strom-research 1.22.0 → 1.22.2

package/dist/commands/setup.js

@@ -29,6 +29,8 @@ const MEDIA_UNNAMED_SAID = 500 * 1024 * 1024;
 import { Tree, VERSION } from "../core/tree.js";
 import { timed } from "../core/timing.js";
 import { checked, installUpdate, isNewer, knownNewerVersion, lastChannelOf, latestRelease, newerNode, newerVersion, setInstallChannel, updateChannel, whatsNewUrl } from "../core/update.js";
+import { privateCopies, writesPrivately } from "../core/packaged.js";
+import { moveToTrash } from "../core/trash.js";
 import { configDir, defaultHome, desktopDir, isolated, noLinks, ownCommand } from "../core/paths.js";
 import { backupBefore, backupSaid, lastBackupLine } from "../cli/backups.js";
 import { BACKUP_SAID_DAYS, lastBackup } from "../core/backup.js";
@@ -41,7 +43,7 @@ import { offerLinks, shortcutName } from "../cli/wizard.js";
 import { linkHandlerState, linkScheme, linkStateText } from "../core/links.js";
 import { globalTargets, installGlobal } from "../agents/global.js";
 import { placeholders, ui, UI } from "../cli/ui.js";
-import { foundTrees } from "../cli/seal.js";
+import { adoptSeal, foundTrees } from "../cli/seal.js";
 import { PERMISSION_LEVELS } from "../core/config.js";
 import { PROFILES } from "../agents/profiles.js";
 import { agentSettingsSaid, EFFORTS, hasEffort, ownEffort, raisesEffort, RECOMMENDED_EFFORT } from "../agents/effort.js";
@@ -58,7 +60,7 @@ import { isArchive } from "../core/mode.js";
 import { fixEnv, fixesDoctorLine } from "./fixchecks.js";
 import { placeOf, sampleFiles } from "../core/clouddrive.js";
 import { check } from "../core/check.js";
-import { assertIntact, verifyFull } from "../core/integrity.js";
+import { assertIntact, OTHER_KEY, verifyFull } from "../core/integrity.js";
 import { ensurePluginsDir } from "../core/connector.js";
 import { checkGate, ensureGatesDir } from "../core/gate.js";
 import { ensureHooksDir } from "../core/hooks.js";
@@ -277,6 +279,10 @@ function diagnoseInto(ctx, checks, t, add, progress) {
         add("program", "ok", `${t("ui.doc.innode", { version: VERSION, node: process.version })}${beta}`);
     else
         add("program", "fail", t("ui.doc.oldnode", { node: process.version }), "https://nodejs.org");
+    // an update an app packaged for Windows installed for itself alone (core/packaged.ts): that app runs another strom
+    const copies = installation().kind === "installed" ? privateCopies(ctx.env, installation().root) : [];
+    if (copies.length)
+        add("packaged", "warn", t("ui.doc.packaged.copy", { folders: copies.map((c) => ctx.display(c)).join(", ") }), "strom doctor --fix", "packaged");
     // The backup before another channel or an older version: one that could not be made (nothing switches until it is),
     // else where the last one is, for a month
     const backup = lastBackup(ctx.env, BACKUP_SAID_DAYS);
@@ -518,9 +524,13 @@ function diagnoseInto(ctx, checks, t, add, progress) {
     else if (ctx.hasTree()) {
         const tr = ctx.tree();
         progress("tree", tr.config.name);
-        const errs = timed("doctor.check", () => check(tr).filter((f) => f.level === "error").length) + timed("doctor.verify", () => verifyFull(tr).findings.filter((f) => f.level === "error").length);
+        const sealErrs = timed("doctor.verify", () => verifyFull(tr).findings.filter((f) => f.level === "error"));
+        const errs = timed("doctor.check", () => check(tr).filter((f) => f.level === "error").length) + sealErrs.length;
         if (errs === 0)
             add("tree", "ok", t("ui.doc.tree.ok", { name: tr.config.name }));
+        // two seal keys of this computer (strom of an app packaged for Windows and of a terminal): united, never repaired
+        else if (sealErrs.length === errs && sealErrs.every((f) => f.code === OTHER_KEY))
+            add("tree", "fail", t("ui.doc.tree.twokeys", { name: tr.config.name }), "strom seal adopt", "unite");
         else
             add("tree", "fail", t("ui.doc.tree.bad", { name: tr.config.name, n: errs }), "strom verify ; strom check");
         // can it be written — its locks (.strom) and history (.git) tried: found on Windows, an agent's sandbox refused
@@ -637,6 +647,20 @@ async function repair(ctx, checks, out) {
     }
     if (todo.has("links") && person)
         await offerLinks(ctx, lang);
+    // two seal keys of this computer united: as strom seal adopt, the person's yes at a terminal (never an agent)
+    if (todo.has("unite") && person && ctx.hasTree()) {
+        const r = await adoptSeal(ctx, ctx.tree(), lang);
+        if (r.adopted)
+            out(ui(lang, "ui.seal.united", { name: ctx.tree().config.name }));
+    }
+    // the private copies of the program into the trash, on the person's yes in a terminal of their own (from the packaged
+    // app itself the copy is what it reads: nothing done there)
+    if (todo.has("packaged") && person && !writesPrivately(ctx.env, installation().root) && (await ctx.confirm(ui(lang, "ui.fix.packaged"), true))) {
+        for (const c of privateCopies(ctx.env, installation().root)) {
+            moveToTrash(c, ctx.env, "Strom (copy of an app)");
+            out(ui(lang, "ui.fix.packaged.done", { folder: ctx.display(c) }));
+        }
+    }
     // a change of strom's that made the reading less sure: returned on the person's yes (a window when an agent asks)
     if (todo.has("tune"))
         await fixTuneWorse(ctx, out);
@@ -737,6 +761,8 @@ register({
             return { text: inst.kind === "npm" ? t("ui.update.npm", { version: newest, tag: channel === "beta" ? "beta" : "latest" }) : t("ui.update.source", { version: newest }), data: { current: VERSION, latest: newest, newer: true, npm: inst.kind === "npm" } };
         // the research where the update replaces the program: nothing asked, backed up or installed
         refuseResearchInProgram(ctx, inst.root);
+        // started by a packaged app (Claude's desktop app): the update would be that app's alone (core/packaged.ts)
+        refusePackaged(ctx, inst.root);
         const older = newer && isNewer(VERSION, newest);
         const question = switching
             ? `${t(`ui.update.channel.${to}.sure`, { version: newest, current: VERSION })} ${older ? t("ui.update.older", { version: newest, current: VERSION }) : t("ui.update.stays")}`
@@ -807,6 +833,15 @@ function refuseResearchInProgram(ctx, root) {
         details: { folder: hit, entry },
     });
 }
+function refusePackaged(ctx, root) {
+    if (!writesPrivately(ctx.env, root))
+        return;
+    throw new StromError(`this strom was started by an app packaged for Windows (MSIX): what it installed into ${ctx.display(root)} only that app would see, the terminal would stay at ${VERSION}; nothing was installed`, {
+        hint: "the user runs strom update in their own terminal (PowerShell); the app takes the new version from there",
+        code: "update.packaged",
+        params: { folder: ctx.display(root), current: VERSION },
+    });
+}
 /**
  * Before strom update installs another channel or an older version: the backup the next run of that version would
  * otherwise make (the same change: from what ran here last, its channel, to the version and channel installed). Made

package/dist/core/changelog.js

@@ -15,7 +15,7 @@ import { eventName, humanDate, humanPlace, humanTask } from "../cli/human.js";
 import { UI, ui } from "../cli/ui.js";
 import { actsAsArchive } from "./state.js";
 /** Operations nobody needs to read: what another line says already, or bookkeeping. */
-const QUIET = new Set(["session.metrics", "session.readers", "task.start", "task.continue", "session.note", "tree.settle", "seal.adopt"]);
+const QUIET = new Set(["session.metrics", "session.readers", "task.start", "task.continue", "session.note", "tree.settle", "seal.adopt", "seal.unite"]);
 /** The one-line form of an operation, by its kind: {who} a person or family, {name} the record. */
 /** What strom mode logs (core/mode.ts), as the history says it. */
 const MODE_SAID = { "the research is an archive": "log.mode.archive", "the research works with an agent again": "log.mode.research" };

package/dist/core/git.js

@@ -276,7 +276,7 @@ function commitTree(dir, tree, parent, message) {
  * fewer processes, no hooks, no editor. Returns the hash, or undefined if
  * nothing changed.
  */
-export function commitAll(dir, message, pathspec = ["."], seal) {
+export function commitAll(dir, message, pathspec = ["."], seal, always = false) {
     // Paths that no longer exist are fine for `add -A` only if git knows them;
     // filter missing, untracked-never-seen paths out to keep `add` from failing.
     const missing = pathspec.filter((p) => p !== "." && !fs.existsSync(path.join(dir, p)));
@@ -286,7 +286,7 @@ export function commitAll(dir, message, pathspec = ["."], seal) {
         git(dir, ["add", "-A", "--", ...specs]);
     const tree = git(dir, ["write-tree"]).trim();
     const parent = headInfo(dir);
-    if (parent && parent.tree === tree)
+    if (parent && parent.tree === tree && !always)
         return undefined;
     const full = seal ? `${message}\n\n${seal(tree)}\n` : `${message}\n`;
     const r = commitTree(dir, tree, parent?.hash, full);

package/dist/core/integrity.js

@@ -16,8 +16,9 @@ import fs from "node:fs";
 import path from "node:path";
 import * as git from "./git.js";
 import { RECORD_TYPES } from "./model.js";
-import { fileSha, fingerprint, verifyCommitSeal, verifyOp } from "./seal.js";
-import { StromError } from "./errors.js";
+import { fileSha, fingerprint, otherKeys, readCommitSeal, verifyCommitSeal, verifyOp } from "./seal.js";
+import { settingsHidden } from "./oldsettings.js";
+import { NeedsConsentError, StromError } from "./errors.js";
 import { counted } from "../cli/format.js";
 /**
  * What strom alone writes in a tree, each change through a sealed operation: the records and their history (data/), the
@@ -56,8 +57,29 @@ function parseOps(text, file, findings, startLine = 0) {
     });
     return out;
 }
+/**
+ * A research sealed with two keys of this computer: the settings' own and another in an old settings folder (strom of
+ * an app packaged for Windows and of a terminal each had their own: core/oldsettings.ts). Its writes are the person's,
+ * never "outside strom" — united by the person in their terminal (strom seal adopt), never undone by strom repair.
+ */
+export const OTHER_KEY = "other-key";
+const OTHER_KEY_HINT = "the user runs in their terminal: strom seal adopt   (unites the keys — never strom repair, which would undo that work)";
+function keysOf(tree, trust = [], united = new Map()) {
+    let others;
+    let hidden;
+    return {
+        hidden: () => (hidden ??= settingsHidden(tree.env)),
+        trusted: new Map(trust.map((k) => [fingerprint(k), k])),
+        united,
+        others: () => (others ??= new Map(tree.key ? otherKeys(tree.env, tree.config.id, tree.key).map((o) => [fingerprint(o.key), o.key]) : [])),
+    };
+}
+/** Is an operation shaped as strom signs one (a key's fingerprint and a signature), whatever key it was? */
+function strommade(op) {
+    return typeof op.k === "string" && /^[0-9a-f]{12}$/u.test(op.k) && typeof op.sig === "string" && /^[0-9a-f]{32}$/u.test(op.sig);
+}
 /** Check chain and signatures of a run of operations. */
-function checkOps(tree, ops, prevSig, file, findings) {
+function checkOps(tree, ops, prevSig, file, findings, keys = keysOf(tree)) {
     const key = tree.key;
     const fp = key ? fingerprint(key) : undefined;
     let prev = prevSig;
@@ -70,16 +92,27 @@ function checkOps(tree, ops, prevSig, file, findings) {
             adopted = true;
         if (!key)
             continue;
-        if (op.k === fp) {
-            if (!verifyOp(op, key))
+        const trusted = keys.trusted.get(op.k);
+        if (op.k === fp || trusted) {
+            if (!verifyOp(op, trusted ?? key))
                 findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} has an invalid signature (written outside strom)` });
         }
+        else if ((keys.united.get(op.k) ?? "") >= op.at) {
+            // another key of this computer, its operations until then checked and taken when the person united the keys
+        }
         else if (adopted) {
-            findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} is signed with an unknown key after the tree was adopted` });
+            const other = keys.others().get(op.k);
+            if (other && verifyOp(op, other))
+                findings.push({ level: "error", code: OTHER_KEY, file, message: `operation ${op.op} at ${op.at} is signed with another seal key of strom on this computer (a second copy of strom's settings)`, hint: OTHER_KEY_HINT });
+            // a key out of sight only for what strom signs (a fingerprint and a signature): anything else was written outside
+            else if (keys.hidden() && strommade(op))
+                findings.push({ level: "error", code: OTHER_KEY, file, message: `operation ${op.op} at ${op.at} is signed with a key this strom does not see (an app packaged for Windows started it)`, hint: OTHER_KEY_HINT });
+            else
+                findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} is signed with an unknown key after the tree was adopted` });
         }
     }
 }
-function headSeal(tree, findings) {
+function headSeal(tree, findings, keys = keysOf(tree)) {
     const head = git.headInfo(tree.root);
     if (!head)
         return;
@@ -93,7 +126,27 @@ function headSeal(tree, findings) {
         });
         return;
     }
-    if (!verifyCommitSeal(key, head.tree, head.message))
+    const sealedWith = (k) => verifyCommitSeal(k, head.tree, head.message);
+    if (sealedWith(key) || [...keys.trusted.values()].some(sealedWith))
+        return;
+    if ([...keys.others().values()].some(sealedWith))
+        findings.push({
+            level: "error",
+            code: OTHER_KEY,
+            message: "the last commit was sealed with another seal key of strom on this computer (a second copy of strom's settings)",
+            hint: OTHER_KEY_HINT,
+        });
+    // started by an app packaged for Windows: the terminal's key is out of its sight — the terminal unites them (where
+    // seal adopt checks every seal again: a commit of nobody's stays refused). Only a commit with strom's seal: one
+    // without (git used directly) is said as it always was, never sent to uniting it cannot do
+    else if (keys.hidden() && readCommitSeal(head.message) !== undefined)
+        findings.push({
+            level: "error",
+            code: OTHER_KEY,
+            message: "the last commit was not sealed with a key this strom sees — an app packaged for Windows started it, the key of the terminal's strom is out of its sight",
+            hint: OTHER_KEY_HINT,
+        });
+    else
         findings.push({
             level: "error",
             code: "foreign-commit",
@@ -295,17 +348,44 @@ export function verifyFast(tree, snap = snapshot(tree)) {
         findings.unshift(notDownloadedFinding([...cloud].sort()));
     return { findings, tampered: [...tampered] };
 }
-/** Full check: every operation and every record. */
-export function verifyFull(tree) {
+/**
+ * The other keys of this computer a seal.unite of the tree's own key took, each with when (its operations until then
+ * are the person's).
+ */
+function unitedKeys(tree, logs) {
+    const united = new Map();
+    const key = tree.key;
+    if (!key)
+        return united;
+    const fp = fingerprint(key);
+    for (const { ops } of logs)
+        for (const op of ops)
+            if (op.op === "seal.unite" && op.k === fp && verifyOp(op, key))
+                for (const k of op.keys ?? [])
+                    if ((united.get(k) ?? "") < op.at)
+                        united.set(k, op.at);
+    return united;
+}
+/**
+ * Full check: every operation and every record. `trust`: other keys of this computer whose operations and commits are
+ * checked with them as the tree's own (strom seal adopt, before it unites them).
+ */
+export function verifyFull(tree, o = {}) {
     const findings = [];
     const tampered = new Set();
-    headSeal(tree, findings);
     const latest = new Map();
     const all = [];
-    for (const file of opsLogs(tree.dataDir)) {
+    const logs = opsLogs(tree.dataDir).map((file) => {
         const rel = path.relative(tree.root, file).split(path.sep).join("/");
-        const ops = parseOps(fs.readFileSync(file, "utf8"), rel, findings);
-        checkOps(tree, ops, "", rel, findings);
+        return { rel, ops: parseOps(fs.readFileSync(file, "utf8"), rel, findings) };
+    });
+    const keys = keysOf(tree, o.trust, unitedKeys(tree, logs));
+    // the last commit said first, as ever
+    const headFindings = [];
+    headSeal(tree, headFindings, keys);
+    findings.unshift(...headFindings);
+    for (const { rel, ops } of logs) {
+        checkOps(tree, ops, "", rel, findings, keys);
         all.push(...ops);
     }
     // Logs are per session: the last word on a file is the newest operation across all of them.
@@ -387,6 +467,9 @@ export function assertIntact(tree) {
         tree.requireKey();
         return;
     }
+    // the last commit sealed with another key of this computer: the person unites them (never strom repair)
+    if (errors.every((f) => f.code === OTHER_KEY))
+        throw otherKeyError(tree.config.name);
     // files only in iCloud: downloaded first — what else is wrong is judged then
     if (errors.some((f) => f.code === NOT_DOWNLOADED))
         throw notDownloadedError(notDownloaded(tree.root));
@@ -410,3 +493,10 @@ export function notDownloadedError(files) {
         details: files.slice(0, 50),
     });
 }
+/**
+ * Writing refused while the last commit carries the seal of another key of this computer: a consent of the person in
+ * their terminal (strom seal adopt unites the keys), said in their language (ui.error.seal.other-key).
+ */
+export function otherKeyError(name) {
+    return new NeedsConsentError([{ key: "seal", kind: "consent", question: "This tree was sealed with two keys of strom on this computer. Unite them?", set: "strom seal adopt" }], undefined, undefined, { code: "seal.other-key", params: { name, set: "strom seal adopt" } });
+}

package/dist/core/live.js

@@ -246,6 +246,7 @@ const CODES = {
     "ui.media.large": "media.large",
     "ui.media.full": "media.full",
     "ui.seal.bridge": SEAL_FOREIGN,
+    "ui.seal.bridge.twokeys": "seal.other-key",
     "ui.error.tree.not-downloaded": "tree.not-downloaded",
     "ui.experiments.link": "experiments.link",
     "ui.history.place.link": "history.link",
@@ -2240,6 +2241,9 @@ export function serveLive(root, env) {
                     // sealed on another computer since it was asked (its key gone meanwhile): said as the bridge says it before
                     if (data.code === SEAL_FOREIGN)
                         reply(409, { ...sealRefusal(), intake: sent.intake });
+                    // sealed here with two keys of this computer (an app packaged for Windows and a terminal): united in a terminal
+                    else if (data.code === "seal.other-key")
+                        reply(409, { ...said(lang, "ui.seal.bridge.twokeys", { name: String(data.params?.name ?? ""), set: "strom seal adopt" }), intake: sent.intake });
                     // no room on the disk: said as everywhere (507 disk.full), never the system's words with strom's inner path
                     else if (data.code === DISK_FULL || isDiskFull(why))
                         reply(507, { ...diskFullSaid(lang, fullWhere(data, root)), reason: why, intake: sent.intake });

package/dist/core/oldsettings.js

@@ -0,0 +1,101 @@
+// strom's settings on Windows before 1.23: %APPDATA%\strom. An app packaged as MSIX (Claude's desktop app) gets every
+// file it creates in AppData as a private copy of its own (%LOCALAPPDATA%\Packages\<app>\LocalCache\Roaming\strom),
+// read before the real one and seen by no other program — a strom it started and a strom of a terminal each had their
+// own seal key for one research, each side's writes "outside strom" to the other (found 2026-10-30). Microsoft: "all
+// newly created files and folders in the user's AppData folder are written to a private per-user, per-app location";
+// "apart from AppData, the app can write to any location where the user has write access, including other parts of
+// %userprofile%" (learn.microsoft.com/windows/msix/desktop/flexible-virtualization). The settings are outside AppData
+// now (paths.ts configDir); these folders are read, taken over once, and never moved or deleted: an older strom reads
+// them still (a switch back to an older version).
+import fs from "node:fs";
+import path from "node:path";
+import { configDir, userHome } from "./paths.js";
+import { writesPrivately } from "./packaged.js";
+import { installation } from "./self.js";
+/**
+ * The folders strom kept its settings in before, as this process sees them: %APPDATA%\strom first (in a packaged app
+ * its private copy where there is one, else the real one), then each packaged app's copy, read by its path. None with
+ * settings of their own (STROM_CONFIG_DIR) and none off Windows. STROM_TEST_OLD_SETTINGS (the sources only): the folders
+ * standing for them, separated as PATH is.
+ */
+export function oldSettingsDirs(env, platform = process.platform, inst = installation()) {
+    if (inst.kind === "source" && env.STROM_TEST_OLD_SETTINGS !== undefined)
+        return env.STROM_TEST_OLD_SETTINGS.split(path.delimiter).filter(Boolean);
+    if (env.STROM_CONFIG_DIR || platform !== "win32")
+        return [];
+    const home = env.USERPROFILE || userHome(env);
+    const roaming = path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), "strom");
+    const packages = path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Packages");
+    let apps = [];
+    try {
+        apps = fs.readdirSync(packages);
+    }
+    catch {
+        // no packaged apps
+    }
+    const copies = apps.map((a) => path.join(packages, a, "LocalCache", "Roaming", "strom")).filter((d) => fs.existsSync(d));
+    return [roaming, ...copies];
+}
+/**
+ * Every packaged app's copy of the old settings as one pattern, those made later too:
+ * `%LOCALAPPDATA%\Packages\*\LocalCache\Roaming\strom` — kept from the agents whole (a key an agent put into a copy
+ * made after the rules were written would make a commit of nobody's another key of this computer, offered to unite).
+ * None where oldSettingsDirs has none. STROM_TEST_PACKAGES (the sources only): the folder standing for Packages.
+ */
+export function packagedSettingsPattern(env, platform = process.platform, inst = installation()) {
+    if (inst.kind === "source" && env.STROM_TEST_PACKAGES !== undefined)
+        return path.join(env.STROM_TEST_PACKAGES, "*", "LocalCache", "Roaming", "strom");
+    if (env.STROM_CONFIG_DIR || platform !== "win32")
+        return undefined;
+    const home = env.USERPROFILE || userHome(env);
+    return path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Packages", "*", "LocalCache", "Roaming", "strom");
+}
+/** What is never copied over: a lock or a file half written of a strom running meanwhile, and the keys (seal.ts). */
+function copied(from, file) {
+    if (/\.(lock|tmp)$/u.test(file))
+        return false;
+    return path.relative(from, file).split(path.sep)[0] !== "keys";
+}
+/**
+ * The settings taken over into the folder of today once, before anything reads them (no config.json there yet): every
+ * old folder with settings copied in, the first one's word kept where two say something. The seal keys are taken one by
+ * one when a research needs its own (seal.ts settleKey). The folder taken from, or undefined.
+ */
+export function takeOverOldSettings(env, platform = process.platform, inst = installation()) {
+    const dir = configDir(env, platform);
+    if (fs.existsSync(path.join(dir, "config.json")))
+        return undefined;
+    const old = oldSettingsDirs(env, platform, inst).filter((d) => fs.existsSync(path.join(d, "config.json")));
+    if (!old.length)
+        return undefined;
+    fs.mkdirSync(dir, { recursive: true });
+    for (const from of old)
+        fs.cpSync(from, dir, { recursive: true, force: false, errorOnExist: false, filter: (file) => copied(from, file) });
+    return old[0];
+}
+/** A research's seal key in the old folders, each different one once with where it was (the first seen first). */
+export function oldKeys(env, treeId, inst = installation()) {
+    const out = [];
+    for (const dir of oldSettingsDirs(env, process.platform, inst)) {
+        const file = path.join(dir, "keys", `${treeId}.key`);
+        let key;
+        try {
+            key = Buffer.from(fs.readFileSync(file, "utf8").trim(), "hex");
+        }
+        catch {
+            continue;
+        }
+        if (key.length && !out.some((o) => o.key.equals(key)))
+            out.push({ file, key });
+    }
+    return out;
+}
+/**
+ * Whether this strom was started by an app packaged for Windows that keeps its own copy of the old settings: the key a
+ * strom of the terminal keeps there it cannot see (its own copy reads first) — what is sealed with it is another key of
+ * this computer, not git used directly. Tried (core/packaged.ts), only when a seal does not match.
+ */
+export function settingsHidden(env, inst = installation()) {
+    const dir = oldSettingsDirs(env, process.platform, inst)[0];
+    return !!dir && fs.existsSync(dir) && writesPrivately(env, dir, process.platform, inst);
+}

package/dist/core/packaged.js

@@ -0,0 +1,69 @@
+// A strom started by an app packaged as MSIX (Claude's desktop app on Windows): every file it creates under AppData goes
+// to a private copy of the app's (%LOCALAPPDATA%\Packages\<app>\LocalCache\Local\…), read before the real one and seen
+// by no other program (learn.microsoft.com/windows/msix/desktop/desktop-to-uwp-behind-the-scenes, "AppData operations
+// on Windows 10, version 1903 and later"). strom's program is in %LOCALAPPDATA%\Programs\Strom: an update installed
+// from there would be that app's alone — the app on the new version, the terminal on the old one for good (found
+// 2026-10-30). Whether this process writes so is tried, not guessed: a file made in the folder and looked for in the
+// private copies.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { userHome } from "./paths.js";
+import { installation } from "./self.js";
+/** The AppData folders a packaged app's new files are taken from, each with its folder in the private copy. */
+function appData(env) {
+    const home = env.USERPROFILE || userHome(env);
+    return [
+        { real: env.LOCALAPPDATA || path.join(home, "AppData", "Local"), copy: "Local" },
+        { real: env.APPDATA || path.join(home, "AppData", "Roaming"), copy: "Roaming" },
+    ];
+}
+/** Where the packaged apps keep their private copies of `dir`, whether they are there or not (none: dir outside AppData). */
+function copiesOf(env, dir) {
+    const packages = path.join(appData(env)[0].real, "Packages");
+    for (const { real, copy } of appData(env)) {
+        const rel = path.relative(real, dir);
+        if (!rel || rel.startsWith("..") || path.isAbsolute(rel))
+            continue;
+        let apps = [];
+        try {
+            apps = fs.readdirSync(packages);
+        }
+        catch {
+            // no packaged apps
+        }
+        return apps.map((a) => path.join(packages, a, "LocalCache", copy, rel));
+    }
+    return [];
+}
+/** The private copies of `dir` some packaged app made (from the terminal: the update it installed only for itself). */
+export function privateCopies(env, dir, platform = process.platform) {
+    if (platform !== "win32")
+        return [];
+    return copiesOf(env, dir).filter((d) => fs.existsSync(d));
+}
+/**
+ * Whether a file this process makes in `dir` lands in a packaged app's private copy instead. STROM_TEST_PACKAGED=1 (the
+ * sources only) stands for it. `make` writes the file (a test makes it where Windows would).
+ */
+export function writesPrivately(env, dir, platform = process.platform, inst = installation(), make = (file) => fs.writeFileSync(file, "", { flag: "wx" })) {
+    if (inst.kind === "source" && env.STROM_TEST_PACKAGED !== undefined)
+        return env.STROM_TEST_PACKAGED === "1";
+    if (platform !== "win32")
+        return false;
+    const copies = copiesOf(env, dir);
+    if (!copies.length)
+        return false;
+    const name = `.strom-probe-${crypto.randomBytes(6).toString("hex")}`;
+    try {
+        make(path.join(dir, name));
+    }
+    catch {
+        return false;
+    }
+    // the private copy says so; the real folder could have it as well — what counts is the copy
+    const hit = copies.some((c) => fs.existsSync(path.join(c, name)));
+    for (const at of [dir, ...copies])
+        fs.rmSync(path.join(at, name), { force: true });
+    return hit;
+}

package/dist/core/paths.js

@@ -44,14 +44,18 @@ export function noLinks(env) {
 export function userHome(env) {
     return env.HOME || env.USERPROFILE || os.homedir();
 }
-/** Directory holding the small user config (the pointer to the Strom home). */
+/**
+ * Directory holding the small user config (the pointer to the Strom home) and the seal keys. On Windows outside AppData
+ * (%USERPROFILE%\.config\strom, as ~/.config/strom elsewhere): an app packaged as MSIX (Claude's desktop app) gets
+ * every new file of AppData as a private copy of its own, which no strom of a terminal sees — a research had two seal
+ * keys, each side's writes "outside strom" to the other (found 2026-10-30). The folder before: core/oldsettings.ts.
+ */
 export function configDir(env, platform = process.platform) {
     if (env.STROM_CONFIG_DIR)
         return path.resolve(env.STROM_CONFIG_DIR);
-    if (platform === "win32") {
-        const appData = env.APPDATA || path.join(userHome(env), "AppData", "Roaming");
-        return path.join(appData, "strom");
-    }
+    // the profile's own folder (HOME is Git Bash's, which may name another)
+    if (platform === "win32")
+        return path.join(env.USERPROFILE || userHome(env), ".config", "strom");
     const xdg = env.XDG_CONFIG_HOME || path.join(userHome(env), ".config");
     return path.join(xdg, "strom");
 }

package/dist/core/placehistory.js

@@ -218,6 +218,39 @@ export function regionEventsAt(tree, shared, id, at = factsByRecord(tree).get(id
     }
     return [...out.values()].sort((a, b) => a.event.from - b.event.from || a.event.id.localeCompare(b.event.id));
 }
+/**
+ * The own events of the tree's places that belong to a region in the years of an event (their facts' places mapped to
+ * it): the mirror of regionEventsAt, for a place looked for before its region (spec 020 K7.1a). Not taken back.
+ */
+export function placeEventsIn(tree, shared, region, e) {
+    if (!shared)
+        return [];
+    const maps = readPlaces(tree);
+    const folded = new Map(Object.entries(maps).map(([k, v]) => [foldText(k), v]));
+    const out = [];
+    for (const [id, at] of factsByRecord(tree)) {
+        const inIt = at.keys.some((key) => ((maps[key] ?? folded.get(foldText(key)))?.regions ?? []).some((g) => g.id === region && inRegion(e, g)));
+        const p = inIt ? placeRecord(tree, id) : undefined;
+        if (!p)
+            continue;
+        for (const x of readPlaceCatalog(shared, placeKeyOf(tree, p))?.events ?? [])
+            if (!x.retracted)
+                out.push({ event: x, place: p });
+    }
+    return out.sort((a, b) => a.event.from - b.event.from || a.event.id.localeCompare(b.event.id));
+}
+/** An event of one of the region's places of the same kind and years: the region's history never writes it again. */
+export function refusePlaceSame(tree, shared, region, e) {
+    const same = placeEventsIn(tree, shared, region, e).filter((x) => x.event.kind === e.kind && x.event.from <= e.to && e.from <= x.event.to);
+    if (!same.length)
+        return;
+    const ids = same.map((x) => `${x.event.id} (${x.place.id})`);
+    throw new UsageError(`an event of a place of ${region} of the same kind and years is there already: ${ids.join(", ")} — nothing written`, {
+        code: "history.same.place",
+        params: { ids: same.map((x) => x.event.id).join(", ") },
+        hint: `the place's event shows there already — leave it out; an event of the whole region (it touched its other places too): --distinct "<why it is another>"`,
+    });
+}
 // ── the person's asks ──────────────────────────────────────────────────────
 export function readPlaceAsks(tree) {
     try {

package/dist/core/seal.js

@@ -16,6 +16,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { configDir } from "./paths.js";
 import { canonicalize } from "./json.js";
+import { oldKeys, oldSettingsDirs } from "./oldsettings.js";
 export function sha256(content) {
     return crypto.createHash("sha256").update(content).digest("hex");
 }
@@ -30,20 +31,67 @@ export function fileSha(file) {
 export function keyFile(env, treeId) {
     return path.join(configDir(env), "keys", `${treeId}.key`);
 }
-export function loadKey(env, treeId) {
+function readKey(file) {
     try {
-        return Buffer.from(fs.readFileSync(keyFile(env, treeId), "utf8").trim(), "hex");
+        const key = Buffer.from(fs.readFileSync(file, "utf8").trim(), "hex");
+        return key.length ? key : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Create the key for a tree on this computer (0600). Fails if it exists. */
+/** The tree's key on this computer: the settings' own, else one of the old settings folders (core/oldsettings.ts). */
+export function loadKey(env, treeId) {
+    return readKey(keyFile(env, treeId)) ?? oldKeys(env, treeId)[0]?.key;
+}
+/**
+ * The tree's key, the one in an old settings folder taken over into the settings of today where they have none: of two
+ * different ones (strom of a packaged app and of a terminal, each its own) the one `prefer` says (the one that sealed the
+ * last commit, the side that could still write), else the first.
+ */
+export function settleKey(env, treeId, prefer) {
+    const own = readKey(keyFile(env, treeId));
+    if (own)
+        return own;
+    const old = oldKeys(env, treeId);
+    if (!old.length)
+        return undefined;
+    const key = (old.length > 1 ? old.find((o) => prefer(o.key)) : undefined)?.key ?? old[0].key;
+    try {
+        const file = keyFile(env, treeId);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+    }
+    catch {
+        // taken over next time
+    }
+    return key;
+}
+/** The tree's other keys on this computer: those of the old settings folders that are not `key` (strom seal adopt unites them). */
+export function otherKeys(env, treeId, key) {
+    return oldKeys(env, treeId).filter((o) => !o.key.equals(key));
+}
+/**
+ * Create the key for a tree on this computer (0600). Fails if it exists. Also into the old settings folder (Windows),
+ * made if need be: an older strom, after a switch back, reads it there.
+ */
 export function createKey(env, treeId) {
     const file = keyFile(env, treeId);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const key = crypto.randomBytes(32);
     fs.writeFileSync(file, key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+    // also where an older strom looks (Windows: %APPDATA%\strom), made if need be — back on an older version, the research
+    // is still sealed here
+    const old = oldSettingsDirs(env)[0];
+    if (old) {
+        try {
+            fs.mkdirSync(path.join(old, "keys"), { recursive: true });
+            fs.writeFileSync(path.join(old, "keys", `${treeId}.key`), key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+        }
+        catch {
+            // a key of its own there already: the older strom keeps it
+        }
+    }
     return key;
 }
 /** Short public fingerprint of a key, stored on each operation. */