strom-research 1.22.1 → 1.22.2

package/CHANGELOG.cs.md

@@ -5,6 +5,21 @@
 Změny každé verze ve zkratce. Úplné poznámky a instalační řádky jsou na
 [GitHub Releases](https://github.com/ACiDekCZ/strom-research/releases) (anglicky).
 
+## 1.22.2
+
+*30. 10. 2026 · patří k aplikaci Strom 3.17.1.*
+
+- **Strom z desktopové aplikace agenta a z terminálu zase zapisují do jednoho výzkumu (Windows).** Desktopová aplikace
+  agenta může být pro Windows zabalená (MSIX) a každý soubor, který strom spuštěný z ní vytvořil v nastavení stromu, skončil
+  v soukromé kopii aplikace: strom z aplikace a strom z terminálu měly každý vlastní pečetní klíč a každý bral zápisy
+  druhého jako změnu mimo strom. Nastavení je teď mimo AppData (`%USERPROFILE%\.config\strom`) a samo se převezme ze
+  staré složky i z kopie aplikace (obě zůstanou, jak byly). Rozdvojený výzkum se opraví sám, kde to jde; jinak
+  klíče sjednotí `strom seal adopt` v terminálu (nabídka ho jednou nabídne) – každý záznam zkontrolovaný, nic se
+  neztratí, nikdy `strom repair`. `strom update` spuštěný z takové aplikace nic nenainstaluje (viděla by to jen ona)
+  a řekne, ať se spustí v terminálu; `strom doctor` najde kopii programu, kterou si aplikace drží pro sebe.
+- **`strom repair` po commitu přes git, který nezměnil žádný záznam** (prázdný, jen poznámky), výzkum znovu zapečetí;
+  dřív commit zůstal nezapečetěný, každý zápis byl odmítnut a nebylo co opravit.
+
 ## 1.22.1
 
 *29. 10. 2026 · patří k aplikaci Strom 3.17.0.*

package/CHANGELOG.de.md

@@ -5,6 +5,23 @@
 Die Änderungen jeder Version in Kürze. Die vollständigen Hinweise und die Installationszeilen stehen bei
 [GitHub Releases](https://github.com/ACiDekCZ/strom-research/releases) (auf Englisch).
 
+## 1.22.2
+
+*30.10.2026 · gehört zur Strom-App 3.17.1.*
+
+- **strom aus der Desktop-App eines Agenten und aus einem Terminal schreiben wieder in eine Forschung (Windows).** Die
+  Desktop-App eines Agenten kann für Windows verpackt sein (MSIX), und jede Datei, die ein von ihr gestartetes strom in den Einstellungen
+  von strom anlegte, landete in der privaten Kopie der App: das strom der App und das des Terminals hatten je einen
+  eigenen Siegelschlüssel, und jedes hielt die Schreibvorgänge des anderen für Änderungen außerhalb von strom. Die
+  Einstellungen liegen jetzt außerhalb von AppData (`%USERPROFILE%\.config\strom`) und werden aus dem alten Ordner
+  und aus der Kopie der App von selbst übernommen (beide bleiben, wie sie waren). Eine so geteilte Forschung heilt sich
+  selbst, wo es geht; sonst vereint `strom seal adopt` in einem Terminal die Schlüssel (das Menü bietet es einmal an) –
+  jeder Datensatz geprüft, nichts geht verloren, nie `strom repair`. Ein aus einer solchen App gestartetes
+  `strom update` installiert nichts (nur die App sähe es) und sagt, es im Terminal auszuführen; `strom doctor` findet
+  eine Kopie des Programms, die eine App für sich behält.
+- **`strom repair` nach einem mit git gemachten Commit, der keinen Datensatz änderte** (leer, nur Notizen), versiegelt
+  die Forschung wieder; vorher blieb der Commit unversiegelt, jeder Schreibvorgang wurde abgelehnt, und es gab nichts zu reparieren.
+
 ## 1.22.1
 
 *29.10.2026 · gehört zur Strom-App 3.17.0.*

package/CHANGELOG.md

@@ -5,6 +5,21 @@ English · [Čeština](CHANGELOG.cs.md) · [Deutsch](CHANGELOG.de.md)
 The changes of each version in short. The full notes and the install lines are on
 [GitHub Releases](https://github.com/ACiDekCZ/strom-research/releases).
 
+## 1.22.2
+
+*2026-10-30 · goes with the Strom app 3.17.1.*
+
+- **Strom from an agent's desktop app and from a terminal write to one research again (Windows).** An agent's
+  desktop app can be packaged for Windows (MSIX), and every file a strom it started made in strom's settings went to
+  the app's private copy: the app's strom and the terminal's each had a seal key of their own, and each refused the other's writes as
+  made outside strom. The settings are now outside AppData (`%USERPROFILE%\.config\strom`), taken over from the old
+  folder and from the app's copy by themselves (both left as they were). A research split so heals itself where it can;
+  else `strom seal adopt` in a terminal unites the keys (the menu offers it once) — every record checked, nothing lost,
+  never `strom repair`. `strom update` started from such an app installs nothing (only the app would see it) and says
+  to run it in a terminal; `strom doctor` finds a copy of the program an app keeps for itself.
+- **`strom repair` after a commit made with git that changed no record** (an empty one, notes only) seals the research
+  again; before, the commit stayed unsealed, every write was refused and there was nothing to repair.
+
 ## 1.22.1
 
 *2026-10-29 · goes with the Strom app 3.17.0.*

package/assets/lang/cs.json

@@ -569,6 +569,8 @@
   "ui.tree.created": "✓ Rodokmen „{name}“ je založený: {dir}",
   "ui.chat.trust": "Claude Code se poprvé zeptá, jestli této složce důvěřovat. Je to složka rodokmenu, kterou vytvořil strom – stačí potvrdit „Yes, proceed“.",
   "ui.doc.program": "program",
+  "ui.doc.packaged": "kopie programu",
+  "ui.doc.packaged.copy": "aplikace zabalená pro Windows má vlastní kopii programu: {folders} – ta aplikace spouští jiný strom než terminál",
   "ui.doc.git": "git (historie)",
   "ui.doc.home": "složka výzkumu",
   "ui.doc.gitdir": "git ve složce výzkumů",
@@ -636,6 +638,7 @@
   "ui.doc.appurl.env.fix": "proměnnou STROM_APP_URL nastavit na adresu aplikace Strom ({web}, nebo její kopie na tomto počítači http://127.0.0.1:<port>/), nebo odebrat",
   "ui.doc.tree.ok": "{name}: data v pořádku a zapečetěná",
   "ui.doc.tree.bad": "{name}: {n, plural, one {# problém} few {# problémy} other {# problémů}}",
+  "ui.doc.tree.twokeys": "{name}: zapečetěno dvěma klíči stromu na tomto počítači (strom z aplikace a z terminálu) – zápisy obou jsou stromu",
   "ui.doc.write": "zápis do rodokmenu",
   "ui.doc.write.ok": "do jeho .strom i .git lze zapisovat",
   "ui.doc.write.sandbox": "{where}: zápis odepřen – strom běží pod agentem, nejspíš to zakazuje jeho sandbox",
@@ -672,6 +675,8 @@
   "ui.fix.git.inwindow": "Dokončit instalaci v okně systému a pak znovu spustit strom doctor.",
   "ui.fix.failed": "Nepovedlo se: {detail}",
   "ui.fix.app": "Otevřít aplikaci Strom v prohlížeči a nainstalovat ji?",
+  "ui.fix.packaged": "Přesunout kopii programu, kterou si aplikace drží pro sebe, do koše (aplikace pak spouští strom z terminálu)?",
+  "ui.fix.packaged.done": "V koši: {folder}",
   "ui.fix.nothing": "Nic, co by strom opravil sám – viz šipky.",
   "ui.why.git.human": "chybí git – strom v něm uchovává historii výzkumu",
   "ui.why.git.agent": "chybí git (strom v něm uchovává historii výzkumu): řekni to uživateli a spusť tohle – uživatel to potvrdí v okně systému",
@@ -2565,6 +2570,8 @@
   "ui.error.folder.in-program.default.hint": "Zadat složku mimo ni: strom setup --home \"{suggested}\" --yes",
   "ui.error.update.in-program": "{folder} leží uvnitř {entry}, kterou aktualizace nahrazuje – výzkum by šel s ní. Nic se nenainstalovalo.",
   "ui.error.update.in-program.hint": "Nejdřív přesunout výzkum ze složky programu strom: strom setup ve vlastním terminálu (otázka na složku ho přesune i s výzkumem), pak znovu strom update",
+  "ui.error.update.packaged": "Tento strom spustila aplikace zabalená pro Windows (MSIX): co by aktualizace nainstalovala do {folder}, uvidí jen ta aplikace, terminál by zůstal na {current}. Nic se nenainstalovalo.",
+  "ui.error.update.packaged.hint": "strom update ve vlastním terminálu (PowerShell); aplikace novou verzi převezme odtud",
   "ui.error.tree.newer": "Tento rodokmen zapsal strom {by}, novější než tento strom {version}. Tento strom ho nechává beze změny.",
   "ui.error.tree.newer.hint": "Aktualizovat strom: strom update",
   "ui.error.tree.newer.backup": "Tento rodokmen zapsal strom {by}, novější než tento strom {version}. Tento strom ho nechává beze změny.",
@@ -3087,9 +3094,16 @@
   "ui.seal.ask": "Převzít „{name}“ na tomto počítači? Záznamy jsou zkontrolované a beze změn.",
   "ui.seal.adopted": "„{name}“ je teď zapečetěný na tomto počítači – zapisovat jde tady",
   "ui.seal.already": "„{name}“ je na tomto počítači zapečetěný už",
+  "ui.seal.unite.ask": "„{name}“ je na tomto počítači zapečetěný dvěma klíči stromu (strom z aplikace a z terminálu, každý s vlastním nastavením). Sjednotit je? Záznamy jsou zkontrolované: nic se nezměnilo mimo strom, nic se neztratí.",
+  "ui.seal.united": "„{name}“ je teď na tomto počítači zapečetěný jedním klíčem – zapisovat jde z aplikace i z terminálu",
+  "ui.error.seal.other-key": "výzkum „{name}“ je na tomto počítači zapečetěný dvěma klíči stromu (strom z aplikace a z terminálu, každý s vlastním nastavením): nic se nezapsalo",
+  "ui.error.seal.other-key.hint": "sjednotit ve vlastním terminálu: {set} – nikdy strom repair, ten by tu práci vrátil zpět",
+  "ui.check.otherkey": "zapečetěno dvěma klíči stromu na tomto počítači (strom z aplikace a z terminálu): zápisy obou jsou stromu",
+  "ui.check.otherkey.hint": "sjednotit ve vlastním terminálu: strom seal adopt – nikdy strom repair",
   "ui.seal.problems": "nepřevzato: záznamy nesedí se svou pečetí – co, řekne strom check",
   "ui.menu.seal": "Zapečetěno na jiném počítači: zapisovat tu jde až po převzetí (strom seal adopt).",
   "ui.seal.bridge": "výzkum „{name}“ je zapečetěný na jiném počítači: nic se nezapsalo – po převzetí na tomto počítači (terminál: strom seal adopt, nebo nabídka strom) poslat znovu",
+  "ui.seal.bridge.twokeys": "výzkum „{name}“ je na tomto počítači zapečetěný dvěma klíči stromu (strom z aplikace a z terminálu): nic se nezapsalo – po sjednocení (terminál: strom seal adopt, nebo nabídka strom) poslat znovu",
   "ui.check.foreignseal": "zapečetěno na jiném počítači (nebo tu chybí nastavení stromu): číst jde, zapisovat až po převzetí tady",
   "ui.check.foreignseal.hint": "převzít ve vlastním terminálu: strom seal adopt – nebo v nabídce (strom)",
   "ui.why.seal.human": "výzkum je zapečetěný na jiném počítači: zapisovat tu jde až po převzetí (potvrzuje se v tomto terminálu)",

package/assets/lang/de.json

@@ -569,6 +569,8 @@
   "ui.tree.created": "✓ Der Stammbaum „{name}“ ist angelegt: {dir}",
   "ui.chat.trust": "Beim ersten Mal fragt Claude Code, ob diesem Ordner vertraut wird. Es ist der Ordner des Stammbaums, von strom angelegt – mit „Yes, proceed“ bestätigen.",
   "ui.doc.program": "Programm",
+  "ui.doc.packaged": "Kopie des Programms",
+  "ui.doc.packaged.copy": "eine für Windows verpackte App hat eine eigene Kopie des Programms: {folders} – diese App startet ein anderes strom als das Terminal",
   "ui.doc.git": "Git (Verlauf)",
   "ui.doc.home": "Forschungsordner",
   "ui.doc.gitdir": "git im Forschungsordner",
@@ -636,6 +638,7 @@
   "ui.doc.appurl.env.fix": "die Variable STROM_APP_URL auf eine Adresse der Strom-App setzen ({web}, oder eine Kopie auf diesem Computer http://127.0.0.1:<port>/) oder entfernen",
   "ui.doc.tree.ok": "{name}: Daten in Ordnung und versiegelt",
   "ui.doc.tree.bad": "{name}: {n, plural, one {# Problem} other {# Probleme}}",
+  "ui.doc.tree.twokeys": "{name}: mit zwei Schlüsseln von strom auf diesem Computer versiegelt (strom einer App und eines Terminals) – die Schreibvorgänge beider sind von strom",
   "ui.doc.write": "Schreiben in diesen Stammbaum",
   "ui.doc.write.ok": "in sein .strom und .git kann geschrieben werden",
   "ui.doc.write.sandbox": "{where}: Schreiben verweigert – strom läuft unter einem Agenten, wahrscheinlich verbietet es dessen Sandbox",
@@ -672,6 +675,8 @@
   "ui.fix.git.inwindow": "Die Installation im Fenster des Systems abschließen, dann strom doctor erneut starten.",
   "ui.fix.failed": "Das hat nicht geklappt: {detail}",
   "ui.fix.app": "Die Strom-App im Browser öffnen, um sie zu installieren?",
+  "ui.fix.packaged": "Die Kopie des Programms, die eine App für sich behält, in den Papierkorb legen (die App startet dann das strom des Terminals)?",
+  "ui.fix.packaged.done": "Im Papierkorb: {folder}",
   "ui.fix.nothing": "Nichts, was strom selbst beheben kann – siehe die Pfeile.",
   "ui.why.git.human": "Git fehlt – strom bewahrt darin den Verlauf der Forschung auf",
   "ui.why.git.agent": "Git fehlt (strom bewahrt darin den Verlauf auf): sag es dem Benutzer und führe dies aus – der Benutzer bestätigt in einem Fenster des Systems",
@@ -2565,6 +2570,8 @@
   "ui.error.folder.in-program.default.hint": "Einen Ordner außerhalb angeben: strom setup --home \"{suggested}\" --yes",
   "ui.error.update.in-program": "{folder} liegt in {entry}, das das Update ersetzt – die Forschung ginge mit. Nichts wurde installiert.",
   "ui.error.update.in-program.hint": "Zuerst die Forschung aus dem Programmordner von strom verschieben: strom setup in einem eigenen Terminal (die Frage nach dem Ordner verschiebt sie mit), dann erneut strom update",
+  "ui.error.update.packaged": "Dieses strom wurde von einer für Windows verpackten App (MSIX) gestartet: was das Update in {folder} installierte, sähe nur diese App, das Terminal bliebe bei {current}. Nichts wurde installiert.",
+  "ui.error.update.packaged.hint": "strom update in einem eigenen Terminal (PowerShell); die App übernimmt die neue Version von dort",
   "ui.error.tree.newer": "Diesen Stammbaum hat strom {by} geschrieben, neuer als dieses strom {version}. Dieses strom lässt ihn unverändert.",
   "ui.error.tree.newer.hint": "strom aktualisieren: strom update",
   "ui.error.tree.newer.backup": "Diesen Stammbaum hat strom {by} geschrieben, neuer als dieses strom {version}. Dieses strom lässt ihn unverändert.",
@@ -3087,9 +3094,16 @@
   "ui.seal.ask": "„{name}“ auf diesem Computer übernehmen? Die Einträge sind geprüft und unverändert.",
   "ui.seal.adopted": "„{name}“ ist jetzt auf diesem Computer versiegelt – schreiben geht hier",
   "ui.seal.already": "„{name}“ ist auf diesem Computer schon versiegelt",
+  "ui.seal.unite.ask": "„{name}“ ist auf diesem Computer mit zwei Schlüsseln von strom versiegelt (strom aus einer App und aus einem Terminal, jedes mit eigenen Einstellungen). Vereinen? Alle Einträge sind geprüft: nichts außerhalb von strom geändert, nichts geht verloren.",
+  "ui.seal.united": "„{name}“ ist jetzt auf diesem Computer mit einem Schlüssel versiegelt – schreiben geht aus der App wie aus dem Terminal",
+  "ui.error.seal.other-key": "die Forschung „{name}“ ist auf diesem Computer mit zwei Schlüsseln von strom versiegelt (strom aus einer App und aus einem Terminal, jedes mit eigenen Einstellungen): nichts wurde geschrieben",
+  "ui.error.seal.other-key.hint": "vereinen in einem eigenen Terminal: {set} – nie strom repair, das würde diese Arbeit rückgängig machen",
+  "ui.check.otherkey": "mit zwei Schlüsseln von strom auf diesem Computer versiegelt (strom aus einer App und aus einem Terminal): was beide schrieben, ist von strom",
+  "ui.check.otherkey.hint": "vereinen in einem eigenen Terminal: strom seal adopt – nie strom repair",
   "ui.seal.problems": "nicht übernommen: was im Stammbaum steht, ist nicht so versiegelt, wie strom es schrieb – was, sagt strom check",
   "ui.menu.seal": "Auf einem anderen Computer versiegelt: schreiben hier erst nach der Übernahme (strom seal adopt).",
   "ui.seal.bridge": "die Forschung „{name}“ ist auf einem anderen Computer versiegelt: nichts wurde geschrieben – nach der Übernahme auf diesem Computer (Terminal: strom seal adopt, oder das Menü von strom) erneut senden",
+  "ui.seal.bridge.twokeys": "die Forschung „{name}“ ist auf diesem Computer mit zwei Schlüsseln von strom versiegelt (strom einer App und eines Terminals): nichts wurde geschrieben – nach dem Vereinen (Terminal: strom seal adopt, oder das Menü von strom) erneut senden",
   "ui.check.foreignseal": "auf einem anderen Computer versiegelt (oder die Einstellungen von strom fehlen hier): lesen geht, schreiben erst nach der Übernahme hier",
   "ui.check.foreignseal.hint": "übernehmen in einem eigenen Terminal: strom seal adopt – oder im Menü (strom)",
   "ui.why.seal.human": "die Forschung ist auf einem anderen Computer versiegelt: schreiben hier erst nach der Übernahme (bestätigt in diesem Terminal)",

package/dist/agents/files.js

@@ -14,6 +14,7 @@ import { isArchive } from "../core/mode.js";
 import { Settings } from "../core/config.js";
 import { agentAppUrl, appSite } from "../core/stromapp.js";
 import { configDir, ownCommand } from "../core/paths.js";
+import { oldSettingsDirs, packagedSettingsPattern } from "../core/oldsettings.js";
 import { within } from "../core/relocate.js";
 import { agentBrowser } from "../core/connector.js";
 import { CHROME_ALLOW, CHROME_DENY, chromeDomain } from "../core/browser.js";
@@ -212,6 +213,15 @@ export function settingsKeptFrom(dir, research, platform = process.platform) {
         return { path: p, folder };
     });
 }
+/**
+ * What of strom's settings is kept from the agents: of today's folder, of each it was kept in before (oldsettings.ts),
+ * and every packaged app's copy whole, one made after these rules too.
+ */
+function keptSettings(tree, settings) {
+    const research = researchFolders(tree, settings);
+    const packaged = packagedSettingsPattern(tree.env);
+    return [...[configDir(tree.env), ...oldSettingsDirs(tree.env)].flatMap((d) => settingsKeptFrom(d, research)), ...(packaged ? [{ path: packaged, folder: true }] : [])];
+}
 /** The folders of the research the agent works in: its home, the shared folder, the tree. */
 function researchFolders(tree, settings) {
     return [settings.home()?.value, settings.shared()?.value, tree.root].filter((p) => !!p);
@@ -227,7 +237,7 @@ function treeRules(tree, agent) {
     const shared = settings.shared()?.value;
     const claude = agent === "claude";
     const at = (abs) => (claude ? permissionPath(abs) : abs.replace(/\\/g, "/"));
-    const kept = settingsKeptFrom(configDir(tree.env), researchFolders(tree, settings)).map((k) => (k.folder ? `${at(k.path)}/**` : at(k.path)));
+    const kept = keptSettings(tree, settings).map((k) => (k.folder ? `${at(k.path)}/**` : at(k.path)));
     // Browser tools (Claude in Chrome): for the sites of the connectors fetching through the browser — or, agent.browser
     // always, of every archive of the research (anything else is asked in a conversation, not used in a run).
     const web = claude ? agentBrowser(tree, shared) : { on: false, hosts: [] };
@@ -402,7 +412,7 @@ export function opencodeConfig(tree) {
                 }
                 : {}),
             // the seal keys and the person's settings, and what the browser downloads (strom's to take over)
-            ...Object.fromEntries(settingsKeptFrom(configDir(tree.env), researchFolders(tree, settings)).map((k) => [k.folder ? `${abs(k.path)}/*` : abs(k.path), "deny"])),
+            ...Object.fromEntries(keptSettings(tree, settings).map((k) => [k.folder ? `${abs(k.path)}/*` : abs(k.path), "deny"])),
             [`${abs(settings.downloads())}/*`]: "deny",
         },
         webfetch: "allow",

package/dist/cli/main.js

@@ -13,6 +13,7 @@ import { commands, match } from "./registry.js";
 import { asCommand, asCommandJson, shellArg } from "./format.js";
 import { groupHelpAs, helpAs } from "./help.js";
 import { autoCommit } from "./commit.js";
+import { takeOverOldSettings } from "../core/oldsettings.js";
 import { assertIntact } from "../core/integrity.js";
 import { head as gitHead, resetCache } from "../core/git.js";
 import { newerTree, Tree, VERSION } from "../core/tree.js";
@@ -226,6 +227,14 @@ async function mainOf(argv, io, env, cwd) {
     resetCache(undefined, "command");
     // the app's install line in its one variable (STROM_FROM): read as the five of an older line
     expandFromLine(env);
+    // strom's settings on Windows before (%APPDATA%\strom and a packaged app's copy of it) taken over, before anything
+    // reads them (core/oldsettings.ts)
+    try {
+        takeOverOldSettings(env);
+    }
+    catch {
+        // taken over next time; the old ones are read meanwhile
+    }
     // what ran and how long, for the reminder of the session's time
     const startedAt = Date.now();
     let ran;

package/dist/cli/menu.js

@@ -10,7 +10,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { ui } from "./ui.js";
 import { isAgent } from "../core/which.js";
-import { offerAdopt } from "./seal.js";
+import { offerAdopt, offerUnite } from "./seal.js";
 import { mb, setTidyAsked, tidyAskAgain, tidyAsked, tidyOn, tidyPlan, TIDY_SAID } from "../core/tidy.js";
 import { calibrationLabel, calibrationOffer } from "../core/viewsizes.js";
 /** A line as a sentence: its first letter capital (a catalog's text that also stands inside a line). */
@@ -231,6 +231,12 @@ export async function runMenu(ctx, run) {
                     out();
                 }
             }
+            else if (offerUnite(ctx, tree, !isAgent(ctx.env))) {
+                // sealed here with two keys of this computer (strom of an app packaged for Windows and of a terminal): united on
+                // the person's yes, offered once (as strom seal adopt: every operation and record checked)
+                await run(["seal", "adopt", "--tree", root]);
+                out();
+            }
             // what of it the Strom app does not show (only here in the terminal) said, so its number and the app's agree
             if (waiting)
                 out(waitingLine(lang, waits));

package/dist/cli/seal.js

@@ -2,7 +2,7 @@
 // every record checked against its seal, the person's yes, then this computer's key. Never by itself, never by an agent.
 import { ui } from "./ui.js";
 import { verifyFull } from "../core/integrity.js";
-import { createKey } from "../core/seal.js";
+import { createKey, fingerprint, otherKeys } from "../core/seal.js";
 import { sealedHere } from "../core/tree.js";
 /**
  * The tree taken over here: refused while a record does not match its seal (what, strom check says), else asked — the
@@ -10,7 +10,7 @@ import { sealedHere } from "../core/tree.js";
  */
 export async function adoptSeal(ctx, tree, lang) {
     if (tree.key)
-        return { adopted: false, why: "already" };
+        return uniteSeal(ctx, tree, lang);
     const problems = verifyFull(tree).findings.filter((f) => f.level === "error");
     if (problems.length)
         return { adopted: false, why: "problems", problems };
@@ -33,6 +33,16 @@ export function offerAdopt(ctx, root, person) {
     asked.add(root);
     return true;
 }
+/**
+ * Whether to offer uniting this tree's keys now (strom update brought a strom that sees both): sealed here, another key
+ * of this computer that the check needs, a person at a terminal, not asked yet in this process.
+ */
+export function offerUnite(ctx, tree, person) {
+    if (!person || !ctx.interactive || asked.has(tree.root) || !tree.key || !otherKeys(tree.env, tree.config.id, tree.key).length)
+        return false;
+    asked.add(tree.root);
+    return keysToUnite(tree).length > 0;
+}
 /**
  * The family trees the setup found in the research's folder (strom brought back, a folder from another computer): each
  * said, and of one sealed on another computer how it is taken over — the setup then never ends with "strom init".
@@ -48,3 +58,36 @@ export function foundTrees(ctx, lang) {
     ];
     return { lines, foreign: foreign.map(({ name, root }) => ({ name, root })) };
 }
+/**
+ * The other keys of this computer a tree sealed here needs united (strom of an app packaged for Windows and of a
+ * terminal each had their own: core/oldsettings.ts): none when the check finds nothing wrong, or none of them.
+ */
+export function keysToUnite(tree) {
+    if (!tree.key)
+        return [];
+    if (!verifyFull(tree).findings.some((f) => f.level === "error"))
+        return [];
+    return otherKeys(tree.env, tree.config.id, tree.key).map((o) => o.key);
+}
+/**
+ * A tree sealed here with another key of this computer too: every operation of the other keys checked with them and
+ * every record against its seal — refused while anything does not match (a record changed outside strom stays refused),
+ * else the person's yes, then the operation seal.unite of this key (the other keys' operations until now taken) and its
+ * commit sealed with it.
+ */
+async function uniteSeal(ctx, tree, lang) {
+    const others = keysToUnite(tree);
+    if (!others.length)
+        return { adopted: false, why: "already" };
+    const problems = verifyFull(tree, { trust: others }).findings.filter((f) => f.level === "error");
+    if (problems.length)
+        return { adopted: false, why: "problems", problems };
+    if (!(await ctx.confirm(ui(lang, "ui.seal.unite.ask", { name: tree.config.name }), true)))
+        return { adopted: false, why: "cancelled" };
+    const united = others.map(fingerprint);
+    tree.withTreeLock(() => {
+        tree.appendOp({ op: "seal.unite", targets: [], files: [], summary: "Seal keys of this computer united", keys: united });
+        tree.commit("Seal: keys of this computer united");
+    });
+    return { adopted: true, united };
+}

package/dist/cli/ui.js

@@ -540,6 +540,8 @@ export const UI = {
     "ui.tree.created": "✓ The family tree \"{name}\" is ready: {dir}",
     "ui.chat.trust": "The first time, Claude Code asks whether this folder is trusted. It is the family tree's folder, made by strom — confirm with \"Yes, proceed\".",
     "ui.doc.program": "program",
+    "ui.doc.packaged": "copy of the program",
+    "ui.doc.packaged.copy": "an app packaged for Windows keeps a copy of the program of its own: {folders} — that app runs another strom than the terminal",
     "ui.doc.git": "git (history)",
     "ui.doc.home": "research folder",
     "ui.doc.gitdir": "git in the research folder",
@@ -607,6 +609,7 @@ export const UI = {
     "ui.doc.appurl.env.fix": "the variable STROM_APP_URL set to an address of the Strom app ({web}, or a copy on this computer http://127.0.0.1:<port>/), or removed",
     "ui.doc.tree.ok": "{name}: data consistent and sealed",
     "ui.doc.tree.bad": "{name}: {n, plural, one {# problem} other {# problems}}",
+    "ui.doc.tree.twokeys": "{name}: sealed with two keys of strom on this computer (strom of an app and of a terminal) — writes of both are strom's",
     "ui.doc.write": "writing into this family tree",
     "ui.doc.write.ok": "its .strom and .git can be written",
     "ui.doc.write.sandbox": "{where}: writing refused — strom runs under an agent, most likely its sandbox forbids it",
@@ -643,6 +646,8 @@ export const UI = {
     "ui.fix.git.inwindow": "Finish the installation in the window of the system, then run strom doctor again.",
     "ui.fix.failed": "It did not work: {detail}",
     "ui.fix.app": "Open the Strom app in the browser, to install it?",
+    "ui.fix.packaged": "Put the copy of the program an app keeps for itself into the trash (the app then runs the strom of the terminal)?",
+    "ui.fix.packaged.done": "Into the trash: {folder}",
     "ui.fix.nothing": "Nothing strom can fix by itself — see the arrows.",
     "ui.why.git.human": "git is missing — strom keeps the history of the research in it",
     "ui.why.git.agent": "git is missing (strom keeps the research history in it): tell the user, then run this — the user says yes in a window of the system",
@@ -2420,6 +2425,8 @@ export const UI = {
     "ui.error.folder.in-program.default.hint": "Name a folder outside it: strom setup --home \"{suggested}\" --yes",
     "ui.error.update.in-program": "{folder} lies inside {entry}, which the update replaces — the research would go with it. Nothing was installed.",
     "ui.error.update.in-program.hint": "First move the research out of strom's program folder: strom setup in a terminal of its own (the question about the folder moves it along), then strom update again",
+    "ui.error.update.packaged": "This strom was started by an app packaged for Windows (MSIX): what the update installed into {folder} only that app would see, the terminal would stay at {current}. Nothing was installed.",
+    "ui.error.update.packaged.hint": "strom update in a terminal of its own (PowerShell); the app takes the new version from there",
     "ui.error.tree.newer": "This family tree was written by strom {by}, newer than this strom {version}. This strom keeps it untouched.",
     "ui.error.tree.newer.hint": "Update strom: strom update",
     "ui.error.tree.newer.backup": "This family tree was written by strom {by}, newer than this strom {version}. This strom keeps it untouched.",
@@ -2781,9 +2788,16 @@ export const UI = {
     "ui.seal.ask": "Take over \"{name}\" on this computer? Its records were checked: unchanged.",
     "ui.seal.adopted": "\"{name}\" is sealed on this computer now — writing works here",
     "ui.seal.already": "\"{name}\" is sealed on this computer already",
+    "ui.seal.unite.ask": "\"{name}\" was sealed with two keys of strom on this computer (strom of an app and of a terminal, each with settings of its own). Unite them? Every record was checked: nothing changed outside strom, nothing is lost.",
+    "ui.seal.united": "\"{name}\" is sealed with one key on this computer now — writing works from the app and the terminal alike",
+    "ui.error.seal.other-key": "\"{name}\" was sealed with two keys of strom on this computer (strom of an app and of a terminal, each with settings of its own): nothing written",
+    "ui.error.seal.other-key.hint": "united in a terminal of its own: {set} — never strom repair, which would undo that work",
+    "ui.check.otherkey": "sealed with two keys of strom on this computer (strom of an app and of a terminal): the writes of both are strom's own",
+    "ui.check.otherkey.hint": "united in a terminal of its own: strom seal adopt — never strom repair",
     "ui.seal.problems": "not taken over: records do not match their seals — what, strom check says",
     "ui.menu.seal": "Sealed on another computer: writing here only once taken over (strom seal adopt).",
     "ui.seal.bridge": "\"{name}\" was sealed on another computer: nothing was written — once it is taken over on this one (a terminal: strom seal adopt, or strom's menu), send again",
+    "ui.seal.bridge.twokeys": "\"{name}\" was sealed with two keys of strom on this computer (strom of an app and of a terminal): nothing was written — once they are united (a terminal: strom seal adopt, or strom's menu), send again",
     "ui.check.foreignseal": "sealed on another computer (or strom's settings are not on this one): it can be read, written only once taken over here",
     "ui.check.foreignseal.hint": "taken over in a terminal of its own: strom seal adopt — or in strom's menu (strom)",
     "ui.why.seal.human": "the research was sealed on another computer: writing here only once taken over (confirmed in this terminal)",

package/dist/commands/checks.js

@@ -8,9 +8,9 @@ import { counted, lines, table } from "../cli/format.js";
 import { check, SHARED_MISSING, sharedMissing } from "../core/check.js";
 import { guard } from "../core/guard.js";
 import { unprovenPeople } from "../core/review.js";
-import { NOT_DOWNLOADED, SEALED_PATHS, notDownloaded, notDownloadedError, verifyFast, verifyFull } from "../core/integrity.js";
+import { NOT_DOWNLOADED, OTHER_KEY, SEALED_PATHS, notDownloaded, notDownloadedError, otherKeyError, verifyFast, verifyFull } from "../core/integrity.js";
 import { verifyCommitSeal } from "../core/seal.js";
-import { adoptSeal } from "../cli/seal.js";
+import { adoptSeal, keysToUnite } from "../cli/seal.js";
 import { NeedsConsentError, StromError } from "../core/errors.js";
 import * as git from "../core/git.js";
 import { ui } from "../cli/ui.js";
@@ -29,6 +29,8 @@ function said(f, lang) {
         return ui(lang, "ui.check.unwritable");
     if (lang && f.code === "foreign-seal")
         return ui(lang, "ui.check.foreignseal");
+    if (lang && f.code === OTHER_KEY)
+        return ui(lang, "ui.check.otherkey");
     if (lang && f.code === NOT_DOWNLOADED)
         return ui(lang, "ui.check.notdownloaded", { n: f.count ?? 1, first: f.file ?? "" });
     if (lang && f.code === SHARED_MISSING)
@@ -45,6 +47,8 @@ function said(f, lang) {
 function hintSaid(f, lang) {
     if (lang && f.code === "foreign-seal")
         return ui(lang, "ui.check.foreignseal.hint");
+    if (lang && f.code === OTHER_KEY)
+        return ui(lang, "ui.check.otherkey.hint");
     if (lang && f.code === NOT_DOWNLOADED)
         return ui(lang, "ui.check.notdownloaded.hint");
     if (lang && f.code === SHARED_MISSING)
@@ -185,8 +189,10 @@ function repair(tree) {
             restored.push(rel);
         }
     }
+    // sealed again even when the commits outside strom changed nothing of it (an empty one, notes only): else the last
+    // commit stays unsealed and every write refused, with nothing left to repair
     if (!headSealed)
-        tree.commit(`Repair: restore the sealed state of ${sealed.slice(0, 8)}\n\nCommits made outside strom were undone for data/, strom.json, history/ and quality/.`, SEALED_PATHS);
+        tree.commit(`Repair: restore the sealed state of ${sealed.slice(0, 8)}\n\nCommits made outside strom were undone for data/, strom.json, history/ and quality/.`, SEALED_PATHS, true);
     return { restored, quarantined, from: sealed };
 }
 register({
@@ -210,22 +216,29 @@ register({
     summary: "Take over a tree sealed on another computer (the user runs this in a terminal)",
     group: "history",
     tree: true,
-    description: "Checks the chain and every record hash, then creates this computer's seal key for the tree.\nAgents must not run this — it needs the user's confirmation.",
+    description: "Checks the chain and every record hash, then creates this computer's seal key for the tree.\n" +
+        "A tree sealed here with a second key of this computer too (a copy of strom's settings an app packaged for Windows\n" +
+        "made): checks every operation of that key with it, then unites the keys — never strom repair, which would undo that work.\n" +
+        "Agents must not run this — it needs the user's confirmation.",
     person: "Taking over this tree on this computer (the seal) is the user's own, in their terminal",
     run: async (ctx) => {
         const tree = ctx.tree();
         // a person reads it in the research's language (the menu, a link's terminal, the setup go the same way)
         const lang = tree.lang;
         const name = tree.config.name;
-        if (tree.key)
+        // sealed here: another key of this computer to unite (strom of a packaged app and of a terminal), else nothing to do
+        const unite = tree.key ? keysToUnite(tree).length > 0 : false;
+        if (tree.key && !unite)
             return { text: ui(lang, "ui.seal.already", { name }), data: { adopted: false } };
+        if (!ctx.interactive && unite)
+            throw otherKeyError(name);
         if (!ctx.interactive)
             throw new NeedsConsentError([
                 { key: "seal", kind: "consent", question: "Take over this tree on this computer?", set: "strom seal adopt" },
             ]);
         const r = await adoptSeal(ctx, tree, lang);
         if (r.adopted)
-            return { text: ui(lang, "ui.seal.adopted", { name }), data: { adopted: true } };
+            return r.united ? { text: ui(lang, "ui.seal.united", { name }), data: { adopted: true, united: r.united } } : { text: ui(lang, "ui.seal.adopted", { name }), data: { adopted: true } };
         if (r.why === "problems") {
             const found = report(r.problems, "", lang, true);
             return { ...found, text: lines(found.text, ui(lang, "ui.seal.problems")), data: { ...found.data, adopted: false } };

package/dist/commands/setup.js

@@ -29,6 +29,8 @@ const MEDIA_UNNAMED_SAID = 500 * 1024 * 1024;
 import { Tree, VERSION } from "../core/tree.js";
 import { timed } from "../core/timing.js";
 import { checked, installUpdate, isNewer, knownNewerVersion, lastChannelOf, latestRelease, newerNode, newerVersion, setInstallChannel, updateChannel, whatsNewUrl } from "../core/update.js";
+import { privateCopies, writesPrivately } from "../core/packaged.js";
+import { moveToTrash } from "../core/trash.js";
 import { configDir, defaultHome, desktopDir, isolated, noLinks, ownCommand } from "../core/paths.js";
 import { backupBefore, backupSaid, lastBackupLine } from "../cli/backups.js";
 import { BACKUP_SAID_DAYS, lastBackup } from "../core/backup.js";
@@ -41,7 +43,7 @@ import { offerLinks, shortcutName } from "../cli/wizard.js";
 import { linkHandlerState, linkScheme, linkStateText } from "../core/links.js";
 import { globalTargets, installGlobal } from "../agents/global.js";
 import { placeholders, ui, UI } from "../cli/ui.js";
-import { foundTrees } from "../cli/seal.js";
+import { adoptSeal, foundTrees } from "../cli/seal.js";
 import { PERMISSION_LEVELS } from "../core/config.js";
 import { PROFILES } from "../agents/profiles.js";
 import { agentSettingsSaid, EFFORTS, hasEffort, ownEffort, raisesEffort, RECOMMENDED_EFFORT } from "../agents/effort.js";
@@ -58,7 +60,7 @@ import { isArchive } from "../core/mode.js";
 import { fixEnv, fixesDoctorLine } from "./fixchecks.js";
 import { placeOf, sampleFiles } from "../core/clouddrive.js";
 import { check } from "../core/check.js";
-import { assertIntact, verifyFull } from "../core/integrity.js";
+import { assertIntact, OTHER_KEY, verifyFull } from "../core/integrity.js";
 import { ensurePluginsDir } from "../core/connector.js";
 import { checkGate, ensureGatesDir } from "../core/gate.js";
 import { ensureHooksDir } from "../core/hooks.js";
@@ -277,6 +279,10 @@ function diagnoseInto(ctx, checks, t, add, progress) {
         add("program", "ok", `${t("ui.doc.innode", { version: VERSION, node: process.version })}${beta}`);
     else
         add("program", "fail", t("ui.doc.oldnode", { node: process.version }), "https://nodejs.org");
+    // an update an app packaged for Windows installed for itself alone (core/packaged.ts): that app runs another strom
+    const copies = installation().kind === "installed" ? privateCopies(ctx.env, installation().root) : [];
+    if (copies.length)
+        add("packaged", "warn", t("ui.doc.packaged.copy", { folders: copies.map((c) => ctx.display(c)).join(", ") }), "strom doctor --fix", "packaged");
     // The backup before another channel or an older version: one that could not be made (nothing switches until it is),
     // else where the last one is, for a month
     const backup = lastBackup(ctx.env, BACKUP_SAID_DAYS);
@@ -518,9 +524,13 @@ function diagnoseInto(ctx, checks, t, add, progress) {
     else if (ctx.hasTree()) {
         const tr = ctx.tree();
         progress("tree", tr.config.name);
-        const errs = timed("doctor.check", () => check(tr).filter((f) => f.level === "error").length) + timed("doctor.verify", () => verifyFull(tr).findings.filter((f) => f.level === "error").length);
+        const sealErrs = timed("doctor.verify", () => verifyFull(tr).findings.filter((f) => f.level === "error"));
+        const errs = timed("doctor.check", () => check(tr).filter((f) => f.level === "error").length) + sealErrs.length;
         if (errs === 0)
             add("tree", "ok", t("ui.doc.tree.ok", { name: tr.config.name }));
+        // two seal keys of this computer (strom of an app packaged for Windows and of a terminal): united, never repaired
+        else if (sealErrs.length === errs && sealErrs.every((f) => f.code === OTHER_KEY))
+            add("tree", "fail", t("ui.doc.tree.twokeys", { name: tr.config.name }), "strom seal adopt", "unite");
         else
             add("tree", "fail", t("ui.doc.tree.bad", { name: tr.config.name, n: errs }), "strom verify ; strom check");
         // can it be written — its locks (.strom) and history (.git) tried: found on Windows, an agent's sandbox refused
@@ -637,6 +647,20 @@ async function repair(ctx, checks, out) {
     }
     if (todo.has("links") && person)
         await offerLinks(ctx, lang);
+    // two seal keys of this computer united: as strom seal adopt, the person's yes at a terminal (never an agent)
+    if (todo.has("unite") && person && ctx.hasTree()) {
+        const r = await adoptSeal(ctx, ctx.tree(), lang);
+        if (r.adopted)
+            out(ui(lang, "ui.seal.united", { name: ctx.tree().config.name }));
+    }
+    // the private copies of the program into the trash, on the person's yes in a terminal of their own (from the packaged
+    // app itself the copy is what it reads: nothing done there)
+    if (todo.has("packaged") && person && !writesPrivately(ctx.env, installation().root) && (await ctx.confirm(ui(lang, "ui.fix.packaged"), true))) {
+        for (const c of privateCopies(ctx.env, installation().root)) {
+            moveToTrash(c, ctx.env, "Strom (copy of an app)");
+            out(ui(lang, "ui.fix.packaged.done", { folder: ctx.display(c) }));
+        }
+    }
     // a change of strom's that made the reading less sure: returned on the person's yes (a window when an agent asks)
     if (todo.has("tune"))
         await fixTuneWorse(ctx, out);
@@ -737,6 +761,8 @@ register({
             return { text: inst.kind === "npm" ? t("ui.update.npm", { version: newest, tag: channel === "beta" ? "beta" : "latest" }) : t("ui.update.source", { version: newest }), data: { current: VERSION, latest: newest, newer: true, npm: inst.kind === "npm" } };
         // the research where the update replaces the program: nothing asked, backed up or installed
         refuseResearchInProgram(ctx, inst.root);
+        // started by a packaged app (Claude's desktop app): the update would be that app's alone (core/packaged.ts)
+        refusePackaged(ctx, inst.root);
         const older = newer && isNewer(VERSION, newest);
         const question = switching
             ? `${t(`ui.update.channel.${to}.sure`, { version: newest, current: VERSION })} ${older ? t("ui.update.older", { version: newest, current: VERSION }) : t("ui.update.stays")}`
@@ -807,6 +833,15 @@ function refuseResearchInProgram(ctx, root) {
         details: { folder: hit, entry },
     });
 }
+function refusePackaged(ctx, root) {
+    if (!writesPrivately(ctx.env, root))
+        return;
+    throw new StromError(`this strom was started by an app packaged for Windows (MSIX): what it installed into ${ctx.display(root)} only that app would see, the terminal would stay at ${VERSION}; nothing was installed`, {
+        hint: "the user runs strom update in their own terminal (PowerShell); the app takes the new version from there",
+        code: "update.packaged",
+        params: { folder: ctx.display(root), current: VERSION },
+    });
+}
 /**
  * Before strom update installs another channel or an older version: the backup the next run of that version would
  * otherwise make (the same change: from what ran here last, its channel, to the version and channel installed). Made

package/dist/core/changelog.js

@@ -15,7 +15,7 @@ import { eventName, humanDate, humanPlace, humanTask } from "../cli/human.js";
 import { UI, ui } from "../cli/ui.js";
 import { actsAsArchive } from "./state.js";
 /** Operations nobody needs to read: what another line says already, or bookkeeping. */
-const QUIET = new Set(["session.metrics", "session.readers", "task.start", "task.continue", "session.note", "tree.settle", "seal.adopt"]);
+const QUIET = new Set(["session.metrics", "session.readers", "task.start", "task.continue", "session.note", "tree.settle", "seal.adopt", "seal.unite"]);
 /** The one-line form of an operation, by its kind: {who} a person or family, {name} the record. */
 /** What strom mode logs (core/mode.ts), as the history says it. */
 const MODE_SAID = { "the research is an archive": "log.mode.archive", "the research works with an agent again": "log.mode.research" };

package/dist/core/git.js

@@ -276,7 +276,7 @@ function commitTree(dir, tree, parent, message) {
  * fewer processes, no hooks, no editor. Returns the hash, or undefined if
  * nothing changed.
  */
-export function commitAll(dir, message, pathspec = ["."], seal) {
+export function commitAll(dir, message, pathspec = ["."], seal, always = false) {
     // Paths that no longer exist are fine for `add -A` only if git knows them;
     // filter missing, untracked-never-seen paths out to keep `add` from failing.
     const missing = pathspec.filter((p) => p !== "." && !fs.existsSync(path.join(dir, p)));
@@ -286,7 +286,7 @@ export function commitAll(dir, message, pathspec = ["."], seal) {
         git(dir, ["add", "-A", "--", ...specs]);
     const tree = git(dir, ["write-tree"]).trim();
     const parent = headInfo(dir);
-    if (parent && parent.tree === tree)
+    if (parent && parent.tree === tree && !always)
         return undefined;
     const full = seal ? `${message}\n\n${seal(tree)}\n` : `${message}\n`;
     const r = commitTree(dir, tree, parent?.hash, full);

package/dist/core/integrity.js

@@ -16,8 +16,9 @@ import fs from "node:fs";
 import path from "node:path";
 import * as git from "./git.js";
 import { RECORD_TYPES } from "./model.js";
-import { fileSha, fingerprint, verifyCommitSeal, verifyOp } from "./seal.js";
-import { StromError } from "./errors.js";
+import { fileSha, fingerprint, otherKeys, readCommitSeal, verifyCommitSeal, verifyOp } from "./seal.js";
+import { settingsHidden } from "./oldsettings.js";
+import { NeedsConsentError, StromError } from "./errors.js";
 import { counted } from "../cli/format.js";
 /**
  * What strom alone writes in a tree, each change through a sealed operation: the records and their history (data/), the
@@ -56,8 +57,29 @@ function parseOps(text, file, findings, startLine = 0) {
     });
     return out;
 }
+/**
+ * A research sealed with two keys of this computer: the settings' own and another in an old settings folder (strom of
+ * an app packaged for Windows and of a terminal each had their own: core/oldsettings.ts). Its writes are the person's,
+ * never "outside strom" — united by the person in their terminal (strom seal adopt), never undone by strom repair.
+ */
+export const OTHER_KEY = "other-key";
+const OTHER_KEY_HINT = "the user runs in their terminal: strom seal adopt   (unites the keys — never strom repair, which would undo that work)";
+function keysOf(tree, trust = [], united = new Map()) {
+    let others;
+    let hidden;
+    return {
+        hidden: () => (hidden ??= settingsHidden(tree.env)),
+        trusted: new Map(trust.map((k) => [fingerprint(k), k])),
+        united,
+        others: () => (others ??= new Map(tree.key ? otherKeys(tree.env, tree.config.id, tree.key).map((o) => [fingerprint(o.key), o.key]) : [])),
+    };
+}
+/** Is an operation shaped as strom signs one (a key's fingerprint and a signature), whatever key it was? */
+function strommade(op) {
+    return typeof op.k === "string" && /^[0-9a-f]{12}$/u.test(op.k) && typeof op.sig === "string" && /^[0-9a-f]{32}$/u.test(op.sig);
+}
 /** Check chain and signatures of a run of operations. */
-function checkOps(tree, ops, prevSig, file, findings) {
+function checkOps(tree, ops, prevSig, file, findings, keys = keysOf(tree)) {
     const key = tree.key;
     const fp = key ? fingerprint(key) : undefined;
     let prev = prevSig;
@@ -70,16 +92,27 @@ function checkOps(tree, ops, prevSig, file, findings) {
             adopted = true;
         if (!key)
             continue;
-        if (op.k === fp) {
-            if (!verifyOp(op, key))
+        const trusted = keys.trusted.get(op.k);
+        if (op.k === fp || trusted) {
+            if (!verifyOp(op, trusted ?? key))
                 findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} has an invalid signature (written outside strom)` });
         }
+        else if ((keys.united.get(op.k) ?? "") >= op.at) {
+            // another key of this computer, its operations until then checked and taken when the person united the keys
+        }
         else if (adopted) {
-            findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} is signed with an unknown key after the tree was adopted` });
+            const other = keys.others().get(op.k);
+            if (other && verifyOp(op, other))
+                findings.push({ level: "error", code: OTHER_KEY, file, message: `operation ${op.op} at ${op.at} is signed with another seal key of strom on this computer (a second copy of strom's settings)`, hint: OTHER_KEY_HINT });
+            // a key out of sight only for what strom signs (a fingerprint and a signature): anything else was written outside
+            else if (keys.hidden() && strommade(op))
+                findings.push({ level: "error", code: OTHER_KEY, file, message: `operation ${op.op} at ${op.at} is signed with a key this strom does not see (an app packaged for Windows started it)`, hint: OTHER_KEY_HINT });
+            else
+                findings.push({ level: "error", code: "forged-op", file, message: `operation ${op.op} at ${op.at} is signed with an unknown key after the tree was adopted` });
         }
     }
 }
-function headSeal(tree, findings) {
+function headSeal(tree, findings, keys = keysOf(tree)) {
     const head = git.headInfo(tree.root);
     if (!head)
         return;
@@ -93,7 +126,27 @@ function headSeal(tree, findings) {
         });
         return;
     }
-    if (!verifyCommitSeal(key, head.tree, head.message))
+    const sealedWith = (k) => verifyCommitSeal(k, head.tree, head.message);
+    if (sealedWith(key) || [...keys.trusted.values()].some(sealedWith))
+        return;
+    if ([...keys.others().values()].some(sealedWith))
+        findings.push({
+            level: "error",
+            code: OTHER_KEY,
+            message: "the last commit was sealed with another seal key of strom on this computer (a second copy of strom's settings)",
+            hint: OTHER_KEY_HINT,
+        });
+    // started by an app packaged for Windows: the terminal's key is out of its sight — the terminal unites them (where
+    // seal adopt checks every seal again: a commit of nobody's stays refused). Only a commit with strom's seal: one
+    // without (git used directly) is said as it always was, never sent to uniting it cannot do
+    else if (keys.hidden() && readCommitSeal(head.message) !== undefined)
+        findings.push({
+            level: "error",
+            code: OTHER_KEY,
+            message: "the last commit was not sealed with a key this strom sees — an app packaged for Windows started it, the key of the terminal's strom is out of its sight",
+            hint: OTHER_KEY_HINT,
+        });
+    else
         findings.push({
             level: "error",
             code: "foreign-commit",
@@ -295,17 +348,44 @@ export function verifyFast(tree, snap = snapshot(tree)) {
         findings.unshift(notDownloadedFinding([...cloud].sort()));
     return { findings, tampered: [...tampered] };
 }
-/** Full check: every operation and every record. */
-export function verifyFull(tree) {
+/**
+ * The other keys of this computer a seal.unite of the tree's own key took, each with when (its operations until then
+ * are the person's).
+ */
+function unitedKeys(tree, logs) {
+    const united = new Map();
+    const key = tree.key;
+    if (!key)
+        return united;
+    const fp = fingerprint(key);
+    for (const { ops } of logs)
+        for (const op of ops)
+            if (op.op === "seal.unite" && op.k === fp && verifyOp(op, key))
+                for (const k of op.keys ?? [])
+                    if ((united.get(k) ?? "") < op.at)
+                        united.set(k, op.at);
+    return united;
+}
+/**
+ * Full check: every operation and every record. `trust`: other keys of this computer whose operations and commits are
+ * checked with them as the tree's own (strom seal adopt, before it unites them).
+ */
+export function verifyFull(tree, o = {}) {
     const findings = [];
     const tampered = new Set();
-    headSeal(tree, findings);
     const latest = new Map();
     const all = [];
-    for (const file of opsLogs(tree.dataDir)) {
+    const logs = opsLogs(tree.dataDir).map((file) => {
         const rel = path.relative(tree.root, file).split(path.sep).join("/");
-        const ops = parseOps(fs.readFileSync(file, "utf8"), rel, findings);
-        checkOps(tree, ops, "", rel, findings);
+        return { rel, ops: parseOps(fs.readFileSync(file, "utf8"), rel, findings) };
+    });
+    const keys = keysOf(tree, o.trust, unitedKeys(tree, logs));
+    // the last commit said first, as ever
+    const headFindings = [];
+    headSeal(tree, headFindings, keys);
+    findings.unshift(...headFindings);
+    for (const { rel, ops } of logs) {
+        checkOps(tree, ops, "", rel, findings, keys);
         all.push(...ops);
     }
     // Logs are per session: the last word on a file is the newest operation across all of them.
@@ -387,6 +467,9 @@ export function assertIntact(tree) {
         tree.requireKey();
         return;
     }
+    // the last commit sealed with another key of this computer: the person unites them (never strom repair)
+    if (errors.every((f) => f.code === OTHER_KEY))
+        throw otherKeyError(tree.config.name);
     // files only in iCloud: downloaded first — what else is wrong is judged then
     if (errors.some((f) => f.code === NOT_DOWNLOADED))
         throw notDownloadedError(notDownloaded(tree.root));
@@ -410,3 +493,10 @@ export function notDownloadedError(files) {
         details: files.slice(0, 50),
     });
 }
+/**
+ * Writing refused while the last commit carries the seal of another key of this computer: a consent of the person in
+ * their terminal (strom seal adopt unites the keys), said in their language (ui.error.seal.other-key).
+ */
+export function otherKeyError(name) {
+    return new NeedsConsentError([{ key: "seal", kind: "consent", question: "This tree was sealed with two keys of strom on this computer. Unite them?", set: "strom seal adopt" }], undefined, undefined, { code: "seal.other-key", params: { name, set: "strom seal adopt" } });
+}

package/dist/core/live.js

@@ -246,6 +246,7 @@ const CODES = {
     "ui.media.large": "media.large",
     "ui.media.full": "media.full",
     "ui.seal.bridge": SEAL_FOREIGN,
+    "ui.seal.bridge.twokeys": "seal.other-key",
     "ui.error.tree.not-downloaded": "tree.not-downloaded",
     "ui.experiments.link": "experiments.link",
     "ui.history.place.link": "history.link",
@@ -2240,6 +2241,9 @@ export function serveLive(root, env) {
                     // sealed on another computer since it was asked (its key gone meanwhile): said as the bridge says it before
                     if (data.code === SEAL_FOREIGN)
                         reply(409, { ...sealRefusal(), intake: sent.intake });
+                    // sealed here with two keys of this computer (an app packaged for Windows and a terminal): united in a terminal
+                    else if (data.code === "seal.other-key")
+                        reply(409, { ...said(lang, "ui.seal.bridge.twokeys", { name: String(data.params?.name ?? ""), set: "strom seal adopt" }), intake: sent.intake });
                     // no room on the disk: said as everywhere (507 disk.full), never the system's words with strom's inner path
                     else if (data.code === DISK_FULL || isDiskFull(why))
                         reply(507, { ...diskFullSaid(lang, fullWhere(data, root)), reason: why, intake: sent.intake });

package/dist/core/oldsettings.js

@@ -0,0 +1,101 @@
+// strom's settings on Windows before 1.23: %APPDATA%\strom. An app packaged as MSIX (Claude's desktop app) gets every
+// file it creates in AppData as a private copy of its own (%LOCALAPPDATA%\Packages\<app>\LocalCache\Roaming\strom),
+// read before the real one and seen by no other program — a strom it started and a strom of a terminal each had their
+// own seal key for one research, each side's writes "outside strom" to the other (found 2026-10-30). Microsoft: "all
+// newly created files and folders in the user's AppData folder are written to a private per-user, per-app location";
+// "apart from AppData, the app can write to any location where the user has write access, including other parts of
+// %userprofile%" (learn.microsoft.com/windows/msix/desktop/flexible-virtualization). The settings are outside AppData
+// now (paths.ts configDir); these folders are read, taken over once, and never moved or deleted: an older strom reads
+// them still (a switch back to an older version).
+import fs from "node:fs";
+import path from "node:path";
+import { configDir, userHome } from "./paths.js";
+import { writesPrivately } from "./packaged.js";
+import { installation } from "./self.js";
+/**
+ * The folders strom kept its settings in before, as this process sees them: %APPDATA%\strom first (in a packaged app
+ * its private copy where there is one, else the real one), then each packaged app's copy, read by its path. None with
+ * settings of their own (STROM_CONFIG_DIR) and none off Windows. STROM_TEST_OLD_SETTINGS (the sources only): the folders
+ * standing for them, separated as PATH is.
+ */
+export function oldSettingsDirs(env, platform = process.platform, inst = installation()) {
+    if (inst.kind === "source" && env.STROM_TEST_OLD_SETTINGS !== undefined)
+        return env.STROM_TEST_OLD_SETTINGS.split(path.delimiter).filter(Boolean);
+    if (env.STROM_CONFIG_DIR || platform !== "win32")
+        return [];
+    const home = env.USERPROFILE || userHome(env);
+    const roaming = path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), "strom");
+    const packages = path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Packages");
+    let apps = [];
+    try {
+        apps = fs.readdirSync(packages);
+    }
+    catch {
+        // no packaged apps
+    }
+    const copies = apps.map((a) => path.join(packages, a, "LocalCache", "Roaming", "strom")).filter((d) => fs.existsSync(d));
+    return [roaming, ...copies];
+}
+/**
+ * Every packaged app's copy of the old settings as one pattern, those made later too:
+ * `%LOCALAPPDATA%\Packages\*\LocalCache\Roaming\strom` — kept from the agents whole (a key an agent put into a copy
+ * made after the rules were written would make a commit of nobody's another key of this computer, offered to unite).
+ * None where oldSettingsDirs has none. STROM_TEST_PACKAGES (the sources only): the folder standing for Packages.
+ */
+export function packagedSettingsPattern(env, platform = process.platform, inst = installation()) {
+    if (inst.kind === "source" && env.STROM_TEST_PACKAGES !== undefined)
+        return path.join(env.STROM_TEST_PACKAGES, "*", "LocalCache", "Roaming", "strom");
+    if (env.STROM_CONFIG_DIR || platform !== "win32")
+        return undefined;
+    const home = env.USERPROFILE || userHome(env);
+    return path.join(env.LOCALAPPDATA || path.join(home, "AppData", "Local"), "Packages", "*", "LocalCache", "Roaming", "strom");
+}
+/** What is never copied over: a lock or a file half written of a strom running meanwhile, and the keys (seal.ts). */
+function copied(from, file) {
+    if (/\.(lock|tmp)$/u.test(file))
+        return false;
+    return path.relative(from, file).split(path.sep)[0] !== "keys";
+}
+/**
+ * The settings taken over into the folder of today once, before anything reads them (no config.json there yet): every
+ * old folder with settings copied in, the first one's word kept where two say something. The seal keys are taken one by
+ * one when a research needs its own (seal.ts settleKey). The folder taken from, or undefined.
+ */
+export function takeOverOldSettings(env, platform = process.platform, inst = installation()) {
+    const dir = configDir(env, platform);
+    if (fs.existsSync(path.join(dir, "config.json")))
+        return undefined;
+    const old = oldSettingsDirs(env, platform, inst).filter((d) => fs.existsSync(path.join(d, "config.json")));
+    if (!old.length)
+        return undefined;
+    fs.mkdirSync(dir, { recursive: true });
+    for (const from of old)
+        fs.cpSync(from, dir, { recursive: true, force: false, errorOnExist: false, filter: (file) => copied(from, file) });
+    return old[0];
+}
+/** A research's seal key in the old folders, each different one once with where it was (the first seen first). */
+export function oldKeys(env, treeId, inst = installation()) {
+    const out = [];
+    for (const dir of oldSettingsDirs(env, process.platform, inst)) {
+        const file = path.join(dir, "keys", `${treeId}.key`);
+        let key;
+        try {
+            key = Buffer.from(fs.readFileSync(file, "utf8").trim(), "hex");
+        }
+        catch {
+            continue;
+        }
+        if (key.length && !out.some((o) => o.key.equals(key)))
+            out.push({ file, key });
+    }
+    return out;
+}
+/**
+ * Whether this strom was started by an app packaged for Windows that keeps its own copy of the old settings: the key a
+ * strom of the terminal keeps there it cannot see (its own copy reads first) — what is sealed with it is another key of
+ * this computer, not git used directly. Tried (core/packaged.ts), only when a seal does not match.
+ */
+export function settingsHidden(env, inst = installation()) {
+    const dir = oldSettingsDirs(env, process.platform, inst)[0];
+    return !!dir && fs.existsSync(dir) && writesPrivately(env, dir, process.platform, inst);
+}

package/dist/core/packaged.js

@@ -0,0 +1,69 @@
+// A strom started by an app packaged as MSIX (Claude's desktop app on Windows): every file it creates under AppData goes
+// to a private copy of the app's (%LOCALAPPDATA%\Packages\<app>\LocalCache\Local\…), read before the real one and seen
+// by no other program (learn.microsoft.com/windows/msix/desktop/desktop-to-uwp-behind-the-scenes, "AppData operations
+// on Windows 10, version 1903 and later"). strom's program is in %LOCALAPPDATA%\Programs\Strom: an update installed
+// from there would be that app's alone — the app on the new version, the terminal on the old one for good (found
+// 2026-10-30). Whether this process writes so is tried, not guessed: a file made in the folder and looked for in the
+// private copies.
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { userHome } from "./paths.js";
+import { installation } from "./self.js";
+/** The AppData folders a packaged app's new files are taken from, each with its folder in the private copy. */
+function appData(env) {
+    const home = env.USERPROFILE || userHome(env);
+    return [
+        { real: env.LOCALAPPDATA || path.join(home, "AppData", "Local"), copy: "Local" },
+        { real: env.APPDATA || path.join(home, "AppData", "Roaming"), copy: "Roaming" },
+    ];
+}
+/** Where the packaged apps keep their private copies of `dir`, whether they are there or not (none: dir outside AppData). */
+function copiesOf(env, dir) {
+    const packages = path.join(appData(env)[0].real, "Packages");
+    for (const { real, copy } of appData(env)) {
+        const rel = path.relative(real, dir);
+        if (!rel || rel.startsWith("..") || path.isAbsolute(rel))
+            continue;
+        let apps = [];
+        try {
+            apps = fs.readdirSync(packages);
+        }
+        catch {
+            // no packaged apps
+        }
+        return apps.map((a) => path.join(packages, a, "LocalCache", copy, rel));
+    }
+    return [];
+}
+/** The private copies of `dir` some packaged app made (from the terminal: the update it installed only for itself). */
+export function privateCopies(env, dir, platform = process.platform) {
+    if (platform !== "win32")
+        return [];
+    return copiesOf(env, dir).filter((d) => fs.existsSync(d));
+}
+/**
+ * Whether a file this process makes in `dir` lands in a packaged app's private copy instead. STROM_TEST_PACKAGED=1 (the
+ * sources only) stands for it. `make` writes the file (a test makes it where Windows would).
+ */
+export function writesPrivately(env, dir, platform = process.platform, inst = installation(), make = (file) => fs.writeFileSync(file, "", { flag: "wx" })) {
+    if (inst.kind === "source" && env.STROM_TEST_PACKAGED !== undefined)
+        return env.STROM_TEST_PACKAGED === "1";
+    if (platform !== "win32")
+        return false;
+    const copies = copiesOf(env, dir);
+    if (!copies.length)
+        return false;
+    const name = `.strom-probe-${crypto.randomBytes(6).toString("hex")}`;
+    try {
+        make(path.join(dir, name));
+    }
+    catch {
+        return false;
+    }
+    // the private copy says so; the real folder could have it as well — what counts is the copy
+    const hit = copies.some((c) => fs.existsSync(path.join(c, name)));
+    for (const at of [dir, ...copies])
+        fs.rmSync(path.join(at, name), { force: true });
+    return hit;
+}

package/dist/core/paths.js

@@ -44,14 +44,18 @@ export function noLinks(env) {
 export function userHome(env) {
     return env.HOME || env.USERPROFILE || os.homedir();
 }
-/** Directory holding the small user config (the pointer to the Strom home). */
+/**
+ * Directory holding the small user config (the pointer to the Strom home) and the seal keys. On Windows outside AppData
+ * (%USERPROFILE%\.config\strom, as ~/.config/strom elsewhere): an app packaged as MSIX (Claude's desktop app) gets
+ * every new file of AppData as a private copy of its own, which no strom of a terminal sees — a research had two seal
+ * keys, each side's writes "outside strom" to the other (found 2026-10-30). The folder before: core/oldsettings.ts.
+ */
 export function configDir(env, platform = process.platform) {
     if (env.STROM_CONFIG_DIR)
         return path.resolve(env.STROM_CONFIG_DIR);
-    if (platform === "win32") {
-        const appData = env.APPDATA || path.join(userHome(env), "AppData", "Roaming");
-        return path.join(appData, "strom");
-    }
+    // the profile's own folder (HOME is Git Bash's, which may name another)
+    if (platform === "win32")
+        return path.join(env.USERPROFILE || userHome(env), ".config", "strom");
     const xdg = env.XDG_CONFIG_HOME || path.join(userHome(env), ".config");
     return path.join(xdg, "strom");
 }

package/dist/core/seal.js

@@ -16,6 +16,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { configDir } from "./paths.js";
 import { canonicalize } from "./json.js";
+import { oldKeys, oldSettingsDirs } from "./oldsettings.js";
 export function sha256(content) {
     return crypto.createHash("sha256").update(content).digest("hex");
 }
@@ -30,20 +31,67 @@ export function fileSha(file) {
 export function keyFile(env, treeId) {
     return path.join(configDir(env), "keys", `${treeId}.key`);
 }
-export function loadKey(env, treeId) {
+function readKey(file) {
     try {
-        return Buffer.from(fs.readFileSync(keyFile(env, treeId), "utf8").trim(), "hex");
+        const key = Buffer.from(fs.readFileSync(file, "utf8").trim(), "hex");
+        return key.length ? key : undefined;
     }
     catch {
         return undefined;
     }
 }
-/** Create the key for a tree on this computer (0600). Fails if it exists. */
+/** The tree's key on this computer: the settings' own, else one of the old settings folders (core/oldsettings.ts). */
+export function loadKey(env, treeId) {
+    return readKey(keyFile(env, treeId)) ?? oldKeys(env, treeId)[0]?.key;
+}
+/**
+ * The tree's key, the one in an old settings folder taken over into the settings of today where they have none: of two
+ * different ones (strom of a packaged app and of a terminal, each its own) the one `prefer` says (the one that sealed the
+ * last commit, the side that could still write), else the first.
+ */
+export function settleKey(env, treeId, prefer) {
+    const own = readKey(keyFile(env, treeId));
+    if (own)
+        return own;
+    const old = oldKeys(env, treeId);
+    if (!old.length)
+        return undefined;
+    const key = (old.length > 1 ? old.find((o) => prefer(o.key)) : undefined)?.key ?? old[0].key;
+    try {
+        const file = keyFile(env, treeId);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+    }
+    catch {
+        // taken over next time
+    }
+    return key;
+}
+/** The tree's other keys on this computer: those of the old settings folders that are not `key` (strom seal adopt unites them). */
+export function otherKeys(env, treeId, key) {
+    return oldKeys(env, treeId).filter((o) => !o.key.equals(key));
+}
+/**
+ * Create the key for a tree on this computer (0600). Fails if it exists. Also into the old settings folder (Windows),
+ * made if need be: an older strom, after a switch back, reads it there.
+ */
 export function createKey(env, treeId) {
     const file = keyFile(env, treeId);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     const key = crypto.randomBytes(32);
     fs.writeFileSync(file, key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+    // also where an older strom looks (Windows: %APPDATA%\strom), made if need be — back on an older version, the research
+    // is still sealed here
+    const old = oldSettingsDirs(env)[0];
+    if (old) {
+        try {
+            fs.mkdirSync(path.join(old, "keys"), { recursive: true });
+            fs.writeFileSync(path.join(old, "keys", `${treeId}.key`), key.toString("hex") + "\n", { mode: 0o600, flag: "wx" });
+        }
+        catch {
+            // a key of its own there already: the older strom keeps it
+        }
+    }
     return key;
 }
 /** Short public fingerprint of a key, stored on each operation. */

package/dist/core/tree.js

@@ -21,7 +21,7 @@ import { settledRecord, validateRecord } from "./validate.js";
 import { NeedsConsentError, StromError, UsageError } from "./errors.js";
 import * as git from "./git.js";
 import { opsLogs } from "./opslog.js";
-import { commitSeal, createKey, fingerprint, loadKey, sha256, signOp } from "./seal.js";
+import { commitSeal, createKey, fingerprint, loadKey, settleKey, sha256, signOp, verifyCommitSeal } from "./seal.js";
 import { stringifyCanonical } from "./json.js";
 import { lastBackup } from "./backup.js";
 export const TREE_FILE = "strom.json";
@@ -29,7 +29,7 @@ export const TREE_FILE = "strom.json";
 export const SEAL_FOREIGN = "seal.foreign";
 // between releases the candidate being made (a bridge run from the sources says what it is: the Strom app goes by it);
 // at a release the release's own (package.json)
-export const VERSION = "1.22.1";
+export const VERSION = "1.22.2";
 const GITIGNORE = `# Strom Research — local state and large files are not versioned
 .strom/
 /media/
@@ -569,7 +569,7 @@ export class Tree {
     /** The tree's seal key on this computer, or undefined (tree moved here). */
     get key() {
         if (this.keyCache === undefined)
-            this.keyCache = loadKey(this.env, this.config.id) ?? null;
+            this.keyCache = settleKey(this.env, this.config.id, (key) => this.headSealedWith(key)) ?? null;
         return this.keyCache ?? undefined;
     }
     lastStamp = 0;
@@ -582,6 +582,11 @@ export class Tree {
     opsFilesTouched() {
         return [...this.touchedOps].map((f) => this.relative(f));
     }
+    /** Whether the last commit carries the seal of this key. */
+    headSealedWith(key) {
+        const head = git.headInfo(this.root);
+        return !!head && verifyCommitSeal(key, head.tree, head.message);
+    }
     /** Forget the cached key (after one was created on this computer). */
     reloadKey() {
         this.keyCache = undefined;
@@ -605,7 +610,8 @@ export class Tree {
         ], undefined, undefined, { code: SEAL_FOREIGN, params: { name: this.config.name, set: "strom seal adopt" } });
     }
     /** Sealed commit of everything under pathspec. */
-    commit(message, pathspec = ["."]) {
+    /** `always`: a commit even when nothing changed (strom repair sealing again what was committed outside strom). */
+    commit(message, pathspec = ["."], always = false) {
         const key = this.requireKey();
         // its IDs on disk before it commits (written once here, not after every record: a sync of 2 200 people wrote the
         // counters thousands of times)
@@ -613,7 +619,7 @@ export class Tree {
         // another process may have committed since this one last looked — under the lock it read HEAD afresh already
         if (this.lockDepth === 0)
             git.resetCache(this.root);
-        const hash = git.commitAll(this.root, message, pathspec, (treeHash) => commitSeal(key, treeHash));
+        const hash = git.commitAll(this.root, message, pathspec, (treeHash) => commitSeal(key, treeHash), always);
         // the logs this commit holds are closed: what comes next goes into new ones
         this.opsNow.clear();
         if (hash) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strom-research",
-  "version": "1.22.1",
+  "version": "1.22.2",
   "description": "Genealogical research toolkit for AI coding agents",
   "type": "module",
   "bin": {