Koh 3.8.6

Changes since 3.8.2:

• koh doctor gives every failed check a remedy, and offers repairs for what it can put right without losing anything: damaged or missing objects from verified copies, missing saves from the remote, recorded strips a save still holds, an interrupted restore, an unfinished remote strip, unused objects, damaged indexes, objects or saves the remote lacks, and stripped paths a remote save still holds. When head is lost and only one save could be it, Doctor can point head there. On a terminal it asks about each repair, and Enter skips it. --yes runs them all; otherwise repairs are only listed.
• Repairs refuse anything they cannot trust. A malformed strip event, or an unfinished-strip note that does not parse or that no recorded strip backs, is reported and never acted on. Re-applying a strip removes only the objects that strip frees. Doctor guesses head only when no remote could hold a newer one, and checks again just before writing it. A remote save with invalid metadata is refused before anything lands, and a damaged remote copy of an empty file is replaced.
• When another machine finishes a strip while koh offer or Doctor is uploading, what they sent loses the stripped paths and keeps the rest; before, an offer deleted its records outright. This now also happens when an upload fails part way, and neither deletes an object another remote save still lists.
• koh doctor --backup writes its copy before any repair, and no repair runs if the backup fails. A repair that fails part way reports what it did finish, and Doctor checks the repo again afterwards.
• koh strip deletes only the objects the strip freed. Other unused objects stay until you remove them with koh doctor.
• koh doctor --offline is gone; --fast skips the remote audit.
• koh man is rewritten in short, direct entries.

Koh 3.8.2

Changes since 3.7.3:

• koh doctor checks the whole repository. Locally it verifies SQLite integrity and foreign keys, every object's hash and size, every save's file references, the history graph (missing parents and cycles), saved paths, events, restore state, unfinished strips, ignore rules and koh.build. It clears the hash cache before reading working files, so a stale hash cannot hide a change.
• Doctor also reads the remote by default: every save, event and object, and each release file's size, Blake3 and SHA256. It never writes to the remote. That audit can take minutes on a large repo; --fast or --offline skips it. Without it, Doctor checks Koh's own repository in under half a second.
• Doctor's report is shorter. Repository details sit in labelled rows, passed checks are folded into one list, and only failed, skipped or warning checks get a line of their own. --json keeps its existing fields and adds health, checks, warnings and repository metadata.
• The save details in koh view end with the total lines added and removed, in green and red. Binary files are not counted.
• Linux releases are built with the system C compiler and static C runtime libraries instead of Zig. Every build still requires garbage collection.

Koh 3.7.3

Changes since 3.4.6:

• koh ignore previews and toggles several file or folder rules in one confirmation. --global edits ~/.kohignore for every repository on this machine. Ignoring leaves older saves intact; removing a broad rule is previewed and warned about.
• koh strip accepts several paths, previews the entire batch and completes every typed-path confirmation before changing local history in one transaction. Interrupted remote cleanup can be retried. Ignore-rule write failures report the rule to add by hand.
• Destructive actions default to No. Enter cancels; y, Y or explicit --yes approves. This also covers remote replacement/forgetting and incoming sync. Choosing --mine or --theirs does not bypass consent. Strip still requires a terminal and exact typed paths. Doctor removes old peek folders only with --yes.
• Every Koh build requires Boehm garbage collection. Native Linux ARM64 and x86_64 releases use static musl and bundled GC; GC-free builds refuse at compile time. In three trials saving a 195.3 MiB tree, median Linux peak memory fell from roughly 3.4 GiB to 29 MiB on ARM64 and 61 MiB on x86_64 under Linux Rosetta.
• Release builds support Apple silicon macOS and ARM64/x86_64 Linux. Intel macOS is no longer supported for new releases. Historical downloads remain available, and Koh can still build Intel macOS targets for other projects.
• The website installer, reference docs and zsh completions reflect these changes. The installer refuses Intel macOS before downloading or replacing an existing installation.

Koh 2 migration preserves the original archive and save IDs. The migration fixtures were not rerun for this release because Koh 2 is unavailable in the build environments; all other source and CLI suites pass.

Koh 3 is here.

History lives in one SQLite file, with one line of saves. No lanes or promotion: save work, inspect it, and restore it without giving up the history that brought you there. The current implementation is written in V with SQLite built in.

• koh opens the help screen; koh man carries the full reference. koh view presents searchable history with sessions, agent attribution, checkpoints, flags, file changes and save details.
• Save, checkpoint, compare, load, undo and revert work on complete saved trees. Pluck applies selected paths or reverses a change. Restorations append to history, preserve rollback points and refuse unsafe paths; machine-readable commands support JSON.
• Configure a folder or S3-compatible remote once per machine. Saves offer automatically when a remote exists. Offer and steal exchange missing saves, objects and events; interrupted transfers can be retried. Diverged machines keep both histories and ask which complete file to keep when both sides change it.
• Public projects can be stolen from Kepr over HTTPS with their history. Streaming bundles reduce requests and reject truncated transfers. All HTTPS requests verify certificates against the system CA bundle. The operator can connect through Kepr's one-time sign-in code and continue offering directly to their own storage.
• koh.build describes local builds and supported platforms. Releases publish every platform together, with Blake3 and SHA-256 checksums, notes and immutable versions. koh update installs only newer releases, verifies TLS using the system CA bundle, verifies downloaded bytes, and replaces the binary atomically.
• Koh 2's update feed now points at Koh 3. Old repositories must run koh migrate before repository commands; Koh 3 does not hand them to an old executable. Migration preserves save IDs and checkpoints and keeps the original Koh 2 repository as an archive, including compatibility for older unsorted manifests.
• The installer supports Apple silicon and Intel macOS, plus ARM64 and x86_64 Linux. It confirms Koh 2 upgrades, verifies checksums and executable version before replacement, and offers the optional zsh prompt and completion plugin. Noninteractive installation supports --yes and explicit plugin selection.
• Doctor verifies repository integrity and makes consistent backups. Flagging records warnings in history. Permanent stripping requires explicit path confirmation and propagates to connected storage.

This first Koh 3 release on the new Kepr includes the complete Koh 3 rewrite and subsequent safety, migration, synchronization, browsing and release fixes, rather than only the final installer changes. Linux binaries use static musl; macOS binaries are signed ad hoc and target macOS 11 or newer.