One Synchronization, Fully Traced

sync builds an authenticated API client, obtains local and remote RecordStatus, and computes a Diff for each (HostId, RecordTag) stream. Indices are owned by the originating host, avoiding one globally serialized counter across offline machines.

Before mutation, Atuin downloads one non-packfile record and attempts decryption. A wrong master key becomes SyncError::WrongKey; it does not first upload unreadable divergent state.

operations converts head comparisons into Upload, Download, or Noop and sorts deterministically. Packfile downloads precede loose history so expanded ranges can prevent redundant record downloads.

Uploads page from the first remote-missing index. Downloads begin at first_gap, not merely last + 1: a previously expanded pack may have inserted higher records while leaving a hole. Pages are idempotently pushed to SQLite.

Finally, downloaded record IDs drive projection rebuilding. History rebuild is incremental; aliases, variables, KV, and scripts rebuild independently. The encrypted log converges first, then caller-facing data catches up.