Why Is It Designed This Way?

Why keep a separate record store and history database?

The encrypted record log provides generic replication truth; the history database provides query-optimized local UX. Projections can change or rebuild without redesigning the wire protocol.

Why index independently by host and tag?

Offline machines can append without coordinating a global sequence. Each origin owns its monotonic tail, and unioning streams preserves all writes.

Why validate the key before sync?

Discovery of a wrong key after uploads could extend divergence with records this installation cannot read. Preflight keeps failure non-mutating.

Why download from the first gap?

Maximum index proves only that some high record exists, not that the prefix is complete. Pack expansion and interrupted pages make holes plausible.

Why is sync sequential?

Transfers could overlap, but packfile-before-history ordering and simpler local mutation currently provide more value than throughput. Concurrency is a policy choice, not an async default.

Why does the server see ciphertext?

Sync availability should not require trusting the service with shell commands, tokens, paths, or secrets users routinely type.

Why tolerate projection failures independently?

The record store has already converged. A broken script projection should not prevent history or aliases from becoming useful.