Peer-to-Peer Sync

Pitchblend Memory Sync moves supported Geist memories directly between your
trusted devices. Pitchblend Cloud provides the account, license, enrollment,
membership, and connection-coordination control plane. It is not a memory-data
service or relay.

Memory Sync is available in v1.0 only from a packaged desktop app using the
normal Pitchblend-managed Geist runtime.

What syncs

Memory Sync includes:

• profile memories; and
• folder memories.

It excludes:

• chats and conversation history;
• private thread memory;
• model files and downloaded model weights;
• account credentials and raw license keys; and
• local application settings outside the sync feature.

The Memory Sync panel states this boundary as Profile and folder memories
only; no chats, private thread memory, or model files.

What Pitchblend Cloud can see

The cloud handles only the information needed to authorize and connect devices,
including account and license eligibility, device membership, public device
keys, invitation state, presence, and bounded connection-signaling messages.

It does not accept or relay memory text, memory journals, embeddings, model
files, application encryption keys, or peer data frames. There is no TURN relay
in the v1.0 sync service.

Internet access is required for initial sign-in, license checks, enrollment,
and Internet connection coordination. Existing trusted devices may use a local
network fallback when the direct Internet path is unavailable, but you should
not rely on that fallback for first-time setup.

How devices become trusted

The first device bootstraps a sync group for one eligible license. Every later
device uses a short-lived, one-time pairing code created by an enrolled device.

Both devices then display the same eight-digit safety code. An existing device
must select Codes match before Approve is enabled. This human comparison
binds approval to the device that is actually joining.

Reject the request when:

• the device label is unfamiliar;
• the safety codes differ;
• nobody you trust is actively adding a device; or
• the request appeared after the pairing code should have expired.

Each device has its own protected signing identity. Membership updates are
signed and checked by enrolled devices, and revoked devices cannot be silently
reactivated.

How memory data moves

For devices on different networks, Pitchblend uses direct WebRTC data channels
and permits STUN discovery only. Relay credentials and TURN URLs are rejected.
When the Internet path fails, Pitchblend can temporarily try direct LAN
discovery between already enrolled devices.

Peer frames are encrypted, authenticated, ordered, and replay-checked. Local
pending changes are kept in an encrypted journal protected by an
operating-system-backed key.

The launcher may briefly show Connecting or Syncing during this work.
When a connection fails, it shows Needs attention and the panel displays a
bounded, redacted error rather than memory content or credentials.

Conflicts do not overwrite a memory silently

If two devices edit the same memory concurrently, Pitchblend uses a keep-both
policy. It creates a separate memory for the concurrent version, counts the
conflict in Sync activity, and says No content was discarded.

Review the resulting memories in Geist. Pitchblend does not automatically
choose one person's edit over another.

License and device lifecycle

One device belongs to one license sync group at a time.

• If the license has fewer available seats, newer devices can become
  Suspended. Their local memories remain unchanged, but they cannot sync.
• If a device is revoked, its launcher shows Removed. Local memories remain
  on that device, but its old group credentials no longer authorize sync.
• Switching licenses revokes the old membership and destroys the old local sync
  keys, metadata, and journal. It does not delete local Geist memories.
• Disabling Sync Geist memories stops sync and also disables background
  launch. It does not delete local memories.

Background operation

Keep syncing in the background registers Pitchblend to start hidden at
login and lets sync continue after the visible window closes. This does not
install a privileged system service. Reopen Pitchblend normally to inspect
status or change settings.

Local discovery and clock accuracy

LAN discovery announcements are signed and accepted for up to 60 seconds, with
at most 30 seconds of future clock skew. If two enrolled devices are on the same
network but do not discover each other, make sure both operating-system clocks
are synchronized.

For setup and device controls, read
Memory Sync. For errors and
recovery, read
Account and Sync Help.