Sync Gateway returning "401 unauthorised" does not set lastError

You can get more details of what the replicator is doing internally, including state transitions, by enabling the Sync logging flag, as documented here. (For even more spew, enable SyncVerbose.)