Exchange DB changes over Iroh

AGENTS.md

@@ -136,8 +136,11 @@ Roadmap items should be actionable and checkable:
 - DB resources can be registered locally and report local-only status plus a
   read-only SQLite schema summary/hash and `crsql_changes` metadata when
   present. The DB crate and daemon can extract typed read-only `crsql_changes`
-  batches through `geth db changes` for future sync messages. cr-sqlite loading,
-  applying remote changes, and sync are still roadmap work.
+  batches through `geth db changes`. `geth db sync <node-id> <name>` can pull
+  authorized typed `crsql_changes` batches over the protected Iroh control ALPN
+  with `db.sync` on the remote `resource:db:<name>`, compare schema metadata,
+  and advance per-peer/per-DB cursors during manual or background live-sync.
+  cr-sqlite loading and applying remote changes are still roadmap work.
 - KV stores support local SQLite-backed create/set/get plus authorized
   `geth kv sync <node-id> <name>` over Iroh. Background live-sync refreshes
   local KV stores from known peers with per-peer/per-KV cursors. Iroh Documents
@@ -170,6 +173,6 @@ Roadmap items should be actionable and checkable:
   `ssh_revocation.sync` on `resource:ssh:revocations`. The daemon live-syncs
   known peers every 30 seconds using per-peer cursors; this is pull-only
   metadata sync, not yet a CRDT/resource-log replication model.
-- cr-sqlite, iroh-docs, iroh-blobs provider/fetch, Automerge sync, broader auth
-  enforcement, and Keyhive/BeeKEM-style authorization are future roadmap items
-  unless implemented later.
+- cr-sqlite apply, iroh-docs, iroh-blobs provider/fetch, Automerge sync,
+  broader auth enforcement, and Keyhive/BeeKEM-style authorization are future
+  roadmap items unless implemented later.