Exchange DB changes over Iroh

docs/architecture.md

@@ -134,8 +134,13 @@ local-only sync status plus a read-only SQLite schema summary/hash. It also
 inspects `crsql_changes` metadata when that table or view exists, reporting
 change count, columns, and max `db_version`. The crate and local daemon can
 extract read-only typed change batches from `crsql_changes` with schema metadata
-through `db changes`. Loading cr-sqlite, applying remote changes, and DB sync
-are future work.
+through `db changes`. As a staged network path, `geth db sync <node-id> <name>`
+uses the protected Iroh control ALPN to request remote typed change batches when
+the caller has `db.sync` on the remote `resource:db:<name>`. The requester
+checks remote schema metadata against its local DB before advancing its
+per-peer/per-DB cursor. Loading cr-sqlite and applying remote changes through
+`crsql_changes` are future work; the current path exchanges and cursors changes
+but does not mutate the local application database.
 
 `geth-kv` currently provides a SQLite-backed local fallback for named KV stores
 through `kv create/set/get`. `kv set --subject <principal>` evaluates local auth

docs/roadmap.md

@@ -376,11 +376,25 @@ Automerge documents.
   - `[x]` Schema hash/version metadata is included in extracted change batches.
   - `[x]` Extracted batches are exposed through `geth db changes`.
 
-- `[ ]` DB sync over Iroh.
+- `[~]` DB sync over Iroh.
   Acceptance criteria:
-  - Two local test nodes can exchange and apply DB changes.
-  - Schema mismatch is detected before applying changes.
-  - Optional CAS-backed snapshots or batches are documented if used.
+  - `[x]` `geth db sync <node-id> <name>` exists and talks to the daemon.
+  - `[x]` Remote DB sync uses the protected Iroh control ALPN.
+  - `[x]` The serving peer validates the caller's signed peer card against the
+    observed Iroh EndpointID before considering authorization.
+  - `[x]` Remote DB sync requires `db.sync` on the remote
+    `resource:db:<name>`.
+  - `[x]` The response carries typed `crsql_changes` batches plus schema
+    metadata.
+  - `[x]` The requester detects schema mismatch before advancing the sync
+    cursor.
+  - `[x]` Background live-sync runs DB sync for local DB resources and known
+    peers.
+  - `[x]` Per-peer/per-DB high-water cursors are stored in `module_state`.
+  - `[ ]` Apply compatible remote changes through cr-sqlite.
+  - `[ ]` Add an integration test with a real cr-sqlite-enabled SQLite DB that
+    proves two local test nodes exchange and apply changes.
+  - `[ ]` Optional CAS-backed snapshots or batches are documented if used.
 
 - `[~]` Automerge document resource.
   Acceptance criteria: