Live sync JSON documents over Iroh

README.md

@@ -105,7 +105,8 @@ The bootstrap implementation provides:
 - local SQLite-backed KV commands: `geth kv create/set/get`; `kv set` accepts
   `--subject <principal>` to exercise local capability checks for non-local
   callers; `geth kv sync <node-id> <name>` pulls authorized remote updates
-- local JSON document commands: `geth document create/status/set/get`
+- local JSON document commands: `geth document create/status/set/get`; `geth
+  document sync <node-id> <name>` pulls authorized remote JSON state
 - local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`; `geth pubsub
   pub <topic> <message> --node <node-id>` publishes to an authorized peer
 - SSH certificate flow metadata:
@@ -156,6 +157,10 @@ Remote pipe connect uses the same protected Iroh control path and requires
 `pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
 connection attempt and whether a listener exists; byte streaming and forwarding
 are still future work.
+Document sync is a bootstrap JSON last-writer-wins path before Automerge:
+manual `geth document sync <node-id> <name>` and background live-sync require
+`document.read` on `resource:document:<name>` and import only state that is not
+older than the local document timestamp.
 Importing or pinging a peer card never grants capabilities by itself.
 When `[iroh].local_discovery = true`, the daemon also advertises and discovers
 signed peer cards on LAN using a geth-specific mDNS TXT payload. That payload is