Clarify pubsub durability boundary

docs/architecture.md

@@ -196,9 +196,11 @@ encoding and sync are future work.
 `geth-pubsub` currently supports local publish/subscribe snapshots through the
 daemon control protocol. Messages live in a bounded in-memory ring buffer and
 are lost when the daemon stops. This is deliberate: pubsub is a lossy wakeup and
-presence channel, not authoritative storage. `geth pubsub pub <topic> <message>
---node <node-id>` can publish to an imported peer over the protected Iroh
-control ALPN. The remote daemon validates endpoint/card binding and requires
+presence channel, not authoritative storage. Durable facts must be written to
+CAS, KV, document, or DB resources before pubsub is used as a wakeup. `geth
+pubsub pub <topic> <message> --node <node-id>` can publish to an imported peer
+over the protected Iroh control ALPN. The remote daemon validates endpoint/card
+binding and requires
 `pubsub.publish` on `resource:pubsub:<topic>` before recording the message in
 its local ring buffer. `geth pubsub sub <topic> --node <node-id>` can read an
 authorized peer's current snapshot for that topic over the same protected path

docs/roadmap.md

@@ -350,7 +350,7 @@ authorization and durable-state boundaries clear.
     `resource:pubsub:<topic>`.
   - `[x]` Tests cover denied and allowed remote pubsub subscribe.
   - `[ ]` Replace bootstrap remote publish with iroh-gossip topics.
-  - `[ ]` Docs and tests keep durable state in CAS/KV/document/db instead.
+  - `[x]` Docs and tests keep durable state in CAS/KV/document/db instead.
 
 ## Phase 4: Pipes, SSH Proxy, And SSH Distribution