Clarify pubsub durability boundary

README.md

@@ -210,9 +210,11 @@ older than the local value.
 Remote pubsub publish uses the protected Iroh control path too. The remote peer
 requires `pubsub.publish` on `resource:pubsub:<topic>` before recording the
 message in its local daemon-lifetime ring buffer. Pubsub remains lossy and is
-not durable storage. Remote pubsub subscribe uses the same protected path and
-requires `pubsub.subscribe` on `resource:pubsub:<topic>` before returning the
-peer's current daemon-lifetime snapshot for that topic.
+not durable storage; facts that must survive restart or reconcile offline
+belong in CAS, KV, document, or DB resources. Remote pubsub subscribe uses the
+same protected path and requires `pubsub.subscribe` on
+`resource:pubsub:<topic>` before returning the peer's current daemon-lifetime
+snapshot for that topic.
 Remote pipe connect uses the same protected Iroh control path and requires
 `pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
 connection attempt and whether a listener exists. `geth pipe send <name>

crates/geth-pubsub/src/lib.rs

@@ -43,7 +43,7 @@ pub fn validate_message(message: &str) -> Result<(), PubsubError> {
 
 #[must_use]
 pub fn pubsub_storage_warning() -> &'static str {
-    "pubsub is lossy notification transport, not authoritative storage"
+    "pubsub is lossy notification transport, not authoritative storage; durable facts belong in CAS, KV, documents, or DB resources"
 }
 
 #[cfg(test)]

crates/geth/tests/bootstrap.rs

@@ -1554,6 +1554,7 @@ fn pubsub_pub_sub_uses_lossy_in_memory_runtime() {
             assert_eq!(messages.len(), 1);
             assert_eq!(messages[0].message, "online");
             assert!(note.contains("not authoritative storage"));
+            assert!(note.contains("CAS, KV, documents, or DB resources"));
         }
         other => panic!("unexpected response: {other:?}"),
     }

docs/architecture.md

@@ -196,9 +196,11 @@ encoding and sync are future work.
 `geth-pubsub` currently supports local publish/subscribe snapshots through the
 daemon control protocol. Messages live in a bounded in-memory ring buffer and
 are lost when the daemon stops. This is deliberate: pubsub is a lossy wakeup and
-presence channel, not authoritative storage. `geth pubsub pub <topic> <message>
---node <node-id>` can publish to an imported peer over the protected Iroh
-control ALPN. The remote daemon validates endpoint/card binding and requires
+presence channel, not authoritative storage. Durable facts must be written to
+CAS, KV, document, or DB resources before pubsub is used as a wakeup. `geth
+pubsub pub <topic> <message> --node <node-id>` can publish to an imported peer
+over the protected Iroh control ALPN. The remote daemon validates endpoint/card
+binding and requires
 `pubsub.publish` on `resource:pubsub:<topic>` before recording the message in
 its local ring buffer. `geth pubsub sub <topic> --node <node-id>` can read an
 authorized peer's current snapshot for that topic over the same protected path

docs/roadmap.md

@@ -350,7 +350,7 @@ authorization and durable-state boundaries clear.
     `resource:pubsub:<topic>`.
   - `[x]` Tests cover denied and allowed remote pubsub subscribe.
   - `[ ]` Replace bootstrap remote publish with iroh-gossip topics.
-  - `[ ]` Docs and tests keep durable state in CAS/KV/document/db instead.
+  - `[x]` Docs and tests keep durable state in CAS/KV/document/db instead.
 
 ## Phase 4: Pipes, SSH Proxy, And SSH Distribution