Add sync health and explicit sync trigger

README.md

@@ -116,6 +116,8 @@ The bootstrap implementation provides:
 - `geth keychain status`
 - `geth keychain sync <node-id-or-name>`
 - `geth auth sync <node-id-or-name>`
+- `geth sync status`
+- `geth sync now [node-id-or-name]`
 - `geth secret status`
 - `geth secret create <resource>`
 - `geth secret rotate <resource>`
@@ -412,6 +414,13 @@ from a currently trusted admin key over the canonical keychain payload. This is
 the current replicated device-management substrate. It is still a pull-based
 operation log, not yet a CRDT or Keyhive-style convergent authority.
 
+The daemon also runs best-effort live sync for imported peers. `geth sync now
+[node]` triggers the same sync pass immediately, and `geth sync status` reports
+the last local attempt, success, cursor, import count, rejection count, and
+error per peer stream. Keychain and auth sync now use per-peer high-water
+cursors, while receivers still verify every imported signed operation before it
+can affect the reduced keychain or authorization views.
+
 ## Authorization Direction
 
 The MVP defines the split between: