Add sync health and explicit sync trigger

docs/architecture.md

@@ -106,6 +106,12 @@ status summary over the same protected Iroh control ALPN. The serving peer
 validates endpoint/card binding and returns only watermarks for streams where
 the caller already has the required resource capability, which reduces blind
 polling without letting discovery reveal private resource names.
+Keychain and auth operation logs are also advertised through this watermark
+path. Pulls are delta-style by per-peer cursor, but every received operation is
+still verified against trusted-admin OpenSSH signatures before import.
+Operators can run `geth sync now [node]` to trigger the same best-effort pass
+immediately and `geth sync status` to inspect locally recorded last-attempt,
+last-success, cursor, import/rejection counts, and errors for each peer stream.
 
 ## Resource Model
 

docs/roadmap.md

@@ -150,7 +150,12 @@ geth-to-geth connections without granting trust from discovery alone.
     the relevant resource capability.
   - `[x]` Background live-sync skips per-module pulls when the authorized remote
     watermark has not advanced.
+  - `[x]` `geth sync status` reports last local attempt, success, cursor,
+    import/rejection counts, and error for each recorded peer stream.
+  - `[x]` `geth sync now [node]` triggers the same best-effort sync pass that
+    background live sync uses.
   - `[x]` Tests verify unauthorized streams are omitted from summary output.
+  - `[x]` Tests verify persisted stream health is exposed in local sync status.
 
 ## Phase 2: Trust And Authorization
 
@@ -188,6 +193,8 @@ resource-scoped capability decisions.
   - `[x]` `geth node rename/revoke` require an admin signing key.
   - `[x]` `geth keychain sync <node>` verifies signatures from currently
     trusted admin keys before accepting keychain ops.
+  - `[x]` Keychain live sync advertises and consumes per-peer high-water
+    cursors instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth node enroll request` creates an agent-key-signed enrollment
     request with requested node name and capabilities.
   - `[x]` `geth node enroll submit/import/list` moves pending enrollment
@@ -217,6 +224,8 @@ resource-scoped capability decisions.
   - `[x]` Enrollment approval signs capability grants as auth ops.
   - `[x]` `geth auth sync <node>` imports only auth ops signed by currently
     trusted admin keys.
+  - `[x]` Auth live sync advertises and consumes per-peer high-water cursors
+    instead of blindly re-requesting the full log on every tick.
   - `[x]` `geth auth grant/revoke --signing-key` records signed auth ops.
 
 - `[x]` Resource auth operation reducer.