Wire KV sync through iroh-docs

docs/architecture.md

@@ -35,17 +35,19 @@ exposes their native ALPNs without creating a second daemon endpoint. CAS now
 registers an `iroh-blobs` provider handler on `/iroh-bytes/4`; local CAS writes
 are mirrored into the native blob store, and remote `geth cas fetch` performs a
 geth control-ALPN authorization preflight before transferring payload bytes over
-`iroh-blobs`. `geth status` reports these native backend libraries. KV and
-pubsub still use explicit documented bootstrap equivalents until each module is
-migrated to its native protocol.
+`iroh-blobs`. KV now starts `iroh-docs` with `iroh-gossip` and the same native
+blob store, mirrors named KV stores into read-shared Iroh Documents namespaces,
+and sends read-only docs tickets only after geth control authorization succeeds.
+`geth status` reports CAS and KV as wired native backends. Pubsub still uses its
+explicit documented bootstrap equivalent until it is migrated to native gossip.
 
 Module ALPNs are registered through `geth-iroh`'s protocol router scaffold. The
 router owns the default protocol descriptors, rejects duplicate ALPN
 registrations, and returns explicit unknown-ALPN errors. The current daemon
 accept loop dispatches geth control, pipe, SSH-proxy, and native CAS blob
-streams directly; the next backend migrations should attach iroh-docs and
-iroh-gossip handlers to the same endpoint instead of creating parallel
-endpoints.
+streams directly, plus native docs and gossip streams used by KV. The next
+backend migration should attach application pubsub behavior to iroh-gossip
+instead of creating parallel endpoints.
 
 The target product should use Iroh relay support for practical internet
 connectivity and mDNS/LAN discovery for local networks. These are connectivity
@@ -203,18 +205,17 @@ or cr-sqlite extension artifact. DB sync intentionally does not use CAS-backed
 snapshots or batch blobs in the prototype. Those become useful when initial
 catch-up or large batches outgrow the protected control path.
 
-`geth-kv` currently provides a SQLite-backed local fallback for named KV stores
-through `kv create/set/get`. `kv set --subject <principal>` evaluates local auth
-ops for `kv.write_key:<key>` so prefix grants can be tested before networked
-callers exist. The local node/agent retains owner access for administration.
-Iroh Documents namespaces remain the target backend, but the bootstrap can sync
-named KV stores over the protected Iroh control ALPN. `geth kv sync <node-id>
-<name>` requires `kv.read` on the remote `resource:kv:<name>`, transfers entries
-at or beyond a per-peer/per-KV high-water cursor, and imports only values that
-are at least as new as the local entry timestamp. The daemon background
-live-sync loop runs the same KV sync for local KV stores and known peers.
-Private value encryption should use resource secret epochs before payloads are
-exposed to remote peers.
+`geth-kv` keeps SQLite as the durable local index for named KV stores through
+`kv create/set/get`. `kv set --subject <principal>` evaluates local auth ops for
+`kv.write_key:<key>` so prefix grants can be tested. The daemon mirrors local KV
+entries and metadata into an Iroh Documents namespace per named store. `geth kv
+sync <node-id> <name>` still starts with a protected geth control request that
+requires `kv.read` on the remote `resource:kv:<name>`; if authorized, the remote
+daemon returns a read-only docs ticket and the requester imports entries through
+Iroh Documents. The control response still carries bootstrap entries for
+compatibility. The daemon background live-sync loop runs the same KV sync for
+local KV stores and known peers. Private value encryption should use resource
+secret epochs before payloads are exposed to remote peers.
 
 `geth-document` registers local document resources and stores durable Automerge
 save bytes in the local SQLite metadata store. The CLI still accepts and returns