Live sync SSH metadata in background

docs/architecture.md

@@ -84,7 +84,11 @@ revocations are stored as signed-list-ready records. The bootstrap can pull
 certificate-flow metadata over Iroh with `geth ssh cert sync <node-id>` when the
 peer grants `ssh_cert.sync` on `resource:ssh:certs`, and revocation metadata with
 `geth ssh revocation sync <node-id>` when the peer grants `ssh_revocation.sync`
-on `resource:ssh:revocations`.
+on `resource:ssh:revocations`. The daemon also runs a 30-second background
+live-sync tick for known peers and records per-peer high-water cursors in
+`module_state`, so repeated ticks request only records at or beyond the last
+remote cursor. Boundary duplicates are harmless because records are keyed by
+stable IDs and inserted with replace semantics.
 
 ## Resource Model
 
@@ -169,6 +173,8 @@ not enumerable through OpenSSH tooling, so geth treats binary import as
 unsupported and asks for JSONL or the spec source. Revocation lists are not yet
 full CRDT-replicated resources, but the daemon can already pull cert-flow and
 revocation metadata from authorized peers over the protected Iroh control ALPN.
+Manual sync commands and the background live-sync loop share the same capability
+checks and cursor state.
 
 ## Keychain, Auth, And Secrets
 

docs/roadmap.md

@@ -214,6 +214,10 @@ resource-scoped capability decisions.
     `geth ssh cert sync <node-id>`.
   - `[x]` Authorized peers can pull SSH revocation metadata with
     `geth ssh revocation sync <node-id>`.
+  - `[x]` The daemon background live-sync loop refreshes known peers without a
+    manual command.
+  - `[x]` SSH metadata live-sync stores per-peer high-water cursors in
+    `module_state` and requests only records at or beyond the cursor.
   - `[ ]` Future completion requires auth checks for local request, approve,
     import, publish, and read capabilities.
 
@@ -318,6 +322,8 @@ Goal: add authorized stream-oriented management workflows over Iroh.
     `resource:ssh:revocations`.
   - `[x]` Consumers can list current certs/revocations from local state while
     offline after sync.
+  - `[x]` Background live-sync uses the same protected Iroh path and cursor
+    state as manual sync.
   - `[ ]` Replace pull-only metadata sync with a resource log or CRDT model.
   - `[ ]` Conflicting or unsigned records are rejected or quarantined.