Store documents as Automerge state

README.md

@@ -155,9 +155,10 @@ The bootstrap implementation provides:
   `--subject <principal>` to exercise local capability checks for non-local
   callers; `geth kv sync <node-id> <name> [--bearer-secret <secret>]` pulls
   authorized remote updates
-- local JSON document commands: `geth document create/status/set/get`; `geth
-  document sync <node-id> <name> [--bearer-secret <secret>]` pulls authorized
-  remote JSON state
+- local Automerge document commands: `geth document create/status/set/get`;
+  CLI input and output are JSON views, while the store keeps durable Automerge
+  save bytes. `geth document sync <node-id> <name> [--bearer-secret <secret>]`
+  pulls authorized remote Automerge state.
 - local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`; `geth pubsub
   pub <topic> <message> --node <node-id>` publishes to an authorized peer;
   `geth pubsub sub <topic> --node <node-id>` reads an authorized peer snapshot
@@ -281,10 +282,10 @@ byte stream; SSH is not a geth transport backend.
 over the protected Iroh control path. It requires `ssh_proxy.admin_shell` on the
 same resource and supports only built-in commands (`help`, `status`, `node-id`);
 it does not execute host shell commands.
-Document sync is a bootstrap JSON last-writer-wins path before Automerge:
+Document sync exchanges durable Automerge state with a JSON view for CLI output:
 manual `geth document sync <node-id> <name>` and background live-sync require
-`document.read` on `resource:document:<name>` and import only state that is not
-older than the local document timestamp.
+`document.read` on `resource:document:<name>` and merge authorized remote state
+when the peer advertises a state timestamp at or after the local document.
 DB sync is a staged cr-sqlite path: manual `geth db sync <node-id> <name>` and
 background live-sync require `db.sync` on `resource:db:<name>`, exchange typed
 `crsql_changes` batches over the protected Iroh control path, and check remote