Skip unchanged live-sync streams

docs/architecture.md

@@ -89,6 +89,11 @@ live-sync tick for known peers and records per-peer high-water cursors in
 `module_state`, so repeated ticks request only records at or beyond the last
 remote cursor. Boundary duplicates are harmless because records are keyed by
 stable IDs and inserted with replace semantics.
+Before issuing per-module pulls, the daemon can request an authorized sync
+status summary over the same protected Iroh control ALPN. The serving peer
+validates endpoint/card binding and returns only watermarks for streams where
+the caller already has the required resource capability, which reduces blind
+polling without letting discovery reveal private resource names.
 
 ## Resource Model
 
@@ -197,7 +202,8 @@ unsupported and asks for JSONL or the spec source. Revocation lists are not yet
 full CRDT-replicated resources, but the daemon can already pull cert-flow and
 revocation metadata from authorized peers over the protected Iroh control ALPN.
 Manual sync commands and the background live-sync loop share the same capability
-checks and cursor state.
+checks and cursor state. The live-sync loop first asks for authorized stream
+watermarks and skips module pulls whose remote high-water value has not advanced.
 
 ## Keychain, Auth, And Secrets
 

docs/roadmap.md

@@ -140,6 +140,18 @@ geth-to-geth connections without granting trust from discovery alone.
   - `[x]` Protected module handlers reject requests that only know an
     EndpointID and lack resource capabilities.
 
+- `[x]` Authorized sync status summary.
+  Acceptance criteria:
+  - `[x]` The daemon can ask an imported peer for sync stream watermarks over
+    the protected Iroh control ALPN.
+  - `[x]` The serving peer validates the caller's signed peer card against the
+    observed Iroh EndpointID before returning watermarks.
+  - `[x]` The serving peer only includes streams where the caller already has
+    the relevant resource capability.
+  - `[x]` Background live-sync skips per-module pulls when the authorized remote
+    watermark has not advanced.
+  - `[x]` Tests verify unauthorized streams are omitted from summary output.
+
 ## Phase 2: Trust And Authorization
 
 Goal: replace stubs with signed, reducible keychain/auth operation logs and