Skip unchanged live-sync streams

docs/roadmap.md

@@ -140,6 +140,18 @@ geth-to-geth connections without granting trust from discovery alone.
   - `[x]` Protected module handlers reject requests that only know an
     EndpointID and lack resource capabilities.
 
+- `[x]` Authorized sync status summary.
+  Acceptance criteria:
+  - `[x]` The daemon can ask an imported peer for sync stream watermarks over
+    the protected Iroh control ALPN.
+  - `[x]` The serving peer validates the caller's signed peer card against the
+    observed Iroh EndpointID before returning watermarks.
+  - `[x]` The serving peer only includes streams where the caller already has
+    the relevant resource capability.
+  - `[x]` Background live-sync skips per-module pulls when the authorized remote
+    watermark has not advanced.
+  - `[x]` Tests verify unauthorized streams are omitted from summary output.
+
 ## Phase 2: Trust And Authorization
 
 Goal: replace stubs with signed, reducible keychain/auth operation logs and