Subscribe to peer pubsub snapshots

README.md

@@ -109,7 +109,8 @@ The bootstrap implementation provides:
 - local JSON document commands: `geth document create/status/set/get`; `geth
   document sync <node-id> <name>` pulls authorized remote JSON state
 - local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`; `geth pubsub
-  pub <topic> <message> --node <node-id>` publishes to an authorized peer
+  pub <topic> <message> --node <node-id>` publishes to an authorized peer;
+  `geth pubsub sub <topic> --node <node-id>` reads an authorized peer snapshot
 - SSH certificate flow metadata:
   - `geth ssh cert request --public-key <path> --principal <name>`
   - `geth ssh cert requests`
@@ -157,7 +158,9 @@ older than the local value.
 Remote pubsub publish uses the protected Iroh control path too. The remote peer
 requires `pubsub.publish` on `resource:pubsub:<topic>` before recording the
 message in its local daemon-lifetime ring buffer. Pubsub remains lossy and is
-not durable storage.
+not durable storage. Remote pubsub subscribe uses the same protected path and
+requires `pubsub.subscribe` on `resource:pubsub:<topic>` before returning the
+peer's current daemon-lifetime snapshot for that topic.
 Remote pipe connect uses the same protected Iroh control path and requires
 `pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
 connection attempt and whether a listener exists; byte streaming and forwarding