Publish pubsub messages over Iroh

README.md

@@ -106,7 +106,8 @@ The bootstrap implementation provides:
   `--subject <principal>` to exercise local capability checks for non-local
   callers; `geth kv sync <node-id> <name>` pulls authorized remote updates
 - local JSON document commands: `geth document create/status/set/get`
-- local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`
+- local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`; `geth pubsub
+  pub <topic> <message> --node <node-id>` publishes to an authorized peer
 - SSH certificate flow metadata:
   - `geth ssh cert request --public-key <path> --principal <name>`
   - `geth ssh cert requests`
@@ -146,6 +147,10 @@ Named KV stores participate in the same live-sync loop once they exist locally:
 manual `geth kv sync <node-id> <name>` and background ticks require `kv.read`
 on the remote `resource:kv:<name>` and import only remote entries that are not
 older than the local value.
+Remote pubsub publish uses the protected Iroh control path too. The remote peer
+requires `pubsub.publish` on `resource:pubsub:<topic>` before recording the
+message in its local daemon-lifetime ring buffer. Pubsub remains lossy and is
+not durable storage.
 Importing or pinging a peer card never grants capabilities by itself.
 When `[iroh].local_discovery = true`, the daemon also advertises and discovers
 signed peer cards on LAN using a geth-specific mDNS TXT payload. That payload is