Live sync KV stores over Iroh

README.md

@@ -104,7 +104,7 @@ The bootstrap implementation provides:
   `geth db changes <name>` for future sync
 - local SQLite-backed KV commands: `geth kv create/set/get`; `kv set` accepts
   `--subject <principal>` to exercise local capability checks for non-local
-  callers
+  callers; `geth kv sync <node-id> <name>` pulls authorized remote updates
 - local JSON document commands: `geth document create/status/set/get`
 - local daemon-lifetime pubsub snapshots: `geth pubsub pub/sub`
 - SSH certificate flow metadata:
@@ -142,6 +142,10 @@ approval/signing workflows. While the daemon is running, it also performs a
 background live-sync tick for known peers every 30 seconds. Live-sync stores
 per-peer high-water cursors in local metadata so repeated ticks request only
 newer SSH certificate-flow and revocation records.
+Named KV stores participate in the same live-sync loop once they exist locally:
+manual `geth kv sync <node-id> <name>` and background ticks require `kv.read`
+on the remote `resource:kv:<name>` and import only remote entries that are not
+older than the local value.
 Importing or pinging a peer card never grants capabilities by itself.
 When `[iroh].local_discovery = true`, the daemon also advertises and discovers
 signed peer cards on LAN using a geth-specific mDNS TXT payload. That payload is