Merge branch 'master' of ssh://r0:30022/repos/dotfiles

3 files changed, 17 insertions, 3 deletions

diff --git a/prompts/skills/agent-task-management/references/3-complete-task.md b/prompts/skills/agent-task-management/references/3-complete-task.md
index 42aab17..4078be8 100644
--- a/prompts/skills/agent-task-management/references/3-complete-task.md
+++ b/prompts/skills/agent-task-management/references/3-complete-task.md
@@ -38,7 +38,7 @@ If the answer suggests improvements or inconsistencies, address them first. Only
 **Once the completion criteria above are met:**
 
 1. **Self-review** (see above). Then spawn a **sub-agent** with **fresh context** (no prior conversation).
-2. Sub-agent reviews the diff, code, or deliverables for the task (including test coverage and test quality — see "What the review sub-agent must check") and **reports back** to the main agent (review comments, suggestions, issues).
+2. The sub-agent's role is an **expert critical reviewer**. Its **only goal** is to find bugs and design flaws in the subject under review. It must be thorough, skeptical, and uncompromising. The sub-agent reviews the diff, code, or deliverables (including test coverage and test quality — see "What the review sub-agent must check") and **reports back** to the main agent with every bug, design flaw, missed edge case, suspicious pattern, or test-quality issue it found. Praise and suggestions for enhancement should only be included when they directly illuminate an underlying flaw or risk.
 3. Main agent **addresses all review comments** from the sub-agent — no exceptions. Fix or respond to every point.
 4. If code changed after review comments were addressed: **Self-review again** (see above), then **spawn another sub-agent** (fresh context again) to **review the updated code** (including test coverage and test quality) and confirm the fixes. If this follow-up review finds further issues and additional code changes are made, repeat this step until the review is satisfied.
 5. **Commit all changes to git** (e.g. `git add` and `git commit` with a message that references the task). Do not mark the task complete with uncommitted changes.
diff --git a/prompts/skills/f3s/references/f3-rocky-vm.md b/prompts/skills/f3s/references/f3-rocky-vm.md
index 94d1106..fee8136 100644
--- a/prompts/skills/f3s/references/f3-rocky-vm.md
+++ b/prompts/skills/f3s/references/f3-rocky-vm.md
@@ -110,3 +110,4 @@ doas vm info rocky
 - Keep this VM plain unless a later task explicitly installs packages or assigns a service role.
 - Root SSH is intentionally enabled for LAN-only administration.
 - The guest was installed from the Rocky Linux 9.7 minimal ISO using an unattended kickstart. See `bootstrap-rocky-bhyve.md` for the bootstrap procedure.
+- Replicated to f2 via zrepl (`f3_to_f2_freebsd` job, every 10 min → `zroot/sink/f3/zroot/bhyve/rocky`). Only zrepl-managed snapshots; excluded from local `zfs-periodic`.
diff --git a/prompts/skills/f3s/references/storage/zrepl.md b/prompts/skills/f3s/references/storage/zrepl.md
index fdeff9a..dc90676 100644
--- a/prompts/skills/f3s/references/storage/zrepl.md
+++ b/prompts/skills/f3s/references/storage/zrepl.md
@@ -52,7 +52,7 @@ jobs:
   # It is now replicated from f3 → f2 (see f3 zrepl config below).
 ```
 
-## f3 configuration (push: freebsd VM → f2)
+## f3 configuration (push: VMs → f2)
 
 ```yaml
 global:
@@ -68,7 +68,8 @@ jobs:
       type: tcp
       address: "192.168.2.132:8888"   # f2 WireGuard IP
     filesystems:
-      "zroot/bhyve/freebsd": true     # development FreeBSD VM
+      "zroot/bhyve/freebsd": true   # development FreeBSD VM
+      "zroot/bhyve/rocky": true     # plain Rocky Linux VM
     send:
       encrypted: true
     snapshotting:
@@ -133,6 +134,18 @@ weekly_zfs_snapshot_enable="NO"
 monthly_zfs_snapshot_enable="NO"
 ```
 
+The local zrepl `snap` job on f3 also excludes both VM datasets so they are only snapshotted by the push job:
+
+```yaml
+  - name: local_zfs_snapshots
+    type: snap
+    filesystems:
+      "zroot<": true
+      "zroot/bhyve/freebsd": false
+      "zroot/bhyve/rocky": false
+    ...
+```
+
 The local zrepl `snap` job on f2 also explicitly excludes `zroot/sink<`.
 
 ## f1 configuration (sink)