skills: pkgrepo + f3s — NetBSD DTail pipeline and pi0/pi1 deployment

pi0/pi1 (NetBSD 10.1 aarch64) now run dserver from the custom pkgrepo:
- pkgrepo: NetBSD repo layout (netbsd/10.1/packages/aarch64, unsigned,
  pkg_summary.gz), client setup via pkg_add URL, make dtail-netbsd
  pipeline (cross-compile on Linux, pkg_create natively on pi0),
  manual packaging reference, install/update steps + gotchas,
  verification state 2026-07-09
- f3s: pi0/pi1 host-role rows, rc.d service list + npf port 2222,
  removed stale 'pi0/pi1 do not run DTail' claims

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2 files changed, 8 insertions, 2 deletions

diff --git a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md
index 673c2c9..e16e86f 100644
--- a/prompts/skills/f3s/references/bootstrap-netbsd-pi.md
+++ b/prompts/skills/f3s/references/bootstrap-netbsd-pi.md
@@ -248,6 +248,7 @@ group "external" on $ext_if {
 	pass stateful out final all
 	pass stateful in final family inet4 proto tcp to $ext_if port 22
 	pass stateful in final family inet4 proto tcp to $ext_if port 80
+	pass stateful in final family inet4 proto tcp to $ext_if port 2222
 	pass stateful in final family inet4 proto icmp all
 }
 
@@ -263,6 +264,9 @@ group default {
 }
 ```
 
+Port 2222 is dserver (DTail) — see the `pkgrepo` skill's `dtail-package.md`
+for the install steps.
+
 `family inet4`/`inet6` must be explicit on multi-family interfaces or
 `npfctl validate` fails with "address family mismatch". `proto <name>` must
 be followed by `all` or a `from`/`to` clause, or it's a syntax error — e.g.
diff --git a/prompts/skills/f3s/references/dtail.md b/prompts/skills/f3s/references/dtail.md
index 9e77f0b..c7963a5 100644
--- a/prompts/skills/f3s/references/dtail.md
+++ b/prompts/skills/f3s/references/dtail.md
@@ -8,15 +8,17 @@ Upstream install and examples live in the repo: `doc/installation.md`, `examples
 
 | Hosts | OS / arch | dserver binary | Typical SSH user |
 |-------|-----------|----------------|------------------|
+| **pi0–pi1** | NetBSD 10.1 **aarch64** (Raspberry Pi 3, see `bootstrap-netbsd-pi.md`) | Cross-build **netbsd/arm64**, `nozstd`; installed via `pkg_add` from the custom pkgrepo | `paul@piN.lan.buetow.org` |
 | **pi2–pi3** | Rocky Linux 9 **aarch64** (Raspberry Pi 3) | Cross-build **linux/arm64**, `nozstd` | `paul@piN.lan.buetow.org` |
 | **r0–r2** | Rocky Linux 9 **x86_64** (bhyve VMs, k3s nodes) | Cross-build **linux/amd64**, `nozstd` | Often `root@rN.lan.buetow.org` (see [Rocky Linux VMs](rocky-linux-vms.md)); add `root` (and `paul` if present) to **Server.Permissions.Users** in `dtail.json` |
 | **blowfish, fishfinger** | OpenBSD 7.8 **amd64** | Native OpenBSD package build | `rex@blowfish.buetow.org`, `rex@fishfinger.buetow.org` |
 
-`pi0`/`pi1` run **NetBSD** (see `bootstrap-netbsd-pi.md`) and do **not** run DTail — would need an untested `GOOS=netbsd GOARCH=arm64` cross-build and an `rc.d` script.
+`pi0`/`pi1` (NetBSD) run dserver since 2026-07-09 from the `dtail` package in the custom pkgrepo — build pipeline (`make dtail-netbsd`), install steps, rc.d/npf details, and gotchas live in the `pkgrepo` skill's `dtail-package.md`.
 
 **Key cache filenames matter:** `examples/update_key_cache.sh.example` only scans `/home/*` and writes `/var/run/dserver/cache/USER.authorized_keys`. In this lab, DTail auth worked only after writing the exact cache filename for the login user:
 
 - **r0–r2**: `root.authorized_keys`
+- **pi0–pi1**: `paul.authorized_keys` (NetBSD rc.d `start_precmd` repopulates it on every start — `/var/run` is volatile)
 - **pi2–pi3**: `paul.authorized_keys`
 - **blowfish, fishfinger**: `rex.authorized_keys`
 
@@ -158,7 +160,7 @@ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags nozstd -o dserver-linux-amd
 
 ## Installation checklist (each server)
 
-Do this on **each** target (pi2–pi3 and/or r0–r2 — not pi0/pi1, which are NetBSD and don't run DTail). Adjust **user** if you are not using `paul` on the node.
+Do this on **each** Linux target (pi2–pi3 and/or r0–r2). pi0/pi1 are NetBSD and install the `dtail` package from the custom pkgrepo instead — see the `pkgrepo` skill's `dtail-package.md`. Adjust **user** if you are not using `paul` on the node.
 
 1. **Binary**: `/usr/local/bin/dserver`, mode `0755`, owned by root.
 2. **OS user**: `dserver` system account (`useradd -r -d /var/lib/dserver -s /sbin/nologin -U dserver`).