update prompts

2 files changed, 22 insertions, 13 deletions

diff --git a/prompts/skills/f3s/SKILL.md b/prompts/skills/f3s/SKILL.md
index 85adca4..9c5e07e 100644
--- a/prompts/skills/f3s/SKILL.md
+++ b/prompts/skills/f3s/SKILL.md
@@ -38,7 +38,7 @@ Detailed reference documentation is in the `references/` subfolder:
 - [Pi-hole on Pis](references/pihole-pi.md) — **pi2/pi3** Docker Pi-hole, **`~/pihole`**, **`*.f3s.lan.buetow.org` → 192.168.1.138**, paths under **`f3s/pihole/docker-pi/`**
 - [goprecords / uptimed uploads](references/goprecords-uptimed.md) — **`https://goprecords.f3s.buetow.org`**, **`PUT /upload`**, OpenBSD **Rex** daily vs **FreeBSD/Pi** manual hourly **`cron`** / **systemd**, **`contrib/goprecords-upload-client.sh`**, **geheim** tokens
 - [Player](references/player.md) — **`https://player.f3s.buetow.org`**, image build/push workflow, Helm chart path, ArgoCD sync, NFS PV/PVC notes
-- [yChat](references/ychat.md) — **`https://ychat.f3s.lan.buetow.org/`**, legacy C++ chat server, image build/push, Helm chart (`f3s/ychat/helm-chart`) + ArgoCD, **not yet deployed** (DB-backed build needs a PVC for `/app/data`)
+- [yChat](references/ychat.md) — **`https://ychat.f3s.lan.buetow.org/`**, legacy C++ chat server, image build/push, Helm chart (`f3s/ychat/helm-chart`) + ArgoCD, **deployed** (image tag `67babb2`, `ychat-data-pvc` hostPath-backed NFS share at `/app/data`); this is the single home for f3s deployment details (the public ychat repo keeps cluster specifics out of scope)
 - [Shelly Plug (Rack Fans)](references/shelly-plug.md) — **Shelly Plug M Gen 3** at **`192.168.1.28`** powering the rack fans; digest auth (`admin`), secret on **`/keys/shelly_plug.secret`** (f-hosts) / **`~/.shelly_plug`** (earth/Pis); boot-time auto-on rc.d service (**`f3s/freebsd-hosts/shelly-fans/`**), `wol-f3s` on/off integration, HTTP RPC API
 
 Package repository details were split into the sibling `pkgrepo` skill. Use `pkgrepo` for `pkgrepo.f3s.buetow.org`, repo layout, package publication, and client repo configuration.
diff --git a/prompts/skills/f3s/references/ychat.md b/prompts/skills/f3s/references/ychat.md
index 33218f9..98dc066 100644
--- a/prompts/skills/f3s/references/ychat.md
+++ b/prompts/skills/f3s/references/ychat.md
@@ -4,12 +4,16 @@ yChat is a legacy (2007) C++ HTTP web chat server, revived to build in Docker
 with a mandatory embedded-SQLite backend. It is deployed on the f3s k3s
 cluster as a GitOps-managed service.
 
-> **Not yet deployed as of this writing.** The live cluster
-> (`https://ychat.f3s.lan.buetow.org/`) still runs an **older, in-memory-only,
-> no-database image**. Rolling out the current DB-backed build is a deliberate
-> follow-up, not automatic: it needs a persistent volume (PVC) for `/app/data`
-> — the existing Helm chart was written for the no-DB build and doesn't
-> provision one yet.
+> **Deployed.** The live LAN URL **https://ychat.f3s.lan.buetow.org/** serves
+> image tag `67babb2` (the DB-backed build), with a persistent volume
+> (`ychat-data-pvc`, hostPath-backed NFS share) mounted at `/app/data`, so
+> registered accounts survive pod restarts. The no-DB build that previously
+> ran live has been retired.
+
+This reference is the single home for f3s-specific deployment details. The
+public app repo (`ychat` on https://codeberg.org/snonux/ychat) deliberately
+keeps deployment/cluster specifics **out of scope** — everything below lives
+here instead.
 
 ## Repositories and paths
 
@@ -60,15 +64,20 @@ The Deployment pulls `registry.lan.buetow.org:30001/ychat:<TAG>` (tag matches
 - **Logs** (`/app/log`: `access_log`, `system_log`, `rooms/<room>`) go to an
   `emptyDir` — ephemeral by design.
 - **SQLite database** (`/app/data/ychat.db`) holds registered accounts and
-  needs a real persistent volume (PVC) to survive pod rescheduling. The
-  current Helm chart doesn't provision one — this is the main blocker for
-  rolling out the DB-backed build.
+  is backed by the `ychat-data-pvc` persistent volume (hostPath-backed NFS
+  share, mounted at `/app/data`), so accounts survive pod rescheduling.
 
 Only registered accounts persist (in SQLite). Sessions/rooms/online-state are
 in-memory, and unregistered `chat.enableguest=true` guest chatters are wiped
 on restart — only the accounts table persists.
 
-## Follow-ups before this build goes live
+## Runtime config notes
 
-- Provision a PVC for `/app/data` and update the Helm chart.
-- Deploy the DB-backed image and ArgoCD-sync it.
+- Configuration is `ychat/etc/ychat.conf`, baked into the image at
+  `/app/etc/ychat.conf`. Any config key can be overridden at runtime with
+  `-o <key> <value>` (the image already does this for
+  `chat.session.md5hash=false` and `chat.database.dbname=data/ychat.db`).
+- The `/exec` command module is removed from the image entirely
+  (defense-in-depth against its shell-injection RCE), and operator status
+  via `chat.defaultop` requires a database-authenticated registered account —
+  an unregistered guest can never claim it.
\ No newline at end of file