f3s-storage skill: document the zusb removable quarterly backup pool

zusb is a 4-disk raidz2 USB-SATA pool used as offline backup storage,
loaded ~once per quarter. Migrated from t450 to the f3s USB-key scheme:
zusb/data/enc rekeyed to a raw key on /keys/zusb.key, scripts on all
f-hosts. Note added to usb-keys.md and the hub SKILL.md.

2 files changed, 30 insertions, 1 deletions

diff --git a/prompts/skills/f3s-storage/SKILL.md b/prompts/skills/f3s-storage/SKILL.md
index 82c0a5e..865c2e3 100644
--- a/prompts/skills/f3s-storage/SKILL.md
+++ b/prompts/skills/f3s-storage/SKILL.md
@@ -12,6 +12,7 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more
 ## When to Use
 
 - Working on the homelab storage layer: ZFS pools/datasets, encryption, USB keys
+- The removable `zusb` backup pool (quarterly load/unload, moving the USB disks between f-hosts)
 - zrepl replication (f0→f1 nfsdata, f3→f2 VM), CARP failover, NFS-over-stunnel
 - Diagnosing NFS mount problems, SUSPENDED pools, or thermal issues
 - For the physical hosts, WireGuard mesh, and host/IP inventory this depends on, see the [`f3s`](../f3s/SKILL.md) hub skill.
@@ -19,7 +20,7 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more
 ## Reference Files
 
 - [ZFS Pools & Encryption](references/zfs.md) — `zdata` pool, physical disks, USB-stored keys mounted by `f3skeys` (not `/etc/fstab`), encrypted datasets, boot-time key loading
-- [USB Key Mounting](references/usb-keys.md) — `f3skeys`, `/usr/local/sbin/f3s-mount-keys`, and current `zfskeys_datasets` per f-host
+- [USB Key Mounting](references/usb-keys.md) — `f3skeys`, `/usr/local/sbin/f3s-mount-keys`, current `zfskeys_datasets` per f-host, and the removable quarterly `zusb` backup pool (raw key on `/keys/zusb.key`, manual `zusb-load`/`zusb-unload` on all f-hosts)
 - [zrepl Replication](references/zrepl.md) — `f0 → f1` nfsdata, `f3 → f2` freebsd VM, sink configs, troubleshooting, DL-state recovery
 - [CARP HA VIP](references/carp.md) — VIP `192.168.1.138`, `carpcontrol.sh`, mgmt script, auto-failback, SUSPENDED-pool limitation
 - [NFS over stunnel](references/nfs.md) — NFS server, mutual-TLS stunnel, Rocky client config, `/etc/fstab`
@@ -39,3 +40,4 @@ Note: original plan was HAST, replaced by **zrepl** (ZFS send/receive) — more
 | Local-path | k3s local-path provisioner | Node-local storage for SQLite/cache workloads |
 | LAN access | FreeBSD relayd on CARP VIP | TCP forwarding to k3s :80/:443 |
 | Backup | S3 Glacier Deep Archive | Off-site encrypted backup |
+| Removable backup | `zusb` raidz2 (4 × 1.8 TB USB-SATA) | Offline backup storage, plugged in ~quarterly; raw key on `/keys/zusb.key`, manual `zusb-load`/`zusb-unload` on all f-hosts |
diff --git a/prompts/skills/f3s-storage/references/usb-keys.md b/prompts/skills/f3s-storage/references/usb-keys.md
index 9871daa..07b7414 100644
--- a/prompts/skills/f3s-storage/references/usb-keys.md
+++ b/prompts/skills/f3s-storage/references/usb-keys.md
@@ -114,3 +114,30 @@ change.
 Note: `zroot/sink/f3/zroot/bhyve/freebsd` on f2 has `mountpoint=none`; the
 reboot check expects its key to be `available`, but it is not mounted because it
 has no filesystem mountpoint.
+
+## Removable backup pool (`zusb`)
+
+`zusb` is a **4-disk raidz2 ZFS pool on 1.8 TB USB-SATA disks** (ASMT ASM235CM
+bridges) used as the **offline backup storage device** — plugged in and loaded
+**roughly once per quarter** to back up data, then exported and unplugged. It
+lives on whichever f-host it is currently plugged into (f1 as of 2026-07-20).
+
+It is **not** auto-imported or auto-mounted at boot and is **not** in any
+host's `zfskeys_datasets` (removable disks must never block boot). It is loaded
+manually with `/usr/local/bin/zusb-load` and exported with
+`/usr/local/bin/zusb-unload`.
+
+The encryption root is `zusb/data/enc`, rekeyed to the same raw-key-on-stick
+scheme as the other f-host secrets: `keyformat=raw`,
+`keylocation=file:///keys/zusb.key`. The 32-byte key file `/keys/zusb.key` is
+placed on **all four** `F3S_KEYS` sticks, and the load/unload scripts are
+deployed to **all four** f-hosts, so the disk stack can be re-plugged to any
+f-host and loaded there with no per-host setup.
+
+`zusb/data/enc` was migrated from t450, where it was unlocked via a
+passphrase-protected `zroot/secret` keystore (`/zroot/secret/zroot.enc.key`);
+that old passphrase key is now obsolete for `zusb`.
+
+Scripts and deployment docs live in the conf repo at
+`f3s/freebsd-hosts/zusb/` (`zusb-load`, `zusb-unload`, `README.md`). The raw
+key itself is **not** in git — it is copied stick-to-stick like the other keys.