docs: link the tailscale comparison, and diagram who calls whom

Author: cablehead

README.md

@@ -266,9 +266,10 @@ something you're working on.
 least one side. pai-sho works when neither machine has open inbound ports.
 
 [WireGuard](https://www.wireguard.com/) has no control plane at all. You put
-peers in a config file by public key, and a peer entry needs an `Endpoint` with
-a routable address, so someone has to solve reachability. If both machines are
-behind NAT, you are standing up a bounce host.
+peers in a [config file](https://www.wireguard.com/quickstart/) by public key,
+and a peer entry needs an `Endpoint` with a routable address, so someone has to
+solve reachability. If both machines are behind NAT, you are standing up a bounce
+host.
 
 [dumbpipe](https://github.com/n0-computer/dumbpipe) is the direct inspiration.
 [pigeons](https://pigeons.computer), SSH over iroh from the same team, is where
@@ -279,31 +280,51 @@ pai-sho's connection handling comes from.
 You probably should use [Tailscale](https://tailscale.com). It solves this
 problem well, and there is a company behind it.
 
-**No account.** Both punch through NAT with help from third-party infrastructure:
-Tailscale's DERP relays, and n0's relays here. A Tailscale node registers with
-`controlplane.tailscale.com`, which decides membership and hands each node a
-filtered list of the peers it may see. Your box phones Tailscale, and Tailscale
-introduces the two of you. A pai-sho box dials your laptop by public key.
-Discovery is a lookup, and the relay is a pipe that cannot read what it carries.
-Nothing in that path can add a peer to your set, and there is nothing to sign up
-for.
+**No account.** Both [punch through NAT](https://tailscale.com/blog/how-nat-traversal-works)
+with third-party help: Tailscale's [DERP relays](https://tailscale.com/kb/1232/derp-servers),
+and [n0's relays](https://www.iroh.computer/docs/concepts/relay) here. The
+difference is who your box calls.
+
+```mermaid
+flowchart LR
+  subgraph ts [Tailscale]
+    direction LR
+    tb[box] --> tc["controlplane.tailscale.com<br>decides membership"]
+    tl[your laptop] --> tc
+  end
+  subgraph ps [pai-sho]
+    direction LR
+    pb[box] --> pl[your laptop]
+    pb -. "cannot read" .-> pr[relay]
+    pr -. "cannot read" .-> pl
+  end
+```
+
+A Tailscale node registers with the
+[coordination server](https://tailscale.com/blog/how-tailscale-works), which
+hands it a filtered list of the peers it may see. A pai-sho box dials your laptop
+by public key, [resolved by discovery](https://www.iroh.computer/docs/concepts/discovery).
+Nothing in that path can add a peer to your set.
 
 **Specific ports, not a whole machine.** Tailscale gives a peer an IP, and
-everything listening on it is reachable unless an ACL says otherwise. Default
-allow, then narrow it. pai-sho grants one port at a time to one key, and a peer
-with no grants sees nothing. Day to day the two feel much the same, since you
-type a name and a port either way.
+everything listening on it is reachable unless an
+[ACL](https://tailscale.com/kb/1018/acls) says otherwise. Default allow, then
+narrow it. pai-sho grants one port at a time to one key, and a peer with no
+grants sees nothing. Day to day the two feel much the same, since you type a name
+and a port either way.
 
 **Less to install.** Without `--tun`, pai-sho binds loopback addresses. On Linux
 that needs no network device and no privilege, because `127.0.0.0/8` already
-routes to `lo`. Tailscale needs a tun device, or its userspace mode, which gives
+routes to `lo`. Tailscale needs a tun device, or its
+[userspace mode](https://tailscale.com/kb/1112/userspace-networking), which gives
 you a proxy rather than real listeners. `--tun` puts pai-sho in the same
 position, so this only holds on loopback.
 
-**The ops story is worse.** Tailscale keeps one policy file for the whole
-tailnet, so who-can-reach-what is a thing you read in a single place. pai-sho's
-answer is "which command did you run on which machine," and there is no central
-view of it. A web UI would help. It does not exist.
+**The ops story is worse.** Tailscale keeps one
+[policy file](https://tailscale.com/kb/1337/policy-syntax) for the whole tailnet,
+so who-can-reach-what is a thing you read in a single place. pai-sho's answer is
+"which command did you run on which machine," and there is no central view of it.
+A web UI would help. It does not exist.
 
 ## More