fix(resources): drop stale park-lab-old Stack; docs(wiki): Periphery connect_as and upgrade gotchas

park-lab-old referenced a server removed from Komodo, breaking the resource
sync. Also documents two Periphery incidents from this session: a Core-UI
rename doesn't touch the agent's own connect_as, and upgrading Periphery is
a config-preserving re-run of the installer.

komodo/resources.toml

@@ -31,43 +31,10 @@
 ##############################################################################
 
 ##############################################################################
-# park-lab — the LAB bench box (hardware/dev testing, no real traffic). Chases
+# art-docker-station — LAB bench box (hardware/dev testing, no real traffic). Chases
 # the dev tier: compose files from `dev`, MOVING image tag `dev` (labs may
-# float; real booths pin). Secrets are its own park_lab_* refs — per-box blast
-# radius, never shared with a real booth even in the lab.
-##############################################################################
-
-[[stack]]
-name = "park-lab-old"
-[stack.config]
-server = "park-lab"
-git_provider = "git.infra.msai.al"
-git_account = "komodo"
-repo = "mca/parking_solution"
-branch = "dev"
-file_paths = [
-  "docker-compose.yml",
-  "docker-compose.prod.yml"
-]
-registry_provider = "git.infra.msai.al"
-registry_account = "komodo"
-environment = """
-REGISTRY=git.infra.msai.al/mca/parking_solution
-# Lab tier: the MOVING dev tag — redeploy pulls the latest dev build. Pin to a
-# dev-<sha> only when reproducing a specific state.
-TAG=dev
-COOKIE_SECURE=0
-VISION_ENABLED=1
-WS_ALLOWED_ORIGINS=
-JWT_SECRET=[[park_lab_jwt_secret]]
-EVENT_SIGNING_KEY=[[park_lab_event_signing_key]]
-BACKUP_KEY=[[park_lab_backup_key]]
-"""
-
-##############################################################################
-# art-docker-station — second LAB bench box (hardware/dev testing, no real traffic). Same tier as
-# park-lab: chases `dev` (compose files + MOVING image tag), own art_docker_station_* secret refs
-# (never shared with park-lab or a real booth, even lab-to-lab — per-box blast radius).
+# float; real booths pin). Secrets are its own art_docker_station_* refs — per-box
+# blast radius, never shared with a real booth even in the lab.
 ##############################################################################
 
 [[stack]]

wiki/decisions/appliance-provisioning.md

@@ -2,7 +2,7 @@
 type: reference
 tags: [parking, deployment, appliance, hardening, runbook, offline-first]
 sources: []
-updated: 2026-07-06
+updated: 2026-08-30
 status: settled
 ---
 
@@ -282,7 +282,10 @@ sudo loginctl enable-linger admin     # so the user service starts at boot witho
 ```
 
 - `--connect-as` is the **Server name in Core** — unique, stable, site-meaningful (the fleet's
-  primary key). Booth #2 = a different name (e.g. `park-durres`); never reuse one.
+  primary key). Booth #2 = a different name (e.g. `park-durres`); never reuse one. **Get this
+  right in the command itself** — it's a plain field in `periphery.config.toml` on the host, so a
+  typo/placeholder here needs a config edit + agent restart to fix, NOT a rename in Core's UI
+  (which only relabels Core's record, not the agent's real identity — gotcha #12 below).
 - `--core-address` is Core's **reverse-proxy URL** (the URL you load the Core UI at over the mesh),
   NOT `:9120` — Core's container port `9120` is exposed-not-published; the agent reaches it through
   the proxy. (Gotcha #7 below.)
@@ -487,3 +490,27 @@ works; the desktop app is a separate workstream.
     `https://` — if Core were plain-HTTP you'd need `http://` (→ `ws://`).
 11. ResourceSync **Execute disabled + file shown clean in Info = empty diff = already in sync**
     (success). Execute only enables when the file and Core diverge (e.g. you edit `TAG`).
+12. **Renaming a Server in Core's UI does NOT change the agent's actual identity.**
+    `connect_as` is a plain field persisted in the agent's own
+    `~/.config/komodo/periphery.config.toml` — Core's UI rename only relabels Core's *record*,
+    the agent keeps re-announcing under its original `connect_as` on every reconnect. Symptom (hit
+    2026-08-30, lab box): a server named via a leftover template placeholder in the install
+    command kept reappearing in Core no matter how many times it was renamed there, while the
+    intended name sat permanently NOT OK (nothing was ever checking in as that name). **Fix: edit
+    `connect_as` directly in `periphery.config.toml` on the host, then `systemctl --user restart
+    periphery`** — no reinstall/re-onboarding needed. Delete the stray old-name Server record in
+    Core afterward. Lesson: always double-check `--connect-as` is a REAL name (never leave a
+    template placeholder like `<new-server-name>` in a copy-pasted install command) — Core will
+    happily create a server with that literal string.
+13. **Upgrading an already-installed Periphery is: re-run the same installer, unchanged
+    `--connect-as`.** No separate update mechanism, no update-only flag. The installer script
+    explicitly skips rewriting `periphery.config.toml` if one already exists ("Config already
+    exists, skipping...") — it only stops the service, replaces the binary, and restarts — so a
+    re-run is **config-preserving** and a fresh/dummy `--onboarding-key` value on that re-run is
+    simply unused (confirmed against Komodo's own `setup-periphery.py` source, 2026-08-30; no
+    Periphery-specific breaking changes between v2.2.0 and v2.3.2 per Komodo's release notes).
+    Verified end-to-end on `art-docker-station` (lab, dry run) then `park-buzi` (live booth,
+    2026-08-30): same command as §7a step 2, same `--connect-as`, app containers untouched
+    throughout (Periphery restarting itself never touches the already-running compose stack).
+    **Always dry-run a version bump on a lab/dev box before a live booth**, even with a clean
+    release-notes check — this project only had one lab box to test against and used it first.

wiki/log.md

@@ -2710,3 +2710,18 @@ schedule-due-ness from the persisted last-success timestamp; `server.ts`'s sched
 to restart timing. New test file `backup-service.test.ts` (6 tests) covers restart-durability and
 `isDue()` directly; full existing suite (319 tests) still green. No API/UI contract change. Not
 yet committed (holding per instruction). Full writeup on [[backup-recovery]].
+
+## [2026-08-30] update | Two Komodo Periphery gotchas: connect_as renaming, agent upgrade procedure
+
+Two real incidents this session, both closed out as new gotchas (#12, #13) on
+[[appliance-provisioning]] §7: (1) a lab box installed with a leftover template placeholder
+left in `--connect-as` kept reappearing under that name in Core no matter how many times it was
+renamed in the UI — because `connect_as` is a plain field in the agent's own
+`periphery.config.toml`, and a Core-UI rename never touches it; fixed by editing the field
+directly on the host + `systemctl --user restart periphery`, no reinstall needed. (2) Upgrading
+Periphery from a version-mismatch (Core bumped to v2.3.2, an agent still on v2.2.0) has no
+separate update mechanism — confirmed against Komodo's own `setup-periphery.py` source that
+re-running the same installer with unchanged `--connect-as` is config-preserving (it explicitly
+skips rewriting an existing config) and safe; verified dry-run on `art-docker-station` (lab) then
+applied to `park-buzi` (live booth) with no disruption to the running app containers. Full detail
++ exact commands on [[appliance-provisioning]].