fix(desktop): route update-failure logging through logClient, not console

console.error/console.warn only forward to the server when the client log
level is debug/trace (default: info) — the earlier error-logging fix never
actually surfaced anything, and a real update failure produced zero logs
anywhere. desktop-updater.ts now calls logClient() directly, unconditionally,
plus download-progress events. Also documents the resource-sync-park-systems
branch misconfig (pointed at dev, Stacks are stage-tier) found while chasing
this — full writeup on fleet-deployment-komodo.md.

wiki/decisions/fleet-deployment-komodo.md

@@ -2,7 +2,7 @@
 type: decision
 tags: [parking, deployment, fleet, komodo, netbird, offline-first, threat-model]
 sources: []
-updated: 2026-07-07
+updated: 2026-09-03
 status: settled
 ---
 
@@ -192,3 +192,32 @@ FILE is read from, each stack's `branch` picks its compose files, `TAG` picks th
 secrets even in the lab (blast radius). The lab box earned its keep immediately: it caught the
 USB close-cancel truncation, the printer/controller wizard gate, and the Periphery v2.2.0
 root_directory default before any of them reached a real booth ([[appliance-provisioning]] §7a).
+
+## ResourceSync branch drift — the exact gotcha this page already warned about (2026-09-03)
+
+This page's own §"park-lab" note (2026-07-07) already spelled it out: *"the ResourceSync's own
+branch only governs where the FILE is read from"* — independent of any `[[stack]]`'s own `branch`
+field. It bit anyway. `resource-sync-park-systems` in Komodo Core was pointed at **`dev`**, while
+`park-buzi` and `park-2` are `stage`-tier Stacks (`branch = "stage"`, pinned `TAG=stage-<sha>`, per
+the promotion-tiers model above). `resources.toml` had been byte-identical on `dev` and `stage`
+since park-buzi's Stack was first written, so this had **zero observable effect for months** — until
+a desktop-app debugging session (see [[desktop-shell-tauri]]) landed 9 real commits on `dev`
+(including a `WS_ALLOWED_ORIGINS` fix) that were never merged to `stage`, creating the first genuine
+divergence between the two branches.
+
+**Symptom:** merged `dev` → `stage`, pushed, bumped `TAG` in `resources.toml` on `stage`, committed,
+pushed — then destroyed + recreated the `park-2` Stack in Komodo Core and it STILL came back running
+the old image. Every sync was silently re-reading `resources.toml` from `dev` (which still had the
+stale `TAG`), overwriting the correct value just committed on `stage`. No error, no warning — the
+sync just quietly did what it was configured to do, from the wrong branch.
+
+**Fix:** pointed `resource-sync-park-systems` at `stage` in Komodo Core's UI (Sync config → branch
+field), then re-synced + redeployed `park-2` — confirmed via `/api/version` (previously 404,
+proving a stale image; correctly 401-auth-gated after the fix, proving the new image + route exist).
+
+**Standing lesson, now written twice:** a `[[stack]]`'s promotion tier (which branch its own
+`branch`/`TAG` fields track) and the ResourceSync resource's own git branch are **two independently
+configured settings in Komodo Core — nothing enforces they agree**, and a mismatch is invisible
+until the two branches' `resources.toml` actually diverge. **Check this FIRST** whenever a
+redeploy doesn't pick up an expected `resources.toml` change, before assuming the change itself,
+the CI build, or the deploy step is broken.