docs(wiki): appliance-provisioning — Komodo deploy is now the primary flow

§6 split: §6 = Docker engine only; new §7 = the Komodo Periphery deploy (PRIMARY,
verified end-to-end on park-buzi 2026-06-27):
- 7a install Periphery (onboarding key, user-mode/outbound, runs as admin, no
  inbound port; core_address = Core's proxy URL)
- 7b deploy the Stack in Core (registry+git accounts, per-booth [[..]] secrets,
  env incl. COOKIE_SECURE=0; seed admin via Komodo's container terminal — no SSH)
- 7b-bis fleet-as-code via komodo/resources.toml + ResourceSync (empty diff =
  in sync)
- 7c break-glass: manual booth.sh when mesh/Core is down

Added Komodo deploy gotchas 7-11 (core_address is the proxy URL not :9120;
git-auth ≠ registry-auth; user-mode vs /etc/komodo root_directory; core_address
singular; empty-diff/disabled-Execute = success). §5b SSH TODO reframed (Komodo
removes SSH from routine ops). Header + date updated; log entry added. Fixed a
stale [[atecc608-secure-element]] alias in the prior log entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -1695,8 +1695,25 @@ break-glass. Three settled choices: many/growing fleet · deploys **manual + pin
 `dev-<sha>` (no webhook — preserves the determinism we chose by pinning) · secrets
 **Komodo-managed, per-booth + unique**. Threat-model caveats recorded: Periphery is a root agent
 (bind to NetBird interface only, passkey+TLS, part of the TCB); `EVENT_SIGNING_KEY` in Core is a
-fraud-root blast radius → per-booth keys + [[atecc608-secure-element|ATECC608]] as the real
+fraud-root blast radius → per-booth keys + [[atecc608|ATECC608]] as the real
 long-term signer; Core becomes Tier-0. GPL-3.0 OK (external ops tooling, not a shipped dep — same
 boundary logic as the AGPL vision exception). New page [[fleet-deployment-komodo]]; infra-as-code
 sketch in `komodo/` (`resources.toml` + README + `.env.komodo.example`). Catalogued in `index.md`;
 `container-deployment` cross-linked + reframed (booth.sh = fallback).
+
+## [2026-06-27] deploy | First Komodo booth deploy VERIFIED end-to-end (park-buzi)
+
+Took the first booth through the whole Komodo flow on real hardware (Core v2.1.2 → agent reported
+v2.2): onboarding key → Periphery installed **user-mode** (runs as `admin`, no root daemon,
+**outbound** so the booth opens no inbound port) → server `park-buzi` **OK** in Core → Stack
+(repo `mca/parking_solution`@`dev`, base+prod compose, registry account `komodo`, per-booth
+`[[…]]` secrets) → all containers green → admin seeded via Komodo's container terminal (no SSH).
+Then `komodo/resources.toml` rewritten to mirror the **working** Stack (exported from Core, v2.2
+field shape, **Stack-only — no `[[server]]`** since onboarding owns the server), committed + pushed
+(`dev` 9918f27); a ResourceSync reads it clean — **empty diff / Execute disabled = already in
+sync** (success, not error). `booth.sh` fixed for the flat `/opt` layout earlier (83298bc).
+Gotchas that bit us (now in [[appliance-provisioning]] §7 + gotchas 7–11): `core_address` is Core's
+**proxy URL** not `:9120` (exposed-not-published → Connection refused); **git-auth ≠ registry-auth**
+(blank registry account → `no basic auth credentials`); user-mode + `/etc/komodo` root_directory →
+`Permission denied`; config key is **`core_address`** singular. [[appliance-provisioning]] §6 split:
+§6 = engine, §7 = Komodo deploy (PRIMARY) with §7c manual `booth.sh` break-glass.