feat(fleet): add park-lab stack (lab bench, dev tier)

Second [[stack]] block: server park-test (the lab box's Periphery
connect_as), compose files from the dev branch, MOVING TAG=dev (a lab
may float; real booths pin), its own park_lab_* secret refs (per-box
blast radius — never shared with a real booth). park-buzi is untouched
on stage + pinned.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/SetupWizard.tsx

@@ -257,8 +257,10 @@ function CategorySection({
   const [formFor, setFormFor] = useState<Assignment | "new" | null>(null);
   const [warnings, setWarnings] = useState<string[]>([]);
 
-  // Binding categories need a controller to point at first.
-  const isBound = category !== "access";
+  // Binding categories need a controller to point at first. Printers do NOT bind
+  // (role + failoverRank route print jobs — see printer-routing.ts), so they are
+  // addable on a controller-less box (e.g. the lab bench testing a USB printer).
+  const isBound = category !== "access" && category !== "printer";
   const blockedNoController = isBound && controllers.length === 0;
   const editing = formFor && formFor !== "new" ? formFor : undefined;
 

komodo/resources.toml

@@ -30,6 +30,42 @@
 # new [[stack]] block per site (unique name, its own per-booth secret refs).
 ##############################################################################
 
+##############################################################################
+# park-lab — the LAB bench box (hardware/dev testing, no real traffic). Chases
+# the dev tier: compose files from `dev`, MOVING image tag `dev` (labs may
+# float; real booths pin). Secrets are its own park_lab_* refs — per-box blast
+# radius, never shared with a real booth even in the lab.
+##############################################################################
+
+[[stack]]
+name = "park-lab"
+[stack.config]
+server = "park-test"
+git_provider = "git.infra.msai.al"
+git_account = "komodo"
+repo = "mca/parking_solution"
+branch = "dev"
+file_paths = [
+  "docker-compose.yml",
+  "docker-compose.prod.yml"
+]
+registry_provider = "git.infra.msai.al"
+registry_account = "komodo"
+environment = """
+REGISTRY=git.infra.msai.al/mca/parking_solution
+# Lab tier: the MOVING dev tag — redeploy pulls the latest dev build. Pin to a
+# dev-<sha> only when reproducing a specific state.
+TAG=dev
+COOKIE_SECURE=0
+VISION_ENABLED=1
+WS_ALLOWED_ORIGINS=
+JWT_SECRET=[[park_lab_jwt_secret]]
+EVENT_SIGNING_KEY=[[park_lab_event_signing_key]]
+BACKUP_KEY=[[park_lab_backup_key]]
+"""
+
+##############################################################################
+
 [[stack]]
 name = "park-buzi"
 [stack.config]

wiki/decisions/appliance-provisioning.md

@@ -287,8 +287,16 @@ sudo loginctl enable-linger admin     # so the user service starts at boot witho
   NOT `:9120` — Core's container port `9120` is exposed-not-published; the agent reaches it through
   the proxy. (Gotcha #7 below.)
 - Config lands at `~/.config/komodo/periphery.config.toml`. The key field is **`core_address`**
-  (singular); `root_directory` must be a path `admin` can write (user-mode default is fine — a
-  `/etc/komodo` default from a system install would `Permission denied` for the user service).
+  (singular); `root_directory` must be a path `admin` can write. **⚠ VERIFY THIS after install —
+  Periphery v2.2.0's installer writes `root_directory = "/etc/komodo"` even with `--user`**
+  (bit the lab box 2026-07-07: panic `Failed to write private key pem to "/etc/komodo/keys/
+  periphery.key" … Permission denied`, crash-loop until systemd gives up). Fix + restart:
+  ```bash
+  sed -i 's|^root_directory = .*|root_directory = "'"$HOME"'/.komodo"|' ~/.config/komodo/periphery.config.toml
+  systemctl --user reset-failed periphery && systemctl --user restart periphery
+  ```
+  NB `sudo systemctl restart periphery` says *unit not found* — it's a USER unit; always
+  `systemctl --user …`. The onboarding key survives a pre-connect crash (unused until first dial).
 
 Verify: `systemctl --user status periphery` → active; the server **`park-buzi`** appears and goes
 **OK/green** in Core → Servers. Then **delete the onboarding key**.

wiki/log.md

@@ -2467,3 +2467,21 @@ Ubuntu's perl adduser/deluser tooling rejects the hyphenated username. [[applian
 §5c now uses `gpasswd -d <operator> sudo|lxd|lpadmin` (shadow-suite, no perl sanitize) and notes
 that group removal applies at NEXT login — the auto-login operator session keeps old memberships
 until reboot/relog, so verify `groups` from inside the session afterwards.
+
+## [2026-07-07] update | Periphery v2.2.0 --user installer writes /etc/komodo root_directory
+
+Lab test box (park-test): periphery crash-looped at startup — panic writing the private key to
+/etc/komodo/keys/periphery.key, Permission denied. Gotcha #9 was documented as a hand-config
+hazard, but v2.2.0's installer now DEFAULTS root_directory to /etc/komodo even with --user (the
+June park-buzi install defaulted under $HOME). [[appliance-provisioning]] §7a now says: verify
+root_directory after every install + the sed one-liner fix; also notes `sudo systemctl restart
+periphery` → "unit not found" (user unit) and that the single-use onboarding key survives a
+pre-connect crash.
+
+## [2026-07-07] update | Setup: printers addable with NO controller configured
+
+Lab bench (USB printer test, no relays on hand) hit a SECOND printer/relay coupling the
+2026-07-06 fix missed: the category section's add-button gate ("Shto fillimisht një kontroller…")
+blocks every non-access category while zero controllers exist. Printers are now exempt there too
+— the binding fix removed the requirement inside the form; this removes the gate in front of it.
+A controller-less box can configure + test a printer.