diff --git a/stacks/park/README.md b/stacks/park/README.md
index 9110691..80fd5f1 100644
--- a/stacks/park/README.md
+++ b/stacks/park/README.md
@@ -2,7 +2,7 @@
 
 Self-contained needs-attention tracker: FastAPI + SQLite (FTS5) + an in-process
 scheduler, one container. Source: `gitea.phasefinal.com/vh/stonehenge-park`,
-deployed at tag **v1.0.0-beta.1**. Owned by `park-dev`.
+deployed at tag **v1.0.0-beta.2** (commit `2c258f7`). Owned by `park-dev`.
 
 - **Host:** ana-docker (`10.250.50.70`), compose home `/opt/docker/compose/park/`.
   Permanent home since 2026-08-13 (migrated off nh3-docker before the v1.0.0 final cut).
@@ -20,12 +20,22 @@ deployed at tag **v1.0.0-beta.1**. Owned by `park-dev`.
 ## Image is built locally (no registry yet)
 
 ```bash
-# on nh3-docker:
-cd ~/deploy-src/stonehenge-park          # rsync'd from the tag
-sudo docker build -t park:v1.0.0-beta.1 .
-cd /opt/docker/compose/park && sudo docker compose up -d
+# ⚠ on ana-docker (10.250.50.70) — NOT nh3-docker, decommissioned for this stack 2026-08-13.
+# The source is exported per-tag from a checkout that has the tag, so the previous
+# tag's tree stays on the host as a rollback. From a box with the repo:
+git -C ~/development/stonehenge-park archive --format=tar v1.0.0-beta.2 | \
+  ssh infra-ops@10.250.50.70 'mkdir -p ~/deploy-src/stonehenge-park-v1.0.0-beta.2 &&
+    tar xf - -C ~/deploy-src/stonehenge-park-v1.0.0-beta.2'
+
+# then on ana-docker (infra-ops is in the docker group — no sudo needed):
+cd ~/deploy-src/stonehenge-park-v1.0.0-beta.2
+docker build -t park:v1.0.0-beta.2 .
+cd /opt/docker/compose/park && docker compose up -d park
 ```
 
+⚠ **Never `docker compose down -v`** — that removes `park_park-data` and every parked
+idea with it. `up -d` and plain `down` both preserve it.
+
 Swap `image:` for a registry ref once one exists (park-dev left the door open).
 
 ## althing wiring (TODO)
@@ -40,8 +50,19 @@ host-run), set `PARK_ALTHING_CHANNEL=henge-crow`, recreate.
 ## Verify
 
 ```bash
-curl -s http://10.100.50.40:8420/healthz                      # {"status":"ok"}
-curl -s http://10.100.50.40:8420/                             # UI shell
+curl -s http://park.phasefinal.com:8420/healthz                      # {"status":"ok"}
+curl -s http://park.phasefinal.com:8420/                             # UI shell
+curl -s http://park.phasefinal.com:8420/ui/assets/favicon.svg        # brand assets (public GET)
 curl -s -H "Authorization: Bearer $KEY" \
-  http://10.100.50.40:8420/park/due-count                     # {"count": N}
+  "http://park.phasefinal.com:8420/park?limit=100"                   # the parked items themselves
 ```
+
+⚠ **Use GET, never `curl -I`.** Every route on this app 401s on **HEAD** — including
+`/healthz` and `/`, so it is app-wide and not an asset or auth-scope problem. `curl -sI`
+therefore reports a false failure on a perfectly healthy deploy. Verified 2026-08-18:
+`HEAD /healthz -> 401` while `GET /healthz -> 200`. Reported upstream to park-dev.
+
+⚠ **`/park/due-count` returning 0 is not a data-loss signal.** It counts what is *due
+now*; a henge holding 28 items can legitimately report `{"count":0}` with `/park/due`
+empty across overdue/today/stale. To check items actually survived a redeploy, hit
+`GET /park` (or count rows in `/data/park.db`), not the due counters.
diff --git a/stacks/park/compose.yaml b/stacks/park/compose.yaml
index 8b37b0b..a0f94cd 100644
--- a/stacks/park/compose.yaml
+++ b/stacks/park/compose.yaml
@@ -1,10 +1,13 @@
 # stonehenge-park — ana-docker (10.250.50.70), permanent home (migrated off nh3-docker 2026-08-13).
 # Stable name: park.phasefinal.com -> 10.250.50.70 (Cloudflare, DNS-only/internal). LAN/WG-internal only
-# (port 8420); NOT internet-exposed. Image built from vh/stonehenge-park v1.0.0-beta.1; build source at
-# ~/deploy-src/stonehenge-park on ana-docker. .env (chmod 600) holds PARK_API_KEY (vault nh3-dev/park-api-key).
+# (port 8420); NOT internet-exposed. Image built from vh/stonehenge-park v1.0.0-beta.2 (commit 2c258f7);
+# build source at ~/deploy-src/stonehenge-park-v1.0.0-beta.2 on ana-docker (per-tag dir, so the previous
+# tag's source stays put as a rollback). .env (chmod 600) holds PARK_API_KEY (vault nh3-dev/park-api-key).
+# NOTE: upstream's deploy/compose.yaml builds from source (context: ..). This host copy deliberately does
+# not — it pins a locally-built image tag so a rebuild is an explicit, reviewable step.
 services:
   park:
-    image: park:v1.0.0-beta.1
+    image: park:v1.0.0-beta.2
     container_name: park
     restart: unless-stopped
     ports: