CM12 - Day 3 in the lab

Right click the DP and today it's all green and ready for an upgrade – no roles left on the DP.  So it will let me upgrade it.  It's asking what credentials to do that with.  Why can't it use the same creds I fed it for the gather task?  I take it I'll need to add CM2$ as a local admin for it to do an upgrade to this DP.  That or make CM2$ part of the same AD group I put CM1$ into yesterday, because in prod, it'd be many servers it'd need permissions to.  Doing the AD group method means I'd have to reboot.  So I guess in this case, I'll just do the one DP manually.

So I hit OK and oddly, it says it's going to connect the DP to the CAS.  The CAS?  It has no clients.  Why there?  Why not my child primary?  Why can't I pick a child primary for it?  Maybe I'm supposed to add it to the CAS, but protected it with my DEV boundary group.