docs(wiki): log-storm hardening + reset drift guard (2026-07-07 incident)

button-light-indicator: failure backoff + rate-limited logging rationale;
app-logs: storm coalescing invariant + --diagnostics wipe; local-dev-workflow
and appliance-provisioning §7d: new reset flag table + drift guard; log entry
tying all three layers to the ENETUNREACH incident.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/local-dev-workflow.md

@@ -71,10 +71,16 @@ RESET_ALLOWED=1 DATABASE_URL=/path node packages/db/scripts/reset-db.mjs --all
 | Flag | Wipes | Keeps |
 | --- | --- | --- |
 | `--financial` | `ledger_events` (entry/exit/payment/void/shift/cash/anomaly), `device_events`, `snapshots`, subscription **instances** + credentials/plates, `blocklist` | users, devices, config, tariffs, subscription **plans** |
-| `--config` | `site_config`, `devices`, `setup_state` (→ re-runs first-run setup), tariffs + versions, subscription plans | everything else |
+| `--config` | `site_config`, `devices`, `setup_state` (→ re-runs first-run setup), tariffs + versions + **drafts**, subscription plans | everything else |
 | `--users` | `users`, `roles`, `role_permissions`, auth `sessions` | everything else |
+| `--diagnostics` | `app_logs` (the unsigned [[app-logs]] store behind `/setup/logs`) | everything else |
 | `--all` | every table (blank slate) | — |
 
+**Drift guard** (2026-07-08): before doing anything, the script compares the category union against
+`sqlite_master` and **refuses if any table is uncategorized** — `app_logs` and `tariff_drafts` had
+silently survived every reset (including `--all`) because the hand-maintained table list lagged the
+schema. A new table now forces a deliberate one-line categorization decision.
+
 > **⚠ `--financial`/`--all` TRUNCATE the append-only, signed [[append-only-event-chain|ledger]].**
 > That is the anti-fraud record; a *partial* delete would break the hash chain, so a financial reset
 > wipes the whole ledger back to empty (re-seeding starts a NEW chain under the **same**