docs(wiki): booth bring-up fixes — relay password, secret re-merge, lamp concurrency

- dingtian-relay: the "offline despite ping" gotcha (relay_pw in every binary frame,
  missing form field → Test connection sent 0 → timeout) + the identity-gated secret
  re-merge that stops a redirected probe exfiltrating the password.
- button-light-indicator: serialized desired-state worker (UDP is unordered → the lamp
  stuck on/off) and hot-reload of the lamp config (no restart).
- log entry for the three fixes (commits 420542c / fd15988 / 830993b).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/concepts/button-light-indicator.md

@@ -51,12 +51,25 @@ a **device-agnostic aux-output** capability.
 - **Fails OFF.** On host loss, shutdown, or a `setAux` error the lamp defaults OFF — a dead lamp is
   "no hint", never a misleading solid "go". SOLID is only ever held while busy + present is actively
   true (never latched on through a crash path).
-- **De-duped.** Only writes when the effective output changes, so the 50 ms input poll doesn't spam
-  the controller over UDP.
+- **Serialized sends (must — UDP is unordered).** The first cut fired fire-and-forget `setAux` every
+  500 ms; over **unordered UDP** the on/off packets reordered/overlapped and the relay **latched on
+  whichever packet the device processed last** — the lamp got stuck on/off at random (observed on
+  hardware). Fix: a **desired-state + serialized worker** (`#pump`). The blink timer only flips a
+  `desiredOn` flag; the worker guarantees **one in-flight send per lamp** and, on completion,
+  re-converges to the latest desired state. So the **final state is always authoritative** and a
+  lost/stale packet self-corrects. This also de-dupes (it skips a send when `confirmedOn === desiredOn`),
+  so the input stream never spams the controller.
+- **Hot-reloads the config (no restart).** The lamp map is reconciled against the live device config
+  at start AND before each event (mirroring [[device-status-monitoring|DeviceMonitor]], which re-reads
+  the device set each tick) — adding/updating/dropping lamps. So a button light added or re-pointed in
+  the setup UI takes effect on the **next radar edge**, not after a server restart. (The first cut
+  loaded the map once at boot, so a just-saved lamp silently did nothing until restart.)
 
 ## Status
 
-Built 2026-06-24 for the first booth (button I1, radar I2, lamp on a spare relay). Covered by
-`apps/server/src/button-light.test.ts` (the truth table + blink toggling + fail-OFF + de-dupe).
+Built 2026-06-24 for the first booth (button I1, radar I2, lamp on a spare relay); the serialized-send
++ hot-reload fixes landed the same day after the lamp stuck on/off on hardware. Covered by
+`apps/server/src/button-light.test.ts` (the truth table, blink toggling asserted on the device's
+*confirmed* state, fail-OFF, de-dupe, and a lamp-added-after-start reconcile case).
 Related: [[hikvision-radar]], [[entry-double-press]], [[lpr-camera]], [[dingtian-relay]],
 [[barrier-not-a-door]].