docs(wiki): log-storm hardening + reset drift guard (2026-07-07 incident)

button-light-indicator: failure backoff + rate-limited logging rationale;
app-logs: storm coalescing invariant + --diagnostics wipe; local-dev-workflow
and appliance-provisioning §7d: new reset flag table + drift guard; log entry
tying all three layers to the ENETUNREACH incident.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

wiki/log.md

@@ -2525,3 +2525,18 @@ deferred (→ delivered by the lab fee breakdown); [[tariff]] lab section gained
 composer increment-guard paragraph; [[i18n]] now records the "25 Qer 14:30" date standard and the
 never-toLocaleString-for-dates rule; [[fleet-deployment-komodo]] gained the park-lab stack + tier
 table (also logging the park-lab addition itself, which had slipped the log).
+
+## [2026-07-08] update | Log-storm hardening + reset-db drift guard
+
+Field incident 2026-07-07: an unreachable UHPPOTE (`ENETUNREACH 10.0.10.5:60000`) put the
+button-light `#pump` worker in a zero-backoff hot loop — hundreds of identical `setAux failed`
+error rows per minute into [[app-logs]]. Three-layer fix: (1) failed sends now arm a 1s→30s
+exponential retry (reset on success), with only the first failure logged, one summary/minute
+after, and one info on recovery ([[button-light-indicator]] §Implementation); (2) LogService
+coalesces a row identical to the last (level+source+message+path, 5-min refreshing window) by
+bumping `context._repeat` instead of inserting — the viewer badges `×N` ([[app-logs]]);
+(3) the user's training reset had ALSO left logs behind: `app_logs` and `tariff_drafts` belonged
+to no reset-db category, silently surviving even `--all`. Added `--diagnostics` (app_logs), put
+tariff_drafts under `--config`, and a drift guard that refuses to run when any table is
+uncategorized ([[local-dev-workflow]], [[appliance-provisioning]] §7d). 8 new tests
+(3 button-light backoff, 5 coalescing); guard + both new wipes verified on a scratch DB.