Both tables belonged to NO reset category and silently survived every
reset, --all included (the hand-maintained table list lagged the schema
twice). app_logs gets a new --diagnostics category; tariff_drafts joins
--config. A drift guard now compares the category union against
sqlite_master before doing anything and refuses on any uncategorized
table, so the next new table forces a deliberate one-line decision instead
of escaping by omission. Verified on a scratch DB: guard refuses a planted
table (exit 1), --all lists both new tables, --diagnostics wipes app_logs.
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
A site is sometimes run live to train operators/admins; afterwards the demo
data must go without an obvious self-serve button (the operator must not be
able to wipe history). Adds packages/db/scripts/reset-db.mjs, exposed as
`pnpm db:reset` (dev) and run via `docker exec ... node
node_modules/@parking/db/scripts/reset-db.mjs` on the booth (no pnpm there).
Category flags (combinable): --financial (ledger + telemetry + snapshots +
subscription instances + blocklist; keeps users/devices/config/tariffs/plans),
--config, --users, --all. Shifts/cash/payments live as event types inside the
hash-chained ledger_events, so --financial truncates the whole signed ledger
back to empty (re-seed starts a new chain under the SAME EVENT_SIGNING_KEY —
keys untouched).
Two safety gates: RESET_ALLOWED=1 env (a real booth never sets it) + typed
DB-filename confirmation (--yes skips for CI). Single transaction + VACUUM.
Verified on throwaway dev-DB copies: both gates refuse correctly; each flag
wipes/keeps the right tables; the real dev DB is never touched.
Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
julian