fix(daemon): serve reset-required stores as a typed state

crates/tracedecay-cli/src/cli/help.rs

@@ -364,7 +364,10 @@ Exit status (a completed binary upgrade stays installed in every case):
   75  the refresh waits on an operator step: an interactive host step (Kimi
       Code's `/plugins install`), or a tracked host whose CLI is not
       installed (install it, or `tracedecay uninstall --agent <host>` to
-      stop tracking it); act on the printed step, then rerun
+      stop tracking it); act on the printed step, then rerun. Also 75 when
+      the restored daemon serves a store whose persisted shape this binary
+      does not open: it names the store and the exact reset command
+      (`tracedecay wipe --all --yes`), which nothing runs on your behalf
 
 Related: tracedecay upgrade (refresh only after a real install),
 tracedecay update-plugin (plugins only), tracedecay channel.";
@@ -456,6 +459,12 @@ pub(crate) const DOCTOR_AFTER_HELP: &str = "\
 Examples:
   tracedecay doctor                              Check everything
 
+Exit status:
+  0   no issue found (warnings may still be printed)
+  1   an issue was found
+  75  no issue, but the daemon serves a store in its reset-required state;
+      Doctor names the store and the exact reset command to run
+
 Related: tracedecay install (fix missing integration), tracedecay daemon
 status, tracedecay status (index health).";
 

crates/tracedecay-cli/src/main.rs

@@ -1221,10 +1221,7 @@ async fn dispatch_command(
             dispatch_configuration_command(profile, command).await?;
             Ok(CommandOutcome::Success)
         }
-        CommandFamily::Diagnostics => {
-            dispatch_diagnostics_command(profile, command).await?;
-            Ok(CommandOutcome::Success)
-        }
+        CommandFamily::Diagnostics => dispatch_diagnostics_command(profile, command).await,
         CommandFamily::Knowledge => {
             dispatch_knowledge_command(profile, command).await?;
             Ok(CommandOutcome::Success)
@@ -1915,14 +1912,19 @@ async fn dispatch_configuration_command(
 async fn dispatch_diagnostics_command(
     profile: &ProfileRoot,
     command: Commands,
-) -> tracedecay_domain::errors::Result<()> {
+) -> tracedecay_domain::errors::Result<CommandOutcome> {
     match command {
         Commands::Doctor => {
-            hotpath::future!(
+            let completion = hotpath::future!(
                 tracedecay::doctor::run_doctor(profile, crate::cloud::doctor_network_probes(),),
                 label = "cli.doctor.run"
             )
             .await?;
+            if completion == tracedecay::doctor::DoctorCompletion::PendingOperatorAction {
+                return Ok(CommandOutcome::Exit(
+                    agent_cmd::PENDING_OPERATOR_ACTION_EXIT_CODE,
+                ));
+            }
         }
         Commands::Cost {
             range,
@@ -1952,7 +1954,7 @@ async fn dispatch_diagnostics_command(
         }
         _ => unreachable!("non-diagnostics command passed to diagnostics dispatcher"),
     }
-    Ok(())
+    Ok(CommandOutcome::Success)
 }
 
 async fn dispatch_knowledge_command(