refactor(cli): rename operator command to tht

tools/tht/internal/pi/recovery_error.go

@@ -0,0 +1,24 @@
+package pi
+
+// RecoveryRequiredError marks a result whose immediate state may be safe but whose durability
+// was explicitly not acknowledged. Callers must not report success or clear maintenance.
+type RecoveryRequiredError struct {
+	Operation string
+	Cause     error
+}
+
+func (e *RecoveryRequiredError) Error() string {
+	return e.Operation + ": recovery required"
+}
+
+func (e *RecoveryRequiredError) Unwrap() error {
+	return e.Cause
+}
+
+func (e *RecoveryRequiredError) RecoveryRequired() bool {
+	return true
+}
+
+func recoveryRequired(operation string, cause error) error {
+	return &RecoveryRequiredError{Operation: operation, Cause: cause}
+}