[flexdinesh]

• Behavior owner and resulting change: reviewstore.Reset moves current or older diffx state (sidecars first) to <db>.schema<N>-<UTC>.bak beside it, under the ownership lock, and prunes earlier backups. Newer, unversioned and non-SQLite files are refused unchanged. Open errors are now a typed StateError (message text unchanged). localserver.StateReset{Force, Confirm, Saved} is threaded through Run/RunForeground. cmd/diffx composes the policy: --reset-state consents up front, an interactive terminal is asked [y/N] for older state, anything else is refused with a --reset-state hint. dev --fixture takes the flag but never prompts. --reset-state with --state memory and on sync is rejected.
• Contracts/invariants affected; local/remote implications: Open still never resets. Only local composition can call Reset; diffx-server (serve and user admin) has no flag and keeps refusing. Collectors are unaffected (no DB; versioned producer dirs already skip old payloads).
• Validation results; remaining risks: mise run check and pre-push suite pass. New tests: reviewstore (backup, sidecars, pruning, refused files byte-identical, lock contention), localserver (confirm/decline/force/newer), cmd/diffx (non-TTY hint, flag reset, dev, memory, sync), cmd/diffx-server (flag rejected, no reset). Scripted pty run against real binaries: 16/16 checks. Risks: reset drops comments, marks and piped captures unless the backup is restored manually; only the newest backup is kept; a local.state pointing at a server DB would be reset too (backup mitigates); piped git diff | diffx needs the flag.
• Intentional architecture/design changes and rationale (if any): reverses "opening a database never resets it" for local mode only. Local state is one developer's re-collectable workspace, while server volumes need an operator decision. docs/architecture.md, system.md, development.md, release.md and docs-site api.md updated.
• UI evidence: affected themes/layouts, keyboard use, Pierre geometry (if applicable): n/a (CLI only).