fix: complete target diagnostics and reset inspection

internal/app/maintenance.go

@@ -80,9 +80,9 @@ func (m *Maintenance) Doctor(ctx context.Context, applicationChecks []target.Che
 	active := activeFromState(m.state)
 	for _, adapter := range m.targets {
 		availability := adapter.Availability(ctx)
-		report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "Target availability", OK: availability.Available, Evidence: availability.Evidence}})
+		report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "Target availability", OK: availability.Available, Evidence: profile.RedactText(availability.Evidence)}})
 		inspection := adapter.Inspect(ctx, active)
-		report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "detected state", OK: inspection.State != target.Drifted, Evidence: string(inspection.State) + ": " + inspection.Evidence}})
+		report.Diagnostics = append(report.Diagnostics, Diagnostic{TargetID: adapter.ID(), Check: target.Check{Name: "detected state", OK: inspection.State != target.Drifted, Evidence: profile.RedactText(string(inspection.State) + ": " + inspection.Evidence)}})
 		if diagnosable, ok := adapter.(target.Diagnosable); ok {
 			for _, check := range diagnosable.DiagnosticChecks(ctx, active) {
 				check.Evidence = profile.RedactText(check.Evidence)
@@ -126,17 +126,22 @@ func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
 			continue
 		}
 		operation := adapter.SetDesired(ctx, false, active)
-		detail, outcome := operation.Inspection.Evidence, "success"
+		finalInspection := operation.Inspection
+		detail, outcome := finalInspection.Evidence, "success"
 		if operation.Err != nil {
+			// OperationResult inspection is explicitly advisory on failure. Reset
+			// must publish and log a fresh observation just like interactive
+			// Target operations do.
+			finalInspection = adapter.Inspect(ctx, active)
 			outcome = "failure"
-			detail = operation.Err.Error()
+			detail = fmt.Sprintf("%v; fresh inspection %s: %s", operation.Err, finalInspection.State, finalInspection.Evidence)
 			result.Err = errors.Join(result.Err, fmt.Errorf("reset %s Target: %w", adapter.ID(), redactError(operation.Err)))
 		}
 		detail = RedactLogDetail(detail)
 		if m.logger != nil {
 			_ = m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail})
 		}
-		result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: operation.Inspection, Err: redactError(operation.Err)})
+		result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: finalInspection, Err: redactError(operation.Err)})
 	}
 	return result
 }

internal/app/maintenance_test.go

@@ -43,6 +43,28 @@ func (f *maintenanceTarget) DiagnosticChecks(context.Context, *profile.Profile)
 	return append([]target.Check(nil), f.checks...)
 }
 
+type staleFailureTarget struct{ inspectCalls int }
+
+func (*staleFailureTarget) ID() string                      { return "stale" }
+func (*staleFailureTarget) Description() target.Description { return target.Description{Name: "stale"} }
+func (*staleFailureTarget) Availability(context.Context) target.Availability {
+	return target.Availability{Available: true}
+}
+func (*staleFailureTarget) Confirmation(bool) string { return "" }
+func (f *staleFailureTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
+	f.inspectCalls++
+	if f.inspectCalls == 1 {
+		return target.Inspection{State: target.Enabled, Evidence: "initial managed state"}
+	}
+	return target.Inspection{State: target.External, Evidence: "fresh evidence http://alice:secret@proxy.example:8080"}
+}
+func (*staleFailureTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
+	return target.OperationResult{
+		Inspection: target.Inspection{State: target.Drifted, Evidence: "stale returned evidence"},
+		Err:        errors.New("failed https://bob:hunter2@proxy.example/path"),
+	}
+}
+
 type recordingLock struct{ held, acquired int }
 
 func (l *recordingLock) Lock(context.Context) (func(), error) {
@@ -111,6 +133,22 @@ func TestApplicationSerializesAndLogsTargetMutations(t *testing.T) {
 	}
 }
 
+func TestResetFailureUsesFreshInspectionForResultAndRedactedLog(t *testing.T) {
+	adapter := &staleFailureTarget{}
+	log := &recordingLog{}
+	result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, log).Reset(context.Background(), true)
+	if result.Err == nil || adapter.inspectCalls != 2 || len(result.Targets) != 1 {
+		t.Fatalf("reset result=%#v inspect calls=%d", result, adapter.inspectCalls)
+	}
+	got := result.Targets[0].Inspection
+	if got.State != target.External || !strings.Contains(got.Evidence, "fresh evidence") || strings.Contains(got.Evidence, "stale") {
+		t.Fatalf("failure inspection = %#v", got)
+	}
+	if len(log.entries) != 1 || !strings.Contains(log.entries[0].Detail, "fresh inspection External") || strings.Contains(log.entries[0].Detail, "secret") || strings.Contains(log.entries[0].Detail, "hunter2") {
+		t.Fatalf("failure log = %#v", log.entries)
+	}
+}
+
 func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
 	good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
 	failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")