fix: complete reset recovery safety

cmd/proxyctl/process_testenv.go

@@ -3,21 +3,47 @@
 package main
 
 import (
+	"context"
 	"errors"
 	"os"
 	"os/user"
+	"path/filepath"
 	"strconv"
 
 	"proxyctl/internal/profile"
 	"proxyctl/internal/target"
 )
 
+type processResetTarget struct{ marker string }
+
+func (t processResetTarget) ID() string { return "docker-daemon-test" }
+func (t processResetTarget) Description() target.Description {
+	return target.Description{Name: "Docker daemon"}
+}
+func (t processResetTarget) Availability(context.Context) target.Availability {
+	return target.Availability{Available: true, Evidence: "isolated process fixture"}
+}
+func (t processResetTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
+	if _, err := os.Stat(t.marker); err == nil {
+		return target.Inspection{State: target.Disabled, Evidence: "isolated managed configuration removed"}
+	}
+	return target.Inspection{State: target.Drifted, Evidence: "isolated recovery metadata exists"}
+}
+func (t processResetTarget) Confirmation(bool) string {
+	return "Docker will restart immediately. This may disrupt running containers and other work."
+}
+func (t processResetTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
+	err := os.WriteFile(t.marker, []byte("reset\n"), 0o600)
+	return target.OperationResult{Inspection: t.Inspect(context.Background(), nil), Err: err}
+}
+
 // This file is compiled only into the process-smoke binary. It gives that real
 // executable an identity whose home is inside the test sandbox and omits
 // production system Targets, so no command can reach developer or host state.
 func init() {
 	processProductionTargets = func(profile.IdentityEnvironment) ([]target.Target, error) {
-		return []target.Target{}, nil
+		home := os.Getenv("PROXYCTL_PROCESS_TEST_HOME")
+		return []target.Target{processResetTarget{marker: filepath.Join(home, "reset-mutation-marker")}}, nil
 	}
 	processCurrentUser = func() (profile.UserIdentity, error) {
 		home := os.Getenv("PROXYCTL_PROCESS_TEST_HOME")