fix: complete reset recovery safety

internal/app/maintenance.go

@@ -94,10 +94,12 @@ func (m *Maintenance) Doctor(ctx context.Context, applicationChecks []target.Che
 }
 
 type ResetTargetResult struct {
-	TargetID   string
-	Inspection target.Inspection
-	Skipped    bool
-	Err        error
+	TargetID     string
+	Inspection   target.Inspection
+	Skipped      bool
+	OperationErr error
+	LogErr       error
+	Err          error
 }
 type ResetResult struct {
 	Cancelled bool
@@ -105,6 +107,23 @@ type ResetResult struct {
 	Err       error
 }
 
+// ResetConfirmation performs only read-only inspection and returns every
+// warning required by Targets that a reset would attempt to disable.
+func (m *Maintenance) ResetConfirmation(ctx context.Context) string {
+	active := activeFromState(m.state)
+	var warnings []string
+	for _, adapter := range m.targets {
+		inspection := adapter.Inspect(ctx, active)
+		if inspection.State != target.Enabled && inspection.State != target.Drifted {
+			continue
+		}
+		if warning := adapter.Confirmation(false); warning != "" {
+			warnings = append(warnings, adapter.ID()+": "+warning)
+		}
+	}
+	return strings.Join(warnings, "\n")
+}
+
 func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
 	if !confirmed {
 		return ResetResult{Cancelled: true}
@@ -138,10 +157,18 @@ func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
 			result.Err = errors.Join(result.Err, fmt.Errorf("reset %s Target: %w", adapter.ID(), redactError(operation.Err)))
 		}
 		detail = RedactLogDetail(detail)
+		operationErr := redactError(operation.Err)
+		var logErr error
 		if m.logger != nil {
-			_ = m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail})
+			if err := m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail}); err != nil {
+				logErr = redactError(err)
+				result.Err = errors.Join(result.Err, fmt.Errorf("record reset %s Target operation log: %w", adapter.ID(), logErr))
+			}
 		}
-		result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: finalInspection, Err: redactError(operation.Err)})
+		result.Targets = append(result.Targets, ResetTargetResult{
+			TargetID: adapter.ID(), Inspection: finalInspection,
+			OperationErr: operationErr, LogErr: logErr, Err: errors.Join(operationErr, logErr),
+		})
 	}
 	return result
 }

internal/app/maintenance_test.go

@@ -19,6 +19,7 @@ type maintenanceTarget struct {
 	checks       []target.Check
 	disableErr   error
 	disableCalls int
+	confirmation string
 }
 
 func (f *maintenanceTarget) ID() string { return f.id }
@@ -26,7 +27,7 @@ func (f *maintenanceTarget) Description() target.Description {
 	return target.Description{Name: strings.ToUpper(f.id)}
 }
 func (f *maintenanceTarget) Availability(context.Context) target.Availability { return f.available }
-func (f *maintenanceTarget) Confirmation(bool) string                         { return "" }
+func (f *maintenanceTarget) Confirmation(bool) string                         { return f.confirmation }
 func (f *maintenanceTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
 	return f.inspection
 }
@@ -73,11 +74,14 @@ func (l *recordingLock) Lock(context.Context) (func(), error) {
 	return func() { l.held-- }, nil
 }
 
-type recordingLog struct{ entries []app.LogEntry }
+type recordingLog struct {
+	entries []app.LogEntry
+	err     error
+}
 
 func (l *recordingLog) Write(entry app.LogEntry) error {
 	l.entries = append(l.entries, entry)
-	return nil
+	return l.err
 }
 
 func TestDoctorReportsReadOnlyChecksEvidenceAndRedactsCredentials(t *testing.T) {
@@ -149,6 +153,41 @@ func TestResetFailureUsesFreshInspectionForResultAndRedactedLog(t *testing.T) {
 	}
 }
 
+func TestResetConfirmationAggregatesWarningsOnlyForManagedCandidatesWithoutMutation(t *testing.T) {
+	managed := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
+	drifted := &maintenanceTarget{id: "drifted", inspection: target.Inspection{State: target.Drifted, Evidence: "recovery metadata remains"}}
+	external := &maintenanceTarget{id: "external", inspection: target.Inspection{State: target.External, Evidence: "administrator owned"}}
+	managed.confirmation = "managed warning"
+	drifted.confirmation = "drifted warning"
+	external.confirmation = "must not be shown"
+	maintenance := app.NewMaintenance(profile.State{}, []target.Target{managed, drifted, external}, &recordingLock{}, nil)
+
+	confirmation := maintenance.ResetConfirmation(context.Background())
+	for _, want := range []string{"managed: managed warning", "drifted: drifted warning"} {
+		if !strings.Contains(confirmation, want) {
+			t.Errorf("confirmation missing %q: %q", want, confirmation)
+		}
+	}
+	if strings.Contains(confirmation, "must not be shown") || managed.disableCalls+drifted.disableCalls+external.disableCalls != 0 {
+		t.Fatalf("confirmation=%q mutation calls=%d/%d/%d", confirmation, managed.disableCalls, drifted.disableCalls, external.disableCalls)
+	}
+}
+
+func TestResetLoggerFailureIsReportedWithoutUndoingCompletedConfiguration(t *testing.T) {
+	adapter := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
+	logger := &recordingLog{err: errors.New("operation log disk full")}
+
+	result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, logger).Reset(context.Background(), true)
+
+	if result.Err == nil || !strings.Contains(result.Err.Error(), "operation log disk full") || len(result.Targets) != 1 {
+		t.Fatalf("reset result = %#v", result)
+	}
+	item := result.Targets[0]
+	if item.Inspection.State != target.Disabled || item.OperationErr != nil || item.LogErr == nil || item.Err == nil || adapter.disableCalls != 1 {
+		t.Fatalf("logger failure outcome=%#v disable calls=%d", item, adapter.disableCalls)
+	}
+}
+
 func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
 	good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
 	failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")