fix: complete reset recovery safety

internal/app/maintenance.go

@@ -94,10 +94,12 @@ func (m *Maintenance) Doctor(ctx context.Context, applicationChecks []target.Che
 }
 
 type ResetTargetResult struct {
-	TargetID   string
-	Inspection target.Inspection
-	Skipped    bool
-	Err        error
+	TargetID     string
+	Inspection   target.Inspection
+	Skipped      bool
+	OperationErr error
+	LogErr       error
+	Err          error
 }
 type ResetResult struct {
 	Cancelled bool
@@ -105,6 +107,23 @@ type ResetResult struct {
 	Err       error
 }
 
+// ResetConfirmation performs only read-only inspection and returns every
+// warning required by Targets that a reset would attempt to disable.
+func (m *Maintenance) ResetConfirmation(ctx context.Context) string {
+	active := activeFromState(m.state)
+	var warnings []string
+	for _, adapter := range m.targets {
+		inspection := adapter.Inspect(ctx, active)
+		if inspection.State != target.Enabled && inspection.State != target.Drifted {
+			continue
+		}
+		if warning := adapter.Confirmation(false); warning != "" {
+			warnings = append(warnings, adapter.ID()+": "+warning)
+		}
+	}
+	return strings.Join(warnings, "\n")
+}
+
 func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
 	if !confirmed {
 		return ResetResult{Cancelled: true}
@@ -138,10 +157,18 @@ func (m *Maintenance) Reset(ctx context.Context, confirmed bool) ResetResult {
 			result.Err = errors.Join(result.Err, fmt.Errorf("reset %s Target: %w", adapter.ID(), redactError(operation.Err)))
 		}
 		detail = RedactLogDetail(detail)
+		operationErr := redactError(operation.Err)
+		var logErr error
 		if m.logger != nil {
-			_ = m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail})
+			if err := m.logger.Write(LogEntry{Time: time.Now(), Operation: "reset", Target: adapter.ID(), Result: outcome, Detail: detail}); err != nil {
+				logErr = redactError(err)
+				result.Err = errors.Join(result.Err, fmt.Errorf("record reset %s Target operation log: %w", adapter.ID(), logErr))
+			}
 		}
-		result.Targets = append(result.Targets, ResetTargetResult{TargetID: adapter.ID(), Inspection: finalInspection, Err: redactError(operation.Err)})
+		result.Targets = append(result.Targets, ResetTargetResult{
+			TargetID: adapter.ID(), Inspection: finalInspection,
+			OperationErr: operationErr, LogErr: logErr, Err: errors.Join(operationErr, logErr),
+		})
 	}
 	return result
 }