fix: complete reset recovery safety

internal/app/maintenance_test.go

@@ -19,6 +19,7 @@ type maintenanceTarget struct {
 	checks       []target.Check
 	disableErr   error
 	disableCalls int
+	confirmation string
 }
 
 func (f *maintenanceTarget) ID() string { return f.id }
@@ -26,7 +27,7 @@ func (f *maintenanceTarget) Description() target.Description {
 	return target.Description{Name: strings.ToUpper(f.id)}
 }
 func (f *maintenanceTarget) Availability(context.Context) target.Availability { return f.available }
-func (f *maintenanceTarget) Confirmation(bool) string                         { return "" }
+func (f *maintenanceTarget) Confirmation(bool) string                         { return f.confirmation }
 func (f *maintenanceTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
 	return f.inspection
 }
@@ -73,11 +74,14 @@ func (l *recordingLock) Lock(context.Context) (func(), error) {
 	return func() { l.held-- }, nil
 }
 
-type recordingLog struct{ entries []app.LogEntry }
+type recordingLog struct {
+	entries []app.LogEntry
+	err     error
+}
 
 func (l *recordingLog) Write(entry app.LogEntry) error {
 	l.entries = append(l.entries, entry)
-	return nil
+	return l.err
 }
 
 func TestDoctorReportsReadOnlyChecksEvidenceAndRedactsCredentials(t *testing.T) {
@@ -149,6 +153,41 @@ func TestResetFailureUsesFreshInspectionForResultAndRedactedLog(t *testing.T) {
 	}
 }
 
+func TestResetConfirmationAggregatesWarningsOnlyForManagedCandidatesWithoutMutation(t *testing.T) {
+	managed := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
+	drifted := &maintenanceTarget{id: "drifted", inspection: target.Inspection{State: target.Drifted, Evidence: "recovery metadata remains"}}
+	external := &maintenanceTarget{id: "external", inspection: target.Inspection{State: target.External, Evidence: "administrator owned"}}
+	managed.confirmation = "managed warning"
+	drifted.confirmation = "drifted warning"
+	external.confirmation = "must not be shown"
+	maintenance := app.NewMaintenance(profile.State{}, []target.Target{managed, drifted, external}, &recordingLock{}, nil)
+
+	confirmation := maintenance.ResetConfirmation(context.Background())
+	for _, want := range []string{"managed: managed warning", "drifted: drifted warning"} {
+		if !strings.Contains(confirmation, want) {
+			t.Errorf("confirmation missing %q: %q", want, confirmation)
+		}
+	}
+	if strings.Contains(confirmation, "must not be shown") || managed.disableCalls+drifted.disableCalls+external.disableCalls != 0 {
+		t.Fatalf("confirmation=%q mutation calls=%d/%d/%d", confirmation, managed.disableCalls, drifted.disableCalls, external.disableCalls)
+	}
+}
+
+func TestResetLoggerFailureIsReportedWithoutUndoingCompletedConfiguration(t *testing.T) {
+	adapter := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
+	logger := &recordingLog{err: errors.New("operation log disk full")}
+
+	result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, logger).Reset(context.Background(), true)
+
+	if result.Err == nil || !strings.Contains(result.Err.Error(), "operation log disk full") || len(result.Targets) != 1 {
+		t.Fatalf("reset result = %#v", result)
+	}
+	item := result.Targets[0]
+	if item.Inspection.State != target.Disabled || item.OperationErr != nil || item.LogErr == nil || item.Err == nil || adapter.disableCalls != 1 {
+		t.Fatalf("logger failure outcome=%#v disable calls=%d", item, adapter.disableCalls)
+	}
+}
+
 func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
 	good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
 	failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")