# 07 — Diagnose and reset managed Target state

**What to build:** Operational maintenance behavior that lets users inspect configuration and permission problems, safely restore every managed Target before uninstalling, and troubleshoot failures from bounded redacted local logs.

**Blocked by:** 02 — Safely control the Shell Target.

**Status:** done

- [ ] `proxyctl doctor` performs read-only checks of Profile validity, identity resolution, storage permissions, Target availability, detected state, required commands, and relevant write authority.
- [ ] Diagnostic output states the evidence behind External or Drifted results and redacts all credentials.
- [ ] `proxyctl reset` requires confirmation before changing any Target.
- [ ] A confirmed reset attempts to disable every managed Target through the same Target Interface used by the TUI and restores recorded original state where safe.
- [ ] Reset reports each Target result independently, preserves truthful state after partial failure, and exits unsuccessfully when any requested cleanup fails.
- [ ] Cancellation performs no Target mutation.
- [ ] Mutating operations are protected against concurrent `proxyctl` processes so recovery metadata cannot be corrupted.
- [ ] Local logs record operation type, Target, result, and redacted failure detail without credentials or full authenticated URLs.
- [ ] Log growth is bounded through rotation or equivalent retention behavior.
- [ ] The maintenance commands have process-level tests using fake Targets and isolated XDG locations; tests never modify the host system.