fix: complete target diagnostics and reset inspection

internal/dockerclient/dockerclient.go

@@ -154,7 +154,10 @@ type Adapter struct {
 	files         FileSystem
 }
 
-var _ target.Target = (*Adapter)(nil)
+var (
+	_ target.Target      = (*Adapter)(nil)
+	_ target.Diagnosable = (*Adapter)(nil)
+)
 
 func New(configuration Configuration, files FileSystem) *Adapter {
 	if files == nil {
@@ -174,6 +177,31 @@ func (a *Adapter) Description() target.Description {
 }
 func (a *Adapter) Confirmation(bool) string { return "" }
 
+// DiagnosticChecks validates the readable JSON surfaces and observes write
+// authority without taking the adapter lock or creating any files.
+func (a *Adapter) DiagnosticChecks(_ context.Context, _ *profile.Profile) []target.Check {
+	commandCheck := target.Check{Name: "required commands", OK: true, Evidence: "Docker client defaults require no external commands"}
+	schemaCheck := target.Check{Name: "configuration schema", OK: true, Evidence: "Docker client configuration and recovery metadata are absent or valid JSON objects"}
+	if config, _, err := a.readConfig(); err != nil {
+		schemaCheck.OK = false
+		schemaCheck.Evidence = profile.RedactText("Docker client config.json is invalid or unreadable: " + err.Error())
+	} else if proxies, _, err := childObject(config, "proxies"); err != nil {
+		schemaCheck.OK = false
+		schemaCheck.Evidence = profile.RedactText(err.Error())
+	} else if _, _, err := childObject(proxies, "default"); err != nil {
+		schemaCheck.OK = false
+		schemaCheck.Evidence = profile.RedactText(err.Error())
+	} else if _, _, err := a.readRecovery(); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		schemaCheck.OK = false
+		schemaCheck.Evidence = profile.RedactText("Docker client recovery metadata is invalid or unreadable: " + err.Error())
+	}
+	return []target.Check{
+		commandCheck,
+		schemaCheck,
+		target.ReadOnlyWriteAuthority(a.configuration.ConfigFile, a.configuration.RecoveryFile),
+	}
+}
+
 func (a *Adapter) Availability(context.Context) target.Availability {
 	if !a.usablePath(a.configuration.ConfigFile) || !a.usablePath(a.configuration.RecoveryFile) {
 		return target.Availability{Evidence: "standard Docker client configuration paths are not usable for the owning user"}

internal/dockerclient/dockerclient_test.go

@@ -44,6 +44,29 @@ func TestAvailabilityAndDescriptionDescribeOnlyDockerClientDefaults(t *testing.T
 	}
 }
 
+func TestDiagnosticChecksCoverSchemaAndAuthorityWithoutMutation(t *testing.T) {
+	files := &countingFS{FileSystem: dockerclient.OSFileSystem{}}
+	a := newAdapterWithFS(t, files)
+	checks := a.DiagnosticChecks(context.Background(), activeProfile())
+	for _, name := range []string{"required commands", "configuration schema", "write authority"} {
+		found := false
+		for _, check := range checks {
+			found = found || check.Name == name
+		}
+		if !found {
+			t.Errorf("diagnostics missing %q: %#v", name, checks)
+		}
+	}
+	if files.writes != 0 {
+		t.Fatalf("diagnostics wrote Docker client state %d times", files.writes)
+	}
+	for _, path := range []string{a.ConfigPath(), a.RecoveryPath(), a.LockPath()} {
+		if _, err := os.Stat(path); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("diagnostics created %s: %v", path, err)
+		}
+	}
+}
+
 func TestDockerClientAdapterRunsReusableTargetContract(t *testing.T) {
 	targettest.Run(t, func(t *testing.T) targettest.Fixture {
 		a := newAdapter(t, nil)