fix: complete target diagnostics and reset inspection

internal/dockerdaemon/dockerdaemon.go

@@ -74,6 +74,8 @@ type Adapter struct {
 	runner        CommandRunner
 }
 
+var _ target.Diagnosable = (*Adapter)(nil)
+
 func New(configuration Configuration, files FileSystem, runner CommandRunner) *Adapter {
 	if configuration.DaemonConfigPath == "" {
 		configuration.DaemonConfigPath = "/etc/docker/daemon.json"
@@ -102,6 +104,42 @@ func (a *Adapter) Description() target.Description {
 func (a *Adapter) Confirmation(bool) string {
 	return "Docker will restart immediately. This may disrupt running containers and other work. Confirm before proxyctl changes daemon configuration."
 }
+
+// DiagnosticChecks performs only systemctl show and filesystem reads/metadata
+// probes; service reload/restart and all configuration mutations are excluded.
+func (a *Adapter) DiagnosticChecks(ctx context.Context, _ *profile.Profile) []target.Check {
+	commandCheck := target.Check{Name: "required command and service", OK: true, Evidence: "systemctl can inspect the loaded docker.service"}
+	if availability, err := a.detect(ctx); err != nil || !availability.Available {
+		commandCheck.OK = false
+		if err != nil {
+			commandCheck.Evidence = profile.RedactText("systemctl show failed: " + err.Error())
+		} else {
+			commandCheck.Evidence = availability.Evidence
+		}
+	}
+	schemaCheck := target.Check{Name: "configuration schema", OK: true, Evidence: "Docker daemon configuration and recovery metadata are absent or valid JSON"}
+	if data, err := a.files.ReadFile(a.configuration.DaemonConfigPath); err == nil {
+		if _, schemaErr := mergeConfig(data, profile.Profile{}); schemaErr != nil {
+			schemaCheck.OK = false
+			schemaCheck.Evidence = profile.RedactText("Docker daemon configuration cannot be safely merged: " + schemaErr.Error())
+		}
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		schemaCheck.OK = false
+		schemaCheck.Evidence = profile.RedactText("Docker daemon configuration cannot be read: " + err.Error())
+	}
+	if schemaCheck.OK {
+		if _, _, err := a.readRecovery(); err != nil && !errors.Is(err, fs.ErrNotExist) {
+			schemaCheck.OK = false
+			schemaCheck.Evidence = profile.RedactText("Docker daemon recovery metadata is invalid or unreadable: " + err.Error())
+		}
+	}
+	return []target.Check{
+		commandCheck,
+		schemaCheck,
+		target.ReadOnlyWriteAuthority(a.configuration.DaemonConfigPath, a.configuration.RecoveryPath),
+	}
+}
+
 func (a *Adapter) Availability(ctx context.Context) target.Availability {
 	availability, _ := a.detect(ctx)
 	return availability