fix: harden target recovery metadata safety

internal/dockerdaemon/dockerdaemon_test.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"proxyctl/internal/app"
 	"proxyctl/internal/dockerdaemon"
 	"proxyctl/internal/profile"
 	"proxyctl/internal/target"
@@ -106,6 +107,61 @@ type fixedAuthority int
 
 func (a fixedAuthority) EffectiveUID() int { return int(a) }
 
+type immediateLock struct{}
+
+func (immediateLock) Lock(context.Context) (func(), error) { return func() {}, nil }
+
+func TestUnsafeRecoveryMetadataIsDriftedAndResetNeverMutatesDaemon(t *testing.T) {
+	fingerprint := strings.Repeat("a", 64)
+	cases := map[string]string{
+		"empty object":                 `{}`,
+		"truncated":                    `{"version":1`,
+		"unsupported version":          `{"version":2,"originalExists":false,"configFingerprint":"` + fingerprint + `"}`,
+		"missing original":             `{"version":1,"originalExists":true,"originalMode":384,"configFingerprint":"` + fingerprint + `"}`,
+		"unexpected original":          `{"version":1,"originalExists":false,"original":"e30=","configFingerprint":"` + fingerprint + `"}`,
+		"mode without original":        `{"version":1,"originalExists":false,"originalMode":384,"configFingerprint":"` + fingerprint + `"}`,
+		"invalid mode":                 `{"version":1,"originalExists":true,"original":"e30=","originalMode":4096,"configFingerprint":"` + fingerprint + `"}`,
+		"invalid fingerprint":          `{"version":1,"originalExists":false,"configFingerprint":"short"}`,
+		"contradictory restart record": `{"version":1,"originalExists":false,"configFingerprint":"` + fingerprint + `","restartedFingerprint":"` + strings.Repeat("b", 64) + `"}`,
+	}
+	for name, metadata := range cases {
+		t.Run(name, func(t *testing.T) {
+			a, record, daemonPath, recoveryPath, _ := fixture(t)
+			originalConfig := []byte(`{"log-level":"debug"}`)
+			if err := os.MkdirAll(filepath.Dir(daemonPath), 0o700); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(daemonPath, originalConfig, 0o640); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.MkdirAll(filepath.Dir(recoveryPath), 0o700); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(recoveryPath, []byte(metadata), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			record.events = nil
+
+			if inspection := a.Inspect(context.Background(), nil); inspection.State != target.Drifted {
+				t.Fatalf("inspection = %#v", inspection)
+			}
+			reset := app.NewMaintenance(profile.State{}, []target.Target{a}, immediateLock{}, nil).Reset(context.Background(), true)
+			if reset.Err == nil || len(reset.Targets) != 1 || reset.Targets[0].Err == nil {
+				t.Fatalf("unsafe reset = %#v", reset)
+			}
+			if events := mutationEvents(record.events); len(events) != 0 {
+				t.Fatalf("unsafe metadata caused mutation: %#v", events)
+			}
+			if got, err := os.ReadFile(daemonPath); err != nil || !reflect.DeepEqual(got, originalConfig) {
+				t.Fatalf("daemon changed to %q: %v", got, err)
+			}
+			if got, err := os.ReadFile(recoveryPath); err != nil || string(got) != metadata {
+				t.Fatalf("recovery changed to %q: %v", got, err)
+			}
+		})
+	}
+}
+
 func TestDiagnosticChecksCoverSystemdSchemaAndAuthorityWithoutMutation(t *testing.T) {
 	a, record, daemonPath, recoveryPath, runner := fixture(t)
 	a = dockerdaemon.New(dockerdaemon.Configuration{DaemonConfigPath: daemonPath, RecoveryPath: recoveryPath, TrustedRoot: filepath.Dir(filepath.Dir(daemonPath))}, recordingFS{recorder: record}, runner, fixedAuthority(0))