fix: harden operations and configuration recovery

internal/target/diagnostic.go

@@ -69,6 +69,14 @@ func readOnlyWritablePath(path string) (bool, string) {
 		}
 		if index == len(components)-1 {
 			_ = unix.Close(child)
+			if kind != unix.S_IFREG {
+				return false, componentPath + " is not a regular file"
+			}
+			readable, readErr := unix.Openat(current, component, unix.O_RDONLY|unix.O_NONBLOCK|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+			if readErr != nil {
+				return false, componentPath + " cannot be read for safe atomic replacement: " + readErr.Error()
+			}
+			_ = unix.Close(readable)
 			return writableDirectory(current, currentPath, absolute)
 		}
 		if kind != unix.S_IFDIR {

internal/target/diagnostic_test.go

@@ -10,6 +10,20 @@ import (
 	"proxyctl/internal/target"
 )
 
+func TestReadOnlyWriteAuthorityRejectsUnreadableExistingFile(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can read files regardless of mode bits")
+	}
+	path := filepath.Join(t.TempDir(), "managed.json")
+	if err := os.WriteFile(path, []byte("{}\n"), 0o200); err != nil {
+		t.Fatal(err)
+	}
+	check := target.ReadOnlyWriteAuthority(path)
+	if check.OK || !strings.Contains(check.Evidence, "cannot be read") {
+		t.Fatalf("unreadable destination reported writable: %#v", check)
+	}
+}
+
 func TestReadOnlyWriteAuthorityRejectsSymlinkedFinalAndAncestorWithoutTouchingVictim(t *testing.T) {
 	for _, test := range []struct {
 		name string