feat: control systemd Docker daemon target

internal/app/app.go

@@ -44,9 +44,10 @@ type Snapshot struct {
 }
 
 type Result struct {
-	Snapshot Snapshot
-	Notice   string
-	Err      error
+	Snapshot     Snapshot
+	Notice       string
+	Confirmation string
+	Err          error
 }
 
 type Module interface {
@@ -159,6 +160,9 @@ func (a *Application) setTargetDesired(intent Intent) Result {
 	if intent.Enabled && active == nil {
 		return Result{Snapshot: a.Snapshot(), Err: errors.New("no Active Profile; open Profile management before enabling a Target")}
 	}
+	if warning := selected.Confirmation(intent.Enabled); warning != "" && !intent.Confirm {
+		return Result{Snapshot: a.Snapshot(), Confirmation: warning}
+	}
 	result := selected.SetDesired(context.Background(), intent.Enabled, active)
 	a.inspections[selected.ID()] = result.Inspection
 	notice := ""

internal/app/target_test.go

@@ -13,10 +13,11 @@ import (
 )
 
 type fakeTarget struct {
-	available bool
-	state     target.State
-	setErr    error
-	calls     []bool
+	available    bool
+	state        target.State
+	setErr       error
+	confirmation string
+	calls        []bool
 }
 
 func (f *fakeTarget) ID() string { return "shell" }
@@ -29,6 +30,7 @@ func (f *fakeTarget) Availability(context.Context) target.Availability {
 func (f *fakeTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
 	return target.Inspection{State: f.state, Evidence: "actual state"}
 }
+func (f *fakeTarget) Confirmation(bool) string { return f.confirmation }
 func (f *fakeTarget) SetDesired(_ context.Context, enabled bool, _ *profile.Profile) target.OperationResult {
 	f.calls = append(f.calls, enabled)
 	if f.setErr == nil {
@@ -71,6 +73,31 @@ func TestApplicationTargetSeamRequiresActiveProfileAndReturnsTruthfulResults(t *
 	}
 }
 
+func TestApplicationRequiresTargetConfirmationBeforeMutation(t *testing.T) {
+	adapter := &fakeTarget{available: true, state: target.Disabled, confirmation: "Docker will restart immediately and may disrupt running work."}
+	application, err := app.NewWithTargets(profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json")), []target.Target{targetWithID{fakeTarget: adapter, id: "docker-daemon"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	createAndActivate(t, application)
+
+	warning := application.Dispatch(app.Intent{Kind: app.SetTargetDesired, TargetID: "docker-daemon", Enabled: true})
+	if warning.Confirmation == "" || warning.Err != nil || len(adapter.calls) != 0 || warning.Snapshot.Targets[0].State != target.Disabled {
+		t.Fatalf("unconfirmed result = %#v, calls=%v", warning, adapter.calls)
+	}
+	confirmed := application.Dispatch(app.Intent{Kind: app.SetTargetDesired, TargetID: "docker-daemon", Enabled: true, Confirm: true})
+	if confirmed.Err != nil || len(adapter.calls) != 1 || confirmed.Snapshot.Targets[0].State != target.Enabled {
+		t.Fatalf("confirmed result = %#v, calls=%v", confirmed, adapter.calls)
+	}
+}
+
+type targetWithID struct {
+	*fakeTarget
+	id string
+}
+
+func (t targetWithID) ID() string { return t.id }
+
 func TestApplicationHidesUnavailableTargetButKeepsExplanation(t *testing.T) {
 	adapter := &fakeTarget{available: false, state: target.Disabled}
 	application, err := app.NewWithTargets(profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json")), []target.Target{adapter})