Add read-only laptop doctor and trusted image recovery entrypoints

docs/hardware/asus-fx517zc.md

@@ -1,11 +1,11 @@
 # ASUS TUF Dash F15 FX517ZC
 
-Read-only inventory 2026-10-13; no serial numbers or machine identifiers.
+Initial read-only inventory on 2026-10-13; no serials or machine identifiers.
 
 | Component | Hardware | Driver / requirement |
 | --- | --- | --- |
 | CPU | i7-12650H, 10 cores / 16 threads | KVM Intel, VT-x |
-| RAM | 32 GB nominal | Four build jobs initially; avoid disrupting existing VMs |
+| RAM | 32 GB nominal | Preserve memory headroom for existing VMs |
 | Display | Intel Alder Lake-P UHD 8086:46a3 | i915, internal eDP, intel_backlight |
 | Discrete GPU | RTX 3050 Mobile 10de:25a2 | Initial shell uses Intel; test NVIDIA separately |
 | Wi-Fi | Intel CNVi 8086:51f0 | iwlwifi/iwlmvm, linux-firmware |
@@ -16,7 +16,53 @@ Read-only inventory 2026-10-13; no serial numbers or machine identifiers.
 | Thunderbolt | Intel 8086:463e | thunderbolt |
 | Laptop controls | ASUS | asus_wmi, asus_nb_wmi |
 
-UEFI boot, Secure Boot currently disabled. Include vmd, nvme, xhci_pci,
-thunderbolt, usb_storage, sd_mod in boot coverage. Target physical refresh144Hz;
-actual guest frame delivery must be measured. About290GiB build storage free at
-inventory. Initial RAM headroom about10GiB with existing sessions running.
+Include vmd, nvme, xhci_pci, thunderbolt, usb_storage and sd_mod in boot coverage.
+Target physical refresh is 144 Hz; actual guest frame delivery requires measurement.
+
+## Read-only doctor and live functional checks
+
+Run `hydra doctor` from the Hydra live session, or `hydra doctor --json` to save
+structured observations. The command reads procfs/sysfs and checks service status;
+it does not connect networks, load modules, change brightness, play sound, mount
+storage, suspend, or start services. Root is not required. Missing tools, absent
+hardware, access failures and service timeouts are reported without aborting.
+
+Reports omit storage serials, PCI addresses, interface names, MAC/IP addresses,
+SSID, usernames, hostname and machine IDs. CPU facts include architecture, logical
+processor count and virtualization flags. Device facts include counts, capacities,
+allowlisted driver names and connector resolution modes. Unknown driver names are
+reported as `other`. Presence and status do not establish physical functionality.
+
+Reads are limited to 64 KiB per file, directory scans to 64 entries, connector
+modes to 32 lines, and seven service queries to one second each. Counts may be
+partial on systems exceeding these limits. Service output is discarded; exit
+status alone determines active/inactive/unavailable/unknown. User audio service
+queries refer to the user running the command. A root invocation can therefore
+observe a different user audio manager than the live desktop user.
+
+The following source-checkout smoke was observed on the running NixOS host on
+2026-10-13. It involved no changes to host settings or hardware. It is separate
+from Hydra ISO validation and does not certify the new image's laptop drivers.
+
+| Check | Doctor detects | Source-checkout host observation | Live functional check still needed |
+| --- | --- | --- | --- |
+| CPU / RAM | Architecture, logical CPUs, VM flags, memory totals | x86_64, 16 logical CPUs, `vmx`, 31,715 MiB RAM | Boot the Hydra image and compare |
+| Firmware | UEFI presence, Secure Boot variable | UEFI present, Secure Boot disabled | Confirm live boot from USB |
+| KVM | Device access and loaded KVM modules | `/dev/kvm` accessible, `kvm` and `kvm_intel` present | Launch a disposable VM from Hydra |
+| Storage | Whole-device count/capacity; no serials or identities | Visibility observed; no target selected | Identify any future installation target separately |
+| Graphics | PCI driver bindings and connector resolution modes | `i915`, `nvidia`; connected 1920×1080 mode | Select 144 Hz and verify actual refresh rate |
+| Input / brightness | Event devices, keyboard capabilities, backlight presence | 23 event devices, three keyboard-capable devices, one backlight | Test keyboard, touchpad and both brightness keys |
+| Wi-Fi / Ethernet | Device counts, wireless presence, driver bindings | One wireless device; `iwlwifi` and `e1000e` | Connect Wi-Fi and test connectivity; test Ethernet if used |
+| Audio | Card presence and user audio service status | Three cards; PipeWire, WirePlumber and PipeWire Pulse active | Test speakers, headphones and microphone recording |
+| Desktop / guest networking | Hydra and desktop service status | NetworkManager active; Hydra services absent on NixOS | Observe required services in the Hydra live session |
+| Suspend / USB | No functional probe | Not exercised | Suspend/resume, then retest graphics/network/audio; attach USB devices |
+
+Run the manual checks before deciding the image is ready for daily laptop use.
+Read-only diagnostics and disposable VM acceptance cannot replace these checks.
+Keep any report you share within its default structured output: unrelated logs,
+network commands and screenshots can contain private identifiers.
+
+Installation remains an explicit operator action; this document selects no disk
+or partition. Signed runtime rollback restores Hydra runtime files only. Offline
+Btrfs root/owned-EFI recovery has separate requirements and acceptance evidence
+in [system-recovery.md](../system-recovery.md).