fix: complete target diagnostics and reset inspection

internal/app/maintenance_test.go

@@ -43,6 +43,28 @@ func (f *maintenanceTarget) DiagnosticChecks(context.Context, *profile.Profile)
 	return append([]target.Check(nil), f.checks...)
 }
 
+type staleFailureTarget struct{ inspectCalls int }
+
+func (*staleFailureTarget) ID() string                      { return "stale" }
+func (*staleFailureTarget) Description() target.Description { return target.Description{Name: "stale"} }
+func (*staleFailureTarget) Availability(context.Context) target.Availability {
+	return target.Availability{Available: true}
+}
+func (*staleFailureTarget) Confirmation(bool) string { return "" }
+func (f *staleFailureTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
+	f.inspectCalls++
+	if f.inspectCalls == 1 {
+		return target.Inspection{State: target.Enabled, Evidence: "initial managed state"}
+	}
+	return target.Inspection{State: target.External, Evidence: "fresh evidence http://alice:secret@proxy.example:8080"}
+}
+func (*staleFailureTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
+	return target.OperationResult{
+		Inspection: target.Inspection{State: target.Drifted, Evidence: "stale returned evidence"},
+		Err:        errors.New("failed https://bob:hunter2@proxy.example/path"),
+	}
+}
+
 type recordingLock struct{ held, acquired int }
 
 func (l *recordingLock) Lock(context.Context) (func(), error) {
@@ -111,6 +133,22 @@ func TestApplicationSerializesAndLogsTargetMutations(t *testing.T) {
 	}
 }
 
+func TestResetFailureUsesFreshInspectionForResultAndRedactedLog(t *testing.T) {
+	adapter := &staleFailureTarget{}
+	log := &recordingLog{}
+	result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, log).Reset(context.Background(), true)
+	if result.Err == nil || adapter.inspectCalls != 2 || len(result.Targets) != 1 {
+		t.Fatalf("reset result=%#v inspect calls=%d", result, adapter.inspectCalls)
+	}
+	got := result.Targets[0].Inspection
+	if got.State != target.External || !strings.Contains(got.Evidence, "fresh evidence") || strings.Contains(got.Evidence, "stale") {
+		t.Fatalf("failure inspection = %#v", got)
+	}
+	if len(log.entries) != 1 || !strings.Contains(log.entries[0].Detail, "fresh inspection External") || strings.Contains(log.entries[0].Detail, "secret") || strings.Contains(log.entries[0].Detail, "hunter2") {
+		t.Fatalf("failure log = %#v", log.entries)
+	}
+}
+
 func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
 	good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
 	failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")