fix: harden Shell Target recovery and storage

internal/target/targettest/contract.go

@@ -4,6 +4,7 @@ package targettest
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -21,6 +22,7 @@ type Fixture struct {
 	PermissionFailure func(*testing.T) target.OperationResult
 	PartialFailure    func(*testing.T) target.OperationResult
 	RedactionFailure  func(*testing.T) target.OperationResult
+	RecoveryRetry     func(*testing.T) (target.OperationResult, target.OperationResult, target.OperationResult)
 	Secret            string
 }
 
@@ -84,12 +86,24 @@ func Run(t *testing.T, factory Factory) {
 			t.Fatalf("permission failure = %#v", permission)
 		}
 		partial := fixture.PartialFailure(t)
-		if partial.Err == nil || partial.Inspection.State != target.External {
+		if partial.Err == nil || partial.Inspection.State != target.Drifted {
 			t.Fatalf("partial failure = %#v", partial)
 		}
+		first, retry, disabled := fixture.RecoveryRetry(t)
+		if first.Err == nil || first.Inspection.State != target.External || retry.Err != nil || retry.Inspection.State != target.Enabled || disabled.Err != nil || disabled.Inspection.State != target.External {
+			t.Fatalf("recovery retry transaction = first %#v, retry %#v, disable %#v", first, retry, disabled)
+		}
+
 		redacted := fixture.RedactionFailure(t)
-		if redacted.Err == nil || fixture.Secret == "" || strings.Contains(redacted.Err.Error(), fixture.Secret) {
-			t.Fatalf("secret was not redacted: %#v", redacted)
+		if redacted.Err == nil || fixture.Secret == "" {
+			t.Fatalf("redaction failure = %#v", redacted)
+		}
+		for current := redacted.Err; current != nil; current = errors.Unwrap(current) {
+			for _, rendered := range []string{current.Error(), fmt.Sprintf("%v", current), fmt.Sprintf("%+v", current), fmt.Sprintf("%#v", current)} {
+				if strings.Contains(rendered, fixture.Secret) {
+					t.Fatalf("secret in error chain representation %q", rendered)
+				}
+			}
 		}
 	})
 }