fix: finish progressive Target detection

internal/dockerdaemon/dockerdaemon.go

@@ -184,8 +184,9 @@ func (a *Adapter) detect(ctx context.Context) (target.Availability, error) {
 }
 
 func (a *Adapter) Detect(ctx context.Context, active *profile.Profile) target.Detection {
-	availability, err := a.detect(ctx)
-	return target.Detection{Availability: availability, Inspection: a.Inspect(ctx, active), Err: err}
+	availability, availabilityErr := a.detect(ctx)
+	inspection, inspectionErr := a.inspect(active)
+	return target.Detection{Availability: availability, Inspection: inspection, Err: errors.Join(availabilityErr, redact(inspectionErr, active))}
 }
 
 func parseProperties(output string) map[string]string {
@@ -209,27 +210,43 @@ type recovery struct {
 }
 
 func (a *Adapter) Inspect(_ context.Context, active *profile.Profile) target.Inspection {
+	inspection, _ := a.inspect(active)
+	return inspection
+}
+
+func (a *Adapter) inspect(active *profile.Profile) (target.Inspection, error) {
 	metadata, managed, metadataErr := a.readRecovery()
 	data, configErr := a.files.ReadFile(a.configuration.DaemonConfigPath)
 	if managed || (metadataErr != nil && !errors.Is(metadataErr, fs.ErrNotExist)) {
 		if metadataErr != nil {
-			return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon recovery metadata cannot be read"}
+			return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon recovery metadata cannot be read"}, fmt.Errorf("inspect Docker daemon recovery metadata: %w", metadataErr)
 		}
 		if configErr != nil {
-			return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon configuration is missing or unreadable"}
+			return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon configuration is missing or unreadable"}, fmt.Errorf("inspect managed Docker daemon configuration: %w", configErr)
+		}
+		if err := validateConfigSchema(data); err != nil {
+			return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon configuration is malformed"}, fmt.Errorf("inspect managed Docker daemon configuration: %w", err)
 		}
 		if fingerprint(data) == metadata.ConfigFingerprint && active != nil {
 			normalized, err := compatible(*active)
 			if err == nil && configMatchesProfile(data, normalized) {
-				return target.Inspection{State: target.Enabled, Evidence: "managed Docker daemon configuration matches the Active Profile"}
+				return target.Inspection{State: target.Enabled, Evidence: "managed Docker daemon configuration matches the Active Profile"}, nil
 			}
 		}
-		return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon configuration does not match the Active Profile"}
+		return target.Inspection{State: target.Drifted, Evidence: "managed Docker daemon configuration does not match the Active Profile"}, nil
 	}
-	if configErr == nil && recognizesProxy(data) {
-		return target.Inspection{State: target.External, Evidence: "recognized proxy settings exist in Docker daemon configuration"}
+	if configErr != nil && !errors.Is(configErr, fs.ErrNotExist) {
+		return target.Inspection{State: target.Disabled, Evidence: "Docker daemon configuration could not be inspected"}, fmt.Errorf("inspect Docker daemon configuration: %w", configErr)
 	}
-	return target.Inspection{State: target.Disabled, Evidence: "no recognized Docker daemon proxy configuration detected"}
+	if configErr == nil {
+		if err := validateConfigSchema(data); err != nil {
+			return target.Inspection{State: target.Disabled, Evidence: "Docker daemon configuration could not be inspected"}, fmt.Errorf("inspect Docker daemon configuration: %w", err)
+		}
+		if recognizesProxy(data) {
+			return target.Inspection{State: target.External, Evidence: "recognized proxy settings exist in Docker daemon configuration"}, nil
+		}
+	}
+	return target.Inspection{State: target.Disabled, Evidence: "no recognized Docker daemon proxy configuration detected"}, nil
 }
 
 func (a *Adapter) SetDesired(ctx context.Context, enabled bool, active *profile.Profile) target.OperationResult {

internal/dockerdaemon/dockerdaemon_test.go

@@ -219,6 +219,24 @@ func TestDiagnosticServiceControlAuthorityUsesInjectedEUIDWithoutMutation(t *tes
 	}
 }
 
+func TestDetectClassifiesMalformedDaemonConfigurationAsFailure(t *testing.T) {
+	a, _, daemonPath, _, _ := fixture(t)
+	if err := os.MkdirAll(filepath.Dir(daemonPath), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(daemonPath, []byte(`{"proxies":[]}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	detection := a.Detect(context.Background(), activeProfile())
+	if detection.Err == nil || detection.Inspection.State != target.Disabled {
+		t.Fatalf("detection = %#v, want failed Disabled inspection", detection)
+	}
+	if got := a.Inspect(context.Background(), activeProfile()); got.State != target.Disabled {
+		t.Fatalf("maintenance inspection = %#v, want established Disabled semantics", got)
+	}
+}
+
 func TestDiagnosticsAndEnableRejectMalformedDaemonProxyTypesWithoutMutation(t *testing.T) {
 	for _, document := range []string{
 		`[]`,