fix: finish progressive Target detection

internal/shell/shell.go

@@ -207,33 +207,45 @@ func (a *Adapter) DiagnosticChecks(_ context.Context, _ *profile.Profile) []targ
 }
 
 func (a *Adapter) Detect(ctx context.Context, active *profile.Profile) target.Detection {
-	return target.Detection{Availability: a.Availability(ctx), Inspection: a.Inspect(ctx, active)}
+	inspection, err := a.inspect(active)
+	return target.Detection{Availability: a.Availability(ctx), Inspection: inspection, Err: redactError(err, active)}
 }
 
+// Inspect retains the maintenance contract: it always returns the safest
+// state supported by the evidence. Detect adds the suppressed read error so an
+// interactive check cannot present unreadable state as a successful result.
 func (a *Adapter) Inspect(_ context.Context, active *profile.Profile) target.Inspection {
+	inspection, _ := a.inspect(active)
+	return inspection
+}
+
+func (a *Adapter) inspect(active *profile.Profile) (target.Inspection, error) {
 	metadata, managed, metadataErr := a.readRecovery()
 	generated, generatedErr := a.files.ReadFile(a.configuration.EnvironmentFile)
 	if managed || (metadataErr != nil && !errors.Is(metadataErr, fs.ErrNotExist)) {
 		if metadataErr != nil {
-			return target.Inspection{State: target.Drifted, Evidence: "managed Shell recovery metadata cannot be read"}
+			return target.Inspection{State: target.Drifted, Evidence: "managed Shell recovery metadata cannot be read"}, fmt.Errorf("inspect Shell recovery metadata: %w", metadataErr)
 		}
 		if generatedErr != nil {
-			return target.Inspection{State: target.Drifted, Evidence: "managed Shell environment is missing or unreadable"}
+			return target.Inspection{State: target.Drifted, Evidence: "managed Shell environment is missing or unreadable"}, fmt.Errorf("inspect managed Shell environment: %w", generatedErr)
 		}
 		if active != nil && fingerprint(generated) == metadata.Fingerprint && fingerprint(renderEnabled(*active)) == metadata.Fingerprint {
-			return target.Inspection{State: target.Enabled, Evidence: "managed Shell environment matches the Active Profile"}
+			return target.Inspection{State: target.Enabled, Evidence: "managed Shell environment matches the Active Profile"}, nil
 		}
-		return target.Inspection{State: target.Drifted, Evidence: "managed Shell environment does not match the Active Profile"}
+		return target.Inspection{State: target.Drifted, Evidence: "managed Shell environment does not match the Active Profile"}, nil
+	}
+	if generatedErr != nil && !errors.Is(generatedErr, fs.ErrNotExist) {
+		return target.Inspection{State: target.Disabled, Evidence: "Shell environment could not be inspected"}, fmt.Errorf("inspect Shell environment: %w", generatedErr)
 	}
 	if generatedErr == nil && recognizesProxy(generated) {
-		return target.Inspection{State: target.External, Evidence: "recognized proxy assignments exist in the Shell environment file"}
+		return target.Inspection{State: target.External, Evidence: "recognized proxy assignments exist in the Shell environment file"}, nil
 	}
 	for _, name := range proxyVariables {
 		if value, ok := a.environment.LookupEnv(name); ok && value != "" {
-			return target.Inspection{State: target.External, Evidence: "recognized proxy variable " + name + " exists"}
+			return target.Inspection{State: target.External, Evidence: "recognized proxy variable " + name + " exists"}, nil
 		}
 	}
-	return target.Inspection{State: target.Disabled, Evidence: "no recognized Shell proxy configuration detected"}
+	return target.Inspection{State: target.Disabled, Evidence: "no recognized Shell proxy configuration detected"}, nil
 }
 
 func (a *Adapter) SetDesired(ctx context.Context, enabled bool, active *profile.Profile) target.OperationResult {

internal/shell/shell_test.go

@@ -80,6 +80,24 @@ func TestShellDiagnosticsRejectSymlinkedPathsWithoutTouchingVictim(t *testing.T)
 	}
 }
 
+func TestDetectClassifiesMalformedRecoveryMetadataAsFailure(t *testing.T) {
+	a := newAdapter(t, "/bin/bash", nil)
+	if err := os.MkdirAll(filepath.Dir(a.RecoveryPath()), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(a.RecoveryPath(), []byte("{malformed"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	detection := a.Detect(context.Background(), activeProfile())
+	if detection.Err == nil || detection.Inspection.State != target.Drifted {
+		t.Fatalf("detection = %#v, want failed Drifted inspection", detection)
+	}
+	if got := a.Inspect(context.Background(), activeProfile()); got.State != target.Drifted {
+		t.Fatalf("maintenance inspection = %#v, want established Drifted semantics", got)
+	}
+}
+
 func TestShellAvailabilitySupportsOnlyBashAndZsh(t *testing.T) {
 	for _, tc := range []struct {
 		shell     string