plan 9: content excludes fail closed; krino.conf excludes checked without directories

1 files changed, 9 insertions, 1 deletions

diff --git a/docs/design.md b/docs/design.md
index bea0e2f..3f10623 100644
--- a/docs/design.md
+++ b/docs/design.md
@@ -199,6 +199,13 @@ as "excluded" in the plan, listed with the form that matched under `-v`,
 and traced by `explain`; `check` lists every directory's exclusions. Since
 no rule has run yet, `(matched)` is never true inside an exclude.
 
+An exclude fails closed: when evaluating it reaches a content test that
+cannot read the file (over `max-read`, a tool missing, failing or timing
+out), the exclude holds, and the file is set aside as "(content
+unreadable)" with the warning. An exclude protects files, so a file krino
+could not check is left alone. Mistakes in krino.conf's excludes are
+reported even while no directory is included.
+
 Unlike `ignore`, which never looks inside a file and never descends into an
 ignored directory, an exclude can test content and size, and is evaluated
 per file after the walk.
@@ -248,7 +255,8 @@ UTF-8 is replaced by U+FFFD before folding.
    `path`, then `duplicate`, then `content`. Content is extracted at most once per file,
    and only if evaluation reaches a `content` test.
 4. If a file's text cannot be extracted, `content` is false and the plan
-   shows a warning naming the rule that wanted it.
+   shows a warning naming the rule that wanted it. Inside an `exclude` the
+   whole exclude then holds instead (§4.6).
 
 ### 5.5 Duplicates