(matched) is unknown after an undecided rule, so a catch-all leaves an unreadable file alone

1 files changed, 9 insertions, 6 deletions

diff --git a/internal/engine/facts.go b/internal/engine/facts.go
index f8fde89..89bd71b 100644
--- a/internal/engine/facts.go
+++ b/internal/engine/facts.go
@@ -132,6 +132,9 @@ type facts struct {
 	file scan.File
 
 	matched bool
+	// undecided: an earlier rule's condition was unknown (content krino
+	// could not read), so (matched) is unknown while none has matched.
+	undecided bool
 
 	contentDone bool            // extraction was attempted
 	contentErr  error           // why it failed
@@ -146,12 +149,12 @@ func newFacts(run *matchRun, file scan.File) *facts {
 	return &facts{run: run, file: file}
 }
 
-func (f *facts) Name() string       { return f.file.Name }
-func (f *facts) Rel() string        { return f.file.Rel }
-func (f *facts) Size() int64        { return f.file.Size }
-func (f *facts) ModTime() time.Time { return f.file.ModTime }
-func (f *facts) Now() time.Time     { return f.run.now }
-func (f *facts) Matched() bool      { return f.matched }
+func (f *facts) Name() string          { return f.file.Name }
+func (f *facts) Rel() string           { return f.file.Rel }
+func (f *facts) Size() int64           { return f.file.Size }
+func (f *facts) ModTime() time.Time    { return f.file.ModTime }
+func (f *facts) Now() time.Time        { return f.run.now }
+func (f *facts) Matched() (bool, bool) { return f.matched, f.undecided }
 
 // ContentContains answers a content test (spec §6.1). A file above
 // max-read is never read, cached or not. Before the file has been