(matched) is unknown after an undecided rule, so a catch-all leaves an unreadable file alone

1 files changed, 6 insertions, 0 deletions

diff --git a/internal/engine/match.go b/internal/engine/match.go
index c252596..2ef3ae1 100644
--- a/internal/engine/match.go
+++ b/internal/engine/match.go
@@ -169,6 +169,9 @@ func evalFile(run *matchRun, file scan.File) FileMatch {
 		for _, w := range res.Warnings {
 			fm.Warnings = append(fm.Warnings, r.Name+": "+w)
 		}
+		if res.Unreadable {
+			f.undecided = true
+		}
 		if !res.Match {
 			continue
 		}
@@ -316,6 +319,9 @@ func (e *Engine) Explain(ctx context.Context, path string) (*Explanation, error)
 		}
 		trace := r.Cond.Explain(f)
 		match := trace.Value
+		if trace.Unknown {
+			f.undecided = true
+		}
 		if match {
 			f.matched = true
 			matched = append(matched, RuleMatch{Rule: r})