1 files changed, 20 insertions, 5 deletions
diff --git a/internal/engine/match.go b/internal/engine/match.go
index 08d75af..fedc053 100644
--- a/internal/engine/match.go
+++ b/internal/engine/match.go
@@ -146,8 +146,8 @@ func evalFile(run *matchRun, file scan.File) FileMatch {
 		for _, w := range res.Warnings {
 			fm.Warnings = append(fm.Warnings, "exclude: "+w)
 		}
-		if res.Match {
-			fm.Excluded = x.Text
+		if excluded := excludedBy(x, res); excluded != "" {
+			fm.Excluded = excluded
 			return fm
 		}
 	}
@@ -274,9 +274,10 @@ func (e *Engine) Explain(ctx context.Context, path string) (*Explanation, error)
 	excluded := ""
 	for _, x := range d.Excludes {
 		trace := x.Cond.Explain(f)
-		excludes = append(excludes, ExcludeTrace{Text: x.Text, Match: trace.Value, Trace: trace})
-		if trace.Value && excluded == "" {
-			excluded = x.Text
+		by := excludedBy(x, x.Cond.Eval(f))
+		excludes = append(excludes, ExcludeTrace{Text: x.Text, Match: by != "", Trace: trace})
+		if by != "" && excluded == "" {
+			excluded = by
 		}
 	}
 
@@ -309,6 +310,20 @@ func (e *Engine) cacheFingerprint(d *Dir) string {
 	return fmt.Sprintf("%s %s %s max-read=%d", e.Extract.Fingerprint(), norm.Fingerprint(), runtime.Version(), d.Settings.MaxRead)
 }
 
+// excludedBy is what x sets a file aside as, given its evaluation: its text
+// when it matched, its text marked "(content unreadable)" when a content
+// test it reached could not read the file - an exclude protects files, so
+// it fails closed (review M11) - or "" when it does not hold.
+func excludedBy(x *Exclude, res cond.Result) string {
+	switch {
+	case res.Match:
+		return x.Text
+	case res.Unreadable:
+		return x.Text + " (content unreadable)"
+	}
+	return ""
+}
+
 // cacheFile is d's keyword cache file.
 func (e *Engine) cacheFile(d *Dir) string {
 	return filepath.Join(e.CacheDir, d.Name+".cache")