From ccd6faf3d10da0669631fb3e3ba17a46b9e63a09 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukas@labunix.xyz>
Date: Tue, 15 Sep 2026 00:32:11 +0200
Subject: (matched) is unknown after an undecided rule, so a catch-all leaves
 an unreadable file alone

---
 internal/cond/eval.go | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

(limited to 'internal/cond/eval.go')

diff --git a/internal/cond/eval.go b/internal/cond/eval.go
index c9f7f75..31c54e3 100644
--- a/internal/cond/eval.go
+++ b/internal/cond/eval.go
@@ -24,7 +24,11 @@ type Facts interface {
 	// -1 when it contains none.
 	ContentContains(opt Options, keywords []string) (int, error)
 	Duplicate(dirs []string) (original string, ok bool, err error)
-	Matched() bool // an earlier rule matched this file
+	// Matched reports whether an earlier rule matched this file, and whether
+	// an earlier rule could not be decided (its condition was unknown): with
+	// no match and an undecided rule, (matched) is unknown (plan 11 review
+	// L6).
+	Matched() (matched, undecided bool)
 }
 
 // Result is the outcome of evaluating a Cond against one file's Facts.
@@ -154,6 +158,9 @@ func (c *Cond) eval(n *node, f Facts, ctx *evalCtx, negated bool) (tri, []string
 		}
 		return yes, []string{"not " + label}
 	default:
+		if m, undecided := f.Matched(); n.kind == kMatched && !m && undecided {
+			return unknown, nil
+		}
 		ok, reason, warn, caps := c.evalLeaf(n, f)
 		ctx.warn(warn)
 		if warn != "" && n.kind == kContent {
@@ -258,7 +265,7 @@ func (c *Cond) evalLeaf(n *node, f Facts) (ok bool, reason, warn string, caps []
 		return false, "", "", nil
 
 	case kMatched:
-		if f.Matched() {
+		if m, _ := f.Matched(); m {
 			return true, "matched", "", nil
 		}
 		return false, "", "", nil
@@ -348,7 +355,7 @@ func (c *Cond) explain(n *node, f Facts) *Trace {
 	default:
 		ok, _, warn, _ := c.evalLeaf(n, f)
 		t := &Trace{Label: n.label, Value: ok, Err: warn}
-		if warn != "" && n.kind == kContent {
+		if m, undecided := f.Matched(); (warn != "" && n.kind == kContent) || (n.kind == kMatched && !m && undecided) {
 			t.set(unknown)
 		}
 		return t
-- 
cgit v1.3