Exempt testdata only on filesystem scans, never detector crashes

An image's paths are chosen by whoever built it, so a /testdata/ path in an
image no longer hides a coverage gap. Only real files on a filesystem scan
earn the test-fixture exemption, and a file a detector crashed on is always
a gap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: devGregA

SNAPSHOT

@@ -3,4 +3,4 @@ php2shell-scan: no commits yet; source/ and image/ copied 2026-10-21
 Engine-only changes since the copy (port these back to emudhra-scan and php2shell-scan):
 - internal/archive: PyInstaller zlib entries cap the untrusted ulen hint at clen*1032+1024, and read() copies a short single chunk so a lying hint cannot keep a large allocation alive
 - internal/source: readOne opens with O_NOFOLLOW|O_NONBLOCK and checks the opened file is the same regular file the walk saw
-- internal/engine: a detector panic on one file is contained and reported as not scanned; archive members named testdata/ no longer escape the coverage gap count (emudhra-scan's report.Gaps has the same exemption)
+- internal/engine: a detector panic on one file is contained and reported as not scanned; the testdata/ exemption from the coverage-gap count applies only to real files on a filesystem scan, never image paths, archive members or detector crashes (emudhra-scan exempts testdata/ everywhere)

internal/engine/engine.go

@@ -119,6 +119,7 @@ type File struct {
 type Skip struct {
 	Path   string
 	Reason string
+	failed bool // set by the engine when the detector panicked
 }
 
 // TargetContext is what a detector can ask about the rest of the target when

internal/engine/engine_test.go

@@ -188,7 +188,11 @@ func TestRegistry(t *testing.T) {
 }
 
 func TestGaps(t *testing.T) {
-	tg := &Target{Skipped: nil}
+	img := &Target{Type: Image, Skipped: []source.Skip{skip("/src/testdata/bad.pem", "unparseable", false)}}
+	if g := img.Gaps(); g != 1 {
+		t.Errorf("image gaps %d, want 1: image paths never earn the fixture exemption", g)
+	}
+	tg := &Target{Type: Filesystem}
 	tg.Skipped = append(tg.Skipped,
 		skip("/proc", "excluded: pseudo-filesystem", true),
 		skip("/x/testdata/bad.pem", "unparseable", false),
@@ -201,14 +205,14 @@ func TestGaps(t *testing.T) {
 
 // A detector that panics on one file loses that file, not the scan.
 func TestDetectorPanicIsContained(t *testing.T) {
-	root := tree(t, map[string][]byte{"bad": []byte("x"), "good": []byte("y")})
+	root := tree(t, map[string][]byte{"testdata/bad": []byte("x"), "good": []byte("y")})
 	seen := &[]string{}
 	p := &panicky{fake: fake{id: "t-panic", seen: seen}}
 	tg := ScanFS([]Detector{p}, root, Options{AsRoot: true})
 	if tg.Error != "" || len(*seen) != 1 || (*seen)[0] != "/good" {
 		t.Fatalf("error %q seen %v", tg.Error, *seen)
 	}
-	if len(tg.Skipped) != 1 || tg.Skipped[0].Path != "/bad" || tg.Gaps() != 1 {
+	if len(tg.Skipped) != 1 || tg.Skipped[0].Path != "/testdata/bad" || tg.Gaps() != 1 {
 		t.Fatalf("the panicking file must be a coverage gap: %+v", tg.Skipped)
 	}
 }
@@ -217,7 +221,7 @@ type panicky struct{ fake }
 
 func (p *panicky) NewScan(TargetKind) Scan { return p }
 func (p *panicky) Visit(f File) []Skip {
-	if f.Path == "/bad" {
+	if f.Path == "/testdata/bad" {
 		panic("hostile input")
 	}
 	return p.fake.Visit(f)

internal/engine/run.go

@@ -47,9 +47,11 @@ func (t *Target) Count(v Verdict) int {
 func (t *Target) Gaps() int {
 	n := 0
 	for _, s := range t.Skipped {
-		// The test-fixture exemption applies to real paths only: names inside an
-		// archive are chosen by whoever built it, so they never earn it.
-		fixture := strings.Contains(s.Path, "/testdata/") && !strings.Contains(s.Path, "!/")
+		// The test-fixture exemption applies only to paths the operator controls:
+		// real files on a scanned filesystem. Image paths and archive member names
+		// are chosen by whoever built them, and a detector failure is never exempt.
+		fixture := t.Type == Filesystem && strings.Contains(s.Path, "/testdata/") &&
+			!strings.Contains(s.Path, "!/") && !s.DetectorFailed
 		if s.Excluded || strings.HasPrefix(s.Reason, "excluded:") || fixture {
 			continue
 		}
@@ -198,7 +200,7 @@ func (w *walker) send(f File, skip func(int) bool) {
 			continue
 		}
 		for _, sk := range w.visitSafely(i, s, f) {
-			w.t.Skipped = append(w.t.Skipped, source.Skip{Path: sk.Path, Reason: sk.Reason})
+			w.t.Skipped = append(w.t.Skipped, source.Skip{Path: sk.Path, Reason: sk.Reason, DetectorFailed: sk.failed})
 		}
 	}
 }
@@ -208,7 +210,7 @@ func (w *walker) send(f File, skip func(int) bool) {
 func (w *walker) visitSafely(i int, s Scan, f File) (skips []Skip) {
 	defer func() {
 		if r := recover(); r != nil {
-			skips = []Skip{{Path: f.Path, Reason: fmt.Sprintf("detector %s failed on this file (%v); not checked", w.dets[i].Manifest().ID, r)}}
+			skips = []Skip{{Path: f.Path, Reason: fmt.Sprintf("detector %s failed on this file (%v); not checked", w.dets[i].Manifest().ID, r), failed: true}}
 		}
 	}()
 	return s.Visit(f)

internal/source/source.go

@@ -34,6 +34,9 @@ type Skip struct {
 	// Excluded is true for deliberate exclusions (pseudo-filesystems, container
 	// storage), which do not make a scan incomplete.
 	Excluded bool `json:"excluded,omitempty"`
+	// DetectorFailed is true when a detector crashed on the file. It is
+	// always a coverage gap.
+	DetectorFailed bool `json:"detector_failed,omitempty"`
 }
 
 // Options control what is read.