Harden scanner accounting and expose controlled scan reports

tests/cli.rs

@@ -45,3 +45,55 @@ fn test_json_output() {
         .stdout(predicate::str::contains("\"entry_type\":\"File\""))
         .stdout(predicate::str::contains("\"path\":"));
 }
+
+#[test]
+fn missing_path_fails_without_a_success_report() {
+    let dir = TempDir::new().unwrap();
+    Command::new(env!("CARGO_BIN_EXE_sized"))
+        .arg(dir.path().join("missing"))
+        .args(["--format", "json"])
+        .assert()
+        .failure()
+        .stdout(predicate::str::is_empty())
+        .stderr(predicate::str::contains("cannot scan"));
+}
+
+#[cfg(unix)]
+#[test]
+fn partial_scan_has_nonzero_status_and_explicit_json_flag() {
+    use std::{fs, os::unix::fs::PermissionsExt};
+    let dir = TempDir::new().unwrap();
+    let blocked = dir.path().join("blocked");
+    fs::create_dir(&blocked).unwrap();
+    fs::set_permissions(&blocked, fs::Permissions::from_mode(0o000)).unwrap();
+    let result = std::panic::catch_unwind(|| {
+        assert!(
+            fs::read_dir(&blocked).is_err(),
+            "permission tests require an unprivileged user"
+        );
+        Command::new(env!("CARGO_BIN_EXE_sized"))
+            .arg(dir.path())
+            .args(["--format", "json"])
+            .assert()
+            .failure()
+            .stdout(predicate::str::contains("\"complete\":false"))
+            .stderr(predicate::str::contains("incomplete scan"));
+    });
+    fs::set_permissions(blocked, fs::Permissions::from_mode(0o700)).unwrap();
+    result.unwrap();
+}
+
+#[cfg(unix)]
+#[test]
+fn dangling_symlink_is_a_valid_scan_target() {
+    use std::os::unix::fs::symlink;
+    let dir = TempDir::new().unwrap();
+    let path = dir.path().join("dangling");
+    symlink(dir.path().join("missing"), &path).unwrap();
+    Command::new(env!("CARGO_BIN_EXE_sized"))
+        .arg(path)
+        .args(["--format", "json"])
+        .assert()
+        .success()
+        .stdout(predicate::str::contains("\"complete\":true"));
+}