Function coverage_with 

pub fn coverage_with(
    rules: &[FwRule],
    exe: &str,
    needs: &[Need],
    category: Category,
    settings: ProfileSettings,
    local_ips: &[Ipv4Addr],
) -> Coverage

Does category’s profile let LAN peers reach exe on every need?

Order, as Windows applies it: a profile with the firewall off filters nothing; “block all incoming” beats every allow; a matching block rule beats any allow; then, with a default inbound action of Allow, nothing more is needed; otherwise every need must have a matching allow rule.