Function rule_applies 

fn rule_applies(
    rule: &FwRule,
    exe: &str,
    need: Need,
    category: Category,
    local_ips: &[Ipv4Addr],
) -> bool

An ALLOW counts only when every field is evaluable and says yes: counting one we cannot evaluate would claim coverage we cannot prove. A BLOCK is the opposite case, handled in coverage_with: skipping one we cannot evaluate would lean toward Covered, the very direction the unreadable-means-unknown rule forbids (ReAgent on #4151).