Struct RuleHits 

pub struct RuleHits<'a> {
    pub hits: Vec<&'a str>,
    pub withheld: Vec<&'static str>,
}

⟨0.24⟩ What one §6.2 deny/pure rule DOES to one function’s signature — see rule_hits.

Fields

hits: Vec<&'a str>

The effects this rule CHARGES on this function, after both narrowing filters. Empty ⇒ the rule does not fire here, which is what the disclosure calls PASSING.

withheld: Vec<&'static str>

The filters — "Unknown" / "Net" — that had no evidence to read, in that order. The hit was dropped from hits AND the fact rides out, because dropping it silently is the mirror defect.