Distinguish three states
Not matched, matched and not evaluated are different states. The teaching model finds the first match in order. Real cores also depend on protocol, rule types and policy context.
Suffixes need a domain boundary
In this model DOMAIN-SUFFIX,example.com,PROXY matches api.example.com. notexample.com does not match merely because its ending is similar. DOMAIN compares the complete domain.
Compare before changing order
A preceding MATCH stops later evaluation in the finite model. The checker gives conservative notes without reordering or deleting covered rules. Ruleset comparison does not prove equivalence.
Scope and sources
This is general guidance based on upstream documentation, without invented device tests or shared-client UI steps. Consult the original documentation for specific versions.