diff --git a/docs/lan-dns-architecture.md b/docs/lan-dns-architecture.md
index 37e7bee..67f65e7 100644
--- a/docs/lan-dns-architecture.md
+++ b/docs/lan-dns-architecture.md
@@ -37,6 +37,11 @@
   且在 AGH 拦截表)经 mosdns 返回真实 IP `183.60.227.49` 而非 `0.0.0.0`。已修复(备份
   `/etc/mosdns/config.yaml.bak-20260812`),修复后同一域名返回 `0.0.0.0`,taobao/google 解析
   与 clash 链均无回归。**§6 的二期示例同款缺陷已一并修正。**
+  同日追加加固:`domestic_fallback`(fallback 插件:`primary: domestic_upstream`(AGH)、
+  `secondary: default_upstream`(223.5.5.5/119.29.29.29)、`threshold: 500ms`)使 AGH 宕机时
+  DIRECT 国内真实 IP 查询回退国内公网 DNS,不再直接报错;实测:AGH 停止时缓存未命中查询由
+  fallback 应答(NXDOMAIN/真实 IP),AGH 恢复后主路径即时应答且拦截(`0.0.0.0`)恢复。
+  备份:`/etc/mosdns/config.yaml.bak-fallback-20260812`。
 - AGH rewrites(实测):`hass.windy.lan`/`hass.local` → `192.168.55.11`;`dns.windy.lan` → `.36`;
   `ubnt.windy.lan` → `.46`;`gfw.windy.lan` → `.1`;`nas.windy.local` → `.32`。
 - 拦截:仅启用 **AdGuard DNS filter**(filter_1);实测 `doubleclick.net`/`googleadservices.com` → `0.0.0.0`。
diff --git a/hosts/gfw.windy.lan.md b/hosts/gfw.windy.lan.md
index a0a4a5d..a3aa7f0 100644
--- a/hosts/gfw.windy.lan.md
+++ b/hosts/gfw.windy.lan.md
@@ -33,8 +33,10 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
   > 2026-08-12: fixed missing `has_resp → accept` guard after the domestic
   > branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded,
   > final answer came from CN public DNS, bypassing AGH blocking/rewrites;
-  > verified via `dup.baidustatic.com` before/after). Backup:
-  > `/etc/mosdns/config.yaml.bak-20260812`. See
+  > verified via `dup.baidustatic.com` before/after); added `domestic_fallback`
+  > (fallback plugin: primary=AGH, secondary=CN public DNS, 500ms) so domestic
+  > DIRECT lookups survive an AGH outage. Backups:
+  > `config.yaml.bak-20260812` / `config.yaml.bak-fallback-20260812`. See
   > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1.
 - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
   `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)