docs(dns): record mosdns sequence misconfig found+fixed (W1N-56)

docs/lan-dns-architecture.md

@@ -28,6 +28,15 @@
 - gfw DNS 链:`server=127.0.0.1#7874`(dnsmasq)→ clash:`nameserver: [127.0.0.1:6052]`(mosdns)、
   `default-nameserver: [127.0.0.1:6052]`、`nameserver-policy` 国外域名 → DoH `https://1.1.1.1/dns-query`、
   `enhanced-mode: fake-ip`(198.18.0.1/16)、`ipv6: false`;nft 有 UDP/53 hijack → dnsmasq。
+- **mosdns 配置缺陷(2026-08-12 发现并修复)**:`main` sequence 的国内分支
+  (`matches: qname $domestic_domains → exec: $domestic_upstream`)之后**缺少
+  `matches: has_resp → accept` 守卫**。mosdns v5 的 `sequence` 在 `forward` 成功后不会停止,
+  只有 `accept`/`reject`/`return` 或错误会终止——因此命中 `geosite_cn` 的查询会被转发**两次**
+  (AGH 与 223.5.5.5/119.29.29.29),最终应答来自最后一个 forward(国内公网 DNS),**AGH 的
+  拦截/rewrite 对 DIRECT 国内域名静默失效**。实测证据:`dup.baidustatic.com`(在 `geosite_cn`
+  且在 AGH 拦截表)经 mosdns 返回真实 IP `183.60.227.49` 而非 `0.0.0.0`。已修复(备份
+  `/etc/mosdns/config.yaml.bak-20260812`),修复后同一域名返回 `0.0.0.0`,taobao/google 解析
+  与 clash 链均无回归。**§6 的二期示例同款缺陷已一并修正。**
 - AGH rewrites(实测):`hass.windy.lan`/`hass.local` → `192.168.55.11`;`dns.windy.lan` → `.36`;
   `ubnt.windy.lan` → `.46`;`gfw.windy.lan` → `.1`;`nas.windy.local` → `.32`。
 - 拦截:仅启用 **AdGuard DNS filter**(filter_1);实测 `doubleclick.net`/`googleadservices.com` → `0.0.0.0`。
@@ -110,6 +119,8 @@ plugins:
     type: sequence
     args:
       - exec: cache 1024            # 缓存加速
+      - matches: has_resp
+        exec: accept
       # 国内分流:命中 geosite:cn → 国内 DoH
       - matches: [ qname &geosite:cn ]
         exec: forward https://dns.alidns.com/dns-query
@@ -122,6 +133,10 @@ plugins:
     args: { entry: main, listen: "127.0.0.1:5353" }
 ```
 
+> **注意**:`sequence` 中每个 `forward` 分支之后必须跟 `matches: has_resp → accept`
+> (或改用 `goto`/`jump` + `return` 结构),否则查询会继续执行后续规则被二次转发,
+> 最终应答来自最后一个 forward——gfw 上 mosdns 的同类缺陷(2026-08-12)已实测并修复(见 §1)。
+
 要点:
 - 上游可加 `upstream` 的 `concurrent > 1` 与多地址故障切换;mosdns 自带 cache,能保证上游故障时
   缓存命中仍即时应答(对应 §8 认定的降级缺口)。

hosts/gfw.windy.lan.md

@@ -30,6 +30,12 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
   (`/etc/mosdns/config.yaml`): domestic domains → AGH `.36:53`, foreign →
   `223.5.5.5`/`119.29.29.29` (Chinese public DNS). mosdns is **not** in the
   client query path — LAN/VLAN10 clients receive fake-ip from clash :7874.
+  > 2026-08-12: fixed missing `has_resp → accept` guard after the domestic
+  > branch in `/etc/mosdns/config.yaml` (domestic queries were double-forwarded,
+  > final answer came from CN public DNS, bypassing AGH blocking/rewrites;
+  > verified via `dup.baidustatic.com` before/after). Backup:
+  > `/etc/mosdns/config.yaml.bak-20260812`. See
+  > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1.
 - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
   `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)