docs(dns): record gfw foreign branch DoH change (W1N-62)

Document encrypted DoH upstream for mosdns foreign queries and note that
DoH traffic goes direct to hk2, not via OpenClash proxy.

docs/lan-dns-architecture.md

@@ -5,6 +5,19 @@
 > `nameserver`/`default-nameserver`(DIRECT 规则真实 IP 解析),处于活动链路,裁决第 5 条
 > 的"删除闲置 mosdns"前提不成立,处置改为"正式纳管并文档化"。
 > 相关:`docs/lan-overview.md`、`hosts/dns.windy.lan.md`、`hosts/gfw.windy.lan.md`、W1N-40。
+> 2026-08-13 (W1N-62):gfw mosdns 国外分支已从"明文国内公网 DNS"改为**加密 DoH**
+> (自建 `https://adg.chans.xyz/dns-query`,hk2),新增 `foreign_upstream`/`foreign_fallback`
+> (primary=DoH, secondary=明文国内 DNS, threshold 1000ms),`bootstrap` 用现有国内公网 IP
+> (防自举循环)。实测:mosdns 平面国外域名 A/AAAA 恢复(google AAAA `2607:f8b0…`)、
+> `dup.baidustatic.com`→`0.0.0.0`(AGH 拦截保留)、clash 7874 fake-ip 平面不变。
+> **重要修正(定稿)**:DoH 流量实测为 **gfw→hk2 直连,未经 clash 代理**——nft output 链
+> (mangle mark/tcp redirect)计数为 0、`/proc/net/tcp` 存在到 hk2:443 的 established
+> 连接,路由自身 TCP 输出当前并未被 OpenClash 重定向,故"经代理访问加密 DNS"的假设不成立。
+> **最终决策:接受直连,不强行走代理**——`foreign_upstream` 唯一指向自建解析器
+> `adg.chans.xyz`(hk2),自有 VPS 直连即可达、无被墙/污染问题、DoH/TLS 已加密、应答干净,
+> 走代理毫无增益反而把 DNS 平面耦合进 clash;实测 kill clash 期间国外查询 0.01s 正常应答,
+> watchdog 自动拉起,直连使 DNS 平面独立于代理(优于过代理)。
+> 备份:`config.yaml.bak-foreign-doh-20260813-103746` / `config.yaml.bak-foreign-doh-20260813-103813`。
 
 ## 1. 现状(实测 2026-08-12)
 

hosts/gfw.windy.lan.md

@@ -38,6 +38,21 @@ OpenClash runs `/etc/openclash/clash` (clash_meta core) with configuration
   > DIRECT lookups survive an AGH outage. Backups:
   > `config.yaml.bak-20260812` / `config.yaml.bak-fallback-20260812`. See
   > [docs/lan-dns-architecture.md](../docs/lan-dns-architecture.md) §1.
+  > 2026-08-13 (W1N-62): foreign branch now uses encrypted DoH
+  > `https://adg.chans.xyz/dns-query` (self-hosted, hk2) via new
+  > `foreign_upstream` / `foreign_fallback` plugins; non-CN queries → DoH,
+  > falls back to CN public DNS after 1000ms. `bootstrap` = existing CN public
+  > DNS IPs (no self-loop). Live-verified: google/youtube real IP + AAAA
+  > restored (2607:f8b0…), `dup.baidustatic.com` → `0.0.0.0` (AGH intercept
+  > kept), clash 7874 fake-ip plane unchanged. **Final decision (2026-08-13):
+  > DoH goes DIRECT to hk2, not via clash proxy** — `foreign_upstream` points
+  > only at the self-hosted resolver `adg.chans.xyz` (hk2), which is directly
+  > reachable and already encrypted (DoH/TLS) with clean answers, so forcing
+  > the proxy adds nothing and would couple the DNS plane to clash (nft output
+  > chains also show OpenClash does not currently redirect router-own TCP).
+  > Kill-test: foreign queries answered during clash outage, watchdog
+  > auto-restarted. Backups: `config.yaml.bak-foreign-doh-20260813-103746` /
+  > `config.yaml.bak-foreign-doh-20260813-103813`.
 - nft: OpenClash injects TPROXY/redirect + DNS-hijack rules into
   `table inet fw4`; a residual `table inet passwall` exists with 0 packets (unused)