milestone 21: abp list exceptions and a regex rule kind

docs/how-to/troubleshoot.md

@@ -401,12 +401,30 @@ snapshot loaded but has no sources in it. The line
 a source in the admin interface, or a `blocklist_sources` entry to the
 configuration file with a `group_sources` link naming a group.
 
+One name resolving while its neighbours are blocked is a third case, and
+`/api/lookup` answers it directly: it reports which level of the filtering
+ladder decided, and against what.
+
+```sh
+curl -s 'http://127.0.0.1:8080/api/lookup?domain=api.ads.tvb.com'
+```
+
+```json
+{"domain":"api.ads.tvb.com","group_id":1,"local_records":false,"forward_zone":null,"blocked":false,"reason":"blocklist_exception","matched":"api.ads.tvb.com","source_url":"https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt","safe_search_rewrite":null}
+```
+
+`blocklist_exception` means a downloaded list lifted that name with an `@@`
+line, and `source_url` names the list that did it. Nothing is broken, and the
+list is not overruling you: an exception cancels only what another list blocks.
+Your own rule wins over it. Adding an exact block rule for the same name and
+asking again reports `rule_block_exact`, `blocked` true and a null `source_url`.
+
 ## A database stamped by a newer binary
 
 **Symptom.** After putting an older binary back, it will not start:
 
 ```
-warning(migrations): config.db is at schema version 99; this nxdns binary supports 2
+warning(migrations): config.db is at schema version 99; this nxdns binary supports 4
 nxdns run failed: SchemaTooNew
 ```