milestone 5: blocklist filtering, local records and conditional forwarding

PLAN.md

@@ -271,14 +271,18 @@ Walk chain to depth 8; any target hitting block logic → synthesize blocked res
 
 ### 7.1 Evaluation
 
-For `{domain, qtype, group_id}`:
+For `{domain, group_id}` (the qtype travels with the query for logging and response synthesis, not
+for matching):
 1. Normalize: lowercase, trim trailing dot.
 2. Build candidate chain (full, parent1, parent2, …).
-3. Explicit rules per §3.10 precedence.
-4. Group's blocklist domains (hash set over compiled lists).
-5. Group's blocklist wildcards.
+3. Explicit rules per §3.10 precedence, evaluated against every candidate in the chain.
+4. Group's blocklist domains (hash set over compiled lists), matched against the query name only.
+5. Group's blocklist wildcards, matched against every proper parent of the query name.
 6. No match → allow.
 
+Blocklist entries do not parent-walk; only rules do (§3.9). ABP `||x.y^` emits both a domain entry
+`x.y` and a wildcard entry `x.y`, which together give domain-and-subdomains semantics.
+
 ### 7.2 Group Assignment
 
 - Per source IP: (1) exact match in `clients`, (2) longest-prefix match in `client_prefixes` (ties: longer prefix, then priority), (3) `default` group.
@@ -287,7 +291,12 @@ For `{domain, qtype, group_id}`:
 
 ### 7.3 Reload
 
-New immutable matcher built from DB + compiled list files → atomic pointer swap (RCU, generation counter). Readers lock-free.
+New immutable matcher built from DB + compiled list files → swap under an `std.Io.RwLock` with a
+generation counter. Readers take the shared lock for the microseconds of one evaluate; the writer
+takes the exclusive lock only for the swap, and the source status table is installed in the same
+critical section, so a failed reload publishes neither. (Deliberate deviation from "readers
+lock-free": freeing the old snapshot without a lock needs epoch-based reclamation, unjustifiable at
+household scale — see specs/milestone-5.md S8.3.)
 
 ### 7.4 Safe-Search