docs: update client routing notes

AGENTS.md

@@ -6,21 +6,25 @@ Use Simplified Chinese to answer my questions.
 ## Documentation Rules
 
 1. 根目录维护 `ARCHITECTURE.md`，描述整体架构、系统边界、分层职责、关键数据流、设计决策、文档链接
-2. 设计调整需同步更新 `ARCHITECTURE.md` 和相关包的 `README.md` 等文档。
-3. 大型方案设计、决策过程及实施进度在 `docs/` 目录下维护文档，推进开始、结束一个阶段时更新文档记录
+2. 设计调整前先更新 `ARCHITECTURE.md` 和相关包的 `README.md` 等文档。
+3. 大型方案设计、决策过程及实施进度在 `docs/` 目录下维护文档，有关键进展需更新文档
 
 ## Coding Agent Rules
 
-1. 代码变更后使用语言的格式化、lint 工具检查代码质量
+1. 禁止修改 `AGENTS.md`，除非用户在当前任务中明确要求
 2. 需求模糊时先提问澄清，不要猜测
 3. 禁止未授权的重构，避免扩大修改面
 4. 日志和输出中的敏感信息需脱敏
 5. 构建时注入版本和日期信息
 6. 谨慎引入第三方依赖，说明引入原因
-7. 代码简洁，避免过早设计和不必要抽象
-8. 英文注释，仅注释复杂逻辑
-9. git 使用 commitizen 规范，英文提交信息
-10. 按需构建单元测试、集成测试
+7. 代码变更后使用语言的格式化、lint 工具检查代码质量
+8. 遵循 KISS 原则，优先简单直接的实现；抽象必须服务于复用、测试或隔离复杂度
+9. 代码逻辑中有错误、不合理就指出、改掉，不要轻易加兜底逻辑
+10. 遵循 Let it Crash 原则，优先返回错误而非隐藏、兜底、屏蔽错误
+11. 英文注释，仅注释复杂逻辑、约束和非显然设计决策
+12. git 使用 commitizen 规范，英文提交信息
+13. commit 前先执行 lint format 操作，确保代码质量、风格一致
+14. 代码模块需要有单元测试、集成测试
 
 ## Design Preferences
 

ARCHITECTURE.md

@@ -54,9 +54,12 @@
 4. Resolve the effective upstream DNS server, falling back to the configured fallback DNS when needed.
 5. Build the upstream dialer for the configured remote transport, using standard TLS by default and optional uTLS fingerprints for `sower` and `trojan`.
 6. Build the router with suffix-tree rules and optional country CIDRs.
-7. Start enabled local listeners for `udp/53`, `tcp/80`, `tcp/443`, and `tcp/1080`.
+   Remote rule files are fetched through the configured upstream proxy dialer, never by direct outbound HTTP, so rule bootstrap uses the same stable egress path as proxied traffic.
+   Remote domain rule files are filtered through per-router `file_skip_rules` before their prefixed entries are appended.
+7. Start enabled local listeners for `udp/53`, `tcp/80`, `tcp/443`, and `tcp/1080` only after rule loading completes.
 8. For DNS requests, return local proxy IPs for proxy-routed domains and query upstream DNS for direct domains.
-9. For HTTP traffic, parse the target host from the request line. For HTTPS transparent traffic, peek the TLS ClientHello to extract SNI without terminating TLS locally. For SOCKS5 traffic, read the SOCKS5 target address. Apply routing rules and either dial directly or wrap traffic in the configured upstream transport.
+9. For HTTP traffic, parse the target host from the request line. For HTTPS transparent traffic, peek the TLS ClientHello to extract SNI. For SOCKS5 traffic, read the SOCKS5 target address. Apply routing rules and either dial directly or wrap traffic in the configured upstream transport.
+   HTTPS transparent proxying reads only the TLS ClientHello, then replays the untouched bytes to the selected upstream; it must not complete or terminate TLS locally.
 10. On shutdown signal, stop listeners and DNS servers through `context` propagation.
 
 ## sowerd Data Flow
@@ -86,11 +89,14 @@
 ## Design Decisions
 
 - Client and server both fail fast on invalid startup configuration instead of silently degrading.
+- The client loads TOML by default, with YAML kept as an alternate file format; HCL is not supported.
 - Sensitive configuration values must never be printed verbatim in logs.
 - Local listeners use explicit shutdown hooks instead of blocking forever with unmanaged goroutines.
 - Network operations use timeouts and `context` to limit hangs during dialing and remote rule downloads.
 - Upstream TLS behavior is configured only on the client side; `sowerd` remains a normal TLS server and does not need uTLS-specific logic.
-- Rule loading supports local files and remote gzip-compressed HTTP sources.
+- Rule loading supports local files and remote HTTP sources; remote downloads must use the configured upstream proxy and fail startup if the proxy path cannot fetch them.
+- Domain rule files support per-router skip rules for filtering third-party file entries without removing explicit local rules.
+- Country routing treats `router.country.mmdb` as optional; an empty value disables GeoIP lookup and keeps CIDR-based matching active without startup warnings.
 - Fake site directory mode is loopback-only on port `80` to avoid exposing local static assets directly to the public internet.
 - `sowerd` prefers the user cache directory for ACME state, but falls back to `/var/cache/sower` so systemd services can start without `HOME`/`XDG_CACHE_HOME` or a config file.
 
@@ -100,7 +106,7 @@
 - `sowerd` must bind privileged ports `80` and `443`.
 - `sowerd -i` also requires root because it writes system-level files for self-deployment.
 - ACME mode requires port `80` to be reachable from the public internet.
-- Remote rule download failures stop startup after bounded retries.
+- Remote rule download failures stop startup after bounded retries before local listeners are exposed.
 
 ## Related Documents
 

README.md

@@ -48,18 +48,26 @@ There are two ways to run the sowerd service:
 
 ## Sower
 
-A config file is required on the sower client side. [Here](https://github.com/sower-proxy/sower/wiki/sower.hcl) is a usable example in China.
+A config file is required on the sower client side. `sower.toml` is the default packaged example.
 
 `Sower` will bind 4 ports by default with root permission. They are: `udp(53)` / `tcp(80)` / `tcp(443)` / `tcp(1080)`.
 
+When DNS-based HTTPS proxying is enabled, `sower` listens on local `443/tcp`, reads the TLS ClientHello only to extract SNI, and forwards the original TLS stream to the selected upstream without terminating TLS.
+
 For `sower` and `trojan` upstreams, `remote.addr` now accepts either `host` or `host:port`. Optional `remote.tls` settings let the client override SNI, skip certificate verification, or use a uTLS client fingerprint such as `chrome` or `firefox`.
 
+Remote domain rule files can be filtered with per-router skip rules. For example, use `file_skip_rules = ["t.co"]` in the TOML `[router.block]` section to ignore a third-party blocklist entry while keeping explicit local `rules` intact.
+
+Remote rule files are downloaded through the configured upstream proxy, not through direct outbound HTTP. `sower` loads these rules before exposing local listeners, so an unreachable upstream proxy or rule URL fails startup instead of starting with incomplete routing state.
+
+`router.country.mmdb` is optional. Leave it empty to disable GeoIP lookup and use only configured CIDR rules for country-based direct routing.
+
 After doing the next three steps, you can enjoy the intelligent transparent proxy solution:
 
 1. Run the command with root permission:
 
     ```shell
-    # sower -f sower.hcl
+    # sower -c sower.toml
     ```
 
 2. Change your DNS server to `127.0.0.1`.