Rule priority: why order decides everything

The rule engine has one iron law: match top to bottom, first hit wins, stop. There is no "more specific rule wins" — only "earlier rule wins".

Case 1: a broad rule placed too early

- DOMAIN-KEYWORD,google,Proxy
- DOMAIN,dl.google.com,DIRECT   # never reached

The intent was to keep Chrome updates direct (they have local CDN), but the KEYWORD rule above swallows everything containing "google", so line two is dead code. Swap the two lines and it works.

Case 2: a catch-all in the middle

- GEOIP,CN,DIRECT
- DOMAIN-SUFFIX,steamcommunity.com,Proxy  # may never fire

If steamcommunity resolves to a domestic CDN IP, GEOIP matches first and the domain rule below never runs. Geo catch-alls (GEOIP, MATCH) belong at the very end of the list.

A solid ordering template

1. LAN / private ranges → DIRECT;
2. Explicit exceptions (force-direct / force-proxy / REJECT for specific domains);
3. Bulk domain rules (rule sets);
4. GEOIP,CN,DIRECT;
5. MATCH catch-all.