feat(blocking): log the matched rule in the block reason

[0xERR0R]

Closes #1458. Fresh implementation superseding the stalled #1489.

What

When a query is blocked, the response reason now names the specific rule that matched per group:

BLOCKED (gr1: domain1.com)
BLOCKED CNAME (ads: *.docler.com)
BLOCKED IP (defaultGroup: 123.145.123.145)
BLOCKED (gr1: a.com, gr2: b.com)        # multiple groups, sorted by group

instead of only the group (BLOCKED CNAME (ads)). With large aggregated lists this turns a manual list-bisection into a one-line log read.

Because the rule rides in the existing response reason, it surfaces everywhere that field already flows — the file/DB/console query log, the debug log, and the EDE EXTRA-TEXT returned to clients when ede.enable is set. No query-log schema change, and the feature is always on.

How

The matched rule is threaded up the existing match stack; only return types change:

Layer	Before	After
trie.HasParentOf	bool	([]labels, bool)
stringcache leaf contains→findMatch	bool	(rule, ok)
GroupedStringCache.Contains (+ chained)	[]string	map[group]rule
lists.Matcher.Match	[]string	map[group]rule
BlockingResolver.matches	[]string	map[group]rule

The reason is formatted once via a new formatBlockReason helper, sorted by group for deterministic output.

Performance

The rule is produced only on a match. Both the grouped-cache maps and the trie's label slice are built only on the matching path, so the common no-match path stays allocation-free. Wildcard benchmark (all-hits worst case): +8% bytes vs main; the miss path (production-common) does not allocate.

Relative to #1489

Same idea, but this resolves the issues that stalled it:

• API-shape deadlock → findMatch (rule, ok) (idiomatic comma-ok, name no longer implies a pure boolean)
• non-deterministic multi-group reason → formatter sorts groups
• no rule-value tests → positive rule-value assertions added at every layer (trie, leaf caches, grouped/chained, lists, resolver, EDE)
• duplicated BLOCKED (...) formatting → single helper
• hot-path allocation → zero-alloc miss path
• trie hard-coding the . separator → trie returns labels, caller joins
• + bug fix: *.docler.com is now reported correctly (Log blocking rule in resolver #1489 dropped the TLD label and the *. prefix, reporting e.g. docler instead)

Tests

go test ./... (all packages) ✓ · gofmt ✓ · go vet ✓ · golangci-lint 0 issues ✓

[codecov]

Codecov Report

❌ Patch coverage is 95.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.10%. Comparing base (e7958e0) to head (4d58335).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
resolver/blocking_resolver.go	89.47%	1 Missing and 1 partial ⚠️
resolver/ede_resolver.go	75.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2091      +/-   ##
==========================================
- Coverage   86.12%   86.10%   -0.02%     
==========================================
  Files         113      113              
  Lines        8532     8551      +19     
==========================================
+ Hits         7348     7363      +15     
- Misses        952      954       +2     
- Partials      232      234       +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR enhances Blocky’s blocking diagnostics by including the specific matched rule (per list group) directly in the existing responseReason string for blocked responses, making it easier to identify the exact denylist entry responsible without changing the query-log schema.

Changes:

• Thread matched-rule information through the matching stack (trie → caches → grouped/chained caches → list matcher → blocking resolver), changing return types to carry group -> rule.
• Add a deterministic formatBlockReason helper (sorted by group) and update resolver logic + tests to assert the new reason formatting and EDE extra text behavior.
• Update documentation to describe the richer responseReason and EDE extra text contents for blocked queries.

Reviewed changes

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
trie/trie.go	Changes HasParentOf to return matched labels for reconstructing the stored entry on match.
trie/trie_test.go	Updates trie tests for new return signature and adds reconstruction assertions.
cache/stringcache/string_caches.go	Reworks leaf caches to return (rule, ok) on match; wildcard cache reconstructs and reports *. rule.
cache/stringcache/string_caches_test.go	Updates cache tests to assert returned rule values (string/regex/wildcard).
cache/stringcache/string_caches_benchmark_test.go	Updates benchmarks to use findMatch instead of boolean-only matching.
cache/stringcache/in_memory_grouped_cache.go	Changes grouped-cache matching to return map[group]rule with lazy allocation on matches.
cache/stringcache/in_memory_grouped_cache_test.go	Updates grouped-cache tests to assert group -> rule results for string/regex/wildcard caches.
cache/stringcache/grouped_cache_interface.go	Updates GroupedStringCache.Contains signature to return map[group]rule.
cache/stringcache/chained_grouped_cache.go	Aggregates matches across chained caches into a map[group]rule (lazy allocation).
cache/stringcache/chained_grouped_cache_test.go	Updates chained-cache tests for the new map[group]rule return shape.
lists/list_cache.go	Updates Matcher.Match to return map[group]rule and forwards results from grouped cache.
lists/list_cache_test.go	Updates list-cache tests to validate group presence using map keys.
resolver/blocking_resolver.go	Switches matching to map[group]rule and formats block reasons via formatBlockReason (sorted groups).
resolver/blocking_resolver_test.go	Updates resolver expectations for new reason strings and adds formatter determinism tests.
resolver/ede_resolver_test.go	Asserts blocked EDE extra text includes the matched rule in the reason string.
docs/configuration.md	Documents that blocked responseReason and EDE extra text include matched group: rule details.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.