## ADDED Requirements

### Requirement: Surge rules route China domains to DIRECT
The reference Surge configuration SHALL use Sukka's China domain rulesets to route China-destined domain traffic to `DIRECT`, bypassing all proxies.

#### Scenario: China domain hits DIRECT
- **WHEN** a client request matches Sukka's China domain ruleset (e.g., `DOMAIN-SET,https://ruleset.skk.moe/List/domainset/cn.conf`)
- **THEN** Surge routes it via `DIRECT` policy
- **THEN** the traffic connects without going through any proxy

### Requirement: Surge rules route China IPs to DIRECT
The reference Surge configuration SHALL use Sukka's China IP ruleset to route China IP CIDR traffic to `DIRECT`.

#### Scenario: China IP hits DIRECT
- **WHEN** a client request resolves to a China IP matching Sukka's China IP ruleset (e.g., `RULE-SET,https://ruleset.skk.moe/List/ip/domestic.conf`)
- **THEN** Surge routes it via `DIRECT` policy

### Requirement: China rules are placed after service-specific rules
The China direct rules SHALL be placed after AI and streaming service rules in the Surge configuration, so that AI/streaming traffic still routes through the chain even if the destination IP is in China.

#### Scenario: AI service with China CDN still goes through chain
- **WHEN** a request to an AI service domain matches the AI ruleset
- **AND** the destination IP happens to be in a China range
- **THEN** the AI ruleset matches first (higher priority) and routes through Chain
- **THEN** the China IP rule does not override the AI routing

### Requirement: China domain rules appear before China IP rules
The China `DOMAIN-SET` and `non_ip` rules SHALL appear before the China `ip` rules, following Sukka's prescribed ordering to maintain DNS protection.

#### Scenario: Correct ordering within China rules
- **WHEN** the Surge config is loaded
- **THEN** China `DOMAIN-SET` and `non_ip` entries appear before any China `ip` entries