[GarageDeveloper]

Three fixes for a VPN chained through another one that routes names by domain.

• Routes by domain stay out of a chained VPN's networks. The chain exception now goes one way only. An address inside a VPN this one goes through is expected. An address inside a VPN that goes through this one belongs to that VPN: the host route here used to take its traffic. When a session registers its routes, the other sessions also hand over the routes by domain that fall inside its networks or on its gateway. A full tunnel connected afterwards takes none of them.
• A refused address is retried later. When another session routes an address, it now waits with its name and expiry. It gets its route by domain once no other session carries it. This matters because macOS keeps the DNS answer cached, so the name may not be asked again.
• A chained VPN no longer removes the other VPN's route to its gateway. If the VPN it goes through already has a host route to that gateway, the chained VPN no longer adds or removes it. macOS keeps only one copy of the route, so removing it when the chained VPN disconnected cut the first VPN's route, and the chained VPN could not reconnect.

Unit tests cover the registry rules and the waiting list. Tested by hand on macOS with an L2TP VPN and an OpenVPN chained through it, connecting and disconnecting the chained one alone.

🤖 Generated with Claude Code