[maxmad64bis]

Stacked on #15141. Only the last commit is this PR's; I'll rebase once it lands.

⚠️ base-red inherited: #15306

Summary

An unchecked replacement can ship a broken core file. The core now checks the generated file with its own binary first: a pass swaps it in atomically, a miss leaves the adopted file alone and raises a warning instead.

Related Issues

• Related to feat(providers): generate the local proxy-core config from a subscription's nodes #14896
• Related to feat(proxy-subscription): generate the local proxy-core configuration (opt-in) #15141

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint — ESLint on the touched files is clean; the full run is red on the base (🔴 Release branch not green: release/v3.8.52 #15306)
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxySubscription.coreApply.test.ts (new, 21 tests: missing/unreadable binary with no execution, passing and failing native checks, slow binary killed on timeout, read-only target, identical content, trapped path as one argument, injected rename faults, preserved file mode)
• tests/unit/proxySubscription.coreConfigSync.test.ts (new cases: verify branch through the native check, each new case fails without the change, side-files removal on delete)
• tests/unit/proxy-subscriptions-route-validation.test.ts (new cases: binary path validation on create and update)
• Attack paths in tests (/tmp/attacker/sing-box as refused coreBinaryPath) are intentional refusal proofs, not real paths.

Coverage Notes

• src/lib/proxySubscription/coreConfig/apply.ts — covered by proxySubscription.coreApply.test.ts and proxySubscription.coreConfigSync.test.ts (branch + removal)
• src/lib/proxySubscription/coreConfig/sync.ts — covered by proxySubscription.coreConfigSync.test.ts (verify branch, each new case fails without the change)
• src/lib/proxySubscription/coreConfig/pathGuard.ts — covered by proxySubscription.coreApply.test.ts and proxy-subscriptions-route-validation.test.ts
• src/lib/proxySubscription/subscriptionService.ts, src/lib/proxySubscription/schema.ts — covered by proxySubscription.coreApply.test.ts and proxy-subscriptions-route-validation.test.ts
• src/app/(dashboard)/dashboard/settings/components/proxy/SubscriptionTab.tsx — covered indirectly through the subscription routes

Reviewer Notes

• Behavior: Deleting a subscription removes its adopted and beside files here (plus tests).
• Merge: Migration counters stay with the release train (fix(proxies): steer selector to members without recent refusals #14804). The file-size ceiling move for the service wiring is documented in config/quality/file-size-baseline.json. Merge after feat(proxy-subscription): generate the local proxy-core configuration (opt-in) #15141 lands (the generation step calls this check; this PR adds 198_proxy_subscription_core_binary.sql and keeps the number while feat(proxy-subscription): reload the proxy core after a verified config replacement #15238/feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295 hold the same slot: the one that lands second renumbers). This PR shares AGENTS.md, README.md, llm.txt and docs/i18n/*/llm.txt (counters + mirrors) with feat(proxy-subscription): generate the local proxy-core configuration (opt-in) #15141, feat(proxy-subscription): reload the proxy core after a verified config replacement #15238 and feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295: one stack, parent-first merge, no parallel lines. Overlaps: either order with fix(proxy-subscription): report internal core config failure distinctly #15377, fix(proxy-health): skip sweep probes already proven by recent production successes #14805, feat(proxies): accept operator-provided dated egress observations for pool members #15314, feat(i18n): forward the optional reasoning control in the translation backend #15462, feat(proxy-subscription): reload the proxy core after a verified config replacement #15238 and feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295, with a rebase on conflict.

[maxmad64bis]

Closing as already covered by #15564, now on release/v3.8.52.

The stack (#15141, #15142, #15238, #15295) was squashed there: src/lib/proxySubscription/coreConfig/{model,renderers,singbox,sync,apply,reload}.ts, the changelog fragments for these PRs and the matching proxySubscription.core*.test.ts suites are on the tip, with later changes on top. What this branch adds is already merged, so it can only conflict with the tip now.