[maxmad64bis]

Stacked on #15238. Only the last commit is this PR's; it rebases once the parent lands.

⚠️ base-red inherited: #15306

Summary

A single node rejected by core verification used to block the whole refresh, leaving the subscription stale until the source changed. The verifier discarded the entire candidate on one failure with no way to say which node caused it. Now the check can name the offending node, which is pruned (recorded as skipped) and verification retried, up to 8 times, so the remaining nodes still apply with a warning.

Related Issues

• Related to feat(proxy-subscription): reload the proxy core after a verified config replacement #15238

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint — No new ESLint warnings is green
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• New proxySubscription.corePruneRejected suite (10 cases, injected check runner): 1 rejected of 3, 2 rejected over 2 rounds, bound reached, error with no named node, unowned position, all-pruned stops before empty, attempt budget, resolver registry, adapter mapping incl. first-match and out-of-range (all 10 fail without the change, pass with it).
• Neighbours coreConfigSync + coreApply: 31/31 green; touched-file suites 4/4 green; full unit run 15/15 green.
• File reads in tests compare adopted content before/after through the real generation unit (same oracle pattern as the parent tests).

Coverage Notes

• src/lib/proxySubscription/coreConfig/sync.ts: prune loop, warning helper, round runner, and model filter — covered by the 10 new cases (single prune, double prune, bound, unnamed error, unowned position, all-pruned stop, budget).
• src/lib/proxySubscription/coreConfig/apply.ts: offending propagation through the existing outcome return — covered by the same 10 cases via the injected check runner (all 10 fail without the change, pass with it).
• src/lib/proxySubscription/coreConfig/renderers.ts + singbox.ts: resolver registry and adapter mapping (first-match, out-of-range, unowned) — covered by the registry and adapter cases.
• Complexity ratchets: 0 new violations vs the parent base.
• Rebased on the current release base; focused tests rerun.

Reviewer Notes

• Merge: On the parent base this PR is exactly 1 commit with a clean tree; the 3 commits above release are the stacked parent chain, expected for a stacked PR. Two checks stay red from the stacked parents, not from this commit: file-size (openapi.generated.ts, subscriptionService.ts, same failure on feat(proxy-subscription): verify the generated core configuration before replacing the file #15142) and mutation-test-coverage (third-party modules missing from stryker.conf). The docs-all delta is only the new migration counter, left to the maintainer. Either order with fix(proxy-subscription): report internal core config failure distinctly #15377, with a rebase on conflict.
• Follow-up: Future track (wanted and tested): when the attempt bound is hit after prunes already happened, the warning reports the check failure without the accumulated prune count; the server-side log keeps the per-round trace. Changing that would alter the specified bound behaviour, so it stays as is.

[diegosouzapw]

Closing as already covered by #15564, now on release/v3.8.52.

src/lib/proxySubscription/coreConfig/sync.ts has MAX_PRUNE_ATTEMPTS and the bounded prune-after-rejected-verification loop. tests/unit/proxySubscription.corePruneRejected.test.ts is on the tip.

Thanks @maxmad64bis.