iOS 5.2.0: in-place subscription routing-profile update that ADDS BlockSites breaks the tunnel ("xRay core error"); identical profile via manual onadd link works

[malbolgeunshackled]

Environment: Happ iOS 5.2.0 (App Store), iPhone. Subscription: base64 VLESS config list; routing profile delivered via the routing: happ://routing/onadd/<base64> response header (as per dev-docs).

Summary: Adding a BlockSites field to a subscription-delivered routing profile breaks the tunnel with "xRay core error" — but only when the profile is applied as an in-place update of the existing subscription-bound profile. The byte-identical profile JSON added manually as a new profile via a happ://routing/onadd/ link connects and blocks correctly.

Steps to reproduce:

1. A subscription serves a routing profile without BlockSites: GlobalProxy: "true", DirectSites (a couple of geosite: categories plus a few dozen explicit domain: entries), DirectIp: ["geoip:ru"], DomainStrategy: "IPIfNonMatch", Geositeurl/Geoipurl → Loyalsoldier/v2ray-rules-dat via jsdelivr, LastUpdated. Everything works.
2. The server adds "BlockSites": ["geosite:category-ads"] (small curated category, ~850 domains, present in the dataset) between DomainStrategy and Geositeurl.
3. In the app: "Update subscription" → the profile is updated in place (same Name).
4. Connect → "xRay core error EQF. Tunnel failed to start due to a critical error…" (short variant, no memory hint).

Ruled out:

• Dataset: category-ads is present in the live geosite.dat (verified by parsing the protobuf); force re-downloading the per-profile geo files → still fails.
• Profile content: the exact same JSON (the full DirectSites list + BlockSites + Geositeurl/Geoipurl/LastUpdated), added as a new manual profile via an onadd link and activated → connects, and BlockSites actually blocks a test domain.
• Stale profile state: deleted the subscription entirely and re-added it (profile recreated fresh, without BlockSites — works), then repeated steps 2–3 on this clean profile → same error.
• In-place updates as such: an earlier in-place update that ADDED the Geositeurl/Geoipurl/LastUpdated keys to this same profile applied fine — the breakage appears specific to adding BlockSites in-place.

Context (possibly separate issues): the same generic dialog appears for two other distinguishable causes we hit while debugging: a profile referencing a category absent from the dat (short text), and BlockSites: ["geosite:category-ads-all"] (168k domains → "…reduce memory usage", Network Extension memory limit). The dialog not distinguishing causes made this hard to diagnose.

Expected: an in-place subscription update adding BlockSites should behave the same as a freshly added identical profile.

Happy to provide any additional details or logs.