Fixes #1031.

Problem

ValidateBlock treated ErrTxMissingParent and ErrTxNotFound from validateBlockSubtrees as consensus violations and persisted the block as invalid=true. Both are catchup-state conditions — the parent tx isn't in our store yet because we haven't absorbed its block. Once persisted invalid, the block can never be re-validated; sync stalls permanently at that height across restarts, recoverable only by manual UPDATE blocks SET invalid=false in Postgres. Hit on ttn-eu-4: one bad catchup window stamped 20 consecutive blocks invalid and wedged sync.

Fix

Principle: only genuine consensus failures persist invalid=true. Missing-data conditions return ErrBlockIncomplete, which catchup already retries against another peer. Safety direction holds — under-marking soft-stalls and retries (never accepts a bad block); over-marking permanently rejects good blocks (the bug).

Sites changed:

• validateBlockSubtrees classifier (BlockValidation.go) — ErrTxInvalid still persists invalid; ErrTxMissingParent/ErrTxNotFound now return ErrBlockIncomplete, not persisted.
• model.getParentTxMetaBlockIDs — a not-yet-present parent tx (and empty-BlockIDs) returns ErrBlockIncomplete instead of BlockInvalid. This also fixes the two untouched block.Valid consumers (optimistic-mining background path and reValidateBlock), which gate invalidation on ErrBlockInvalid.
• block.Valid consumers — the synchronous ValidateBlock handler no longer storeInvalidBlocks a transient; the gRPC ValidateBlock handler returns BlockIncomplete instead of BlockInvalid.
• Catchup classifier (Server.go) — extracted isUnvalidatablePeerError (= BlockInvalid || TxInvalid); transient errors no longer flag honest peers malicious or abandon peer-retry.
• checkParentInvalid — cascade left unchanged, now documented: with transient errors no longer persisting invalid, an invalid parent is invalid for a real consensus reason, so cascading is correct. (BlockHeaderMeta has no reason field to classify on anyway.)

Test plan

• go test -race -tags testtxmetacache ./services/blockvalidation/ ./model/ — green
• go build ./..., go vet — clean
• New tests: subtree-error classification (transient → incomplete + not persisted; ErrTxInvalid → persisted); model missing-parent → incomplete; synchronous + gRPC block.Valid transient → not persisted/returned invalid; isUnvalidatablePeerError table; parent-cascade regression guard.

Notes

• Deliberate tradeoff: a block that is both genuinely-invalid and incomplete surfaces BlockIncomplete (errgroup first-error) and is retried. Fails safe — never accepted; re-validation still catches the invalid tx once data resolves, or soft-stalls otherwise.
• Cosmetic: the new BlockIncomplete messages render %!s(MISSING) from a trailing : %s with no arg — matches the file's existing NewBlockInvalidError convention; the wrapped error chain still carries the real cause. Left for consistency.

Out of scope (follow-ups)

• legacy/netsync/handle_block.go blockExists early-return: doesn't re-validate an existing-but-invalid block (compounds the stall).
• Operator-facing recovery for already-poisoned DBs (the SQL stays a manual runbook).
• BlockHeaderMeta invalid-reason field that would enable richer parent-cascade classification.
• Pre-existing gRPC ValidateBlock infra-filter asymmetry (no storage/service/processing filter on that path).