Approve

Correct, minimal, well-tested fix for the boot-path regression from #844. The gate-skip is keyed on the right discriminator (priorState == IDLE), preserving protection on the two source states (LEGACYSYNCING, CATCHINGBLOCKS) that actually carry an "I'm caught up" claim.

Strengths

• Surgical change. 8 lines of fix, ~120 lines of test — the right ratio for a state-machine gate.
• Test coverage hits the right matrix. All three RUN-permitted source states × (below-checkpoint, at-or-above-checkpoint), plus an assertion that the FSM remains in the source state on rejection — that last one would catch a future regression if someone flipped the order of gate vs. Event().
• Test plumbing is correct. newTestBlockchainForGate now provides notifications, stats (needed for SendNotification's tracing.WithParentStat(b.stats)), initPrometheusMetrics() (needed for the enter_state gauge write), and a buffered-channel drainer so the FSM callback can publish without blocking. .Maybe() on the store mock is the right call — IDLE sources never reach GetBestBlockHeader.

Optional follow-ups (non-blocking)

1. Comment misrepresents the safety mechanism. The new comment on Server.go:2598-2604 says:

…the legacy service already suppresses tx relay while FSM != RUNNING (#843) so the original bad-txns-vout-p2sh ban concern does not regress.

But after this fix the FSM does reach RUNNING, at which point peer_server.go:2612's gate (IsFSMCurrentState(RUNNING)) permits relay. The real safety argument is structural: while FSM was IDLE, #843 prevented mempool accumulation, so the mempool is empty at the moment of transition — there is nothing pre-Genesis to relay. Worth rewording so future readers don't think the cited mechanism is what protects the new path.

2. Operator-bypass surface worth acknowledging. Idle() emits STOP, which moves RUNNING/LEGACYSYNCING → IDLE while preserving the tip. An operator calling setfsmstate idle then setfsmstate running on a partially-synced node (e.g., tip 600000) bypasses the gate — explicitly accepted by the "IDLE with tip 100 still below checkpoint succeeds" case. This is a deliberate design choice (and #843's mempool clearing during IDLE makes it tolerable), but the test name doesn't flag it as such. Consider renaming to something like "IDLE bypasses gate even with non-zero tip (operator override path)" or expanding the test-block comment.

3. Minor: drainer goroutine lifetime. t.Cleanup(func() { close(done) }) signals shutdown but doesn't wait. Harmless today (each subtest gets its own Blockchain), but a future refactor that shares state across subtests would inherit cross-talk. Not a blocker.

Verdict: ship it. The two comment-level suggestions can land in a follow-up if convenient.