Approve with changes. Core consensus migration is correct (strict ValidLockTime matches bitcoin-sv IsFinalTx, BIP68 -1 matches CalculateSequenceLocks, finality selection matches ContextualCheckBlock, T7 zero-txid aligns to bitcoin-sv IsNull). BDK migration coverage at cdfa78 confirmed. Fix the items below before merge:

P0 — era-routing branch is untested. validateTransactions decides between CandidateBlockTime and CandidateParentMedianTime based on blockHeightUint32 < CSVHeight. All PreValidateTransactions unit tests pass literal 0, 0 for both — only the soft-fall path is exercised, never the era-selection logic the PR introduces. TestSyncManager_validateTransactions is t.Skip()'d. Add two table cases (pre-CSV and post-CSV heights) that assert the era-correct field is set.

P1 — silent zero on height conversion (services/legacy/netsync/handle_block.go:1187). The if blockHeightUint32, hErr := ...; hErr == nil { ... } block silently drops both candidateBlockTime and candidateParentMedianTime to zero on failure → soft-fall (the path this PR is eliminating). Outer guard at line 1216 catches the error today, but the duplicate conversion is fragile. Convert once at top and return the error immediately, matching validateTransactionsLegacyMode:654.

P1 — walkParentChain breaks silently on nil header (handle_block.go:773 + check_block_subtrees.go:1243). When GetBlockHeader returns (nil, meta, nil) the loop breaks and the caller computes a median from however many headers were collected — no error. Near genesis this is correct, mid-chain on transient cache miss it silently yields an incomplete MTP. Treat (nil, _, nil) as an error inside walkParentChain, or only tolerate short returns when blockHeight < 11.

P1 — CheckSubtreeFromBlock peer-priority path leaves CandidateParentMedianTime unpopulated (services/subtreevalidation/Server.go:759-780). Mainline paths close the finality-MTP race; peer-priority falls back to tip MTP. Two nodes processing the same subtree under different tip-MTP snapshots can diverge on finality. The request has PreviousBlockHash — call fetchCandidateParentMedianTime(ctx, req.GetPreviousBlockHash()) here too.

Discussion (non-blocking):

• Strict < ValidLockTime flip is consensus-correct vs bitcoin-sv. Confirm TTN history doesn't contain a boundary-equality tx mined into a block — if clean, no further action.
• BDK migration boundary under-tested in teranode: no startup-config panic test, no e2e fee-reject through mapBDKValidationError. BDK side is covered; add the teranode bridge tests.

P2s (extract walkParentChain to shared package, deduplicate MTP fetch, HTTP parse warnings, InsufficientFee wire-divergence with sv-node) are tracked in the review notes — happy to file follow-up issues.

Approval

Solid work — the design is well-reasoned, doc comments are top-tier, and test pinning is more thorough than most consensus-affecting PRs. Approving with a recommendation to address the three silent-failure / contract concerns below before merge. The rest of the review notes are reasonable follow-ups.

Please address before merge

1. walkParentChain should not silently truncate on nil headers (services/legacy/netsync/handle_block.go:145-167, also duplicated in services/subtreevalidation/check_block_subtrees.go)

if header == nil {
    break
}

BIP113 MTP requires exactly 11 headers. An early break silently computes MTP over a smaller window. Gated by blockHeight >= CSVHeight so unreachable on mainnet, but on regtest or test setups walking close to genesis this produces a wrong MTP. Return an error when the loop terminates with fewer than depth headers due to a nil response.

2. extractValidationParams silently ignores ParseUint errors (services/validator/Server.go:737-746)

if v, err := strconv.ParseUint(candidateBlockTimeStr, 10, 32); err == nil {
    options.CandidateBlockTime = uint32(v)
}

A malformed value (candidateBlockTime=abc) leaves the field at 0 and silently degrades to skip-finality (pre-CSV) or tip-MTP fallback (post-CSV). Add a warn log on parse failure so future regressions on the HTTP fallback path don't ship silently.

3. selectFinalityComparisonTime post-CSV soft-fall masks caller bugs (services/validator/Validator.go:324-358)

The post-CSV default arm soft-falls to blockState.MedianTime when CandidateParentMedianTime == 0. The doc comment correctly states this is reserved for CheckSubtree, but a block-validation caller that forgets to populate the field gets the soft-fall instead of a hard error — exactly the asynchronous-MTP race this whole change exists to eliminate.

Consider enforcing the contract in the API rather than via documentation. Options:

• A required-field flag (Options.RequireCandidateParentMedianTime) that block-validation callers set
• A separate validator entry point (ValidateForBlock) that requires the field
• A distinguished sentinel ("explicitly unset") so the soft-fall only fires when explicitly opted into

Documentation-only contracts on async race-prone paths tend to erode.

Other notes (non-blocking)

The full review with positive observations and additional non-blocking items (helper duplication, missing panic-path tests, comment placement in CheckSubtree, MinConsolidationInputMaturity not wired, consensus-tightening notes) is in a separate comment.

Re-reviewed at 9a53d36ff. All blocking items from my previous review and ordishs's three are fixed — verified, not just acknowledged:

• Era-routing now tested (TestCandidateFinalityTimesForBlock_EraSelection, pre/post-CSV + boundary).
• Height conversion done once + error returned; silent-zero path gone.
• walkParentChain hard-errors on nil header / nil link in both the netsync and subtreevalidation copies — no more silent short-window MTP.
• CheckSubtreeFromBlock populates CandidateParentMedianTime on the peer path, behind the existing parent-resolution check (no peer-DoS).
• selectFinalityComparisonTime post-CSV soft-fall removed — a caller that doesn't populate the field now hard-errors instead of silently falling back to tip MTP. Right fix.
• extractValidationParams warns on parse failure.

Core consensus re-confirmed (strict < IsFinalTx, BIP68 −1, era selection); build/vet/tests clean; BDK pin unchanged at cdfa78.

One thing before merge, not a code change: confirm TTN block history has no already-mined boundary-equality (locktime == limit) tx — the strict < flip would reject such a block on revalidation. Mainline is safe by construction.

Non-blocking follow-ups, fine as separate issues: teranode-side BDK boundary tests (startup-config panic + e2e fee-reject; BDK side is already covered), a "don't expose externally" guard on the HTTP candidate-time params, and extracting the duplicated walkParentChain helper. Approving.