engineapi: defer V3 payloadAttributes checks until head is VALID

[yperbasis]

Summary

• Hive engine-cancun / Invalid PayloadAttributes, Missing BeaconRoot, Syncing=True (Cancun) (test 376 of this run) was failing because Erigon validated parentBeaconBlockRoot before the SYNCING short-circuit and returned -38003 when the head was unknown.
• Split validatePayloadAttributes into request-level (pre-FCU) and point-(8)-extension (post-FCU) halves so the spec-mandated ordering is preserved on both the SYNCING and VALID paths.
• The fix that motivated engineapi: validate payloadAttributes before SYNCING short-circuit #20728 (hive engine-withdrawals / Empty Withdrawals (Paris)) still passes — its check (V2 wrong withdrawals presence) is in the pre-FCU group.

Why

cancun.md says fcuV3 extends point (8) of engine_forkchoiceUpdatedV1:

2. Extend point (8) of the engine_forkchoiceUpdatedV1 specification by defining the following sequence of checks that MUST be run over payloadAttributes:
   1. payloadAttributes matches the PayloadAttributesV3 structure, return -38003: Invalid payload attributes on failure.
   2. payloadAttributes.timestamp does not fall within the time frame of the Cancun fork, return -38005: Unsupported fork on failure.
   3. payloadAttributes.timestamp is greater than timestamp of a block referenced by forkchoiceState.headBlockHash, return -38003: Invalid payload attributes on failure.

…and point (8) of V1 (paris.md) gates the entire processing flow on the head being VALID:

8. Client software MUST process provided payloadAttributes after successfully applying the forkchoiceState and only if the payload referenced by forkchoiceState.headBlockHash is VALID.

So with an unknown head, point (8) doesn't fire and the response is the SYNCING one in point (9). The Syncing=True family of hive cancun tests pin exactly this.

The pre-FCU "wrong version of structure" rule is different — it lives in the V2 Request section and has no precondition on head state, which is why #20728 correctly moved it before the short-circuit.

What changed

• validatePayloadAttributesPreFCU keeps the request-level checks: parentBeaconBlockRoot on V1/V2, V1/V2 fcu at a Cancun timestamp, withdrawals presence vs Shanghai. Runs before the SYNCING short-circuit.
• validatePayloadAttributesPostFCU runs the V3 point-(8) extensions: parentBeaconBlockRoot != null for V3+, Cancun-window for V3+, SlotNumber != null for V4+. Runs only when status.Status == ValidStatus.
• Two regression tests in testing_api_test.go:
  • TestForkchoiceUpdatedV3DefersAttributesValidationWhenSyncing — pins the hive Syncing=True scenario (no error, status=SYNCING).
  • TestForkchoiceUpdatedV3RejectsMissingBeaconRootWhenValid — pins the spec-mandated -38003 when the head is VALID so the deferral can't regress into a permanent swallow.

[Copilot]

Pull request overview

This PR adjusts Engine API engine_forkchoiceUpdatedV3+ payload attribute validation to match the spec ordering: only run the V3 “extend point (8)” checks (e.g., parentBeaconBlockRoot != null) once the FCU head is VALID, while still enforcing request-level “wrong version of structure” checks before the SYNCING short-circuit.

Changes:

• Split payload attributes validation into pre-FCU (request-level) vs post-FCU (point-(8)-extension) phases and update forkchoiceUpdated to call them in spec order.
• Add regression tests covering (a) deferral on SYNCING and (b) rejection on VALID for missing parentBeaconBlockRoot.
• Tighten Hive CI for the engine/cancun simulator by requiring zero failures.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
execution/engineapi/engine_server.go	Splits validation into pre/post FCU phases and runs post-FCU checks only when head is VALID.
execution/engineapi/testing_api_test.go	Adds targeted regression tests for SYNCING deferral vs VALID rejection of missing beacon root in FCU V3.
.github/workflows/test-hive.yml	Sets engine/cancun Hive suite max-allowed-failures to 0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yperbasis]

Reapplied the gate tightening and bumped hive_ref from 684d4add → 02075f47 (ethereum/hive master). The bump pulls in ethereum/hive#1395 "simulators/engine: make SetBlock robust for reorg chains", which is the upstream fix for the two Invalid Missing Ancestor Syncing ReOrg, ..., Invalid P8 TEST ISSUE failures from the previous run.

Re-dispatched Test Hive: https://github.com/erigontech/erigon/actions/runs/25074084347