[1932819331hy-debug]

Summary

 Request block 300; the node returns a valid header for block 301
- use block 301's timestamp as block 300's actual finish time
+ reject the mismatched header with RpcShapeError

Check that a numbered block request receives that block before using its timestamp. This protects the start, sample boundary, and actual end timestamp used by checkSchedule.

Numeric requests and hexadecimal tags share the check. Matching zero-height requests, hex digits in either case, named tags, missing-block errors, and the existing quantity validation retain their behavior. The change consists of the RPC guard, library regressions, and offline CLI regressions with their fixture.

Evidence

• Before: against main 13184ff111532c172f37d54d59f00e7eea6b9a23, the 17 library regressions have 11 passes and 6 assertion failures. The four CLI regressions separately have 2 passes and 2 assertion failures: wrong end headers incorrectly exit 0 in both JSON and text modes.
  After: npm test passes 44/44, including all 23 original tests, 17 library regressions, and four CLI regressions. The actual CLI now exits 2 without success output in both modes; matching-header controls still succeed.
• Reverting the production fix restores the six library failures. The library regressions detect checking only numeric requests and skipping genesis-height requests. Independent AI-assisted review of the unchanged production fix found no blocking issue.
• Before the CLI test additions, local composition of the same production fix and library regressions with fix: reject unsafe schedule block counts before projection #1–fix: reject missing CLI option values #4 passed 95/95 in both application orders. That composed suite was not rerun for the test-only additions. Their branches and scopes are unchanged.

The tests execute the complete public functions and actual CLI process with injected transport and native JSON decoding. All execution used Node 24.22.1. No dependencies were added or installed. Real RPC providers, hosted CI, Node 18/20/22, other operating systems, npx installation, and actual GitHub Action execution remain unverified. Build, lint, and typecheck scripts are not configured.

This is a reproducible source-contract repair, not a reported production incident or completion of a maintainer-assigned issue. AI assistance was used for implementation, testing, and review.

Merge Danger

Door: Two-way. A local response-validation change with no migration.

Blast Radius: RPC.

A well-formed header with the wrong requested height now fails instead of entering a schedule report. Named tags keep their existing behavior. This does not validate block hashes, chain identity, or consensus.