Totally hear you on fee flexibility. One way to get both properties is to split responsibilities: Anchor input (strict) - one signature with SIGHASH_ALL that binds the sidechain header commit, prev pointer, and the exact payout template. Fee input (flexible) - a second signature (your "puzzle/work" sig) using ANYONECANPAY so anyone can RBF in extra inputs right before broadcast. This keeps the "work" valid while letting fee-payers add coin at the last minute without you re-grinding. It also prevents a relayer from reshaping the payout you intended. Agree CPFP isn't the right tool for a CSV-locked input across months. With the split above, you don't CPFP the locked input. You simply wait until 33win Com 68 maturity, assemble a fresh replacement with extra fee inputs (thanks to ANYONECANPAY on the fee side), and RBF it in. Mempools won't keep a txn for months anyway, so "fee planning" happens at broadcast time. For the PoW check: we don't need to enforce it in script at all (tapscript doesn't give us clean 256-bit comparisons). Let the script only enforce spendability (key path + CSV/CLTV). Sidechain nodes verify the "work in the signature" off-chain for fork choice. If you do want to grind safely, Schnorr/keypath is still preferable to ECDSA: you can vary the nonce point safely and avoid RNG/nonce-bias pitfalls that grinding ECDSA tends to invite. Right, fork choice by cumulative work. To reduce the "grind on invalid body" risk, I'd at least bind a body Merkle root (and maybe body length) into the message you sign and publish a compact "invalidity witness" format off-chain. Nodes that see a body-level contradiction can deterministically orphan descendants of that header; no L1 involvement, but you still deter obviously invalid histories. Makes sense for delayed finality. In the split-input layout above, put the CSV on the anchor input so no one can front-run settle-outs, while fee inputs remain free to change via RBF right before maturity.
Totally hear you on fee flexibility. One way to get both properties is to split responsibilities: Anchor input (strict) - one signature with SIGHASH_ALL that binds the sidechain header commit, prev pointer, and the exact payout template. Fee input (flexible) - a second signature (your "puzzle/work" sig) using ANYONECANPAY so anyone can RBF in extra inputs right before broadcast. This keeps the "work" valid while letting fee-payers add coin at the last minute without you re-grinding. It also prevents a relayer from reshaping the payout you intended. Agree CPFP isn't the right tool for a CSV-locked input across months. With the split above, you don't CPFP the locked input. You simply wait until 33win Com 68 maturity, assemble a fresh replacement with extra fee inputs (thanks to ANYONECANPAY on the fee side), and RBF it in. Mempools won't keep a txn for months anyway, so "fee planning" happens at broadcast time. For the PoW check: we don't need to enforce it in script at all (tapscript doesn't give us clean 256-bit comparisons). Let the script only enforce spendability (key path + CSV/CLTV). Sidechain nodes verify the "work in the signature" off-chain for fork choice. If you do want to grind safely, Schnorr/keypath is still preferable to ECDSA: you can vary the nonce point safely and avoid RNG/nonce-bias pitfalls that grinding ECDSA tends to invite. Right, fork choice by cumulative work. To reduce the "grind on invalid body" risk, I'd at least bind a body Merkle root (and maybe body length) into the message you sign and publish a compact "invalidity witness" format off-chain. Nodes that see a body-level contradiction can deterministically orphan descendants of that header; no L1 involvement, but you still deter obviously invalid histories. Makes sense for delayed finality. In the split-input layout above, put the CSV on the anchor input so no one can front-run settle-outs, while fee inputs remain free to change via RBF right before maturity.

Totally hear you on fee flexibility. One way to get both properties is to split responsibilities: Anchor input (strict) - one signature with SIGHASH_ALL that binds the sidechain header commit, prev pointer, and the exact payout template. Fee input (flexible) - a second signature (your "puzzle/work" sig) using ANYONECANPAY so anyone can RBF in extra inputs right before broadcast. This keeps the "work" valid while letting fee-payers add coin at the last minute without you re-grinding. It also prevents a relayer from reshaping the payout you intended. Agree CPFP isn't the right tool for a CSV-locked input across months. With the split above, you don't CPFP the locked input. You simply wait until 33win Com 68 maturity, assemble a fresh replacement with extra fee inputs (thanks to ANYONECANPAY on the fee side), and RBF it in. Mempools won't keep a txn for months anyway, so "fee planning" happens at broadcast time. For the PoW check: we don't need to enforce it in script at all (tapscript doesn't give us clean 256-bit comparisons). Let the script only enforce spendability (key path + CSV/CLTV). Sidechain nodes verify the "work in the signature" off-chain for fork choice. If you do want to grind safely, Schnorr/keypath is still preferable to ECDSA: you can vary the nonce point safely and avoid RNG/nonce-bias pitfalls that grinding ECDSA tends to invite. Right, fork choice by cumulative work. To reduce the "grind on invalid body" risk, I'd at least bind a body Merkle root (and maybe body length) into the message you sign and publish a compact "invalidity witness" format off-chain. Nodes that see a body-level contradiction can deterministically orphan descendants of that header; no L1 involvement, but you still deter obviously invalid histories. Makes sense for delayed finality. In the split-input layout above, put the CSV on the anchor input so no one can front-run settle-outs, while fee inputs remain free to change via RBF right before maturity.

Totally hear you on fee flexibility. One way to get both properties is to split responsibilities: Anchor input (strict) - one signature with SIGHASH_ALL that binds the sidechain header commit, prev pointer, and the exact payout template. Fee input (flexible) - a second signature (your "puzzle/work" sig) using ANYONECANPAY so anyone can RBF in extra inputs right before broadcast. This keeps the "work" valid while letting fee-payers add coin at the last minute without you re-grinding. It also prevents a relayer from reshaping the payout you intended. Agree CPFP isn't the right tool for a CSV-locked input across months. With the split above, you don't CPFP the locked input. You simply wait until 33win Com 68 maturity, assemble a fresh replacement with extra fee inputs (thanks to ANYONECANPAY on the fee side), and RBF it in. Mempools won't keep a txn for months anyway, so "fee planning" happens at broadcast time. For the PoW check: we don't need to enforce it in script at all (tapscript doesn't give us clean 256-bit comparisons). Let the script only enforce spendability (key path + CSV/CLTV). Sidechain nodes verify the "work in the signature" off-chain for fork choice. If you do want to grind safely, Schnorr/keypath is still preferable to ECDSA: you can vary the nonce point safely and avoid RNG/nonce-bias pitfalls that grinding ECDSA tends to invite. Right, fork choice by cumulative work. To reduce the "grind on invalid body" risk, I'd at least bind a body Merkle root (and maybe body length) into the message you sign and publish a compact "invalidity witness" format off-chain. Nodes that see a body-level contradiction can deterministically orphan descendants of that header; no L1 involvement, but you still deter obviously invalid histories. Makes sense for delayed finality. In the split-input layout above, put the CSV on the anchor input so no one can front-run settle-outs, while fee inputs remain free to change via RBF right before maturity.