which types of transactions does bitcoind v0.10 perform checksig validation on?
my guesses for answers would be 1 - yes, 2 - yes, 3 - no. however i would like confirmation of this.
1, 2 and 3.
Transactions that arrive through inventory announcements on the network are validated completely by checking the form of the transaction for sanity, executing the script, checking signatures, ensuring that the outputs they are spending actually exist, and that the transaction doesn't end up making negative values anywhere. If they are accepted they are added to the nodes memory pool where they wait for inclusion in a block.
Additionally, non-consensus rules are applied to bare transactions known as IsStandard. On the production network only a small subset of transaction types are "standard", this includes P2SH (pay to script hash) and P2PKH (pay to pubkey hash, or an address), but not raw multisignature and other scripts. Transactions that do not pass are not accepted but relaying a non standard transaction is not a bannable offense.
After validation, IsMine is run to check if the nodes wallet (if it exists) has the keys which own these transactions, of it they have been added as a watching address, if they do they are marked as unconfirmed in the wallet file.
Transactions that arrive in a block are completely validated, along with the rest of the structure of the block. The proof of work is checked, the size and form of the block is checked, the merkle tree is validated to contain all the transactions it claims to and that it connects properly with the header. Every transaction is validated, same as if it had arrived from the network. If they are found to be invalid the entire block is thrown out and the peer who relayed the block is banned from connecting. If the block is valid, it is committed and written to the unspent outputs database, additional undo data is written to file if the accepted block is ever needed to be undone.
IsStandard does not apply here, any transaction that is valid is acceptable when it is included in a block.
IsMine is run to filter out any transactions relevant to the wallet or watch address (if present), and updates the wallet with confirmations if necessary.
checkpoints is not disabled in the configuration, once nodes are caught up to the most recent checkpoint they do the full blown verification for all content. It's an unfortunate and inelegant solution to the reality that ECDSA is nasty slow to verify on this sort of scale (much slower than to sign somewhat interestingly).
checkblocks, and the intensity can be altered with checklevel.