@aztec-labs/aztec-node 6.0.0 → 6.1.0-nightly.20261024

package/src/sentinel/README.md

@@ -45,23 +45,39 @@ The aggregator catches up if multiple epochs become eligible at once (e.g. after
 
 ## Six-case taxonomy
 
-For each slot, the proposer is assigned one of six statuses, ranked highest-confidence first:
+For each slot, the proposer is assigned one of six statuses, ranked highest-confidence first. Case 5 is refined into 5a and 5b when the evidence allows it:
 
 | # | Status | Trigger | Inactive party |
 |---|---|---|---|
 | 6 | `checkpoint-mined` | `archiver.getCheckpoint({ slot })` returns a checkpoint (one covering this slot has landed on L1) | Attestors who didn't attest |
-| 5 | `checkpoint-valid` | `tracker.getOutcomeForSlot(slot) === 'valid'` | Attestors who didn't attest |
+| 5a | `checkpoint-unpublished` | Case 5, and the proposal's parent is on L1 and a quorum of the committee attested | Attestors who didn't attest (proposer fault recorded, not yet penalized) |
+| 5b | `checkpoint-orphaned` | Case 5, and the parent the proposal built on never landed on L1 (missing or different archive root), or an earlier slot landed the proposal's checkpoint number after a quorum attested it | Attestors who didn't attest, unless a different checkpoint landed in the parent's position or an earlier slot took the checkpoint number |
+| 5 | `checkpoint-valid` | `tracker.getOutcomeForSlot(slot) === 'valid'`, not refined into 5a or 5b | Attestors who didn't attest |
 | 4 | `checkpoint-invalid` | `tracker.getOutcomeForSlot(slot) === 'invalid'` (re-executed and rejected) | Proposer |
 | 3 | `checkpoint-unvalidated` | `tracker.getOutcomeForSlot(slot) === 'unvalidated'` (validation aborted: missing data, timeout, etc.) | Proposer |
 | 2 | `checkpoint-missed` | `p2p.hasBlockProposalsForSlot(slot)` true (blocks seen but no checkpoint proposal observed) | Proposer |
 | 1 | `blocks-missed` | None of the above (no block proposals observed) | Proposer |
 
-Missing-attestor faults are only recorded in cases 5 and 6 — where the local node has positive evidence the checkpoint was valid or canonical. In cases 1–4 the proposer is at fault and no attestor penalty applies.
+Missing-attestor faults are only recorded in cases 5 (including 5a and 5b) and 6 — where the local node has positive evidence the checkpoint was valid or canonical. In cases 1–4 the proposer is at fault and no attestor penalty applies. Nor does one apply when a different checkpoint landed in the parent's position or an earlier slot landed the proposal's checkpoint number: a validator that already held the landed checkpoint's blocks rejects the proposal (or the parent it builds on) as conflicting, and is right to.
+
+### Refining case 5: unpublished and orphaned proposals
+
+Under proposer pipelining, the proposer for slot N+1 builds on slot N's gossiped proposal. If slot N never lands, slot N+1 cannot land either, through no fault of its own. Cases 5a and 5b separate that cascade from a proposer that simply failed to publish. When a slot has a valid re-execution outcome but no checkpoint on L1, the sentinel reads the tracker's record for the slot (`getRecordForSlot`) and checks, in order:
+
+1. If the slot had a proposal equivocation, or the record has no checkpoint number, parent archive root or payload hash, the status stays `checkpoint-valid`.
+2. If the parent checkpoint (`checkpointNumber - 1`) is not on L1, or its archive root differs from the proposal's `lastArchiveRoot`, the status is `checkpoint-orphaned`. The first checkpoint builds on genesis, which always counts as on L1. When a different checkpoint holds the parent's position (`parent-hash-mismatch`), no attestor is tagged `attestation-missed`: a validator that held that checkpoint's blocks rightly rejects the proposal's parent as conflicting.
+3. If a checkpoint from an earlier slot landed on L1 with the proposal's checkpoint number (`unexpected-parent-appeared`, the reason the sequencer gives when it discards its own pipelined checkpoint for this cause), the earlier slot's proposal reached the proposer too late to build on, and once it landed this proposal could not. With a quorum of attestations the status is `checkpoint-orphaned`. Below quorum it stays `checkpoint-valid`, and no attestor is tagged `attestation-missed`. Both are logged at `verbose` with the reason and the slot that took the number.
+4. If fewer than `computeQuorum(committee.length)` distinct committee members attested the proposal's payload on P2P (the proposer's own attestation counts, as it does for the sequencer; attestations for another payload in the slot do not, since the proposer could not publish them), the status stays `checkpoint-valid`: the proposer could not publish, and the attestors are at fault.
+5. Otherwise the status is `checkpoint-unpublished`, logged at `info` with the attestation count and quorum.
+
+A checkpoint from a later slot that holds the proposal's checkpoint number does not exempt the proposer: that slot only got the number because this proposer failed to land it.
+
+Neither `checkpoint-unpublished` nor `checkpoint-orphaned` counts toward `missedProposals` or inactivity slashing yet. Like `checkpoint-valid`, both only add to the proposer's slot total.
 
 Each non-proposer committee member is tagged:
 
 - `attestation-sent` — attestation seen on P2P (with valid signature) or in the L1 checkpoint's attestor set
-- `attestation-missed` — only when proposer status is case 5 or 6 and the validator's attestation was not seen
+- `attestation-missed` — only when proposer status is case 5 (including 5a and 5b) or 6 and the validator's attestation was not seen, unless a different checkpoint landed in the parent's position or an earlier slot landed the proposal's checkpoint number
 - none — otherwise
 
 ## Inactivity slashing

package/src/sentinel/sentinel.ts

@@ -1,3 +1,4 @@
+import { INITIAL_CHECKPOINT_NUMBER } from '@aztec-labs/constants';
 import { type EpochCache, requireStableCommittee } from '@aztec-labs/epoch-cache';
 import {
   CheckpointNumber,
@@ -22,8 +23,17 @@ import type { SlasherConfig } from '@aztec-labs/slasher/config';
 import { type L2BlockSource, getAttestationInfoFromPublishedCheckpoint } from '@aztec-labs/stdlib/block';
 import type { CheckpointReexecutionTracker } from '@aztec-labs/stdlib/checkpoint';
 import type { ChainConfig } from '@aztec-labs/stdlib/config';
-import { getEpochAtSlot, getSlotRangeForEpoch, getTimestampForSlot } from '@aztec-labs/stdlib/epoch-helpers';
-import { ConsensusPayload, type CoordinationSignatureContext } from '@aztec-labs/stdlib/p2p';
+import {
+  computeQuorum,
+  getEpochAtSlot,
+  getSlotRangeForEpoch,
+  getTimestampForSlot,
+} from '@aztec-labs/stdlib/epoch-helpers';
+import {
+  type CheckpointAttestation,
+  ConsensusPayload,
+  type CoordinationSignatureContext,
+} from '@aztec-labs/stdlib/p2p';
 import type {
   SingleValidatorStats,
   ValidatorStats,
@@ -45,6 +55,42 @@ export type SentinelRuntimeConfig = Pick<
   Pick<SentinelConfig, 'sentinelEpochEndBufferSlots'> &
   Pick<ChainConfig, 'l1ChainId' | 'rollupAddress'>;
 
+/**
+ * Why a valid checkpoint proposal that never reached L1 could not have landed, regardless of its proposer.
+ * `unexpected-parent-appeared` matches the reason the sequencer gives when it discards its own pipelined checkpoint
+ * for the same cause.
+ */
+type OrphanedProposalReason = 'parent-not-on-l1' | 'parent-hash-mismatch' | 'unexpected-parent-appeared';
+
+const ORPHANED_PROPOSAL_REASON_DESCRIPTIONS: Record<OrphanedProposalReason, string> = {
+  'parent-not-on-l1': 'the parent checkpoint it built on never landed on L1',
+  'parent-hash-mismatch': 'a different checkpoint landed on L1 in place of the parent it built on',
+  'unexpected-parent-appeared':
+    'a checkpoint from an earlier slot landed on L1 with its checkpoint number after it was built on the previous one',
+};
+
+/** Refined status of a valid checkpoint proposal for a slot whose checkpoint never reached L1. */
+type UnpublishedProposalClassification =
+  | { status: 'checkpoint-unpublished' }
+  | { status: 'checkpoint-orphaned'; reason: OrphanedProposalReason }
+  | {
+      status: 'checkpoint-valid';
+      reason: 'equivocation' | 'no-proposal-data' | 'below-quorum' | 'unexpected-parent-appeared';
+    };
+
+/**
+ * Whether the classification shows the proposal conflicts with a checkpoint that landed on L1, either in its parent's
+ * position or in its own. A validator that already held the landed checkpoint's blocks rejects the proposal's blocks as
+ * conflicting, so it is right not to attest.
+ */
+function excusesMissingAttestations(classification: UnpublishedProposalClassification | undefined): boolean {
+  return (
+    classification !== undefined &&
+    'reason' in classification &&
+    (classification.reason === 'parent-hash-mismatch' || classification.reason === 'unexpected-parent-appeared')
+  );
+}
+
 /** Maps a validator status to its category: proposer or attestation. */
 function statusToCategory(status: ValidatorStatusInSlot): ValidatorStatusType {
   switch (status) {
@@ -85,12 +131,19 @@ function statusToCategory(status: ValidatorStatusInSlot): ValidatorStatusType {
  * ## Six-case taxonomy in `getSlotActivity`
  *
  * For each slot, the sentinel assigns the proposer one of six statuses, ranked highest-confidence
- * first:
+ * first, with case 5 refined into 5a and 5b:
  *
  *  - `checkpoint-mined`        — a checkpoint covering this slot has landed on L1
  *                                (fetched on demand via `archiver.getCheckpoint({ slot })`).
+ *  - `checkpoint-unpublished`  — (5a) a valid checkpoint proposal built on a parent that is on L1
+ *                                reached quorum, yet the proposer did not land it.
+ *  - `checkpoint-orphaned`     — (5b) a valid checkpoint proposal could not land because the parent
+ *                                it built on never reached L1 (the proposer pipelining cascade), or
+ *                                because an earlier slot's checkpoint landed with its number after it
+ *                                had built on the previous one.
  *  - `checkpoint-valid`        — the local node re-executed a checkpoint proposal for this slot
- *                                successfully (consulted via `CheckpointReexecutionTracker`).
+ *                                successfully (consulted via `CheckpointReexecutionTracker`), and it
+ *                                could not be refined into 5a or 5b.
  *  - `checkpoint-invalid`      — the local node re-executed a checkpoint proposal for this slot
  *                                and rejected it (e.g. header/archive/out-hash mismatch, limit
  *                                breach). Proposer-fault.
@@ -100,9 +153,15 @@ function statusToCategory(status: ValidatorStatusInSlot): ValidatorStatusType {
  *  - `checkpoint-missed`       — block proposals seen on P2P but no checkpoint proposal at all.
  *  - `blocks-missed`           — no block proposals seen for this slot.
  *
- * Missing-attestor faults are recorded only in `checkpoint-mined` and `checkpoint-valid`, where
- * the local node has positive evidence the checkpoint was canonical or valid. In the other four
- * cases the proposer is at fault and no attestor penalty applies.
+ * Missing-attestor faults are recorded only in `checkpoint-mined` and the three valid-proposal
+ * statuses (`checkpoint-unpublished`, `checkpoint-orphaned`, `checkpoint-valid`), where the local
+ * node has positive evidence the checkpoint was canonical or valid. In the other four cases the
+ * proposer is at fault and no attestor penalty applies. A valid proposal that conflicts with a checkpoint
+ * that landed on L1, in its parent's position or its own, is also exempt: a validator holding the landed
+ * checkpoint's blocks rightly refuses it.
+ *
+ * `checkpoint-unpublished` and `checkpoint-orphaned` are neutral for the proposer, like
+ * `checkpoint-valid`: neither counts toward `missedProposals` or inactivity slashing.
  *
  * ## Re-execution tracker
  *
@@ -135,6 +194,21 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
   /** Largest epoch number for which the end-of-epoch aggregator has run. */
   protected lastEvaluatedEpoch: EpochNumber | undefined;
 
+  /** Bumped on every history write so cached stats are never served from before the write. */
+  private historyGeneration = 0;
+  /**
+   * Stats for the default window, shared by every caller until the next processed slot or history write. Computing them
+   * scans and deserializes the full history of every validator, while the inputs only change once per slot.
+   */
+  private defaultStatsCache:
+    | {
+        lastProcessedSlot: SlotNumber;
+        initialSlot: SlotNumber | undefined;
+        historyGeneration: number;
+        stats: Promise<ValidatorsStats>;
+      }
+    | undefined;
+
   constructor(
     protected epochCache: EpochCache,
     protected archiver: L2BlockSource,
@@ -490,8 +564,12 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
    *
    * Proposer status:
    *  - case 6 `checkpoint-mined`        — a checkpoint covering this slot has landed on L1.
+   *  - case 5a `checkpoint-unpublished` — a valid proposal with its parent on L1 reached quorum but
+   *                                       was not landed by the proposer.
+   *  - case 5b `checkpoint-orphaned`    — a valid proposal could not land because its parent never
+   *                                       reached L1, or because an earlier slot took its checkpoint number.
    *  - case 5 `checkpoint-valid`        — the local node re-executed a checkpoint proposal for this
-   *                                       slot successfully.
+   *                                       slot successfully, and it could not be refined into 5a or 5b.
    *  - case 4 `checkpoint-invalid`      — the local node re-executed a checkpoint proposal for this
    *                                       slot and rejected it.
    *  - case 3 `checkpoint-unvalidated`  — the local node observed a checkpoint proposal for this
@@ -499,8 +577,9 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
    *  - case 2 `checkpoint-missed`       — block proposals seen on P2P but no checkpoint proposal.
    *  - case 1 `blocks-missed`           — no block proposals seen for this slot.
    *
-   * Missing-attestor penalties apply only in cases 5 and 6, where the local node has positive
-   * evidence the checkpoint was valid or has been canonicalised on L1.
+   * Missing-attestor penalties apply only in cases 5 (including 5a and 5b) and 6, where the local
+   * node has positive evidence the checkpoint was valid or has been canonicalised on L1, and never when
+   * the proposal conflicts with a checkpoint that landed in its parent's position or its own.
    */
   protected async getSlotActivity(slot: SlotNumber, epoch: EpochNumber, proposer: EthAddress, committee: EthAddress[]) {
     this.logger.debug(`Computing stats for slot ${slot} at epoch ${epoch}`, { slot, epoch, proposer, committee });
@@ -517,19 +596,24 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
       ),
     );
 
-    // Determine the proposer status from the six-case taxonomy.
+    // Determine the proposer status from the six-case taxonomy. A valid proposal that never reached L1 (case 5) is
+    // refined into `checkpoint-unpublished` (5a) or `checkpoint-orphaned` (5b) when the evidence allows it.
     const reexecutionOutcome = this.reexecutionTracker.getOutcomeForSlot(slot);
     let status:
       | 'checkpoint-mined'
+      | 'checkpoint-unpublished'
+      | 'checkpoint-orphaned'
       | 'checkpoint-valid'
       | 'checkpoint-invalid'
       | 'checkpoint-unvalidated'
       | 'checkpoint-missed'
       | 'blocks-missed';
+    let classification: UnpublishedProposalClassification | undefined;
     if (checkpoint) {
       status = 'checkpoint-mined';
     } else if (reexecutionOutcome === 'valid') {
-      status = 'checkpoint-valid';
+      classification = await this.classifyUnpublishedProposal(slot, proposer, committee, p2pAttested);
+      status = classification.status;
     } else if (reexecutionOutcome === 'invalid') {
       status = 'checkpoint-invalid';
     } else if (reexecutionOutcome === 'unvalidated') {
@@ -546,12 +630,17 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
     // A local `invalid` verdict vetoes them even for a mined checkpoint (an honest validator refuses
     // to sign what it re-executed as invalid), and so does a proposal equivocation in the slot: with
     // two conflicting proposals an honest attestor may have seen an invalid one and correctly
-    // declined, so neither must count as a missed attestor (inactivity slashing).
+    // declined, so neither must count as a missed attestor (inactivity slashing). Nor does a proposal that conflicts
+    // with a checkpoint that landed on L1 (see excusesMissingAttestations).
     const hasEquivocation = this.reexecutionTracker.hasEquivocation(slot);
     const attestorsExpected =
-      (status === 'checkpoint-mined' || status === 'checkpoint-valid') &&
+      (status === 'checkpoint-mined' ||
+        status === 'checkpoint-unpublished' ||
+        status === 'checkpoint-orphaned' ||
+        status === 'checkpoint-valid') &&
       reexecutionOutcome !== 'invalid' &&
-      !hasEquivocation;
+      !hasEquivocation &&
+      !excusesMissingAttestations(classification);
     const missedAttestors = new Set(
       attestorsExpected
         ? committee.filter(v => !attestors.has(v.toString()) && !proposer.equals(v)).map(v => v.toString())
@@ -584,17 +673,156 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
     return Object.fromEntries(committee.map(v => v.toString()).map(who => [who, statusFor(who)]));
   }
 
+  /**
+   * Refines case 5 (a checkpoint proposal for the slot re-executed as valid, with no checkpoint for the slot on L1)
+   * into whose fault it was that the proposal did not land:
+   *
+   *  - `checkpoint-orphaned` (5b) when other proposers prevented it: the parent it built on never landed on L1 (it is
+   *    missing, or a different checkpoint holds the parent's position), or, with a quorum of attestations, an earlier
+   *    slot's checkpoint landed with its number after it built on the previous one (`unexpected-parent-appeared`).
+   *    The latter happens when the earlier slot's proposal reached this proposer too late to build on.
+   *  - `checkpoint-unpublished` (5a) when its parent is on L1 and a quorum of the committee attested, so the proposer
+   *    had everything it needed to publish. A later slot that lands the same checkpoint number does not exempt it:
+   *    that slot only got the number because this proposer failed to land it.
+   *  - `checkpoint-valid` (5) otherwise: the slot had an equivocation, the tracker has no parent or payload data to
+   *    judge by, or attestations fell short of quorum. Short of quorum is a fault of the attestors, who are tagged
+   *    `attestation-missed`, except after an unexpected parent appeared (`unexpected-parent-appeared`), when
+   *    refusing to attest was correct.
+   *
+   * Only attestations for the proposal's own payload count toward quorum, since those are the only ones its proposer
+   * could have published.
+   */
+  protected async classifyUnpublishedProposal(
+    slot: SlotNumber,
+    proposer: EthAddress,
+    committee: EthAddress[],
+    p2pAttested: CheckpointAttestation[],
+  ): Promise<UnpublishedProposalClassification> {
+    if (this.reexecutionTracker.hasEquivocation(slot)) {
+      return { status: 'checkpoint-valid', reason: 'equivocation' };
+    }
+    const record = this.reexecutionTracker.getRecordForSlot(slot);
+    const checkpointNumber = record?.checkpointNumber;
+    const lastArchiveRoot = record?.lastArchiveRoot;
+    const payloadHash = record?.payloadHash;
+    if (checkpointNumber === undefined || lastArchiveRoot === undefined || payloadHash === undefined) {
+      return { status: 'checkpoint-valid', reason: 'no-proposal-data' };
+    }
+
+    const logData = { slot, proposer: proposer.toString(), checkpointNumber };
+    const orphaned = (
+      reason: OrphanedProposalReason,
+      extra: Record<string, unknown> = {},
+    ): UnpublishedProposalClassification => {
+      this.logger.verbose(
+        `Valid checkpoint proposal for slot ${slot} was orphaned (${reason}): ${ORPHANED_PROPOSAL_REASON_DESCRIPTIONS[reason]}`,
+        { ...logData, ...extra, reason },
+      );
+      return { status: 'checkpoint-orphaned', reason };
+    };
+
+    // The first checkpoint builds on genesis, which is always on L1.
+    const parentNumber = checkpointNumber - 1;
+    if (parentNumber >= INITIAL_CHECKPOINT_NUMBER) {
+      const parent = await this.archiver.getCheckpointData({ number: CheckpointNumber(parentNumber) });
+      if (!parent) {
+        return orphaned('parent-not-on-l1');
+      }
+      if (parent.archive.root.toString() !== lastArchiveRoot) {
+        return orphaned('parent-hash-mismatch');
+      }
+    }
+
+    // The proposer's own attestation counts, as it does when its sequencer collects attestations for L1.
+    const committeeMembers = new Set(committee.map(member => member.toString()));
+    const attestationCount = new Set(
+      p2pAttested
+        .filter(attestation => attestation.getPayloadHash() === payloadHash)
+        .map(attestation => attestation.getSender()?.toString())
+        .filter(attestor => attestor !== undefined && committeeMembers.has(attestor)),
+    ).size;
+    const quorum = computeQuorum(committee.length);
+
+    // A checkpoint landed for the slot itself would have made this case 6, so a holder of the same number comes from
+    // an earlier or a later slot. Only an earlier one can have stopped this proposal from landing.
+    const sameNumber = await this.archiver.getCheckpointData({ number: checkpointNumber });
+    const sameNumberSlot = sameNumber?.header.slotNumber;
+    if (sameNumberSlot !== undefined && sameNumberSlot < slot) {
+      const conflictData = { takenBySlot: sameNumberSlot, attestationCount, quorum };
+      if (attestationCount < quorum) {
+        this.logger.verbose(
+          `Valid checkpoint proposal for slot ${slot} fell short of quorum after checkpoint ${checkpointNumber} landed ` +
+            `from earlier slot ${sameNumberSlot} (unexpected-parent-appeared), so missing attestations are not counted`,
+          { ...logData, ...conflictData, reason: 'unexpected-parent-appeared' },
+        );
+        return { status: 'checkpoint-valid', reason: 'unexpected-parent-appeared' };
+      }
+      return orphaned('unexpected-parent-appeared', conflictData);
+    }
+
+    if (attestationCount < quorum) {
+      return { status: 'checkpoint-valid', reason: 'below-quorum' };
+    }
+
+    this.logger.info(`Proposer did not publish checkpoint ${checkpointNumber} for slot ${slot} despite quorum`, {
+      ...logData,
+      attestationCount,
+      quorum,
+    });
+    return { status: 'checkpoint-unpublished' };
+  }
+
   /** Push the status for each slot for each validator. */
-  protected updateValidators(slot: SlotNumber, stats: Record<`0x${string}`, ValidatorStatusInSlot | undefined>) {
-    return this.store.updateValidators(slot, stats);
+  protected async updateValidators(slot: SlotNumber, stats: Record<`0x${string}`, ValidatorStatusInSlot | undefined>) {
+    this.historyGeneration++;
+    try {
+      await this.store.updateValidators(slot, stats);
+    } finally {
+      this.historyGeneration++;
+    }
+  }
+
+  /**
+   * Computes stats to be returned based on stored data. Calls without arguments cover the default window ending at the
+   * last processed slot and are served from a cache that is refreshed whenever that slot or the stored history changes.
+   */
+  public computeStats(
+    args: { fromSlot?: SlotNumber; toSlot?: SlotNumber; validators?: EthAddress[] } = {},
+  ): Promise<ValidatorsStats> {
+    const isDefaultWindow = args.fromSlot === undefined && args.toSlot === undefined && args.validators === undefined;
+    // Before the first processed slot the default window ends at the wall-clock slot, which moves without any write.
+    if (!isDefaultWindow || this.lastProcessedSlot === undefined) {
+      return this.computeStatsUncached(args);
+    }
+
+    const { lastProcessedSlot, initialSlot, historyGeneration } = this;
+    if (
+      this.defaultStatsCache?.lastProcessedSlot !== lastProcessedSlot ||
+      this.defaultStatsCache.initialSlot !== initialSlot ||
+      this.defaultStatsCache.historyGeneration !== historyGeneration
+    ) {
+      const stats = this.computeStatsUncached(args);
+      const entry = { lastProcessedSlot, initialSlot, historyGeneration, stats };
+      this.defaultStatsCache = entry;
+      // A failed computation is dropped so the next caller retries instead of receiving the cached rejection.
+      stats.catch(() => {
+        if (this.defaultStatsCache === entry) {
+          this.defaultStatsCache = undefined;
+        }
+      });
+    }
+    return this.defaultStatsCache.stats;
   }
 
-  /** Computes stats to be returned based on stored data. */
-  public async computeStats({
+  private async computeStatsUncached({
     fromSlot,
     toSlot,
     validators,
-  }: { fromSlot?: SlotNumber; toSlot?: SlotNumber; validators?: EthAddress[] } = {}): Promise<ValidatorsStats> {
+  }: {
+    fromSlot?: SlotNumber;
+    toSlot?: SlotNumber;
+    validators?: EthAddress[];
+  }): Promise<ValidatorsStats> {
     const histories = validators
       ? fromEntries(await Promise.all(validators.map(async v => [v.toString(), await this.store.getHistory(v)])))
       : await this.store.getHistories();
@@ -685,7 +913,15 @@ export class Sentinel extends (EventEmitter as new () => WatcherEmitter) impleme
   ): ValidatorStats {
     let history = fromSlot ? allHistory.filter(h => BigInt(h.slot) >= fromSlot) : allHistory;
     history = toSlot ? history.filter(h => BigInt(h.slot) <= toSlot) : history;
-    const lastProposal = history.filter(h => h.status === 'checkpoint-valid' || h.status === 'checkpoint-mined').at(-1);
+    const lastProposal = history
+      .filter(
+        h =>
+          h.status === 'checkpoint-valid' ||
+          h.status === 'checkpoint-unpublished' ||
+          h.status === 'checkpoint-orphaned' ||
+          h.status === 'checkpoint-mined',
+      )
+      .at(-1);
     const lastAttestation = history.filter(h => h.status === 'attestation-sent').at(-1);
     return {
       address: EthAddress.fromString(address),

package/src/sentinel/store.ts

@@ -175,6 +175,10 @@ export class SentinelStore {
         return 7;
       case 'checkpoint-unvalidated':
         return 8;
+      case 'checkpoint-unpublished':
+        return 9;
+      case 'checkpoint-orphaned':
+        return 10;
       default: {
         const _exhaustive: never = status;
         throw new Error(`Unknown status: ${status}`);
@@ -200,6 +204,10 @@ export class SentinelStore {
         return 'checkpoint-invalid';
       case 8:
         return 'checkpoint-unvalidated';
+      case 9:
+        return 'checkpoint-unpublished';
+      case 10:
+        return 'checkpoint-orphaned';
       default:
         throw new Error(`Unknown status: ${status}`);
     }