@aztec-labs/validator-client 6.0.0-rc.1 → 6.0.0-rc.2

package/src/proposal_handler.ts

@@ -82,6 +82,9 @@ export type BlockProposalValidationFailureReason =
   | 'invalid_signature'
   | 'invalid_proposal'
   | 'parent_block_not_found'
+  // The parent was found, but pruned from the local chain before validation finished, so a verdict read off the
+  // local chain may describe other blocks than the ones the proposal builds on. Never proposer misconduct.
+  | 'parent_block_pruned_during_validation'
   | 'parent_block_wrong_slot'
   // Streaming Inbox per-block acceptance failures.
   | StreamingBlockCheckReason
@@ -124,12 +127,17 @@ export type CheckpointProposalValidationFailureReason =
   | 'invalid_signature'
   | 'invalid_fee_asset_price_modifier'
   | 'last_block_not_found'
+  // The checkpoint's last block was found, but pruned from the local chain before validation finished, so a verdict
+  // read off the local chain may describe other blocks than the ones the proposal builds on. Never proposer misconduct.
+  | 'last_block_pruned_during_validation'
   | 'block_fetch_error'
   | 'world_state_not_synced'
   | 'checkpoint_already_published'
   | 'last_block_archive_mismatch'
   | 'too_many_blocks_in_checkpoint'
   | 'initial_archive_mismatch'
+  // The header's lastArchiveRoot is not the archive the checkpoint's first block builds on.
+  | 'last_archive_root_mismatch'
   | 'checkpoint_header_mismatch'
   | 'archive_mismatch'
   | 'out_hash_mismatch'
@@ -161,8 +169,8 @@ type CheckpointInboxPrefixReason = Extract<
  *
  * Matched on the error name rather than with `instanceof`, because the archiver package is only a dev dependency
  * here: the validator talks to its archiver through the `L2BlockSink` interface and must not take a runtime
- * dependency on the implementation to classify its errors. Both prefix outcomes are local-view disagreements, so
- * neither is in {@link SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT}.
+ * dependency on the implementation to classify its errors. Every reason returned here is a local-view disagreement,
+ * so none is in {@link SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT}.
  */
 function getInboxPrefixInsertFailureReason(err: unknown): StreamingBlockCheckReason | undefined {
   if (!(err instanceof Error)) {
@@ -174,8 +182,11 @@ function getInboxPrefixInsertFailureReason(err: unknown): StreamingBlockCheckRea
     case 'InboxPrefixNotSyncedError':
     case 'ProposedBlockParentNotFoundError':
       return 'inbox_prefix_unavailable';
+    // An insert-time consumption rewind means an L1 reorg landed between the deterministic metadata check (which
+    // already passed) and the insert, so it is a local-view disagreement, not proposer misconduct. Report it as the
+    // non-slashable prefix mismatch; the deterministic metadata check remains the only slashing evidence for a rewind.
     case 'InboxConsumptionRewindsError':
-      return 'consumption_moves_backwards';
+      return 'inbox_prefix_mismatch';
     default:
       return undefined;
   }
@@ -195,9 +206,11 @@ const CHECKPOINT_VALIDATION_REASON_TO_OUTCOME: Record<
   invalid_fee_asset_price_modifier: 'invalid',
   checkpoint_already_published: undefined,
   last_block_not_found: 'unvalidated',
+  last_block_pruned_during_validation: 'unvalidated',
   block_fetch_error: 'unvalidated',
   world_state_not_synced: 'unvalidated',
   initial_archive_mismatch: 'unvalidated',
+  last_archive_root_mismatch: 'invalid',
   last_block_archive_mismatch: 'invalid',
   too_many_blocks_in_checkpoint: 'invalid',
   checkpoint_header_mismatch: 'invalid',
@@ -241,6 +254,9 @@ type CheckpointComputationResult =
   | { checkpointNumber: CheckpointNumber; reason?: undefined }
   | { checkpointNumber?: undefined; reason: 'invalid_proposal' | 'global_variables_mismatch' };
 
+/** A block proposal's log context, completed with its block and checkpoint numbers as validation resolves them. */
+type BlockProposalLogInfo = LogData & { blockNumber?: BlockNumber; checkpointNumber?: CheckpointNumber };
+
 type BlockProposalSlotValidationResult =
   | { isValid: true }
   | { isValid: false; reason: 'block_proposal_beyond_checkpoint' | 'checkpoint_proposal_equivocation' };
@@ -332,16 +348,45 @@ export type BlockProposalObservers = {
   ) => void;
 };
 
-/** Block-proposal validation failures that constitute a slashable invalid-block offense. */
-export const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT: BlockProposalValidationFailureReason[] = [
-  'state_mismatch',
-  'failed_txs',
-  'global_variables_mismatch',
-  'invalid_proposal',
-  'parent_block_wrong_slot',
-  'duplicate_txs',
-  'invalid_embedded_txs',
-];
+/**
+ * Block-proposal validation failures classified by whether they constitute a slashable invalid-block offense.
+ * A `Record` over the whole reason union, not a plain array, so a newly added reason - in particular one that reaches
+ * `BlockProposalValidationFailureReason` through `StreamingBlockCheckReason` - fails to compile until it is classified
+ * here, the way {@link SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT} already does for checkpoints.
+ */
+export const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT: Record<BlockProposalValidationFailureReason, boolean> = {
+  // enabled: deterministic offenses computed from the block's own content, so every honest node rejects them.
+  ['invalid_proposal']: true,
+  ['state_mismatch']: true,
+  ['failed_txs']: true,
+  ['global_variables_mismatch']: true,
+  ['parent_block_wrong_slot']: true,
+  ['duplicate_txs']: true,
+  ['invalid_embedded_txs']: true,
+  // Deterministic streaming-Inbox violations: computed from the block's own content by the metadata check, so a
+  // reject is the proposer's fault.
+  ['consumption_moves_backwards']: true,
+  ['bundle_over_block_cap']: true,
+  ['checkpoint_over_msg_cap']: true,
+
+  // disabled: local-view disagreements, timeouts, and this node's own inability to check - never proposer misconduct.
+  ['invalid_signature']: false,
+  ['parent_block_not_found']: false,
+  // A parent found once but pruned mid-validation; the verdict may describe another chain, not proposer misconduct.
+  ['parent_block_pruned_during_validation']: false,
+  // The local-view streaming reasons: a trailing archiver or an unfollowed reorg, including an insert-time
+  // consumption rewind reported as inbox_prefix_mismatch.
+  ['inbox_prefix_unavailable']: false,
+  ['inbox_prefix_mismatch']: false,
+  ['block_number_already_exists']: false,
+  ['txs_not_available']: false,
+  ['initial_state_mismatch']: false,
+  ['timeout']: false,
+  ['block_proposal_beyond_checkpoint']: false,
+  // Equivocation has its own offense path (markProposalEquivocation), so it is not a slashable invalid-block reason.
+  ['checkpoint_proposal_equivocation']: false,
+  ['unknown_error']: false,
+};
 
 /** Checkpoint-proposal validation failures that constitute a slashable invalid-checkpoint offense. */
 export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT: Record<
@@ -351,6 +396,8 @@ export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT: Record<
   // enabled
   ['invalid_fee_asset_price_modifier']: true,
   ['checkpoint_header_mismatch']: true,
+  // An unprovable header: the checkpoint circuit derives lastArchiveRoot from the first block's lastArchive.
+  ['last_archive_root_mismatch']: true,
   // These late mismatches should normally be caught by earlier checks, but if reached after validating the local
   // checkpoint inputs, the proposer-signed payload disagrees with deterministic recomputation.
   ['archive_mismatch']: true,
@@ -372,13 +419,30 @@ export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT: Record<
   ['inbox_endpoint_mismatch']: false,
   ['invalid_signature']: false,
   ['last_block_not_found']: false,
+  // The local chain was pruned under the validation, so a slashable verdict may describe blocks of another chain.
+  ['last_block_pruned_during_validation']: false,
   ['block_fetch_error']: false,
   ['world_state_not_synced']: false,
-  // A reorg / divergent local chain, not a proposer offense (mirrors the block path's initial_state_mismatch).
+  // World state forked off the chain of the local archiver blocks being rebuilt (e.g. a reorg racing the fork), not
+  // a proposer offense (mirrors the block path's initial_state_mismatch).
   ['initial_archive_mismatch']: false,
   ['checkpoint_already_published']: false,
 };
 
+/** Whether a block-proposal validation result is a rejection for a slashable reason. */
+function isSlashableBlockProposalResult(
+  result: BlockProposalValidationResult,
+): result is BlockProposalValidationFailureResult {
+  return !result.isValid && SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT[result.reason];
+}
+
+/** Whether a checkpoint-proposal validation result is a rejection for a slashable reason. */
+function isSlashableCheckpointProposalResult(
+  result: CheckpointProposalValidationResult,
+): result is CheckpointProposalValidationFailureResult {
+  return !result.isValid && SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason];
+}
+
 /**
  * Handles block and checkpoint proposals for both validator and non-validator nodes. Also tracks which slots
  * had a slashable invalid proposal or a proposal equivocation, exposing them via the
@@ -502,7 +566,7 @@ export class ProposalHandler {
       ...(await this.observedProposal(proposal)),
       accepted: result.isValid && !escapeHatchOpen,
       reason: result.isValid ? undefined : result.reason,
-      slashable: !result.isValid && SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(result.reason),
+      slashable: isSlashableBlockProposalResult(result),
       escapeHatchOpen,
     });
   }
@@ -608,7 +672,7 @@ export class ProposalHandler {
           if (result.reason === 'checkpoint_proposal_equivocation') {
             this.markProposalEquivocation(slotNumber);
           } else if (
-            SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(result.reason) &&
+            isSlashableBlockProposalResult(result) &&
             !(await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber))
           ) {
             this.markInvalidProposalSlot(slotNumber);
@@ -692,7 +756,7 @@ export class ProposalHandler {
           // Track invalid checkpoint proposals so offense observers (the attested-invalid-proposal watcher)
           // work on non-validator nodes too. This handler runs for all nodes; validators also mark via the
           // failure callback below (idempotent).
-          if (SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason]) {
+          if (isSlashableCheckpointProposalResult(result)) {
             this.markInvalidProposalSlot(proposal.slotNumber);
             this.markInvalidCheckpointProposal(proposal.slotNumber, proposal.getPayloadHash());
           }
@@ -735,11 +799,11 @@ export class ProposalHandler {
       return { isValid: false, reason: 'invalid_signature' };
     }
 
-    const proposalInfo = {
+    const proposalInfo: BlockProposalLogInfo = {
       ...proposal.toBlockInfo(),
       proposer: proposer.toString(),
-      blockNumber: undefined as BlockNumber | undefined,
-      checkpointNumber: undefined as CheckpointNumber | undefined,
+      blockNumber: undefined,
+      checkpointNumber: undefined,
     };
 
     this.log.info(`Processing proposal for slot ${slotNumber}`, {
@@ -788,6 +852,55 @@ export class ProposalHandler {
       return { isValid: false, reason: 'parent_block_not_found' };
     }
 
+    const result = await this.validateBlockProposalOnParent(
+      proposal,
+      parentBlock,
+      proposalSender,
+      shouldReexecute,
+      proposalInfo,
+    );
+    // A genesis parent cannot be pruned.
+    return parentBlock !== 'genesis' && isSlashableBlockProposalResult(result)
+      ? await this.checkParentStillLocal(proposal, result, proposalInfo)
+      : result;
+  }
+
+  /**
+   * Demotes a block-proposal rejection when the proposal's parent is no longer found by archive. The parent is
+   * fetched once, but later checks read the local chain by number, and the archiver can prune the parent and insert
+   * other blocks at the same numbers while they run: under pipelining, when a checkpoint lands on L1 differing from the
+   * version this node gossiped. A prune removes the pruned blocks' archive entries, and an archive root commits to the
+   * block's whole history, so a parent still found by archive means the chain below it is still its own ancestry. A
+   * parent that is gone means the verdict may rest on another chain, which says nothing about the proposer.
+   */
+  private async checkParentStillLocal(
+    proposal: BlockProposal,
+    result: BlockProposalValidationFailureResult,
+    proposalInfo: BlockProposalLogInfo,
+  ): Promise<BlockProposalValidationFailureResult> {
+    if ((await this.getParentBlock(proposal, { awaitSync: false })) !== undefined) {
+      return result;
+    }
+    this.log.warn(
+      `Parent block was pruned while validating the proposal, not attributing the rejection to its proposer`,
+      {
+        ...proposalInfo,
+        originalReason: result.reason,
+      },
+    );
+    return { ...result, reason: 'parent_block_pruned_during_validation' };
+  }
+
+  /** Validates a block proposal against the parent block it builds on, as fetched by the parent archive. */
+  private async validateBlockProposalOnParent(
+    proposal: ValidatedBlockProposal,
+    parentBlock: 'genesis' | BlockData,
+    proposalSender: PeerId,
+    shouldReexecute: boolean,
+    proposalInfo: BlockProposalLogInfo,
+  ): Promise<BlockProposalValidationResult> {
+    const slotNumber = proposal.slotNumber;
+
     // Check that the parent block's slot is not greater than the proposal's slot.
     if (parentBlock !== 'genesis' && parentBlock.header.getSlot() > slotNumber) {
       this.log.warn(`Parent block slot is greater than proposal slot, skipping processing`, {
@@ -1030,7 +1143,14 @@ export class ProposalHandler {
     }
   }
 
-  private async getParentBlock(proposal: BlockProposal): Promise<'genesis' | BlockData | undefined> {
+  /**
+   * Looks up the block a proposal builds on by its parent archive. Unless `awaitSync` is false, a parent that is not
+   * local yet is waited for through forced archiver syncs until the slot's attestation deadline.
+   */
+  private async getParentBlock(
+    proposal: BlockProposal,
+    { awaitSync = true }: { awaitSync?: boolean } = {},
+  ): Promise<'genesis' | BlockData | undefined> {
     const parentArchive = proposal.blockHeader.lastArchive.root;
     const { genesisArchiveRoot } = await this.blockSource.getGenesisValues();
 
@@ -1043,7 +1163,7 @@ export class ProposalHandler {
       if (parentBlock !== undefined) {
         return parentBlock;
       }
-      if (this.getReexecutionDeadline(proposal.slotNumber).getTime() - this.dateProvider.now() <= 0) {
+      if (!awaitSync || this.getReexecutionDeadline(proposal.slotNumber).getTime() - this.dateProvider.now() <= 0) {
         return undefined;
       }
       const synced = await this.awaitLocalSync(proposal.slotNumber, 'force archiver sync', () =>
@@ -1302,6 +1422,10 @@ export class ProposalHandler {
    * never saw. The retry re-runs the whole read (metadata plus range) on each attempt rather than reusing a range
    * from an earlier view, because the parent and checkpoint-start counts it derives can move while a reorg is being
    * followed.
+   *
+   * Every attempt's unexpected error is kept, not only the first one's. A read that starts as ordinary sync lag and
+   * later hits a store fault or a broken provider is the case worth reporting, and reporting only the first attempt
+   * discards exactly that: the diagnosis a node whose retries ran out has to offer is its latest failure.
    */
   private async awaitStreamingBlockBundle(
     proposal: BlockProposal,
@@ -1309,9 +1433,16 @@ export class ProposalHandler {
     parentBlock: 'genesis' | BlockData,
     proposalInfo: LogData,
   ): Promise<StreamingBlockCheckResult> {
+    let latestUnexpectedError: string | undefined;
     const readBundle = async (): Promise<StreamingBlockCheckResult> => {
       const metadata = await this.checkStreamingBlockMetadata(proposal, blockNumber, parentBlock);
-      return metadata.accepted ? readStreamingBlockBundle(this.l1ToL2MessageSource, metadata) : metadata;
+      const result: StreamingBlockCheckResult = metadata.accepted
+        ? await readStreamingBlockBundle(this.l1ToL2MessageSource, metadata)
+        : metadata;
+      if (!result.accepted && result.error !== undefined) {
+        latestUnexpectedError = result.error;
+      }
+      return result;
     };
 
     const first = await readBundle();
@@ -1334,12 +1465,14 @@ export class ProposalHandler {
         reason: 'inbox_prefix_sync_timeout',
         firstReason: first.reason,
         // Set only when the message source failed for a reason the checks did not anticipate, rather than sync lag.
-        error: first.error,
+        // The latest such failure, since a later store fault says more about why this node gave up than the first
+        // attempt's lag does.
+        error: latestUnexpectedError,
         slot: slotNumber,
         waitedMs: timer.ms(),
         ...proposalInfo,
       });
-      return first;
+      return { ...first, error: latestUnexpectedError };
     }
     return resolved;
   }
@@ -1524,8 +1657,11 @@ export class ProposalHandler {
 
   /**
    * Reads the blocks of a slot as one snapshot for checkpoint validation, locating the checkpoint's last block by the
-   * signed archive. Undefined when the archive is not among the slot's blocks or the blocks do not chain onto each
-   * other, both of which are the archiver replacing or pruning blocks while they were read.
+   * signed archive. Undefined when the archive is not among the slot's blocks, the blocks do not chain onto each
+   * other, or they are not one checkpoint's blocks from its first one on. All of these are local state in motion:
+   * the archiver replacing or pruning blocks while they were read, or skipping a block whose body it cannot load.
+   * Checkpoint validation relies on `blocks[0]` being the checkpoint's first block to attribute a wrong
+   * lastArchiveRoot to the proposer.
    */
   private async readCheckpointBlocksSnapshot(
     slot: SlotNumber,
@@ -1538,8 +1674,11 @@ export class ProposalHandler {
     }
     const contiguous = blocks.every(
       (block, i) =>
-        i === 0 ||
-        (block.number === blocks[i - 1].number + 1 && block.header.lastArchive.root.equals(blocks[i - 1].archive.root)),
+        block.checkpointNumber === blocks[0].checkpointNumber &&
+        block.indexWithinCheckpoint === i &&
+        (i === 0 ||
+          (block.number === blocks[i - 1].number + 1 &&
+            block.header.lastArchive.root.equals(blocks[i - 1].archive.root))),
     );
     return contiguous ? { blocks, lastBlockIndex } : undefined;
   }
@@ -1770,7 +1909,10 @@ export class ProposalHandler {
         );
         result = { isValid: false, reason: 'invalid_fee_asset_price_modifier' };
       } else {
-        result = await this.validateCheckpointProposal(proposal, proposalInfo);
+        const validation = await this.validateCheckpointProposal(proposal, proposalInfo);
+        result = isSlashableCheckpointProposalResult(validation)
+          ? await this.checkLastBlockStillLocal(proposal, validation, proposalInfo)
+          : validation;
       }
 
       this.lastCheckpointValidationResult = { payloadHash, result };
@@ -1803,10 +1945,16 @@ export class ProposalHandler {
     // slot is a different question, and still records. A recorded `invalid` is protected for the slot outright:
     // the tracker keys its slot entry by slot alone, so an equivocating proposer whose second proposal this node
     // could not check would otherwise erase the first one's determination.
+    //
+    // The protected `valid` is matched by slot and archive as well as by checkpoint number, because the second look
+    // can fail before the blocks are loaded and then carries no checkpoint number at all: pruning the block the
+    // cached verdict rested on makes revalidation report `last_block_not_found`, which by checkpoint number alone
+    // is indistinguishable from a first evaluation and would overwrite the verdict this node reached.
     const outcome = result.isValid ? ('valid' as const) : CHECKPOINT_VALIDATION_REASON_TO_OUTCOME[result.reason];
     const wouldForgetVerdict =
       outcome === 'unvalidated' &&
       (this.reexecutionTracker.getOutcomeForSlot(slot) === 'invalid' ||
+        this.reexecutionTracker.hasValidOutcomeForSlot(slot, proposal.archive) ||
         (result.checkpointNumber !== undefined &&
           this.reexecutionTracker.hasReexecuted(result.checkpointNumber, proposal.archive)));
     if (outcome !== undefined && !wouldForgetVerdict) {
@@ -1915,12 +2063,47 @@ export class ProposalHandler {
     }
   }
 
-  /** The endpoint gate's own ceiling, narrowed by a slot whose attestation window is nearly spent. */
+  /**
+   * Demotes a checkpoint rejection when the checkpoint's last block is no longer found by the signed archive.
+   * Validation reads the slot's blocks once, but reads the block before the checkpoint and the parent checkpoint by
+   * number afterwards, and the archiver can prune those and insert other blocks at the same numbers while the
+   * checkpoint is rebuilt. A prune removes the pruned blocks' archive entries, and the last block's archive commits to
+   * its whole history, so a last block still found by archive means the chain below it is still its own ancestry.
+   */
+  private async checkLastBlockStillLocal(
+    proposal: CheckpointProposalCore,
+    result: CheckpointProposalValidationFailureResult,
+    proposalInfo: LogData,
+  ): Promise<CheckpointProposalValidationFailureResult> {
+    if ((await this.blockSource.getBlockData({ archive: proposal.archive })) !== undefined) {
+      return result;
+    }
+    this.log.warn(`Checkpoint's last block was pruned while validating the proposal, not attributing the rejection`, {
+      ...proposalInfo,
+      originalReason: result.reason,
+    });
+    return { ...result, reason: 'last_block_pruned_during_validation' };
+  }
+
+  /**
+   * The endpoint gate's own ceiling, narrowed by a slot whose attestation window is nearly spent.
+   *
+   * The floor survives past the attestation deadline on purpose, and is bounded at
+   * {@link INBOX_ENDPOINT_CHECK_MIN_WINDOW_MS} for it: a late node still wants the content verdict for telemetry,
+   * and reaching one costs one bounded local L1 read. What the floor must not buy is a signature, which is why
+   * {@link getAttestationDeadline} is re-read at the signing boundary rather than here — a window is not a
+   * permission to attest.
+   */
   private getInboxEndpointWindowMs(slot: SlotNumber): number {
     const remainingMs = this.getReexecutionDeadline(slot).getTime() - this.dateProvider.now();
     return Math.min(INBOX_ENDPOINT_CHECK_WINDOW_MS, Math.max(INBOX_ENDPOINT_CHECK_MIN_WINDOW_MS, remainingMs));
   }
 
+  /** The consensus attestation deadline for a slot: the last moment an attestation for it may be signed. */
+  public getAttestationDeadline(slot: SlotNumber): Date {
+    return this.getReexecutionDeadline(slot);
+  }
+
   /**
    * Validates a checkpoint proposal by building the full checkpoint and comparing it with the proposal.
    * @returns Validation result with isValid flag and reason if invalid.
@@ -1941,9 +2124,10 @@ export class ProposalHandler {
     // runs on: the block carrying the signed archive is the checkpoint's last block, and the slot's blocks before it
     // are the checkpoint's. Reading the last block by archive and the slot's blocks separately would let a local prune
     // between the two reads look like a proposer offense; a slot read without the signed archive, or one that is not
-    // a contiguous chain, is local state in motion and is retried. The deadline is passed to retryUntil as an
-    // absolute date so the remaining budget is derived from the date provider; a deadline already in the past times
-    // out after a single attempt instead of looping (the immediate-timeout semantics of the deadline overload).
+    // a contiguous chain of one checkpoint's blocks starting at its first, is local state in motion and is retried.
+    // The deadline is passed to retryUntil as an absolute date so the remaining budget is derived from the date
+    // provider; a deadline already in the past times out after a single attempt instead of looping (the
+    // immediate-timeout semantics of the deadline overload).
     let snapshot: CheckpointBlocksSnapshot | undefined;
     try {
       snapshot = await retryUntil(
@@ -2031,6 +2215,18 @@ export class ProposalHandler {
     const constants = this.extractCheckpointConstants(firstBlock);
     const checkpointNumber = firstBlock.checkpointNumber;
 
+    // The rebuild derives the header's lastArchiveRoot from the first block's lastArchive (as does the checkpoint
+    // circuit), so any other claimed value is an unprovable header; reject it before paying for the rebuild.
+    const expectedLastArchiveRoot = firstBlock.header.lastArchive.root;
+    if (!proposal.checkpointHeader.lastArchiveRoot.equals(expectedLastArchiveRoot)) {
+      this.log.warn(`Checkpoint proposal's last archive root does not match its first block`, {
+        ...proposalInfo,
+        expectedLastArchiveRoot: expectedLastArchiveRoot.toString(),
+        proposalLastArchiveRoot: proposal.checkpointHeader.lastArchiveRoot.toString(),
+      });
+      return { isValid: false, reason: 'last_archive_root_mismatch', checkpointNumber };
+    }
+
     // The checkpoint's Inbox consumption starts at the leaf count of the block before its first block. Without that
     // block the consumed bundle cannot be derived; an empty bundle would make a valid proposal fail its rolling-hash
     // recomputation and be classified as a proposer offense, so a missing parent is a local fetch failure instead.
@@ -2104,17 +2300,15 @@ export class ProposalHandler {
     }
     await using fork = forkResult;
 
-    // Verify the fork's archive root matches the checkpoint's expected starting archive (the archive after
-    // the parent block). A mismatch means world state forked from a different chain than the proposal was
-    // built on (e.g. a reorg), so recomputing the checkpoint against it would be meaningless. This mirrors
-    // the block-proposal re-execution check and fails fast with a clean, non-slashable result instead of a
-    // confusing downstream mismatch.
+    // World state must be on the same chain as the archiver blocks being rebuilt; otherwise the rebuild would disagree
+    // with an honest proposal. This is a local race (e.g. a reorg between the hash-pinned sync and the fork), never a
+    // proposer offense. It mirrors the block-proposal re-execution check.
     const forkArchiveRoot = new Fr((await fork.getTreeInfo(MerkleTreeId.ARCHIVE)).root);
-    if (!forkArchiveRoot.equals(proposal.checkpointHeader.lastArchiveRoot)) {
-      this.log.warn(`Fork archive root does not match checkpoint proposal's last archive`, {
+    if (!forkArchiveRoot.equals(expectedLastArchiveRoot)) {
+      this.log.warn(`Fork archive root does not match the checkpoint's first block last archive`, {
         ...proposalInfo,
         forkArchiveRoot: forkArchiveRoot.toString(),
-        expectedLastArchiveRoot: proposal.checkpointHeader.lastArchiveRoot.toString(),
+        expectedLastArchiveRoot: expectedLastArchiveRoot.toString(),
       });
       return { isValid: false, reason: 'initial_archive_mismatch', checkpointNumber };
     }

package/src/streaming_inbox_checks.ts

@@ -211,12 +211,21 @@ export async function readStreamingBlockBundle(
 }
 
 /**
- * Message fragments that identify an ordinary local-view shortfall from the archiver's range read: the range reaches
- * past what this node has synced, or its bounds are not a valid range at all. Matched on the message text rather than
- * on the error's class, since a JSON-RPC hop between the validator and its message source leaves the class behind
- * while preserving the message.
+ * The complete message forms of an ordinary local-view shortfall from the archiver's range read: the range reaches
+ * past what this node has synced, or its bounds are not a valid range at all. Matched on the message text rather
+ * than on the error's class, since a JSON-RPC hop between the validator and its message source leaves the class
+ * behind while preserving the message.
+ *
+ * Anchored to the whole message on purpose. A substring test also swallows anything that quotes one of these — a
+ * store or provider fault reported as `database unavailable: Inbox message range [3, 7) is not fully synced` is a
+ * failure the checks did not anticipate, and reporting it as ordinary sync lag loses the only diagnosis a validator
+ * that runs out of retries can offer. Matching is about which failures are *reported*, not which are accepted:
+ * every range-read failure stays non-punitive either way.
  */
-const EXPECTED_RANGE_READ_FAILURES = ['is not fully synced', 'Invalid Inbox leaf count range'];
+const EXPECTED_RANGE_READ_FAILURES: readonly RegExp[] = [
+  /^Inbox message range \[-?\d+, -?\d+\) is not fully synced(: [\s\S]*)?$/,
+  /^Invalid Inbox leaf count range \[-?\d+, -?\d+\)$/,
+];
 
 /** Upper bound on the error text carried onto a result, so a verbose provider error cannot blow up a log record. */
 const MAX_REPORTED_ERROR_LENGTH = 200;
@@ -224,7 +233,7 @@ const MAX_REPORTED_ERROR_LENGTH = 200;
 /** Bounded text of a range-read failure the checks did not anticipate, or undefined for ordinary sync lag. */
 function unexpectedRangeReadError(err: unknown): string | undefined {
   const message = err instanceof Error ? err.message : String(err);
-  return EXPECTED_RANGE_READ_FAILURES.some(fragment => message.includes(fragment))
+  return EXPECTED_RANGE_READ_FAILURES.some(form => form.test(message))
     ? undefined
     : message.slice(0, MAX_REPORTED_ERROR_LENGTH);
 }