@aztec/prover-node 5.0.0-rc.1 → 5.0.0-rc.2

package/src/job/epoch-session.ts

@@ -92,7 +92,7 @@ export type EpochSessionDeps = {
  *
  * Lifecycle (happy path):
  *
- *   initialized → awaiting-checkpoints → completed
+ *   initialized → awaiting-checkpoints → awaiting-root → publishing-proof → completed
  *
  * Terminal states map the publishing outcome: `published` → `completed`, `superseded` →
  * `superseded`, `failed` → `failed`, `expired` → `timed-out`, `withdrawn` → `cancelled`.
@@ -320,6 +320,12 @@ export class EpochSession implements Traceable {
       0,
     );
 
+    // Reflect the publish phase. Guard against a terminal state set concurrently by cancel() — the
+    // post-submit isTerminal() check below relies on cancel still winning.
+    if (!this.isTerminal()) {
+      this.state = 'publishing-proof';
+    }
+
     const outcome = await this.deps.publishingService.submit({
       id: this.uuid,
       epoch: this.spec.epochNumber,
@@ -333,6 +339,7 @@ export class EpochSession implements Traceable {
       proof: proof.proof,
       batchedBlobInputs: proof.batchedBlobInputs,
       attestations,
+      headers: this.checkpoints.map(c => c.checkpoint.header),
     });
 
     if (this.isTerminal()) {
@@ -347,7 +354,7 @@ export class EpochSession implements Traceable {
           { uuid: this.uuid, ...this.spec },
         );
         this.state = 'completed';
-        this.deps.metrics.recordProvingJob(timer.ms(), timer.ms(), checkpointCount, epochSizeBlocks, epochSizeTxs);
+        this.deps.metrics.recordProvingJob(timer.ms(), checkpointCount, epochSizeBlocks, epochSizeTxs);
         return;
       case 'superseded':
         this.log.info(`EpochSession ${this.uuid} superseded by a longer candidate`, {
@@ -410,15 +417,20 @@ export class EpochSession implements Traceable {
     }
   }
 
-  private toTopTreeHooks(): TopTreeJobHooks | undefined {
+  private toTopTreeHooks(): TopTreeJobHooks {
     const hooks = this.deps.hooks;
-    if (!hooks?.beforeTopTreeProve && !hooks?.afterTopTreeProve && !hooks?.topTreeProveOverride) {
-      return undefined;
-    }
     return {
-      beforeProve: hooks.beforeTopTreeProve,
-      afterProve: hooks.afterTopTreeProve,
-      proveOverride: hooks.topTreeProveOverride,
+      // `beforeProve` fires once the sub-tree (checkpoint block) proofs are ready and the root prove is
+      // about to start — the boundary between `awaiting-checkpoints` and proving the top tree. Don't
+      // clobber a terminal state set concurrently by cancel().
+      beforeProve: async () => {
+        if (!this.isTerminal()) {
+          this.state = 'awaiting-root';
+        }
+        await hooks?.beforeTopTreeProve?.();
+      },
+      afterProve: hooks?.afterTopTreeProve,
+      proveOverride: hooks?.topTreeProveOverride,
     };
   }
 }

package/src/metrics.ts

@@ -22,7 +22,6 @@ import type { CheckpointStore } from './checkpoint-store.js';
 import type { SessionManager } from './session-manager.js';
 
 export class ProverNodeJobMetrics {
-  proverEpochExecutionDuration: Histogram;
   provingJobDuration: Histogram;
   provingJobCheckpoints: Gauge;
   provingJobBlocks: Gauge;
@@ -31,6 +30,9 @@ export class ProverNodeJobMetrics {
   private blobProcessingDuration: Gauge;
   private blockProcessingDuration: Histogram;
   private checkpointProcessingDuration: Histogram;
+  private checkpointProvingDuration: Histogram;
+  private checkpointBlocks: Histogram;
+  private checkpointTransactions: Histogram;
 
   /** Observable gauges for live state. Registered via `observeState(...)` once the
    *  CheckpointStore and SessionManager are available. */
@@ -44,7 +46,6 @@ export class ProverNodeJobMetrics {
     public readonly tracer: Tracer,
     private logger = createLogger('prover-node:publisher:metrics'),
   ) {
-    this.proverEpochExecutionDuration = this.meter.createHistogram(Metrics.PROVER_NODE_EXECUTION_DURATION);
     this.provingJobDuration = this.meter.createHistogram(Metrics.PROVER_NODE_JOB_DURATION);
     this.provingJobCheckpoints = this.meter.createGauge(Metrics.PROVER_NODE_JOB_CHECKPOINTS);
     this.provingJobBlocks = this.meter.createGauge(Metrics.PROVER_NODE_JOB_BLOCKS);
@@ -53,16 +54,12 @@ export class ProverNodeJobMetrics {
     this.blobProcessingDuration = this.meter.createGauge(Metrics.PROVER_NODE_BLOB_PROCESSING_LAST_DURATION);
     this.blockProcessingDuration = this.meter.createHistogram(Metrics.PROVER_NODE_BLOCK_PROCESSING_DURATION);
     this.checkpointProcessingDuration = this.meter.createHistogram(Metrics.PROVER_NODE_CHECKPOINT_PROCESSING_DURATION);
+    this.checkpointProvingDuration = this.meter.createHistogram(Metrics.PROVER_NODE_CHECKPOINT_PROVING_DURATION);
+    this.checkpointBlocks = this.meter.createHistogram(Metrics.PROVER_NODE_CHECKPOINT_BLOCKS);
+    this.checkpointTransactions = this.meter.createHistogram(Metrics.PROVER_NODE_CHECKPOINT_TRANSACTIONS);
   }
 
-  public recordProvingJob(
-    executionTimeMs: number,
-    totalTimeMs: number,
-    numCheckpoints: number,
-    numBlocks: number,
-    numTxs: number,
-  ) {
-    this.proverEpochExecutionDuration.record(Math.ceil(executionTimeMs));
+  public recordProvingJob(totalTimeMs: number, numCheckpoints: number, numBlocks: number, numTxs: number) {
     this.provingJobDuration.record(totalTimeMs / 1000);
     this.provingJobCheckpoints.record(Math.floor(numCheckpoints));
     this.provingJobBlocks.record(Math.floor(numBlocks));
@@ -77,8 +74,14 @@ export class ProverNodeJobMetrics {
     this.blockProcessingDuration.record(Math.ceil(durationMs));
   }
 
-  public recordCheckpointProcessing(durationMs: number) {
+  public recordCheckpointProcessing(durationMs: number, numBlocks: number, numTxs: number) {
     this.checkpointProcessingDuration.record(Math.ceil(durationMs));
+    this.checkpointBlocks.record(Math.floor(numBlocks));
+    this.checkpointTransactions.record(Math.floor(numTxs));
+  }
+
+  public recordCheckpointProving(durationMs: number) {
+    this.checkpointProvingDuration.record(Math.ceil(durationMs));
   }
 
   /**

package/src/proof-publishing-service.ts

@@ -7,7 +7,7 @@ import { SerialQueue } from '@aztec/foundation/queue';
 import type { DateProvider } from '@aztec/foundation/timer';
 import type { L2BlockSource } from '@aztec/stdlib/block';
 import type { Proof } from '@aztec/stdlib/proofs';
-import type { RootRollupPublicInputs } from '@aztec/stdlib/rollup';
+import type { CheckpointHeader, RootRollupPublicInputs } from '@aztec/stdlib/rollup';
 
 import type { ProverNodePublisher } from './prover-node-publisher.js';
 import type { ProverPublisherFactory } from './prover-publisher-factory.js';
@@ -45,6 +45,8 @@ export type PublishCandidate = {
   proof: Proof;
   batchedBlobInputs: BatchedBlob;
   attestations: ViemCommitteeAttestation[];
+  /** Committee-attested checkpoint headers for the range, supplying the L1-verified fee recipient/value. */
+  headers: CheckpointHeader[];
 };
 
 /** Terminal outcome for a candidate. The promise from `submit()` resolves with one of these. */
@@ -333,6 +335,7 @@ export class ProofPublishingService {
       proof: candidate.proof,
       batchedBlobInputs: candidate.batchedBlobInputs,
       attestations: candidate.attestations,
+      headers: candidate.headers,
       // Stop the L1 tx retrying past the candidate's submission-window deadline.
       deadline: candidate.deadline,
     };

package/src/prover-node-publisher.ts

@@ -2,19 +2,17 @@ import { BatchedBlob, getEthBlobEvaluationInputs } from '@aztec/blob-lib';
 import { MAX_CHECKPOINTS_PER_EPOCH } from '@aztec/constants';
 import type { RollupContract, ViemCommitteeAttestation } from '@aztec/ethereum/contracts';
 import type { L1TxUtils } from '@aztec/ethereum/l1-tx-utils';
-import { makeTuple } from '@aztec/foundation/array';
 import { CheckpointNumber, EpochNumber } from '@aztec/foundation/branded-types';
 import { areArraysEqual } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
-import type { Tuple } from '@aztec/foundation/serialize';
 import { Timer } from '@aztec/foundation/timer';
 import { RollupAbi } from '@aztec/l1-artifacts';
 import type { PublisherConfig, TxSenderConfig } from '@aztec/sequencer-client';
 import { CommitteeAttestation, CommitteeAttestationsAndSigners } from '@aztec/stdlib/block';
 import type { Proof } from '@aztec/stdlib/proofs';
-import type { FeeRecipient, RootRollupPublicInputs } from '@aztec/stdlib/rollup';
+import type { CheckpointHeader, RootRollupPublicInputs } from '@aztec/stdlib/rollup';
 import type { L1PublishProofStats } from '@aztec/stdlib/stats';
 import { type TelemetryClient, getTelemetryClient } from '@aztec/telemetry-client';
 
@@ -31,7 +29,7 @@ export type L1SubmitEpochProofArgs = {
   endTimestamp: Fr;
   outHash: Fr;
   proverId: Fr;
-  fees: Tuple<FeeRecipient, typeof MAX_CHECKPOINTS_PER_EPOCH>;
+  headers: CheckpointHeader[];
   proof: Proof;
 };
 
@@ -78,6 +76,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
     /** Wall-clock deadline (proof-submission window end) past which the L1 tx should stop retrying. */
     deadline?: Date;
   }): Promise<boolean> {
@@ -134,6 +133,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }) {
     const { fromCheckpoint, toCheckpoint, publicInputs, batchedBlobInputs } = args;
 
@@ -207,6 +207,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }): Promise<void> {
     const { epochNumber, fromCheckpoint, toCheckpoint } = args;
 
@@ -254,6 +255,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }): Hex {
     return encodeFunctionData({
       abi: RollupAbi,
@@ -270,6 +272,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }): Promise<TransactionReceipt | undefined> {
     const txArgs = [this.getSubmitEpochProofArgs(args)] as const;
 
@@ -316,6 +319,7 @@ export class ProverNodePublisher {
     publicInputs: RootRollupPublicInputs;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }) {
     // Returns arguments for EpochProofLib.sol -> getEpochProofPublicInputs()
     return [
@@ -327,11 +331,7 @@ export class ProverNodePublisher {
         outHash: args.publicInputs.outHash.toString(),
         proverId: EthAddress.fromField(args.publicInputs.constants.proverId).toString(),
       } /*_args*/,
-      makeTuple(MAX_CHECKPOINTS_PER_EPOCH * 2, i =>
-        i % 2 === 0
-          ? args.publicInputs.fees[i / 2].recipient.toField().toString()
-          : args.publicInputs.fees[(i - 1) / 2].value.toString(),
-      ) /*_fees*/,
+      args.headers.map(header => header.toViem()) /*_headers*/,
       getEthBlobEvaluationInputs(args.batchedBlobInputs) /*_blobPublicInputs*/,
     ] as const;
   }
@@ -343,6 +343,7 @@ export class ProverNodePublisher {
     proof: Proof;
     batchedBlobInputs: BatchedBlob;
     attestations: ViemCommitteeAttestation[];
+    headers: CheckpointHeader[];
   }) {
     // Returns arguments for EpochProofLib.sol -> submitEpochRootProof()
     const proofHex: Hex = `0x${args.proof.withoutPublicInputs().toString('hex')}`;
@@ -351,7 +352,7 @@ export class ProverNodePublisher {
       start: argsArray[0],
       end: argsArray[1],
       args: argsArray[2],
-      fees: argsArray[3],
+      headers: argsArray[3],
       attestations: CommitteeAttestationsAndSigners.packAttestations(
         args.attestations.map(a => CommitteeAttestation.fromViem(a)),
       ),

package/src/prover-node.ts

@@ -5,12 +5,14 @@ import { BlockNumber, CheckpointNumber, EpochNumber } from '@aztec/foundation/br
 import { assertRequired, compact, pick } from '@aztec/foundation/collection';
 import { memoize } from '@aztec/foundation/decorators';
 import { createLogger } from '@aztec/foundation/log';
+import { RunningPromise } from '@aztec/foundation/running-promise';
 import { DateProvider, executeTimeout } from '@aztec/foundation/timer';
 import type { EpochProverFactory } from '@aztec/prover-client';
 import { getLastSiblingPath } from '@aztec/prover-client/helpers';
 import { ChonkCache } from '@aztec/prover-client/orchestrator';
 import { PublicProcessorFactory } from '@aztec/simulator/server';
 import {
+  type L2BlockId,
   type L2BlockSource,
   L2BlockStream,
   type L2BlockStreamEvent,
@@ -28,7 +30,6 @@ import {
   type ITxProvider,
   type ProverNodeApi,
   type Service,
-  type WorldStateSyncStatus,
   type WorldStateSynchronizer,
   tryStop,
 } from '@aztec/stdlib/interfaces/server';
@@ -95,6 +96,17 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
    */
   protected lastExpiredEpoch: EpochNumber | undefined;
 
+  /**
+   * Highest checkpoint number whose proving-side handling has completed (or that was legitimately skipped).
+   * The catch-up loop walks from here to each `chain-checkpointed` tip event. Seeded at start() from the last
+   * checkpoint of the last fully-proven epoch (or 0), so a restart reprocesses the partially-proven epoch rather
+   * than trusting a checkpointed tip that may sit ahead of unproven checkpoints. Clamped down on a prune.
+   */
+  protected lastProcessedCheckpoint: CheckpointNumber = CheckpointNumber.ZERO;
+
+  /** Periodic tick that runs the epoch-expiry sweep during idle periods when no block-stream events arrive. */
+  private expiryTicker: RunningPromise | undefined;
+
   public readonly tracer: Tracer;
 
   protected publishingService: ProofPublishingService | undefined;
@@ -198,17 +210,6 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     return this.sessionManager;
   }
 
-  /** Returns world state status. */
-  public async getWorldStateSyncStatus(): Promise<WorldStateSyncStatus> {
-    const { syncSummary } = await this.worldState.status();
-    return syncSummary;
-  }
-
-  /** Returns archiver status. */
-  public getL2Tips() {
-    return this.l2BlockSource.getL2Tips();
-  }
-
   /** Returns the underlying prover instance. */
   public getProver() {
     return this.prover;
@@ -219,17 +220,25 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
   public async handleBlockStreamEvent(event: L2BlockStreamEvent): Promise<void> {
     switch (event.type) {
       case 'chain-checkpointed':
-        await this.handleCheckpointEvent(event.checkpoint);
+        await this.processCheckpointJump(event.checkpoint.number);
         break;
       case 'chain-pruned':
-        await this.handlePruneEvent(event.checkpointed.checkpoint);
+        await this.handlePruneEvent(event.block);
         break;
       case 'chain-proven':
         this.publishingService?.onChainProven(BlockNumber(event.block.number));
         break;
+      // The proposed tip drives only the tips store's walk-back history (recorded below); the prover-node
+      // tracks checkpoints, not proposed blocks. `blocks-added` is never emitted in tips-only mode, and
+      // `chain-finalized` carries nothing the prover-node acts on.
+      case 'chain-proposed':
       case 'chain-finalized':
       case 'blocks-added':
         break;
+      default: {
+        const _: never = event;
+        break;
+      }
     }
     // Expiry is driven by the archiver's latest synced L2 slot
     await this.checkEpochExpiry();
@@ -239,34 +248,92 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     await this.tipsStore.handleBlockStreamEvent(event);
   }
 
-  /** Register a new checkpoint with the store and notify the session manager. */
-  private async handleCheckpointEvent(publishedCheckpoint: PublishedCheckpoint) {
-    const checkpoint = publishedCheckpoint.checkpoint;
-    const slotNumber = checkpoint.header.slotNumber;
-    const l1Constants = await this.getL1Constants();
-    const epochNumber = getEpochAtSlot(slotNumber, l1Constants);
-
-    if (await this.isEpochFullyProven(epochNumber, l1Constants)) {
-      this.log.debug(`Skipping checkpoint ${checkpoint.number} for already-proven epoch ${epochNumber}`);
+  /**
+   * Walks every checkpoint between the local cursor and the newly-reported checkpointed tip, registering
+   * each one that belongs to an epoch that can still be proven. The block stream now delivers a single thin
+   * `chain-checkpointed` tip event per pass rather than one fat event per checkpoint, so this drives the
+   * catch-up itself: light metadata first (`getCheckpointsData`) to decide relevance per epoch, then a heavy
+   * `getCheckpoints` fetch only for checkpoints in provable epochs.
+   *
+   * The cursor advances one checkpoint at a time and only after that checkpoint's proving-side handling has
+   * fully succeeded, preserving the A-1041 at-least-once semantics: a mid-jump failure leaves the cursor
+   * behind so the next pass retries from the first checkpoint that did not complete.
+   */
+  private async processCheckpointJump(targetCheckpoint: CheckpointNumber): Promise<void> {
+    if (targetCheckpoint <= this.lastProcessedCheckpoint) {
       return;
     }
+    const l1Constants = await this.getL1Constants();
 
-    if (await this.isEpochPastProofSubmissionWindow(epochNumber, l1Constants)) {
-      this.log.debug(
-        `Skipping checkpoint ${checkpoint.number} for epoch ${epochNumber} past its proof-submission window`,
-      );
-      return;
+    // Cap the catch-up at the `(proofSubmissionEpochs + 1) * epochDuration` most recent checkpoints.
+    // When the cursor is much further behind (e.g. resyncing after a long time offline), fetching the whole gap could
+    // load thousands of checkpoints we cannot act on: anything older than the last two epochs is already past
+    // its proof-submission window, so we skip it and jump the cursor forward to the start of the capped range.
+    const maxCheckpoints = (l1Constants.proofSubmissionEpochs + 1) * l1Constants.epochDuration;
+    let from = CheckpointNumber(this.lastProcessedCheckpoint + 1);
+    if (Number(targetCheckpoint - from) + 1 > maxCheckpoints) {
+      const cappedFrom = CheckpointNumber(targetCheckpoint - maxCheckpoints + 1);
+      this.log.warn(`Skipping unprovable checkpoints during catch-up; the prover node is far behind`, {
+        from,
+        cappedFrom,
+        targetCheckpoint,
+        maxCheckpoints,
+      });
+      // Advance the cursor past the skipped checkpoints so they are never retried.
+      this.lastProcessedCheckpoint = CheckpointNumber(cappedFrom - 1);
+      from = cappedFrom;
     }
+    const limit = Number(targetCheckpoint - from) + 1;
+    const metadatas = await this.l2BlockSource.getCheckpointsData({ from, limit });
+
+    // Per-epoch relevance is cached so a multi-checkpoint epoch resolves it once. Skipping is whole-epoch
+    // only: the SessionManager requires an epoch's checkpoints fully covered before it opens a session, so we
+    // never drop an individual checkpoint inside an epoch we will prove.
+    const epochSkippable = new Map<EpochNumber, boolean>();
+    for (const metadata of metadatas) {
+      const epochNumber = getEpochAtSlot(metadata.header.slotNumber, l1Constants);
+      let skippable = epochSkippable.get(epochNumber);
+      if (skippable === undefined) {
+        skippable =
+          (await this.isEpochFullyProven(epochNumber, l1Constants)) ||
+          (await this.isEpochPastProofSubmissionWindow(epochNumber, l1Constants));
+        epochSkippable.set(epochNumber, skippable);
+      }
+      if (skippable) {
+        this.log.debug(`Skipping checkpoint ${metadata.checkpointNumber} for unprovable epoch ${epochNumber}`);
+      } else {
+        await this.registerCheckpoint(metadata.checkpointNumber, epochNumber);
+      }
+      // Advance only after the checkpoint's handling succeeded (or it was legitimately skipped). registerCheckpoint
+      // throws on failure, which leaves the cursor here for the next pass to retry (A-1041).
+      this.lastProcessedCheckpoint = metadata.checkpointNumber;
+    }
+  }
 
+  /** Heavy-fetch a single checkpoint, register it with the store, and notify the session manager. */
+  private async registerCheckpoint(checkpointNumber: CheckpointNumber, epochNumber: EpochNumber): Promise<void> {
+    const published = await this.l2BlockSource.getCheckpoint({ number: checkpointNumber });
+    if (!published) {
+      throw new Error(`Checkpoint ${checkpointNumber} not found in block source during catch-up`);
+    }
+    const checkpoint = published.checkpoint;
     this.log.info(`New checkpoint ${checkpoint.number} for epoch ${epochNumber}`, {
       checkpointNumber: checkpoint.number,
       epochNumber,
-      slotNumber,
+      slotNumber: checkpoint.header.slotNumber,
     });
 
-    const registerData = await this.collectRegisterData(checkpoint, publishedCheckpoint.attestations);
+    const registerData = await this.collectRegisterData(checkpoint, published.attestations);
     await this.checkpointStore.addOrUpdate(checkpoint, registerData);
     await this.sessionManager?.onCheckpointAdded(epochNumber);
+
+    // Tips-only mode delivers no blocks, so record one witness per checkpointed block: a reorg into the checkpoint's
+    // range then prunes at the true divergence instead of the nearest sparse tip anchor.
+    await this.tipsStore.recordBlockHashes(
+      await Promise.all(
+        checkpoint.blocks.map(async block => ({ number: block.number, hash: (await block.header.hash()).toString() })),
+      ),
+    );
   }
 
   /**
@@ -295,10 +362,41 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     };
   }
 
-  /** Mark every prover above the prune threshold as pruned and notify the session manager. */
-  private async handlePruneEvent(prunedCheckpoint: { number: CheckpointNumber; hash: string }) {
-    this.log.warn(`Chain pruned to checkpoint ${prunedCheckpoint.number}`, { prunedCheckpoint });
-    const affected = this.checkpointStore.markPrunedAfter(prunedCheckpoint.number);
+  /**
+   * Marks every prover orphaned by the prune as pruned, clamps the catch-up cursor below the prune target's
+   * checkpoint, and notifies the session manager. Keyed off the prune target block (the highest surviving block)
+   * rather than the source's checkpointed tip, which can sit above the target after a re-checkpoint and would leave
+   * orphaned provers canonical. Throws (rather than warning) if the cursor floor cannot be resolved, so the pass
+   * fails and the prune is retried next iteration.
+   */
+  private async handlePruneEvent(prunedToBlock: L2BlockId) {
+    this.log.warn(`Chain pruned to block ${prunedToBlock.number}`, { prunedToBlock });
+
+    // Resolve the cursor floor BEFORE marking provers: markPrunedAboveBlock returns only newly-marked provers, so a
+    // throw after marking would leave a retry pass with nothing to act on. Resolving first means a throw leaves
+    // everything untouched and the next pass retries the whole handler (the tips cursor only advances on success).
+    let cursorFloor: CheckpointNumber;
+    if (prunedToBlock.number === 0) {
+      cursorFloor = CheckpointNumber.ZERO;
+    } else {
+      const targetData = await this.l2BlockSource.getBlockData({ number: prunedToBlock.number });
+      if (targetData === undefined) {
+        throw new Error(
+          `No block data found for prune target block ${prunedToBlock.number}; cannot clamp checkpoint cursor`,
+        );
+      }
+      // Clamp to `cpAtTarget - 1`: a mid-checkpoint target leaves that checkpoint partially orphaned and it must be
+      // reprocessed. Over-clamping merely re-registers a checkpoint (at-least-once by design — A-1041); under-clamping
+      // would permanently skip a rebuilt same-number checkpoint.
+      cursorFloor = CheckpointNumber(Math.max(0, Number(targetData.checkpointNumber) - 1));
+    }
+
+    const affected = this.checkpointStore.markPrunedAboveBlock(prunedToBlock.number);
+
+    if (this.lastProcessedCheckpoint > cursorFloor) {
+      this.lastProcessedCheckpoint = cursorFloor;
+    }
+
     if (affected.length === 0) {
       return;
     }
@@ -409,14 +507,24 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     // Now that the store + manager exist, arm the live-state observable gauges.
     this.jobMetrics.observeState(this.checkpointStore, this.sessionManager);
 
-    const { startingBlock, lastFullyProvenEpoch } = await this.computeStartupState();
+    const { lastFullyProvenEpoch } = await this.resolveLastFullyProvenEpoch();
     this.lastExpiredEpoch = lastFullyProvenEpoch;
+    this.lastProcessedCheckpoint = await this.computeStartingCheckpoint(lastFullyProvenEpoch);
     this.blockStream = new L2BlockStream(this.l2BlockSource, this.tipsStore, this, this.log, {
       pollIntervalMS: this.config.proverNodePollingIntervalMs,
-      startingBlock,
+      tipsOnly: true,
     });
     this.blockStream.start();
 
+    // With thin once-per-pass tip events, the expiry sweep no longer fires once per checkpoint; drive it
+    // from a periodic tick so epochs still expire during idle/no-event periods.
+    this.expiryTicker = new RunningPromise(
+      () => this.checkEpochExpiry(),
+      this.log,
+      this.config.proverNodePollingIntervalMs,
+    );
+    this.expiryTicker.start();
+
     await this.rewardsMetrics.start();
     this.l1Metrics.start();
     this.log.info(`Started Prover Node with prover id ${this.prover.getProverId().toString()}`, this.config);
@@ -426,6 +534,7 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     this.log.info('Stopping ProverNode');
     this.jobMetrics.stopObservingState();
     await this.blockStream?.stop();
+    await this.expiryTicker?.stop();
     if (this.sessionManager) {
       await this.sessionManager.stop();
     }
@@ -552,38 +661,40 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
   }
 
   /**
-   * Resolves the L2BlockStream's starting block and the last fully-proven epoch in one
-   * pass. The starting block is the first block of the next unproven epoch (or the start
-   * of the partially-proven epoch if the proven tip falls mid-epoch). The fully-proven
-   * epoch is `provenEpoch` when the proven tip is the last block of its epoch, otherwise
-   * `provenEpoch - 1`, or `undefined` if no block is proven yet.
+   * Resolves the last fully-proven epoch from L1 proven state, used to seed the catch-up cursor (via
+   * `computeStartingCheckpoint`) and `lastExpiredEpoch`. The fully-proven epoch is `provenEpoch` when the
+   * proven tip is the last block of its epoch, otherwise `provenEpoch - 1`, or `undefined` if no block is
+   * proven yet (so a restart reprocesses the partially-proven epoch rather than trusting a stale tip).
    */
-  protected async computeStartupState(): Promise<{
-    startingBlock: BlockNumber;
-    lastFullyProvenEpoch: EpochNumber | undefined;
-  }> {
+  protected async resolveLastFullyProvenEpoch(): Promise<{ lastFullyProvenEpoch: EpochNumber | undefined }> {
     const provenBlockNumber = await this.l2BlockSource.getBlockNumber({ tag: 'proven' });
     if (!provenBlockNumber || provenBlockNumber <= 0) {
-      return { startingBlock: BlockNumber(1), lastFullyProvenEpoch: undefined };
+      return { lastFullyProvenEpoch: undefined };
     }
     const l1Constants = await this.getL1Constants();
     const provenHeader = (await this.l2BlockSource.getBlockData({ number: BlockNumber(provenBlockNumber) }))?.header;
     if (!provenHeader) {
-      return { startingBlock: BlockNumber(provenBlockNumber + 1), lastFullyProvenEpoch: undefined };
+      return { lastFullyProvenEpoch: undefined };
     }
     const provenEpoch = getEpochAtSlot(provenHeader.getSlot(), l1Constants);
     if (await this.isProvenBlockLastOfItsEpoch(BlockNumber(provenBlockNumber), provenEpoch, l1Constants)) {
-      return { startingBlock: BlockNumber(provenBlockNumber + 1), lastFullyProvenEpoch: provenEpoch };
+      return { lastFullyProvenEpoch: provenEpoch };
     }
-    const epochCheckpoints = await this.l2BlockSource.getCheckpointsData({ epoch: provenEpoch });
-    const firstBlockOfEpoch =
-      epochCheckpoints.length > 0 ? epochCheckpoints[0].startBlock : BlockNumber(provenBlockNumber);
-    this.log.info(
-      `Starting L2BlockStream at block ${firstBlockOfEpoch} (start of partially-proven epoch ${provenEpoch})`,
-      { provenBlockNumber, provenEpoch, firstBlockOfEpoch },
-    );
     const lastFullyProvenEpoch = provenEpoch > 0 ? EpochNumber(provenEpoch - 1) : undefined;
-    return { startingBlock: firstBlockOfEpoch, lastFullyProvenEpoch };
+    return { lastFullyProvenEpoch };
+  }
+
+  /**
+   * Resolves the catch-up cursor seed: the last checkpoint of the last fully-proven epoch, or 0 if none. Seeding
+   * from a checkpoint (rather than a checkpointed tip) guarantees a restart reprocesses every checkpoint of the
+   * partially-proven epoch, since the checkpointed tip can sit ahead of the last fully-proven checkpoint.
+   */
+  protected async computeStartingCheckpoint(lastFullyProvenEpoch: EpochNumber | undefined): Promise<CheckpointNumber> {
+    if (lastFullyProvenEpoch === undefined) {
+      return CheckpointNumber.ZERO;
+    }
+    const checkpoints = await this.l2BlockSource.getCheckpointsData({ epoch: lastFullyProvenEpoch });
+    return checkpoints.at(-1)?.checkpointNumber ?? CheckpointNumber.ZERO;
   }
 
   private async gatherPreviousBlockHeader(previousBlockNumber: number) {