@aztec/prover-node 5.0.0-rc.2 → 5.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aztec/prover-node",
-  "version": "5.0.0-rc.2",
+  "version": "5.0.1",
   "type": "module",
   "exports": {
     ".": "./dest/index.js",
@@ -56,28 +56,28 @@
     ]
   },
   "dependencies": {
-    "@aztec/archiver": "5.0.0-rc.2",
-    "@aztec/bb-prover": "5.0.0-rc.2",
-    "@aztec/blob-client": "5.0.0-rc.2",
-    "@aztec/blob-lib": "5.0.0-rc.2",
-    "@aztec/constants": "5.0.0-rc.2",
-    "@aztec/epoch-cache": "5.0.0-rc.2",
-    "@aztec/ethereum": "5.0.0-rc.2",
-    "@aztec/foundation": "5.0.0-rc.2",
-    "@aztec/kv-store": "5.0.0-rc.2",
-    "@aztec/l1-artifacts": "5.0.0-rc.2",
-    "@aztec/native": "5.0.0-rc.2",
-    "@aztec/node-keystore": "5.0.0-rc.2",
-    "@aztec/node-lib": "5.0.0-rc.2",
-    "@aztec/noir-protocol-circuits-types": "5.0.0-rc.2",
-    "@aztec/p2p": "5.0.0-rc.2",
-    "@aztec/protocol-contracts": "5.0.0-rc.2",
-    "@aztec/prover-client": "5.0.0-rc.2",
-    "@aztec/sequencer-client": "5.0.0-rc.2",
-    "@aztec/simulator": "5.0.0-rc.2",
-    "@aztec/stdlib": "5.0.0-rc.2",
-    "@aztec/telemetry-client": "5.0.0-rc.2",
-    "@aztec/world-state": "5.0.0-rc.2",
+    "@aztec/archiver": "5.0.1",
+    "@aztec/bb-prover": "5.0.1",
+    "@aztec/blob-client": "5.0.1",
+    "@aztec/blob-lib": "5.0.1",
+    "@aztec/constants": "5.0.1",
+    "@aztec/epoch-cache": "5.0.1",
+    "@aztec/ethereum": "5.0.1",
+    "@aztec/foundation": "5.0.1",
+    "@aztec/kv-store": "5.0.1",
+    "@aztec/l1-artifacts": "5.0.1",
+    "@aztec/native": "5.0.1",
+    "@aztec/node-keystore": "5.0.1",
+    "@aztec/node-lib": "5.0.1",
+    "@aztec/noir-protocol-circuits-types": "5.0.1",
+    "@aztec/p2p": "5.0.1",
+    "@aztec/protocol-contracts": "5.0.1",
+    "@aztec/prover-client": "5.0.1",
+    "@aztec/sequencer-client": "5.0.1",
+    "@aztec/simulator": "5.0.1",
+    "@aztec/stdlib": "5.0.1",
+    "@aztec/telemetry-client": "5.0.1",
+    "@aztec/world-state": "5.0.1",
     "source-map-support": "^0.5.21",
     "tslib": "^2.4.0",
     "viem": "npm:@aztec/viem@2.38.2"

package/src/checkpoint-store.ts

@@ -1,6 +1,5 @@
 import type { BlockNumber, CheckpointNumber, EpochNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
-import { RunningPromise } from '@aztec/foundation/promise';
 import type { L2BlockSource } from '@aztec/stdlib/block';
 import type { Checkpoint } from '@aztec/stdlib/checkpoint';
 import { type L1RollupConstants, getEpochAtSlot, getSlotRangeForEpoch } from '@aztec/stdlib/epoch-helpers';
@@ -19,54 +18,64 @@ export type CheckpointProverFactory = (args: CheckpointProverArgs, deps: Checkpo
  *
  * The store survives every epoch / session boundary. A prover lives from its first
  * `addOrUpdate` call until either:
- *  - it has been pruned and the L2 chain has moved past its slot (no re-add possible), or
+ *  - its checkpoint is pruned by an L1 reorg (`cancelAndRemoveAboveBlock`), or
  *  - its epoch's proof-submission window has closed (`reapExpired`), so the proof could no
  *    longer be accepted on L1 even if produced.
  *
- * A re-add of a checkpoint that matches an existing prover's content key reuses the
- * existing prover (and flips it back to canonical); the in-flight sub-tree work never
- * stops, so a prune-then-re-add of the same content avoids re-proving entirely.
+ * A prover's sub-tree work forks world-state per block and does not survive a prune of a base
+ * block, so there is nothing to preserve across a reorg: a pruned prover is cancelled and
+ * dropped, and a re-add (even of identical content) constructs a fresh prover.
  */
 export class CheckpointStore {
   private readonly provers = new Map<string, CheckpointProver>();
-  private readonly slotWatcher: RunningPromise;
+  /**
+   * Teardowns of provers already removed from `provers` (by prune or reap), awaited on `stop()`.
+   * Keyed by a monotonic id rather than the prover's content id: a prune-then-re-add can leave two
+   * teardowns for the same content id in flight at once, which a content-id key would clobber.
+   */
+  private readonly pendingTeardowns = new Map<number, Promise<void>>();
+  private nextTeardownId = 0;
   private readonly log: Logger;
 
   constructor(
-    private readonly l2BlockSource: Pick<L2BlockSource, 'getSyncedL2SlotNumber' | 'getL1Constants'>,
+    private readonly l2BlockSource: Pick<L2BlockSource, 'getL1Constants'>,
     private readonly proverDeps: Omit<CheckpointProverDeps, 'log'>,
-    private readonly options: { slotWatcherPollIntervalMs: number },
     bindings?: LoggerBindings,
     private readonly proverFactoryFn: CheckpointProverFactory = (args, deps) => new CheckpointProver(args, deps),
   ) {
     this.log = createLogger('prover-node:checkpoint-store', bindings);
-    this.slotWatcher = new RunningPromise(
-      () => this.reapPrunedPastSlot(),
-      this.log,
-      this.options.slotWatcherPollIntervalMs,
-    );
   }
 
   public start(): Promise<void> {
-    this.slotWatcher.start();
     return Promise.resolve();
   }
 
   public async stop(): Promise<void> {
-    await this.slotWatcher.stop();
-    // Cancel every live prover; await teardown.
+    // Cancel every live prover, then await both their teardown and any still in flight for provers
+    // already removed by a prune or reap.
     const provers = Array.from(this.provers.values());
     this.provers.clear();
     for (const prover of provers) {
       prover.cancel();
     }
-    await Promise.allSettled(provers.map(p => p.whenDone()));
+    await Promise.allSettled([...provers.map(p => p.whenDone()), ...this.pendingTeardowns.values()]);
+  }
+
+  /**
+   * Tracks the teardown of a prover just removed from the store so `stop()` can await it. The entry
+   * removes itself once teardown settles, so the map stays bounded by the number in flight.
+   */
+  private trackTeardown(prover: CheckpointProver): void {
+    const id = this.nextTeardownId++;
+    const done = prover.whenDone();
+    this.pendingTeardowns.set(id, done);
+    void done.finally(() => this.pendingTeardowns.delete(id));
   }
 
   /**
    * Registers a checkpoint with the store. If a prover already exists for the
-   * `(number, slot, archive root)` content key, it is reused and marked canonical;
-   * otherwise a new prover is constructed.
+   * `(number, slot, archive root)` content key it is reused (an at-least-once re-registration of
+   * still-canonical content); otherwise a new prover is constructed.
    */
   public async addOrUpdate(checkpoint: Checkpoint, data: RegisterCheckpointData): Promise<CheckpointProver> {
     const l1Constants = await this.l2BlockSource.getL1Constants();
@@ -75,18 +84,18 @@ export class CheckpointStore {
 
     const existing = this.provers.get(id);
     if (existing) {
-      existing.markCanonical();
       return existing;
     }
 
-    // At most one canonical checkpoint per slot. A different canonical checkpoint at the
-    // same slot means the caller forgot to prune the old chain before adding the replacement
-    // — surface it rather than silently creating a parallel canonical chain.
+    // At most one canonical checkpoint per slot. A different checkpoint at the same slot means the
+    // caller forgot to prune the old chain before adding the replacement — surface it rather than
+    // silently creating a parallel canonical chain. A pruned checkpoint has already been removed,
+    // so every prover still in the store is canonical.
     for (const prover of this.provers.values()) {
-      if (prover.slotNumber === checkpoint.header.slotNumber && !prover.isPruned()) {
+      if (prover.slotNumber === checkpoint.header.slotNumber) {
         throw new Error(
           `Cannot add checkpoint ${checkpoint.number} (archive ${checkpoint.archive.root}) at slot ${checkpoint.header.slotNumber}: ` +
-            `a different canonical checkpoint already occupies this slot. Prune it first.`,
+            `a different checkpoint already occupies this slot. Prune it first.`,
         );
       }
     }
@@ -97,20 +106,25 @@ export class CheckpointStore {
   }
 
   /**
-   * Marks every canonical prover that holds a block above the prune target as pruned. A checkpoint is orphaned by a
-   * prune to block `targetBlockNumber` iff its last block sits above the target — including a checkpoint whose range
-   * straddles the target (partially orphaned), which block-range marking catches without boundary ambiguity. Keying
-   * off the surviving block number (rather than a checkpoint number) is correct even when the source has already
+   * Cancels and removes every prover that holds a block above the prune target. A checkpoint is orphaned by a prune to
+   * block `targetBlockNumber` iff its last block sits above the target — including a checkpoint whose range straddles
+   * the target (partially orphaned), which block-range marking catches without boundary ambiguity. Keying off the
+   * surviving block number (rather than a checkpoint number) is correct even when the source has already
    * re-checkpointed past the divergence: the prune event reports the highest surviving block, which by construction
    * survives on the source, whereas the source's current checkpointed tip can sit above the prune target.
-   * Sub-tree work keeps running so a re-add of the same content can pick it up. Returns the affected provers.
+   *
+   * The prover's in-flight sub-tree work forks world-state per block and faults once its base block is pruned, so it
+   * cannot be reused; it is cancelled (aborting the fork reads) and dropped. A subsequent re-add constructs a fresh
+   * prover. Returns the removed provers.
    */
-  public markPrunedAboveBlock(targetBlockNumber: BlockNumber): CheckpointProver[] {
+  public cancelAndRemoveAboveBlock(targetBlockNumber: BlockNumber): CheckpointProver[] {
     const affected: CheckpointProver[] = [];
-    for (const prover of this.provers.values()) {
+    for (const [id, prover] of Array.from(this.provers.entries())) {
       const lastBlockNumber = prover.checkpoint.blocks.at(-1)!.number;
-      if (lastBlockNumber > targetBlockNumber && !prover.isPruned()) {
-        prover.markPruned();
+      if (lastBlockNumber > targetBlockNumber) {
+        prover.cancel();
+        this.trackTeardown(prover);
+        this.provers.delete(id);
         affected.push(prover);
       }
     }
@@ -118,20 +132,17 @@ export class CheckpointStore {
   }
 
   /**
-   * Drops canonical (non-pruned) provers whose epoch is at or below the supplied expired
-   * epoch. Once an epoch's proof-submission window has closed, its proof can no longer be
-   * accepted on L1, so the prover is no longer needed.
+   * Drops provers whose epoch is at or below the supplied expired epoch. Once an epoch's
+   * proof-submission window has closed, its proof can no longer be accepted on L1, so the
+   * prover is no longer needed.
    */
   public reapExpired(expiredEpoch: EpochNumber): void {
     const reaped: { id: string; checkpointNumber: CheckpointNumber; epochNumber: EpochNumber }[] = [];
     for (const [id, prover] of Array.from(this.provers.entries())) {
-      if (prover.isPruned()) {
-        continue;
-      }
       if (prover.epochNumber <= expiredEpoch) {
         reaped.push({ id, checkpointNumber: prover.checkpoint.number, epochNumber: prover.epochNumber });
         prover.cancel({ routine: true });
-        void prover.whenDone();
+        this.trackTeardown(prover);
         this.provers.delete(id);
       }
     }
@@ -154,63 +165,28 @@ export class CheckpointStore {
     return this.provers.get(CheckpointProver.idFor(checkpoint));
   }
 
-  /** Every prover currently in the store (canonical and pruned), in insertion order. */
+  /** Every prover currently in the store, in insertion order. */
   public listAll(): CheckpointProver[] {
     return Array.from(this.provers.values());
   }
 
-  /** Canonical (non-pruned) provers in the store, sorted by checkpoint number. */
-  public listCanonical(): CheckpointProver[] {
-    return Array.from(this.provers.values())
-      .filter(p => !p.isPruned())
-      .sort((a, b) => a.checkpoint.number - b.checkpoint.number);
+  /** Provers in the store, sorted by checkpoint number. */
+  public list(): CheckpointProver[] {
+    return Array.from(this.provers.values()).sort((a, b) => a.checkpoint.number - b.checkpoint.number);
   }
 
   /**
-   * Canonical provers whose slot is in the supplied epoch's slot range, sorted by
-   * checkpoint number.
+   * Provers whose slot is in the supplied epoch's slot range, sorted by checkpoint number.
    */
-  public async listCanonicalForEpoch(epoch: EpochNumber): Promise<CheckpointProver[]> {
+  public async listForEpoch(epoch: EpochNumber): Promise<CheckpointProver[]> {
     const l1Constants = await this.l2BlockSource.getL1Constants();
     const [fromSlot, toSlot] = getSlotRangeForEpoch(epoch, l1Constants);
-    return this.listCanonicalInSlotRange(fromSlot, toSlot);
+    return this.listInSlotRange(fromSlot, toSlot);
   }
 
-  /** Canonical provers whose slot falls within `[fromSlot, toSlot]`, sorted by checkpoint number. */
-  public listCanonicalInSlotRange(fromSlot: SlotNumber, toSlot: SlotNumber): CheckpointProver[] {
-    return this.listCanonical().filter(p => p.slotNumber >= fromSlot && p.slotNumber <= toSlot);
-  }
-
-  /**
-   * SlotWatcher tick: reap pruned provers whose slot has passed the chain's synced
-   * slot. Once the chain has moved past, no re-add can revive the prover and its
-   * content key is unique enough that an actual re-add would create a new entry.
-   *
-   * Protected so unit tests can drive a single tick without spinning up the
-   * `RunningPromise` and waiting on its interval.
-   */
-  protected async reapPrunedPastSlot(): Promise<void> {
-    let syncedSlot: SlotNumber | undefined;
-    try {
-      syncedSlot = await this.l2BlockSource.getSyncedL2SlotNumber();
-    } catch (err) {
-      this.log.debug(`SlotWatcher could not read synced slot`, { error: `${err}` });
-      return;
-    }
-    if (syncedSlot === undefined) {
-      return;
-    }
-    for (const [id, prover] of Array.from(this.provers.entries())) {
-      if (prover.isPruned() && prover.slotNumber < syncedSlot) {
-        this.log.info(`Reaping pruned CheckpointProver ${id}: slot ${prover.slotNumber} < synced ${syncedSlot}`, {
-          checkpointNumber: prover.checkpoint.number,
-          slotNumber: prover.slotNumber,
-        });
-        prover.cancel();
-        void prover.whenDone();
-        this.provers.delete(id);
-      }
-    }
+  /** Provers whose slot falls within `[fromSlot, toSlot]`, sorted by checkpoint number. */
+  public listInSlotRange(fromSlot: SlotNumber, toSlot: SlotNumber): CheckpointProver[] {
+    return this.list().filter(p => p.slotNumber >= fromSlot && p.slotNumber <= toSlot);
   }
 }
 

package/src/job/checkpoint-prover.ts

@@ -59,16 +59,16 @@ export type CheckpointProverArgs = {
  * The store creates a CheckpointProver once per content-key. Keying on the checkpoint's
  * own archive root (its post-state) means two checkpoints are "the same" iff they
  * produce the same archive — so a reorg branch, or a replacement built on the same
- * predecessor but with different content, keys to a distinct prover; an identical
- * re-add keys to the same one and reuses its in-flight sub-tree work.
+ * predecessor but with different content, keys to a distinct prover.
  *
  * The prover eagerly starts its own tx gather and sub-tree work in the constructor, so
  * callers only need to call `whenBlockProofsReady()` to obtain the resulting block-rollup
  * proofs.
  *
- * The prover survives prune/re-add cycles via `markPruned()` / `markCanonical()` —
- * sub-tree proving keeps running underneath, so a checkpoint that is re-added after
- * a brief reorg can be re-consumed with no re-proving.
+ * A CheckpointProver does not survive a prune: its sub-tree work forks world-state per
+ * block, and an L1 prune of a base block faults those reads. The store therefore cancels and
+ * discards a prover when its checkpoint is pruned, and a re-add (even of identical content)
+ * constructs a fresh prover.
  *
  * `cancel()` is idempotent. It aborts the gather + sub-tree, rejects the block-proof
  * promise, and exposes a `whenDone()` that resolves once teardown has unwound.
@@ -92,8 +92,6 @@ export class CheckpointProver {
   private cancelled = false;
   private subTree?: CheckpointSubTreeOrchestrator;
   private completed = false;
-  /** Pruned in the canonical chain but not yet reaped — sub-tree continues running. */
-  private pruned = false;
   private readonly abortController = new AbortController();
 
   /** Tracks the eager gather+execute task so `cancel()` and `whenDone()` can await its unwind. */
@@ -146,37 +144,6 @@ export class CheckpointProver {
     return this.completed;
   }
 
-  public isPruned(): boolean {
-    return this.pruned;
-  }
-
-  /**
-   * Mark this prover as no longer present in the canonical chain. Sub-tree proving keeps
-   * running so the work survives if the checkpoint is re-added. Idempotent.
-   */
-  public markPruned(): void {
-    if (this.pruned) {
-      return;
-    }
-    this.pruned = true;
-    this.deps.log.info(`Marking CheckpointProver ${this.id} as pruned`, {
-      checkpointNumber: this.checkpoint.number,
-      slotNumber: this.slotNumber,
-    });
-  }
-
-  /** Mark this prover as part of the canonical chain again after a re-add. Idempotent. */
-  public markCanonical(): void {
-    if (!this.pruned) {
-      return;
-    }
-    this.pruned = false;
-    this.deps.log.info(`Marking CheckpointProver ${this.id} as canonical`, {
-      checkpointNumber: this.checkpoint.number,
-      slotNumber: this.slotNumber,
-    });
-  }
-
   /** AbortSignal that fires on cancel — for callers that want to wire their own tasks. */
   public getAbortSignal(): AbortSignal {
     return this.abortController.signal;
@@ -432,7 +399,14 @@ export class CheckpointProver {
   }
 
   private async processTxs(publicProcessor: PublicProcessor, txs: Tx[]): Promise<ProcessedTx[]> {
-    const [processedTxs, failedTxs] = await publicProcessor.process(txs, { deadline: this.deps.deadline });
+    // Pass the abort signal so a prune-driven cancel stops the current block's public execution
+    // immediately, rather than running it to completion before the next `signal.aborted` check.
+    // On abort `process` returns a partial result, the length check below throws, and
+    // `gatherAndExecute` swallows it via its `cancelled` guard.
+    const [processedTxs, failedTxs] = await publicProcessor.process(txs, {
+      deadline: this.deps.deadline,
+      signal: this.abortController.signal,
+    });
 
     if (failedTxs.length) {
       const failedTxHashes = await Promise.all(failedTxs.map(({ tx }) => tx.getTxHash()));

package/src/job/epoch-session.ts

@@ -228,7 +228,7 @@ export class EpochSession implements Traceable {
    * Cancels the session. Idempotent. Withdraws any submitted candidate from the
    * publishing service so the in-flight publisher (if any) is interrupted.
    */
-  public async cancel(reason = 'cancelled'): Promise<void> {
+  public async cancel(reason = 'cancelled', { abortJobs = true }: { abortJobs?: boolean } = {}): Promise<void> {
     if (this.isTerminal()) {
       return;
     }
@@ -247,7 +247,9 @@ export class EpochSession implements Traceable {
     if (this.topTreeJob && !this.topTreeJob.isCancelled()) {
       const job = this.topTreeJob;
       this.topTreeJob = undefined;
-      job.cancel();
+      // On a clean shutdown we leave the in-flight broker jobs alone so a restart can reuse them;
+      // other cancellations (reorg, supersede, deadline) abort them since their inputs are stale.
+      job.cancel(abortJobs);
       this.pendingTopTreeCleanups.push(job);
     }
     await this.teardownTopTreeIfNeeded();

package/src/job/top-tree-job.ts

@@ -128,7 +128,7 @@ export class TopTreeJob {
    * via `whenDone()` — the parent collects the cancelled job and awaits all
    * pending top-tree teardowns at the end of the epoch.
    */
-  public cancel(): void {
+  public cancel(abortJobs = true): void {
     if (this.cancelled) {
       return;
     }
@@ -146,7 +146,7 @@ export class TopTreeJob {
     // Fire and forget: parent awaits the cancel-driven teardown via whenDone(); the
     // chained .catch swallows rejections so the unawaited promise doesn't surface
     // as an unhandled rejection.
-    this.cancelPromise = this.runCancel().catch(() => {});
+    this.cancelPromise = this.runCancel(abortJobs).catch(() => {});
   }
 
   /** Resolves once the cancel-driven teardown of the underlying orchestrator has unwound. */
@@ -156,9 +156,9 @@ export class TopTreeJob {
     }
   }
 
-  private async runCancel(): Promise<void> {
+  private async runCancel(abortJobs: boolean): Promise<void> {
     try {
-      this.topTree.cancel({ abortJobs: true });
+      this.topTree.cancel({ abortJobs });
     } catch (err) {
       this.deps.log.error('Error cancelling top tree', err);
     }

package/src/metrics.ts

@@ -96,7 +96,7 @@ export class ProverNodeJobMetrics {
     this.activeCheckpoints = this.meter.createObservableGauge(Metrics.PROVER_NODE_ACTIVE_CHECKPOINTS);
     this.activeEpochSessions = this.meter.createObservableGauge(Metrics.PROVER_NODE_ACTIVE_EPOCH_SESSIONS);
     this.stateObserver = (observer: BatchObservableResult) => {
-      observer.observe(this.activeCheckpoints!, checkpointStore.listCanonical().length);
+      observer.observe(this.activeCheckpoints!, checkpointStore.listAll().length);
       let full = 0;
       let partial = 0;
       for (const session of sessionManager.allSessions()) {

package/src/prover-node.ts

@@ -12,9 +12,9 @@ import { getLastSiblingPath } from '@aztec/prover-client/helpers';
 import { ChonkCache } from '@aztec/prover-client/orchestrator';
 import { PublicProcessorFactory } from '@aztec/simulator/server';
 import {
+  EventDrivenL2BlockStream,
   type L2BlockId,
   type L2BlockSource,
-  L2BlockStream,
   type L2BlockStreamEvent,
   type L2BlockStreamEventHandler,
   L2TipsMemoryStore,
@@ -87,7 +87,7 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
   /** In-memory store for the L2BlockStream's local data provider. */
   private tipsStore: L2TipsMemoryStore;
   /** Block stream for checkpoint and reorg detection. */
-  private blockStream: L2BlockStream | undefined;
+  private blockStream: EventDrivenL2BlockStream | undefined;
   /**
    * Highest epoch whose proof-submission window has passed. Monotonic high-water mark.
    * Seeded from the last fully-proven epoch at start(); advanced on every block-stream
@@ -169,7 +169,6 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
         txGatheringTimeoutMs: this.config.txGatheringTimeoutMs,
         deadline: undefined,
       },
-      { slotWatcherPollIntervalMs: this.config.proverNodePollingIntervalMs },
       this.log.getBindings(),
     );
   }
@@ -372,8 +371,8 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
   private async handlePruneEvent(prunedToBlock: L2BlockId) {
     this.log.warn(`Chain pruned to block ${prunedToBlock.number}`, { prunedToBlock });
 
-    // Resolve the cursor floor BEFORE marking provers: markPrunedAboveBlock returns only newly-marked provers, so a
-    // throw after marking would leave a retry pass with nothing to act on. Resolving first means a throw leaves
+    // Resolve the cursor floor BEFORE removing provers: cancelAndRemoveAboveBlock returns only the provers it removed,
+    // so a throw after removing would leave a retry pass with nothing to act on. Resolving first means a throw leaves
     // everything untouched and the next pass retries the whole handler (the tips cursor only advances on success).
     let cursorFloor: CheckpointNumber;
     if (prunedToBlock.number === 0) {
@@ -391,7 +390,7 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
       cursorFloor = CheckpointNumber(Math.max(0, Number(targetData.checkpointNumber) - 1));
     }
 
-    const affected = this.checkpointStore.markPrunedAboveBlock(prunedToBlock.number);
+    const affected = this.checkpointStore.cancelAndRemoveAboveBlock(prunedToBlock.number);
 
     if (this.lastProcessedCheckpoint > cursorFloor) {
       this.lastProcessedCheckpoint = cursorFloor;
@@ -510,7 +509,7 @@ export class ProverNode implements L2BlockStreamEventHandler, ProverNodeApi, Tra
     const { lastFullyProvenEpoch } = await this.resolveLastFullyProvenEpoch();
     this.lastExpiredEpoch = lastFullyProvenEpoch;
     this.lastProcessedCheckpoint = await this.computeStartingCheckpoint(lastFullyProvenEpoch);
-    this.blockStream = new L2BlockStream(this.l2BlockSource, this.tipsStore, this, this.log, {
+    this.blockStream = new EventDrivenL2BlockStream(this.l2BlockSource, this.tipsStore, this, this.log, {
       pollIntervalMS: this.config.proverNodePollingIntervalMs,
       tipsOnly: true,
     });

package/src/session-manager.ts

@@ -185,7 +185,7 @@ export class SessionManager {
    * slot. Dedupes against any existing session covering the same range, returning its id.
    */
   public async startProof(epoch: EpochNumber): Promise<string> {
-    const canonical = await this.deps.checkpointStore.listCanonicalForEpoch(epoch);
+    const canonical = await this.deps.checkpointStore.listForEpoch(epoch);
     if (canonical.length === 0) {
       throw new EmptyEpochError(epoch);
     }
@@ -227,7 +227,9 @@ export class SessionManager {
     await this.epochTicker?.stop();
     await this.reconcileQueue.cancel();
     const sessions = this.allSessions();
-    await Promise.allSettled(sessions.map(s => s.cancel('prover-node stopping')));
+    // A clean shutdown is just a restart, so preserve the in-flight broker jobs (abortJobs: false)
+    // for the restarted node to reuse rather than re-proving the epoch from scratch.
+    await Promise.allSettled(sessions.map(s => s.cancel('prover-node stopping', { abortJobs: false })));
   }
 
   // ---------------- reconcile ----------------
@@ -268,7 +270,7 @@ export class SessionManager {
         this.fullSessions.delete(key);
         continue;
       }
-      const canonical = this.canonicalCheckpointsForSpec(session.getSpec());
+      const canonical = this.checkpointsForSpec(session.getSpec());
       if (!this.checkpointsMatch(session.getCheckpoints(), canonical)) {
         this.fireAndForgetCancel(session, 'canonical content changed');
         this.fullSessions.delete(key);
@@ -284,7 +286,7 @@ export class SessionManager {
         this.partialSessions.delete(key);
         continue;
       }
-      const canonical = this.canonicalCheckpointsForSpec(session.getSpec());
+      const canonical = this.checkpointsForSpec(session.getSpec());
       if (!this.checkpointsMatch(session.getCheckpoints(), canonical)) {
         this.fireAndForgetCancel(session, 'canonical content changed');
         this.partialSessions.delete(key);
@@ -298,6 +300,8 @@ export class SessionManager {
   }
 
   private async openFullSessionIfReady(epoch: EpochNumber): Promise<void> {
+    // `recreateInvalidSessions` runs at the top of every reconcile and deletes terminal sessions
+    // before this is called, so a session present here is live and already covers the epoch.
     if (this.fullSessions.has(epoch)) {
       return;
     }
@@ -314,7 +318,7 @@ export class SessionManager {
       return;
     }
     const [fromSlot, toSlot] = getSlotRangeForEpoch(epoch, l1Constants);
-    const canonical = this.deps.checkpointStore.listCanonicalInSlotRange(fromSlot, toSlot);
+    const canonical = this.deps.checkpointStore.listInSlotRange(fromSlot, toSlot);
     if (!this.archiverFullyCovered(archiverCps, canonical)) {
       this.log.debug(`Skipping full-session open for epoch ${epoch}: archiver checkpoints not all in store`, {
         archiverCount: archiverCps.length,
@@ -329,7 +333,7 @@ export class SessionManager {
   }
 
   private openPartialSession(spec: SessionSpec): void {
-    const canonical = this.deps.checkpointStore.listCanonicalInSlotRange(spec.fromSlot, spec.toSlot);
+    const canonical = this.deps.checkpointStore.listInSlotRange(spec.fromSlot, spec.toSlot);
     if (canonical.length === 0) {
       return;
     }
@@ -403,6 +407,17 @@ export class SessionManager {
     const state = await session.start();
     this.log.info(`Session ${session.getId()} exited with state ${state}`);
     if (state === 'failed' && this.deps.onSessionFailed) {
+      // Best-effort suppression of the spurious post-mortem upload a prune produces: if the session's
+      // checkpoints no longer match the store's current set, the failure was caused by the content
+      // changing under it, not a genuine proving fault, so skip the upload. This is inherently racy —
+      // the store lags the world-state unwind, so a fault observed before the prune is reconciled here
+      // still uploads. The epoch is recovered regardless by recreating the session on re-add.
+      if (!this.checkpointsMatch(session.getCheckpoints(), this.checkpointsForSpec(session.getSpec()))) {
+        this.log.info(`Skipping failure upload for session ${session.getId()}: canonical content changed`, {
+          ...session.getSpec(),
+        });
+        return;
+      }
       try {
         await this.deps.onSessionFailed(session);
       } catch (err) {
@@ -447,6 +462,24 @@ export class SessionManager {
     return live >= max;
   }
 
+  /**
+   * Maps a reconcile trigger to the epochs whose full session should be (re)opened.
+   *
+   * This is where the "don't retry a genuinely-failed epoch, but do recover a pruned one" invariant
+   * lives — enforced by which triggers are gated by `lastTickEpoch`:
+   *
+   * - The periodic `tick` IS gated: once a tick has opened a session for an epoch, `lastTickEpoch`
+   *   advances to it and later ticks skip it (`epoch <= lastTickEpoch`). So a failed attempt is never
+   *   resubmitted on a loop by the tick.
+   * - `checkpoint` and `prune` are deliberately NOT gated. They only fire when the epoch's canonical
+   *   content actually changes — a checkpoint arrives, or a reorg prunes/replaces one — which is
+   *   exactly when re-attempting is correct.
+   *
+   * A genuine proving failure produces no content change, hence no checkpoint/prune event, so only
+   * the gated tick could reopen it — and it won't. A prune + re-add fires ungated events, so the
+   * epoch is reopened through this path (and `openFullSessionIfReady` rebuilds over the fresh
+   * provers). See the "onTick does not retry ... but recovers ... re-added" test.
+   */
   private async epochsForTrigger(trigger: ReconcileTrigger): Promise<EpochNumber[]> {
     switch (trigger.kind) {
       case 'checkpoint':
@@ -481,8 +514,8 @@ export class SessionManager {
     return getEpochAtSlot(header.getSlot(), await this.getL1Constants());
   }
 
-  private canonicalCheckpointsForSpec(spec: SessionSpec): CheckpointProver[] {
-    return this.deps.checkpointStore.listCanonicalInSlotRange(spec.fromSlot, spec.toSlot);
+  private checkpointsForSpec(spec: SessionSpec): CheckpointProver[] {
+    return this.deps.checkpointStore.listInSlotRange(spec.fromSlot, spec.toSlot);
   }
 
   private fireAndForgetCancel(session: EpochSession, reason: string): void {