@aztec/sequencer-client 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/dest/sequencer/sequencer.js

@@ -379,22 +379,25 @@ import { merge, omit, pick } from '@aztec/foundation/collection';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
-import { getEpochAtSlot, getSlotStartBuildTimestamp } from '@aztec/stdlib/epoch-helpers';
+import { buildCheckpointSimulationOverridesPlan } from '@aztec/stdlib/checkpoint';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
+import { MIN_PER_BLOCK_ALLOCATION_MULTIPLIER, MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER, computeNetworkTxGasLimits } from '@aztec/stdlib/gas';
 import { SequencerConfigSchema } from '@aztec/stdlib/interfaces/server';
 import { pickFromSchema } from '@aztec/stdlib/schemas';
+import { buildProposerTimetable } from '@aztec/stdlib/timetable';
 import { Attributes, getTelemetryClient, trackSpan } from '@aztec/telemetry-client';
 import EventEmitter from 'node:events';
 import { DefaultSequencerConfig } from '../config.js';
-import { buildCheckpointSimulationOverridesPlan } from './chain_state_overrides.js';
 import { CheckpointProposalJob } from './checkpoint_proposal_job.js';
 import { CheckpointProposalJobMetrics } from './checkpoint_proposal_job_metrics.js';
 import { CheckpointVoter } from './checkpoint_voter.js';
-import { SequencerInterruptedError, SequencerTooSlowError } from './errors.js';
+import { SequencerInterruptedError } from './errors.js';
 import { SequencerMetrics } from './metrics.js';
-import { SequencerTimetable } from './timetable.js';
+import { logMissingCommittee } from './missing_committee.js';
+import { RequestsTracker } from './requests_tracker.js';
 import { SequencerState } from './utils.js';
 export { SequencerState };
-_dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpointProposal'), _dec2 = trackSpan('Seqeuencer.tryVoteWhenSyncFails', ({ slot })=>({
+_dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpointProposal'), _dec2 = trackSpan('Sequencer.tryVoteAndPruneWhenCannotBuild', ({ slot })=>({
         [Attributes.SLOT_NUMBER]: slot
     })), _dec3 = trackSpan('Sequencer.tryVoteWhenEscapeHatchOpen', ({ slot })=>({
         [Attributes.SLOT_NUMBER]: slot
@@ -437,7 +440,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             [
                 _dec2,
                 2,
-                "tryVoteWhenSyncFails"
+                "tryVoteAndPruneWhenCannotBuild"
             ],
             [
                 _dec3,
@@ -449,22 +452,34 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     runningPromise;
     state;
     stateSlotNumber;
-    stateEnteredAtMs;
+    /** Wall-clock time (ms, via the date provider) at which the current state was entered. */ stateEnteredAtMs;
     metrics;
     checkpointProposalJobMetrics;
     stateLog;
-    /** The last slot for which we attempted to perform our voting duties with degraded block production */ lastSlotForFallbackVote;
-    /** The last slot for which we logged "no committee" warning, to avoid spam */ lastSlotForNoCommitteeWarning;
+    /** The last slot for which we attempted to perform our fallback duties (votes and/or prune) with degraded block production */ lastSlotForFallbackAction;
+    /** The (checkpoint, slot) of the last invalidation request we successfully simulated, to prevent
+   * re-simulating and re-submitting the same invalidation across the many ticks within a single slot. */ lastInvalidationAttempt;
+    /** The last epoch for which we logged a "no committee" diagnostic, to avoid per-slot log spam. */ lastEpochForNoCommitteeLog;
     /** The last slot for which we triggered a checkpoint proposal job, to prevent duplicate attempts. */ lastSlotForCheckpointProposalJob;
     /** Last successful checkpoint proposed */ lastCheckpointProposed;
     /** The last epoch for which we logged strategy comparison in fisherman mode. */ lastEpochForStrategyComparison;
     /** The last checkpoint proposal job, tracked so we can await its pending L1 submission during shutdown. */ lastCheckpointProposalJob;
-    /** The maximum number of seconds that the sequencer can be into a slot to transition to a particular state. */ timetable;
+    /**
+   * In-flight fire-and-forget requests that {@link stop} interrupts and drains, and {@link pause} awaits
+   * untouched: the checkpoint proposal jobs' backgrounded L1 submissions (each job is handed this shared
+   * tracker) plus the sequencer's own fallback submissions (votes/prune when we cannot build, or
+   * escape-hatch votes). Each fallback send is gated by its wrapper publisher's interruptible target-slot
+   * sleep; the tracked interrupt wakes that sleep so the send short-circuits without publishing. A wrapper
+   * is created for a single send and is never restarted, so once interrupted its sleeper can never publish
+   * a stale-slot tx, even after the pooled publishers are restarted by a later {@link start}.
+   */ pendingRequests;
+    /** Proposer schedule and block sub-slot timetable for the sequencer, rebuilt on every config update. */ timetable;
     /** Config for the sequencer */ config;
     signatureContext;
     constructor(publisherFactory, validatorClient, globalsBuilder, p2pClient, worldState, slasherClient, l2BlockSource, l1ToL2MessageSource, checkpointsBuilder, l1Constants, dateProvider, epochCache, rollupContract, config, telemetry = getTelemetryClient(), log = createLogger('sequencer')){
-        super(), this.publisherFactory = publisherFactory, this.validatorClient = validatorClient, this.globalsBuilder = globalsBuilder, this.p2pClient = p2pClient, this.worldState = worldState, this.slasherClient = slasherClient, this.l2BlockSource = l2BlockSource, this.l1ToL2MessageSource = l1ToL2MessageSource, this.checkpointsBuilder = checkpointsBuilder, this.l1Constants = l1Constants, this.dateProvider = dateProvider, this.epochCache = epochCache, this.rollupContract = rollupContract, this.telemetry = telemetry, this.log = log, this.state = (_initProto(this), SequencerState.STOPPED), this.stateEnteredAtMs = performance.now(), this.config = DefaultSequencerConfig;
+        super(), this.publisherFactory = publisherFactory, this.validatorClient = validatorClient, this.globalsBuilder = globalsBuilder, this.p2pClient = p2pClient, this.worldState = worldState, this.slasherClient = slasherClient, this.l2BlockSource = l2BlockSource, this.l1ToL2MessageSource = l1ToL2MessageSource, this.checkpointsBuilder = checkpointsBuilder, this.l1Constants = l1Constants, this.dateProvider = dateProvider, this.epochCache = epochCache, this.rollupContract = rollupContract, this.telemetry = telemetry, this.log = log, this.state = (_initProto(this), SequencerState.STOPPED), this.pendingRequests = new RequestsTracker(), this.config = DefaultSequencerConfig;
         this.stateLog = log.createChild('state');
+        this.stateEnteredAtMs = this.dateProvider.now();
         // Add [FISHERMAN] prefix to logger if in fisherman mode
         if (config.fishermanMode) {
             this.log = log.createChild('[FISHERMAN]');
@@ -477,25 +492,120 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         this.checkpointProposalJobMetrics = new CheckpointProposalJobMetrics(telemetry);
         this.updateConfig(config);
     }
-    /** Updates sequencer config by the defined values and updates the timetable */ updateConfig(config) {
+    /**
+   * Updates sequencer config by the defined values and rebuilds the timetable.
+   *
+   * The merged config is validated against a candidate before being committed: {@link buildTimetable} may
+   * reject the candidate (invalid timing geometry, or per-block allocation multipliers below the network
+   * minimums). On rejection we leave `this.config` and `this.timetable` untouched and rethrow, so a bad update
+   * never leaves the sequencer running with a rejected config and a stale timetable.
+   */ updateConfig(config) {
         const filteredConfig = pickFromSchema(config, SequencerConfigSchema);
+        const candidate = merge(this.config, filteredConfig);
+        let timetable;
+        try {
+            timetable = this.buildTimetable(candidate);
+        } catch (err) {
+            this.log.warn(`Rejecting sequencer config update: ${err.message}`, {
+                rejectedConfig: omit(filteredConfig, 'txPublicSetupAllowListExtend')
+            });
+            throw err;
+        }
+        this.config = candidate;
+        this.timetable = timetable;
         this.log.info(`Updated sequencer config`, omit(filteredConfig, 'txPublicSetupAllowListExtend'));
-        this.config = merge(this.config, filteredConfig);
-        const p2pPropagationTime = this.config.attestationPropagationTime;
-        this.timetable = new SequencerTimetable({
-            ethereumSlotDuration: this.l1Constants.ethereumSlotDuration,
-            aztecSlotDuration: this.aztecSlotDuration,
-            l1PublishingTime: this.l1PublishingTime,
-            p2pPropagationTime,
-            blockDurationMs: this.config.blockDurationMs,
-            enforce: this.config.enforceTimeTable,
-            pipelining: this.epochCache.isProposerPipeliningEnabled()
-        }, this.metrics, this.log);
+    }
+    /**
+   * Builds the proposer timetable from the given config and L1 constants via the shared
+   * {@link buildProposerTimetable} helper, so the sequencer derives the same blocks-per-checkpoint as the p2p
+   * layer and `getNodeInfo`. The fast local/e2e profile and budget clamping happen inside
+   * {@link ProposerTimetable}.
+   *
+   * Throws if the timing geometry is invalid or the per-block allocation multipliers are below the network
+   * minimums; callers must treat a throw as a rejected config and not commit it.
+   */ buildTimetable(config) {
+        const timetable = buildProposerTimetable(config, this.l1Constants);
+        const maxNumberOfBlocks = timetable.getMaxBlocksPerCheckpoint();
+        this.log.info(`Sequencer timetable initialized with ${maxNumberOfBlocks} blocks per slot`, {
+            aztecSlotDuration: timetable.aztecSlotDuration,
+            ethereumSlotDuration: timetable.ethereumSlotDuration,
+            blockDuration: timetable.blockDuration,
+            minBlockDuration: timetable.minBlockDuration,
+            p2pPropagationTime: timetable.p2pPropagationTime,
+            checkpointProposalPrepareTime: timetable.checkpointProposalPrepareTime,
+            maxNumberOfBlocks
+        });
+        this.assertConfigMeetsNetworkTxLimits(config, maxNumberOfBlocks);
+        return timetable;
+    }
+    /**
+   * Checks this node's configured per-block allocation against the network admission limit. A node
+   * advertises and admits txs up to the limit derived from the network-minimum multipliers (see
+   * {@link computeNetworkTxGasLimits}).
+   *
+   * Fails startup (and runtime config updates) only when the configured per-block allocation *multipliers*
+   * (`perBlockAllocationMultiplier` / `perBlockDAAllocationMultiplier`) are below the network minimums: such
+   * a node would accept txs over RPC/gossip that its builder can never pack into a block regardless of block
+   * size. Operators may configure a higher (more generous) multiplier, but not a lower one.
+   *
+   * When the multipliers meet the floor but an absolute per-block gas cap (`maxDABlockGas` / `maxL2BlockGas`)
+   * shrinks the builder's effective grant below the network limit, this is legitimate operator
+   * restrictiveness — the node simply builds smaller blocks and such txs stay in the pool for other
+   * proposers — so we only log a warning rather than failing startup. Restrictive tx-count caps
+   * (`maxTxsPerBlock` / `maxTxsPerCheckpoint`) can likewise make the builder skip admitted txs; they are
+   * intentionally not modeled here for the same reason.
+   */ assertConfigMeetsNetworkTxLimits(config, maxBlocksPerCheckpoint) {
+        // Mirror CheckpointBuilder.capLimitsByCheckpointBudgets: DA falls back to the general multiplier.
+        const l2Multiplier = config.perBlockAllocationMultiplier;
+        const daMultiplier = config.perBlockDAAllocationMultiplier ?? l2Multiplier;
+        // The allocation is monotonic in the multiplier, so a multiplier at or above the network minimum
+        // guarantees the builder grants at least the network admission limit. Checking the multipliers directly
+        // is sufficient (and strictly more conservative than modeling the resulting gas grant).
+        if (daMultiplier < MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER) {
+            throw new Error(`perBlockDAAllocationMultiplier (${daMultiplier}) is below the network minimum ` + `${MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`);
+        }
+        if (l2Multiplier < MIN_PER_BLOCK_ALLOCATION_MULTIPLIER) {
+            throw new Error(`perBlockAllocationMultiplier (${l2Multiplier}) is below the network minimum ` + `${MIN_PER_BLOCK_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`);
+        }
+        // Absolute per-block gas caps below the network admission limit are legitimate operator restrictiveness:
+        // the node simply builds smaller blocks and such txs stay in the pool for other proposers. Warn only.
+        const networkLimit = computeNetworkTxGasLimits({
+            maxBlocksPerCheckpoint,
+            manaCheckpointBudget: this.l1Constants.rollupManaLimit
+        });
+        if (config.maxDABlockGas !== undefined && config.maxDABlockGas < networkLimit.daGas) {
+            this.log.warn(`Sequencer maxDABlockGas (${config.maxDABlockGas}) is below the network DA admission limit ` + `(${networkLimit.daGas}): txs declaring more DA gas are admitted over RPC/gossip but will be skipped ` + `by this proposer's own blocks and left in the pool for other proposers.`, {
+                maxDABlockGas: config.maxDABlockGas,
+                networkDaGas: networkLimit.daGas,
+                maxBlocksPerCheckpoint
+            });
+        }
+        if (config.maxL2BlockGas !== undefined && config.maxL2BlockGas < networkLimit.l2Gas) {
+            this.log.warn(`Sequencer maxL2BlockGas (${config.maxL2BlockGas}) is below the network L2 admission limit ` + `(${networkLimit.l2Gas}): txs declaring more L2 gas are admitted over RPC/gossip but will be skipped ` + `by this proposer's own blocks and left in the pool for other proposers.`, {
+                maxL2BlockGas: config.maxL2BlockGas,
+                networkL2Gas: networkLimit.l2Gas,
+                maxBlocksPerCheckpoint
+            });
+        }
     }
     /** Initializes the sequencer (precomputes tables). Takes about 3s. */ init() {
         getKzg();
     }
-    /** Starts the sequencer and moves to IDLE state. */ start() {
+    /**
+   * Starts (or restarts) the sequencer and moves it to the IDLE state. Idempotent: a start while already
+   * running is a no-op, so it never orphans the previous poll loop. A start while STOPPING throws, since the
+   * in-flight stop would mark the fresh loop's state STOPPED and orphan it — silently doing nothing would
+   * leave the caller believing the sequencer is running when it is on its way to STOPPED. Safe to call after
+   * a previous {@link stop} has resolved; the caller must also restart the publishers (see
+   * {@link SequencerClient.start}) so L1 publishing is re-enabled.
+   */ start() {
+        if (this.state === SequencerState.STOPPING) {
+            throw new Error('Cannot start sequencer while it is stopping');
+        }
+        if (this.runningPromise?.isRunning()) {
+            this.log.warn('Attempted to start sequencer that is already running');
+            return;
+        }
         this.runningPromise = new RunningPromise(this.safeWork.bind(this), this.log, this.config.sequencerPollingIntervalMS);
         this.setState(SequencerState.IDLE, undefined, {
             force: true
@@ -506,38 +616,64 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     /** Triggers an immediate run of the sequencer, bypassing the polling interval. */ trigger() {
         return this.runningPromise?.trigger();
     }
-    /** Stops the sequencer from building blocks and moves to STOPPED state. */ async stop() {
+    /**
+   * Stops the sequencer from building blocks and moves it to STOPPED state, interrupting the in-flight
+   * work() iteration and its pending L1 submissions for a fast shutdown, then draining before returning.
+   * Idempotent: a second call while already stopped or stopping is a no-op. Lifecycle calls are expected
+   * to be serialized by the caller. For a restartable pause that lets in-flight work finish untouched
+   * (e.g. around a test clock warp), use {@link pause} instead.
+   */ async stop() {
+        if (this.state === SequencerState.STOPPED || this.state === SequencerState.STOPPING) {
+            this.log.debug(`Sequencer already ${this.state.toLowerCase()}, ignoring stop`);
+            return;
+        }
         this.log.info(`Stopping sequencer`);
         this.setState(SequencerState.STOPPING, undefined, {
             force: true
         });
+        this.lastCheckpointProposalJob?.interrupt();
         await this.publisherFactory.stopAll();
+        // Stop the poll loop and await the in-flight work() iteration. work() registers its fire-and-forget
+        // requests synchronously before returning, so once the loop has stopped, pendingRequests holds every
+        // request that will ever exist. Interrupting any earlier could miss a request registered by the last
+        // in-flight iteration.
         await this.runningPromise?.stop();
-        await this.lastCheckpointProposalJob?.awaitPendingSubmission();
+        this.pendingRequests.interruptRequests();
+        await this.pendingRequests.awaitRequests();
         this.setState(SequencerState.STOPPED, undefined, {
             force: true
         });
         this.log.info('Stopped sequencer');
     }
+    /**
+   * Gracefully pauses block production so the sequencer can later be resumed with {@link start}: halts the
+   * poll loop and waits for the in-flight work() iteration and every pending L1 submission / fallback send
+   * to finish, without interrupting them. No interrupt lands mid-build, so no spurious checkpoint-error is
+   * emitted and no enqueued checkpoint is dropped. Deliberately does not stop inner services (validator/HA
+   * signer, publishers), so the slashing-protection store stays open and the sequencer stays restartable.
+   * Used by tests that pause sequencers around an L1 clock warp. Idempotent.
+   */ async pause() {
+        if (!this.runningPromise?.isRunning()) {
+            this.log.debug('Sequencer not running, ignoring pause');
+            return;
+        }
+        this.log.info('Pausing sequencer');
+        // Halt the poll loop and let the in-flight iteration finish naturally — no interrupt, and no STOPPING
+        // state, since entering STOPPING would make the iteration's own setState calls throw and fail it.
+        // work() registers its fire-and-forget requests synchronously before returning, so once the loop has
+        // stopped pendingRequests holds every request that will ever exist; awaiting it lets them all finish.
+        await this.runningPromise.stop();
+        await this.pendingRequests.awaitRequests();
+        this.log.info('Paused sequencer');
+    }
     /** Main sequencer loop with a try/catch */ async safeWork() {
         try {
             await this.work();
         } catch (err) {
-            if (err instanceof SequencerTooSlowError && [
-                SequencerState.INITIALIZING_CHECKPOINT,
-                SequencerState.PROPOSER_CHECK
-            ].includes(err.proposedState)) {
-                // No need to alert if we just didn't get to start in time
-                this.log.debug(err.message, {
-                    now: this.dateProvider.nowInSeconds()
-                });
-            } else {
-                // Re-throw other errors
-                this.emit('checkpoint-error', {
-                    error: err
-                });
-                throw err;
-            }
+            this.emit('checkpoint-error', {
+                error: err
+            });
+            throw err;
         } finally{
             this.setState(SequencerState.IDLE, undefined);
         }
@@ -579,7 +715,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     }
     /** Returns slot and target slot from a single clock snapshot. */ getSlotContextInNextL1Slot() {
         const { slot, ts, nowSeconds, epoch } = this.epochCache.getEpochAndSlotInNextL1Slot();
-        const targetSlot = SlotNumber(slot + (this.epochCache.isProposerPipeliningEnabled() ? PROPOSER_PIPELINING_SLOT_OFFSET : 0));
+        const targetSlot = SlotNumber(slot + PROPOSER_PIPELINING_SLOT_OFFSET);
         return {
             slot,
             targetSlot,
@@ -594,10 +730,8 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
    * This is the initial step in the main loop.
    * @returns CheckpointProposalJob if successful, undefined if we are not yet synced or are not the proposer.
    */ async prepareCheckpointProposal(slot, targetSlot, epoch, targetEpoch, ts, nowSeconds) {
-        // Check we have not already processed this target slot (cheapest check)
-        // We only check this if enforce timetable is set, since we want to keep processing the same slot if we are not
-        // running against actual time (eg when we use sandbox-style automining)
-        if (this.lastSlotForCheckpointProposalJob && this.lastSlotForCheckpointProposalJob >= targetSlot && this.config.enforceTimeTable) {
+        // Check we have not already processed this target slot (cheapest check).
+        if (this.lastSlotForCheckpointProposalJob && this.lastSlotForCheckpointProposalJob >= targetSlot) {
             this.log.trace(`Target slot ${targetSlot} has already been processed`);
             return undefined;
         }
@@ -614,26 +748,16 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             });
             return undefined;
         }
-        // Check all components are synced to latest as seen by the archiver (queries all subsystems)
-        const syncedTo = await this.checkSync({
-            ts,
-            slot
-        });
-        if (!syncedTo) {
-            await this.tryVoteWhenSyncFails({
-                slot,
-                targetSlot,
-                ts
-            });
-            return undefined;
-        }
+        // Cheap proposer check first: most nodes are not the proposer for most slots, so gate the
+        // expensive multi-subsystem checkSync (and the rest of the build path) behind it. Computed once
+        // here and reused for the escape-hatch voting path below. No setState/timing gate on this path:
+        // the build-start deadline gate runs only on the proposer build path after a successful checkSync.
+        const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
         // If escape hatch is open for the target epoch, do not start checkpoint proposal work and do not attempt invalidations.
         // Still perform governance/slashing voting (as proposer) once per slot.
         // When pipelining, we check the target epoch (slot+1's epoch) since that's the epoch we're building for.
         const isEscapeHatchOpen = await this.epochCache.isEscapeHatchOpen(targetEpoch);
         if (isEscapeHatchOpen) {
-            this.setState(SequencerState.PROPOSER_CHECK, slot);
-            const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
             if (canPropose) {
                 await this.tryVoteWhenEscapeHatchOpen({
                     slot,
@@ -649,6 +773,57 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             }
             return undefined;
         }
+        // If we are not the proposer, check whether we should invalidate an invalid pending chain (a
+        // liveness backstop) and bail before any sync work or build-timing gate. This reads only the
+        // archiver's pending-chain validation status, which is authoritative on its own, instead of
+        // running the full sync check. Wrapped in try/catch because this leaner path skips the broader
+        // proposed-checkpoint/tip coherence screen that checkSync applied, so transient archiver
+        // incoherence surfaces as a quiet skip rather than a work-loop error.
+        if (!canPropose) {
+            try {
+                const pendingChainValidationStatus = await this.l2BlockSource.getPendingChainValidationStatus();
+                await this.considerInvalidatingCheckpoint(pendingChainValidationStatus, slot);
+            } catch (err) {
+                this.log.warn(`Failed to consider invalidating checkpoint`, {
+                    err,
+                    slot,
+                    targetSlot
+                });
+            }
+            return undefined;
+        }
+        // Explicit build-loop entry gate: if we are past the latest useful block-building start for the
+        // target slot, abandon building for this slot. The proposer prioritizes the ideal L1-publish path
+        // and does not plan around the late consensus-handoff path. This is the proposer build path's
+        // timing gate; it runs only after we know we are the synced proposer, so non-proposer invalidation
+        // and escape-hatch voting (which returned above) are never gated by build timing. Vote-only paths
+        // still run when block building is abandoned.
+        const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
+        const nowForStartGate = this.dateProvider.now() / 1000;
+        if (nowForStartGate > startDeadline) {
+            this.log.debug(`Past start deadline for slot ${targetSlot}, abandoning block building`, {
+                targetSlot,
+                nowForStartGate,
+                startDeadline
+            });
+            // Mark the slot as attempted so a deadline abort is not retried within the same slot. Vote-only actions
+            // still need to run because sync can succeed even when it is too late to start building a checkpoint.
+            await this.tryVoteAndPruneWhenCannotBuild({
+                slot,
+                targetSlot
+            });
+            this.lastSlotForCheckpointProposalJob = targetSlot;
+            return undefined;
+        }
+        // We are the proposer, the escape hatch is closed, and we have time before the build start deadline.
+        // Now run the full sync check before building.
+        const syncedTo = await this.checkSync({
+            ts,
+            slot
+        });
+        if (!syncedTo) {
+            return undefined;
+        }
         // Next checkpoint follows from the last synced one
         const checkpointNumber = CheckpointNumber(syncedTo.checkpointNumber + 1);
         const logCtx = {
@@ -660,14 +835,8 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             checkpointNumber,
             isPendingChainValid: pick(syncedTo.pendingChainValidationStatus, 'valid', 'reason', 'invalidIndex')
         };
-        // Check that we are a proposer for the target slot.
-        this.setState(SequencerState.PROPOSER_CHECK, slot);
-        const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
-        // If we are not a proposer check if we should invalidate an invalid checkpoint, and bail
-        if (!canPropose) {
-            await this.considerInvalidatingCheckpoint(syncedTo, slot);
-            return undefined;
-        }
+        // We are the synced proposer within the build window; enter the proposer-check state and build.
+        this.setState(SequencerState.PROPOSER_CHECK, targetSlot);
         // Guard: don't exceed 1-deep pipeline. Without a proposed checkpoint, we can only build
         // confirmed + 1. With a proposed checkpoint, we can build confirmed + 2.
         const confirmedCkpt = syncedTo.checkpointedCheckpointNumber;
@@ -691,16 +860,15 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         const proposerForPublisher = this.config.fishermanMode ? undefined : proposer;
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposerForPublisher);
         this.log.verbose(`Created publisher at address ${publisher.getSenderAddress()} for attestor ${attestorAddress}`);
-        const isPipelining = this.epochCache.isProposerPipeliningEnabled();
         // Prepare invalidation request if the pending chain is invalid (returns undefined if no need).
         // Only simulate invalidation when there's no proposed parent, since we assume the proposed parent
         // will invalidate the currently invalid checkpoint on L1.
-        const invalidateCheckpoint = isPipelining && syncedTo.hasProposedCheckpoint || syncedTo.pendingChainValidationStatus.valid ? undefined : await publisher.simulateInvalidateCheckpoint(syncedTo.pendingChainValidationStatus);
+        const invalidateCheckpoint = syncedTo.hasProposedCheckpoint || syncedTo.pendingChainValidationStatus.valid ? undefined : await publisher.simulateInvalidateCheckpoint(syncedTo.pendingChainValidationStatus);
         // Determine the correct archive and L1 state overrides for the canProposeAt check.
         // The L1 contract reads archives[proposedCheckpointNumber] and compares it with the provided archive.
         // When invalidating or pipelining, the local archive may differ from L1's, so we adjust accordingly.
         let archiveForCheck = syncedTo.archive;
-        if (isPipelining && syncedTo.hasProposedCheckpoint) {
+        if (syncedTo.hasProposedCheckpoint) {
             this.metrics.recordPipelineDepth(syncedTo.checkpointNumber - syncedTo.checkpointedCheckpointNumber);
             this.log.verbose(`Building on top of proposed checkpoint (pending=${syncedTo.proposedCheckpointData?.checkpointNumber}) for target slot ${targetSlot}`, {
                 targetSlot,
@@ -725,7 +893,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         // plus the parent checkpoint cell and fee header when pipelining.
         const simulationOverridesPlan = await buildCheckpointSimulationOverridesPlan({
             checkpointNumber,
-            proposedCheckpointData: isPipelining && syncedTo.hasProposedCheckpoint ? syncedTo.proposedCheckpointData : undefined,
+            proposedCheckpointData: syncedTo.hasProposedCheckpoint ? syncedTo.proposedCheckpointData : undefined,
             invalidateToPendingCheckpointNumber: invalidateCheckpoint?.forcePendingCheckpointNumber,
             checkpointedCheckpointNumber: syncedTo.checkpointedCheckpointNumber,
             rollup: this.rollupContract,
@@ -749,7 +917,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         this.emit('preparing-checkpoint', {
             targetSlot,
             checkpointNumber,
-            hadProposedParent: this.epochCache.isProposerPipeliningEnabled() && syncedTo.hasProposedCheckpoint,
+            hadProposedParent: syncedTo.hasProposedCheckpoint,
             provenOverride,
             simulatedPending: simulationOverridesPlan?.chainTipsOverride?.pending
         });
@@ -810,14 +978,13 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         this.log.info(`Preparing checkpoint proposal ${checkpointNumber} for target slot ${targetSlot} during wall-clock slot ${slot}`, {
             ...logCtx,
             ...proposeContext,
-            proposer,
-            pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled()
+            proposer
         });
         // Create and return the checkpoint proposal job
-        return this.createCheckpointProposalJob(slot, targetSlot, targetEpoch, checkpointNumber, syncedTo.blockNumber, syncedTo.checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, syncedTo.proposedCheckpointData);
+        return this.createCheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedTo.blockNumber, syncedTo.checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, syncedTo.proposedCheckpointData);
     }
-    createCheckpointProposalJob(slot, targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, proposedCheckpointData) {
-        return new CheckpointProposalJob(slot, targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, this.validatorClient, this.globalsBuilder, this.p2pClient, this.worldState, this.l1ToL2MessageSource, this.l2BlockSource, this.checkpointsBuilder, this.l2BlockSource, this.l1Constants, this.signatureContext, this.config, this.timetable, this.slasherClient, this.epochCache, this.dateProvider, this.metrics, this.checkpointProposalJobMetrics.createRecorder(), this, this.setState.bind(this), this.tracer, this.log.getBindings(), proposedCheckpointData);
+    createCheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, proposedCheckpointData) {
+        return new CheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, this.validatorClient, this.globalsBuilder, this.p2pClient, this.worldState, this.l1ToL2MessageSource, this.l2BlockSource, this.checkpointsBuilder, this.l2BlockSource, this.l1Constants, this.signatureContext, this.config, this.timetable, this.slasherClient, this.epochCache, this.dateProvider, this.metrics, this.checkpointProposalJobMetrics.createRecorder(), this, this.pendingRequests, this.setState.bind(this), this.tracer, this.log.getBindings(), proposedCheckpointData);
     }
     /**
    * Returns the current sequencer state.
@@ -825,9 +992,11 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         return this.state;
     }
     /**
-   * Internal helper for setting the sequencer state and checks if we have enough time left in the slot to transition to the new state.
+   * Internal helper for setting the sequencer state. Pure: sets the state, emits `state-changed`, and
+   * records metrics. Timing deadlines are queried explicitly at the relevant call sites, not gated here.
    * @param proposedState - The new state to transition to.
-   * @param slotNumber - The current slot number.
+   * @param slotNumber - The target slot being proposed for, emitted as `targetSlot` on the event payload
+   * and used to anchor `secondsIntoBuildFrame`. Undefined for lifecycle states with no associated slot.
    * @param force - Whether to force the transition even if the sequencer is stopped.
    */ setState(proposedState, slotNumber, opts = {}) {
         if (this.state === SequencerState.STOPPING && proposedState !== SequencerState.STOPPED && !opts.force) {
@@ -838,15 +1007,13 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.log.warn(`Cannot set sequencer from ${this.state} to ${proposedState} as it is stopped.`);
             return;
         }
-        let secondsIntoSlot = undefined;
-        if (slotNumber !== undefined) {
-            secondsIntoSlot = this.getSecondsIntoSlot(slotNumber);
-            this.timetable.assertTimeLeft(proposedState, secondsIntoSlot);
-        }
+        const secondsIntoBuildFrame = slotNumber !== undefined ? this.getSecondsIntoBuildFrame(slotNumber) : undefined;
         const oldState = this.state;
         const oldStateSlotNumber = this.stateSlotNumber;
         const stateChanged = proposedState !== oldState;
-        const transitionAtMs = performance.now();
+        // Wall-clock time spent in the previous state: the delta between consecutive state-changing setState
+        // calls, read from the date provider so it tracks simulated time under a test/manual clock.
+        const transitionAtMs = this.dateProvider.now();
         const stateDurationMs = transitionAtMs - this.stateEnteredAtMs;
         const boringStates = [
             SequencerState.IDLE,
@@ -858,7 +1025,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             newState: proposedState,
             slotNumber,
             stateSlotNumber: oldStateSlotNumber,
-            secondsIntoSlot,
+            secondsIntoBuildFrame,
             ...stateChanged && {
                 stateDurationMs: Math.ceil(stateDurationMs)
             }
@@ -866,8 +1033,8 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         this.emit('state-changed', {
             oldState,
             newState: proposedState,
-            secondsIntoSlot,
-            slot: slotNumber
+            secondsIntoBuildFrame,
+            targetSlot: slotNumber
         });
         if (stateChanged) {
             this.metrics.recordStateDuration(stateDurationMs, oldState);
@@ -899,8 +1066,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
                 })),
             this.l2BlockSource.getL2Tips().then((t)=>({
                     proposed: t.proposed,
-                    checkpointed: t.checkpointed,
-                    proposedCheckpoint: t.proposedCheckpoint
+                    checkpointed: t.checkpointed
                 })),
             this.p2pClient.getStatus().then((p2p)=>p2p.syncedToL2Block),
             this.l1ToL2MessageSource.getL2Tips().then((t)=>({
@@ -940,35 +1106,23 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         // matching proposed checkpoint (e.g. it crashed before assembling it). Building on this orphan block
         // would fork the chain off a tip no other node can follow. The archiver prunes these orphan blocks
         // once their build slot ends; this guard is the correctness barrier during the grace window before.
-        if (blockData.checkpointNumber > l2Tips.checkpointed.checkpoint.number && (l2Tips.proposedCheckpoint.checkpoint.number !== blockData.checkpointNumber || proposedCheckpointData?.checkpointNumber !== blockData.checkpointNumber)) {
-            this.log.warn(`Sequencer sync check failed: proposed block has no matching proposed checkpoint`, {
+        // `getProposedCheckpointData()` returns the latest proposed checkpoint payload, which is always
+        // the leading one (a proposed entry is only stored beyond the confirmed frontier and is deleted
+        // on confirmation). It carries no tip, so there is no tip-vs-payload split read to reconcile.
+        if (blockData.checkpointNumber > l2Tips.checkpointed.checkpoint.number && proposedCheckpointData?.checkpointNumber !== blockData.checkpointNumber) {
+            const logCtx = {
                 blockCheckpointNumber: blockData.checkpointNumber,
                 checkpointedCheckpointNumber: l2Tips.checkpointed.checkpoint.number,
-                proposedCheckpointTipNumber: l2Tips.proposedCheckpoint.checkpoint.number,
-                proposedCheckpointDataNumber: proposedCheckpointData?.checkpointNumber,
+                proposedCheckpointTipNumber: proposedCheckpointData?.checkpointNumber,
                 blockNumber: blockData.header.getBlockNumber(),
                 blockSlot: blockData.header.getSlot(),
                 syncedL2Slot,
                 ...args
-            });
-            return undefined;
-        }
-        const hasProposedCheckpoint = l2Tips.proposedCheckpoint.checkpoint.number > l2Tips.checkpointed.checkpoint.number;
-        // The l2Tips and proposedCheckpointData reads above come from independent archiver snapshots
-        // (a JS-side tips cache vs. a direct store read on `#proposedCheckpoints`). A concurrent archiver
-        // write that mutates both can be observed split, leaving us with `hasProposedCheckpoint=true` but
-        // no proposedCheckpointData (or one whose number doesn't match the tip). Refuse to proceed in that
-        // window — the next checkSync tick will see a coherent snapshot.
-        if (hasProposedCheckpoint && (!proposedCheckpointData || proposedCheckpointData.checkpointNumber !== l2Tips.proposedCheckpoint.checkpoint.number)) {
-            this.log.warn(`Sequencer sync check failed: inconsistent proposed-checkpoint state`, {
-                proposedCheckpointTipNumber: l2Tips.proposedCheckpoint.checkpoint.number,
-                checkpointedTipNumber: l2Tips.checkpointed.checkpoint.number,
-                proposedCheckpointDataNumber: proposedCheckpointData?.checkpointNumber,
-                syncedL2Slot,
-                ...args
-            });
+            };
+            this.log.debug(`Waiting for proposed checkpoint to catch up with reexecuted block`, logCtx);
             return undefined;
         }
+        const hasProposedCheckpoint = proposedCheckpointData !== undefined;
         // Check that the proposed checkpoint is indeed the parent of the checkpoint we'll be building
         // The checkpoint number to build is derived as blockData.checkpointNumber + 1
         if (proposedCheckpointData && proposedCheckpointData.checkpointNumber !== blockData.checkpointNumber) {
@@ -1001,9 +1155,17 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             proposer = await this.epochCache.getProposerAttesterAddressInSlot(targetSlot);
         } catch (e) {
             if (e instanceof NoCommitteeError) {
-                if (this.lastSlotForNoCommitteeWarning !== targetSlot) {
-                    this.lastSlotForNoCommitteeWarning = targetSlot;
-                    this.log.warn(`Cannot propose at target slot ${targetSlot} since the committee does not exist on L1`);
+                const targetEpoch = getEpochAtSlot(targetSlot, this.l1Constants);
+                if (this.lastEpochForNoCommitteeLog !== targetEpoch) {
+                    this.lastEpochForNoCommitteeLog = targetEpoch;
+                    await logMissingCommittee(targetSlot, targetEpoch, {
+                        epochCache: this.epochCache,
+                        rollupContract: this.rollupContract,
+                        l2BlockSource: this.l2BlockSource,
+                        l1Constants: this.l1Constants,
+                        dateProvider: this.dateProvider,
+                        logger: this.log
+                    });
                 }
                 return [
                     false,
@@ -1053,30 +1215,24 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         ];
     }
     /**
-   * Tries to vote on slashing actions and governance when the sync check fails but we're past the max time for initializing a proposal.
-   * This allows the sequencer to participate in governance/slashing votes even when it cannot build blocks.
-   */ async tryVoteWhenSyncFails(args) {
+   * Tries to vote on slashing actions and governance and to prune when we cannot build and are past the
+   * block-building window. This allows the sequencer to participate in governance/slashing votes even when it
+   * cannot build blocks, and to prune the pending chain so it can recover from bad data that is blocking sync.
+   */ async tryVoteAndPruneWhenCannotBuild(args) {
         const { slot, targetSlot } = args;
         // Prevent duplicate attempts in the same slot
-        if (this.lastSlotForFallbackVote === slot) {
-            this.log.trace(`Already attempted to vote in slot ${slot} (skipping)`);
-            return;
-        }
-        // Check if we're past the max time for initializing a proposal
-        const secondsIntoSlot = this.getSecondsIntoSlot(slot);
-        const maxAllowedTime = this.timetable.getMaxAllowedTime(SequencerState.INITIALIZING_CHECKPOINT);
-        // If we haven't exceeded the time limit for initializing a proposal, don't proceed with voting
-        // We use INITIALIZING_PROPOSAL time limit because if we're past that, we can't build a block anyway
-        if (maxAllowedTime === undefined || secondsIntoSlot <= maxAllowedTime) {
-            this.log.trace(`Not attempting to vote since there is still time for block building`, {
-                secondsIntoSlot,
-                maxAllowedTime
-            });
+        if (this.lastSlotForFallbackAction === slot) {
+            this.log.trace(`Already attempted fallback actions in slot ${slot} (skipping)`);
             return;
         }
-        this.log.trace(`Sync for slot ${slot} failed, checking for voting opportunities`, {
-            secondsIntoSlot,
-            maxAllowedTime
+        // Vote-only actions do not give up the slot: if sync recovers, a later work-loop iteration can still build.
+        // Under proposer pipelining the work loop reasons about the next L1 slot, so waiting for the target slot's
+        // build-start deadline can miss the whole fallback window when the target advances with the clock.
+        const nowSeconds = this.dateProvider.now() / 1000;
+        const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
+        this.log.trace(`Cannot build for slot ${slot}, checking for voting opportunities`, {
+            nowSeconds,
+            startDeadline
         });
         // Check if we're a proposer or proposal is open
         const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
@@ -1088,7 +1244,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             return;
         }
         // Mark this slot as attempted
-        this.lastSlotForFallbackVote = slot;
+        this.lastSlotForFallbackAction = slot;
         // Get a publisher for voting
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
         this.log.debug(`Attempting to vote despite sync failure at slot ${slot}`, {
@@ -1099,22 +1255,41 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         const voter = new CheckpointVoter(targetSlot, publisher, attestorAddress, this.validatorClient, this.slasherClient, this.l1Constants, this.config, this.metrics, this.log);
         const votesPromises = voter.enqueueVotes();
         const votes = await Promise.all(votesPromises);
-        if (votes.every((p)=>!p)) {
-            this.log.debug(`No votes to enqueue for slot ${slot}`);
+        // Even if we cannot build, try to prune so a stuck pending chain (e.g. bad data blocking sync) can
+        // recover. prune() is permissionless, so it rides the same fallback multicall as the votes.
+        const pruneEnqueued = await this.tryEnqueuePruneIfPrunable(targetSlot, publisher);
+        // Bail if nothing to do
+        if (votes.every((p)=>!p) && !pruneEnqueued) {
+            this.log.debug(`Nothing to enqueue for slot ${slot} (no votes, not prunable)`);
             return;
         }
-        this.log.info(`Voting in slot ${slot} despite sync failure`, {
-            slot
+        const [governanceVoteEnqueued, slashingVoteEnqueued] = votes;
+        this.log.info(`Submitting fallback requests in slot ${slot} despite sync failure`, {
+            slot,
+            pruneEnqueued,
+            governanceVoteEnqueued: !!governanceVoteEnqueued,
+            slashingVoteEnqueued: !!slashingVoteEnqueued
         });
         // Votes are EIP-712-signed for `targetSlot` (the pipelined slot in which the multicall is
         // expected to mine). Delay submission to the start of `targetSlot` so the tx mines in the
         // slot the votes were signed for. We fire-and-forget so we don't block the sequencer's
-        // work loop while waiting for the target slot to start.
-        void publisher.sendRequestsAt(targetSlot).catch((err)=>{
-            this.log.error(`Failed to publish votes despite sync failure for slot ${slot}`, err, {
+        // work loop while waiting for the target slot to start, but track it so stop() can drain it.
+        const send = publisher.sendRequestsAt(targetSlot).catch((err)=>{
+            this.log.error(`Failed to publish fallback requests despite sync failure for slot ${slot}`, err, {
                 slot
             });
         });
+        this.pendingRequests.trackRequest(send, ()=>publisher.interrupt());
+    }
+    async tryEnqueuePruneIfPrunable(targetSlot, publisher) {
+        try {
+            return await publisher.enqueuePruneIfPrunable(targetSlot);
+        } catch (err) {
+            this.log.error(`Failed to enqueue rollup prune for slot ${targetSlot}`, err, {
+                targetSlot
+            });
+            return false;
+        }
     }
     /**
    * Tries to vote on slashing actions and governance proposals when escape hatch is open.
@@ -1122,12 +1297,12 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
    */ async tryVoteWhenEscapeHatchOpen(args) {
         const { slot, targetSlot, proposer } = args;
         // Prevent duplicate attempts in the same slot
-        if (this.lastSlotForFallbackVote === slot) {
+        if (this.lastSlotForFallbackAction === slot) {
             this.log.trace(`Already attempted to vote in slot ${slot} (escape hatch open, skipping)`);
             return;
         }
         // Mark this slot as attempted
-        this.lastSlotForFallbackVote = slot;
+        this.lastSlotForFallbackAction = slot;
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
         this.log.debug(`Escape hatch open for slot ${slot}, attempting vote-only actions`, {
             slot,
@@ -1137,8 +1312,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         // Under proposer pipelining, the multicall is expected to mine in `targetSlot` (slot + 1).
         // Governance and slashing votes are EIP-712-signed against the slot they will mine in, and the
         // L1 contract checks `msg.sender == getCurrentProposer()` using the mining slot. So we must
-        // sign for `targetSlot` and delay submission to the start of `targetSlot`. When pipelining is
-        // disabled `targetSlot == slot` and `sendRequestsAt` resolves with no extra sleep.
+        // sign for `targetSlot` and delay submission to the start of `targetSlot`.
         const voter = new CheckpointVoter(targetSlot, publisher, attestorAddress, this.validatorClient, this.slasherClient, this.l1Constants, this.config, this.metrics, this.log);
         const votesPromises = voter.enqueueVotes();
         const votes = await Promise.all(votesPromises);
@@ -1154,32 +1328,45 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         // the multicall mines in the slot the votes were signed for; otherwise the L1 contract reads
         // `signaler = getCurrentProposer()` against the wrong slot and signature verification fails
         // silently inside Multicall3. Fire-and-forget so we don't block the sequencer's work loop while
-        // waiting for the target slot to start, mirroring tryVoteWhenSyncFails.
-        void publisher.sendRequestsAt(targetSlot).catch((err)=>{
+        // waiting for the target slot to start, mirroring tryVoteAndPruneWhenCannotBuild, but tracked so
+        // stop() can drain it.
+        const send = publisher.sendRequestsAt(targetSlot).catch((err)=>{
             this.log.error(`Failed to publish escape-hatch votes for slot ${slot}`, err, {
                 slot,
                 targetSlot
             });
         });
+        this.pendingRequests.trackRequest(send, ()=>publisher.interrupt());
     }
     /**
    * Considers invalidating a block if the pending chain is invalid. Depends on how long the invalid block
    * has been there without being invalidated and whether the sequencer is in the committee or not. We always
    * have the proposer try to invalidate, but if they fail, the sequencers in the committee are expected to try,
    * and if they fail, any sequencer will try as well.
-   */ async considerInvalidatingCheckpoint(syncedTo, currentSlot) {
-        const { pendingChainValidationStatus, syncedL2Slot } = syncedTo;
+   * @param pendingChainValidationStatus - The archiver's pending-chain validation status, authoritative on its own.
+   * @param currentSlot - The wall-clock slot, used for committee lookup, the per-(checkpoint, slot) dedup guard, and logging.
+   */ async considerInvalidatingCheckpoint(pendingChainValidationStatus, currentSlot) {
         if (pendingChainValidationStatus.valid) {
             return;
         }
         const invalidCheckpointNumber = pendingChainValidationStatus.checkpoint.checkpointNumber;
+        // Avoid re-running the committee lookup, simulation, and submission on every tick within a slot.
+        // The guard is keyed by (checkpoint, slot) — so a different invalid checkpoint surfacing later in
+        // the same slot is not suppressed — and is set only after a request is successfully simulated below,
+        // so a transient simulation failure (or thresholds not yet met) still retries on the next tick.
+        if (this.lastInvalidationAttempt?.slot === currentSlot && this.lastInvalidationAttempt.checkpointNumber === invalidCheckpointNumber) {
+            this.log.trace(`Already attempted to invalidate checkpoint ${invalidCheckpointNumber} in slot ${currentSlot}`, {
+                currentSlot,
+                invalidCheckpointNumber
+            });
+            return;
+        }
         const invalidCheckpointTimestamp = pendingChainValidationStatus.checkpoint.timestamp;
         const timeSinceChainInvalid = this.dateProvider.nowInSeconds() - Number(invalidCheckpointTimestamp);
         const ourValidatorAddresses = this.validatorClient.getValidatorAddresses();
         const { secondsBeforeInvalidatingBlockAsCommitteeMember, secondsBeforeInvalidatingBlockAsNonCommitteeMember } = this.config;
         const logData = {
             invalidL1Timestamp: invalidCheckpointTimestamp,
-            syncedL2Slot,
             invalidCheckpoint: pendingChainValidationStatus.checkpoint,
             secondsBeforeInvalidatingBlockAsCommitteeMember,
             secondsBeforeInvalidatingBlockAsNonCommitteeMember,
@@ -1213,6 +1400,12 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.log.warn(`Failed to simulate invalidate checkpoint`, logData);
             return;
         }
+        // We produced a valid invalidation request; record it so further ticks within this slot skip the
+        // committee lookup, simulation, and submission above for this same invalid checkpoint.
+        this.lastInvalidationAttempt = {
+            slot: currentSlot,
+            checkpointNumber: invalidCheckpointNumber
+        };
         this.log.info(invalidateAsCommitteeMember ? `Invalidating checkpoint ${invalidCheckpointNumber} as committee member` : `Invalidating checkpoint ${invalidCheckpointNumber} as non-committee member`, logData);
         publisher.enqueueInvalidateCheckpoint(invalidateCheckpoint);
         if (!this.config.fishermanMode) {
@@ -1248,12 +1441,12 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
                 }))
         });
     }
-    getSlotStartBuildTimestamp(slotNumber) {
-        return getSlotStartBuildTimestamp(slotNumber, this.l1Constants);
-    }
-    getSecondsIntoSlot(slotNumber) {
-        const slotStartTimestamp = this.getSlotStartBuildTimestamp(slotNumber);
-        return Number((this.dateProvider.now() / 1000 - slotStartTimestamp).toFixed(3));
+    /**
+   * Wall-clock seconds elapsed since the build-frame start of the given target slot
+   * (`now − getBuildFrameStart(targetSlot)`). May be negative if called before the build frame opens.
+   */ getSecondsIntoBuildFrame(targetSlot) {
+        const buildFrameStart = this.timetable.getBuildFrameStart(targetSlot);
+        return Number((this.dateProvider.now() / 1000 - buildFrameStart).toFixed(3));
     }
     get aztecSlotDuration() {
         return this.l1Constants.slotDuration;
@@ -1276,7 +1469,4 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     getConfig() {
         return this.config;
     }
-    get l1PublishingTime() {
-        return this.config.l1PublishingTime ?? this.l1Constants.ethereumSlotDuration;
-    }
 }