@aztec/sequencer-client 0.0.1-commit.9ef841308 → 0.0.1-commit.a4600f49

package/dest/sequencer/sequencer.js

@@ -372,29 +372,31 @@ function _apply_decs_2203_r(targetClass, memberDecs, classDecs, parentClass) {
 }
 var _dec, _dec1, _dec2, _dec3, _initProto;
 import { getKzg } from '@aztec/blob-lib';
-import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
+import { PROPOSER_PIPELINING_SLOT_OFFSET } from '@aztec/epoch-cache';
 import { NoCommitteeError } from '@aztec/ethereum/contracts';
-import { BlockNumber, CheckpointNumber } from '@aztec/foundation/branded-types';
+import { CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import { merge, omit, pick } from '@aztec/foundation/collection';
-import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
-import { getSlotStartBuildTimestamp } from '@aztec/stdlib/epoch-helpers';
+import { buildCheckpointSimulationOverridesPlan } from '@aztec/stdlib/checkpoint';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
+import { MIN_PER_BLOCK_ALLOCATION_MULTIPLIER, MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER, computeNetworkTxGasLimits } from '@aztec/stdlib/gas';
 import { SequencerConfigSchema } from '@aztec/stdlib/interfaces/server';
 import { pickFromSchema } from '@aztec/stdlib/schemas';
-import { MerkleTreeId } from '@aztec/stdlib/trees';
+import { buildProposerTimetable } from '@aztec/stdlib/timetable';
 import { Attributes, getTelemetryClient, trackSpan } from '@aztec/telemetry-client';
 import EventEmitter from 'node:events';
 import { DefaultSequencerConfig } from '../config.js';
 import { CheckpointProposalJob } from './checkpoint_proposal_job.js';
+import { CheckpointProposalJobMetrics } from './checkpoint_proposal_job_metrics.js';
 import { CheckpointVoter } from './checkpoint_voter.js';
-import { SequencerInterruptedError, SequencerTooSlowError } from './errors.js';
+import { SequencerInterruptedError } from './errors.js';
 import { SequencerMetrics } from './metrics.js';
-import { SequencerTimetable } from './timetable.js';
+import { RequestsTracker } from './requests_tracker.js';
 import { SequencerState } from './utils.js';
 export { SequencerState };
-_dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpointProposal'), _dec2 = trackSpan('Seqeuencer.tryVoteWhenSyncFails', ({ slot })=>({
+_dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpointProposal'), _dec2 = trackSpan('Sequencer.tryVoteAndPruneWhenCannotBuild', ({ slot })=>({
         [Attributes.SLOT_NUMBER]: slot
     })), _dec3 = trackSpan('Sequencer.tryVoteWhenEscapeHatchOpen', ({ slot })=>({
         [Attributes.SLOT_NUMBER]: slot
@@ -437,7 +439,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             [
                 _dec2,
                 2,
-                "tryVoteWhenSyncFails"
+                "tryVoteAndPruneWhenCannotBuild"
             ],
             [
                 _dec3,
@@ -448,40 +450,161 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     }
     runningPromise;
     state;
+    stateSlotNumber;
+    /** Wall-clock time (ms, via the date provider) at which the current state was entered. */ stateEnteredAtMs;
     metrics;
-    /** The last slot for which we attempted to perform our voting duties with degraded block production */ lastSlotForFallbackVote;
+    checkpointProposalJobMetrics;
+    stateLog;
+    /** The last slot for which we attempted to perform our fallback duties (votes and/or prune) with degraded block production */ lastSlotForFallbackAction;
+    /** The (checkpoint, slot) of the last invalidation request we successfully simulated, to prevent
+   * re-simulating and re-submitting the same invalidation across the many ticks within a single slot. */ lastInvalidationAttempt;
     /** The last slot for which we logged "no committee" warning, to avoid spam */ lastSlotForNoCommitteeWarning;
     /** The last slot for which we triggered a checkpoint proposal job, to prevent duplicate attempts. */ lastSlotForCheckpointProposalJob;
     /** Last successful checkpoint proposed */ lastCheckpointProposed;
     /** The last epoch for which we logged strategy comparison in fisherman mode. */ lastEpochForStrategyComparison;
-    /** The maximum number of seconds that the sequencer can be into a slot to transition to a particular state. */ timetable;
+    /** The last checkpoint proposal job, tracked so we can await its pending L1 submission during shutdown. */ lastCheckpointProposalJob;
+    /**
+   * In-flight fire-and-forget requests that {@link stop} interrupts and drains, and {@link pause} awaits
+   * untouched: the checkpoint proposal jobs' backgrounded L1 submissions (each job is handed this shared
+   * tracker) plus the sequencer's own fallback submissions (votes/prune when we cannot build, or
+   * escape-hatch votes). Each fallback send is gated by its wrapper publisher's interruptible target-slot
+   * sleep; the tracked interrupt wakes that sleep so the send short-circuits without publishing. A wrapper
+   * is created for a single send and is never restarted, so once interrupted its sleeper can never publish
+   * a stale-slot tx, even after the pooled publishers are restarted by a later {@link start}.
+   */ pendingRequests;
+    /** Proposer schedule and block sub-slot timetable for the sequencer, rebuilt on every config update. */ timetable;
     /** Config for the sequencer */ config;
+    signatureContext;
     constructor(publisherFactory, validatorClient, globalsBuilder, p2pClient, worldState, slasherClient, l2BlockSource, l1ToL2MessageSource, checkpointsBuilder, l1Constants, dateProvider, epochCache, rollupContract, config, telemetry = getTelemetryClient(), log = createLogger('sequencer')){
-        super(), this.publisherFactory = publisherFactory, this.validatorClient = validatorClient, this.globalsBuilder = globalsBuilder, this.p2pClient = p2pClient, this.worldState = worldState, this.slasherClient = slasherClient, this.l2BlockSource = l2BlockSource, this.l1ToL2MessageSource = l1ToL2MessageSource, this.checkpointsBuilder = checkpointsBuilder, this.l1Constants = l1Constants, this.dateProvider = dateProvider, this.epochCache = epochCache, this.rollupContract = rollupContract, this.telemetry = telemetry, this.log = log, this.state = (_initProto(this), SequencerState.STOPPED), this.config = DefaultSequencerConfig;
+        super(), this.publisherFactory = publisherFactory, this.validatorClient = validatorClient, this.globalsBuilder = globalsBuilder, this.p2pClient = p2pClient, this.worldState = worldState, this.slasherClient = slasherClient, this.l2BlockSource = l2BlockSource, this.l1ToL2MessageSource = l1ToL2MessageSource, this.checkpointsBuilder = checkpointsBuilder, this.l1Constants = l1Constants, this.dateProvider = dateProvider, this.epochCache = epochCache, this.rollupContract = rollupContract, this.telemetry = telemetry, this.log = log, this.state = (_initProto(this), SequencerState.STOPPED), this.pendingRequests = new RequestsTracker(), this.config = DefaultSequencerConfig;
+        this.stateLog = log.createChild('state');
+        this.stateEnteredAtMs = this.dateProvider.now();
         // Add [FISHERMAN] prefix to logger if in fisherman mode
         if (config.fishermanMode) {
             this.log = log.createChild('[FISHERMAN]');
         }
+        this.signatureContext = {
+            chainId: config.l1ChainId,
+            rollupAddress: config.rollupAddress
+        };
         this.metrics = new SequencerMetrics(telemetry, this.rollupContract, 'Sequencer');
+        this.checkpointProposalJobMetrics = new CheckpointProposalJobMetrics(telemetry);
         this.updateConfig(config);
     }
-    /** Updates sequencer config by the defined values and updates the timetable */ updateConfig(config) {
+    /**
+   * Updates sequencer config by the defined values and rebuilds the timetable.
+   *
+   * The merged config is validated against a candidate before being committed: {@link buildTimetable} may
+   * reject the candidate (invalid timing geometry, or per-block allocation multipliers below the network
+   * minimums). On rejection we leave `this.config` and `this.timetable` untouched and rethrow, so a bad update
+   * never leaves the sequencer running with a rejected config and a stale timetable.
+   */ updateConfig(config) {
         const filteredConfig = pickFromSchema(config, SequencerConfigSchema);
+        const candidate = merge(this.config, filteredConfig);
+        let timetable;
+        try {
+            timetable = this.buildTimetable(candidate);
+        } catch (err) {
+            this.log.warn(`Rejecting sequencer config update: ${err.message}`, {
+                rejectedConfig: omit(filteredConfig, 'txPublicSetupAllowListExtend')
+            });
+            throw err;
+        }
+        this.config = candidate;
+        this.timetable = timetable;
         this.log.info(`Updated sequencer config`, omit(filteredConfig, 'txPublicSetupAllowListExtend'));
-        this.config = merge(this.config, filteredConfig);
-        this.timetable = new SequencerTimetable({
-            ethereumSlotDuration: this.l1Constants.ethereumSlotDuration,
-            aztecSlotDuration: this.aztecSlotDuration,
-            l1PublishingTime: this.l1PublishingTime,
-            p2pPropagationTime: this.config.attestationPropagationTime,
-            blockDurationMs: this.config.blockDurationMs,
-            enforce: this.config.enforceTimeTable
-        }, this.metrics, this.log);
+    }
+    /**
+   * Builds the proposer timetable from the given config and L1 constants via the shared
+   * {@link buildProposerTimetable} helper, so the sequencer derives the same blocks-per-checkpoint as the p2p
+   * layer and `getNodeInfo`. The fast local/e2e profile and budget clamping happen inside
+   * {@link ProposerTimetable}.
+   *
+   * Throws if the timing geometry is invalid or the per-block allocation multipliers are below the network
+   * minimums; callers must treat a throw as a rejected config and not commit it.
+   */ buildTimetable(config) {
+        const timetable = buildProposerTimetable(config, this.l1Constants);
+        const maxNumberOfBlocks = timetable.getMaxBlocksPerCheckpoint();
+        this.log.info(`Sequencer timetable initialized with ${maxNumberOfBlocks} blocks per slot`, {
+            aztecSlotDuration: timetable.aztecSlotDuration,
+            ethereumSlotDuration: timetable.ethereumSlotDuration,
+            blockDuration: timetable.blockDuration,
+            minBlockDuration: timetable.minBlockDuration,
+            p2pPropagationTime: timetable.p2pPropagationTime,
+            checkpointProposalPrepareTime: timetable.checkpointProposalPrepareTime,
+            maxNumberOfBlocks
+        });
+        this.assertConfigMeetsNetworkTxLimits(config, maxNumberOfBlocks);
+        return timetable;
+    }
+    /**
+   * Checks this node's configured per-block allocation against the network admission limit. A node
+   * advertises and admits txs up to the limit derived from the network-minimum multipliers (see
+   * {@link computeNetworkTxGasLimits}).
+   *
+   * Fails startup (and runtime config updates) only when the configured per-block allocation *multipliers*
+   * (`perBlockAllocationMultiplier` / `perBlockDAAllocationMultiplier`) are below the network minimums: such
+   * a node would accept txs over RPC/gossip that its builder can never pack into a block regardless of block
+   * size. Operators may configure a higher (more generous) multiplier, but not a lower one.
+   *
+   * When the multipliers meet the floor but an absolute per-block gas cap (`maxDABlockGas` / `maxL2BlockGas`)
+   * shrinks the builder's effective grant below the network limit, this is legitimate operator
+   * restrictiveness — the node simply builds smaller blocks and such txs stay in the pool for other
+   * proposers — so we only log a warning rather than failing startup. Restrictive tx-count caps
+   * (`maxTxsPerBlock` / `maxTxsPerCheckpoint`) can likewise make the builder skip admitted txs; they are
+   * intentionally not modeled here for the same reason.
+   */ assertConfigMeetsNetworkTxLimits(config, maxBlocksPerCheckpoint) {
+        // Mirror CheckpointBuilder.capLimitsByCheckpointBudgets: DA falls back to the general multiplier.
+        const l2Multiplier = config.perBlockAllocationMultiplier;
+        const daMultiplier = config.perBlockDAAllocationMultiplier ?? l2Multiplier;
+        // The allocation is monotonic in the multiplier, so a multiplier at or above the network minimum
+        // guarantees the builder grants at least the network admission limit. Checking the multipliers directly
+        // is sufficient (and strictly more conservative than modeling the resulting gas grant).
+        if (daMultiplier < MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER) {
+            throw new Error(`perBlockDAAllocationMultiplier (${daMultiplier}) is below the network minimum ` + `${MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`);
+        }
+        if (l2Multiplier < MIN_PER_BLOCK_ALLOCATION_MULTIPLIER) {
+            throw new Error(`perBlockAllocationMultiplier (${l2Multiplier}) is below the network minimum ` + `${MIN_PER_BLOCK_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`);
+        }
+        // Absolute per-block gas caps below the network admission limit are legitimate operator restrictiveness:
+        // the node simply builds smaller blocks and such txs stay in the pool for other proposers. Warn only.
+        const networkLimit = computeNetworkTxGasLimits({
+            maxBlocksPerCheckpoint,
+            manaCheckpointBudget: this.l1Constants.rollupManaLimit
+        });
+        if (config.maxDABlockGas !== undefined && config.maxDABlockGas < networkLimit.daGas) {
+            this.log.warn(`Sequencer maxDABlockGas (${config.maxDABlockGas}) is below the network DA admission limit ` + `(${networkLimit.daGas}): txs declaring more DA gas are admitted over RPC/gossip but will be skipped ` + `by this proposer's own blocks and left in the pool for other proposers.`, {
+                maxDABlockGas: config.maxDABlockGas,
+                networkDaGas: networkLimit.daGas,
+                maxBlocksPerCheckpoint
+            });
+        }
+        if (config.maxL2BlockGas !== undefined && config.maxL2BlockGas < networkLimit.l2Gas) {
+            this.log.warn(`Sequencer maxL2BlockGas (${config.maxL2BlockGas}) is below the network L2 admission limit ` + `(${networkLimit.l2Gas}): txs declaring more L2 gas are admitted over RPC/gossip but will be skipped ` + `by this proposer's own blocks and left in the pool for other proposers.`, {
+                maxL2BlockGas: config.maxL2BlockGas,
+                networkL2Gas: networkLimit.l2Gas,
+                maxBlocksPerCheckpoint
+            });
+        }
     }
     /** Initializes the sequencer (precomputes tables). Takes about 3s. */ init() {
         getKzg();
     }
-    /** Starts the sequencer and moves to IDLE state. */ start() {
+    /**
+   * Starts (or restarts) the sequencer and moves it to the IDLE state. Idempotent: a start while already
+   * running is a no-op, so it never orphans the previous poll loop. A start while STOPPING throws, since the
+   * in-flight stop would mark the fresh loop's state STOPPED and orphan it — silently doing nothing would
+   * leave the caller believing the sequencer is running when it is on its way to STOPPED. Safe to call after
+   * a previous {@link stop} has resolved; the caller must also restart the publishers (see
+   * {@link SequencerClient.start}) so L1 publishing is re-enabled.
+   */ start() {
+        if (this.state === SequencerState.STOPPING) {
+            throw new Error('Cannot start sequencer while it is stopping');
+        }
+        if (this.runningPromise?.isRunning()) {
+            this.log.warn('Attempted to start sequencer that is already running');
+            return;
+        }
         this.runningPromise = new RunningPromise(this.safeWork.bind(this), this.log, this.config.sequencerPollingIntervalMS);
         this.setState(SequencerState.IDLE, undefined, {
             force: true
@@ -489,18 +612,59 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         this.runningPromise.start();
         this.log.info('Started sequencer');
     }
-    /** Stops the sequencer from building blocks and moves to STOPPED state. */ async stop() {
+    /** Triggers an immediate run of the sequencer, bypassing the polling interval. */ trigger() {
+        return this.runningPromise?.trigger();
+    }
+    /**
+   * Stops the sequencer from building blocks and moves it to STOPPED state, interrupting the in-flight
+   * work() iteration and its pending L1 submissions for a fast shutdown, then draining before returning.
+   * Idempotent: a second call while already stopped or stopping is a no-op. Lifecycle calls are expected
+   * to be serialized by the caller. For a restartable pause that lets in-flight work finish untouched
+   * (e.g. around a test clock warp), use {@link pause} instead.
+   */ async stop() {
+        if (this.state === SequencerState.STOPPED || this.state === SequencerState.STOPPING) {
+            this.log.debug(`Sequencer already ${this.state.toLowerCase()}, ignoring stop`);
+            return;
+        }
         this.log.info(`Stopping sequencer`);
         this.setState(SequencerState.STOPPING, undefined, {
             force: true
         });
+        this.lastCheckpointProposalJob?.interrupt();
         await this.publisherFactory.stopAll();
+        // Stop the poll loop and await the in-flight work() iteration. work() registers its fire-and-forget
+        // requests synchronously before returning, so once the loop has stopped, pendingRequests holds every
+        // request that will ever exist. Interrupting any earlier could miss a request registered by the last
+        // in-flight iteration.
         await this.runningPromise?.stop();
+        this.pendingRequests.interruptRequests();
+        await this.pendingRequests.awaitRequests();
         this.setState(SequencerState.STOPPED, undefined, {
             force: true
         });
         this.log.info('Stopped sequencer');
     }
+    /**
+   * Gracefully pauses block production so the sequencer can later be resumed with {@link start}: halts the
+   * poll loop and waits for the in-flight work() iteration and every pending L1 submission / fallback send
+   * to finish, without interrupting them. No interrupt lands mid-build, so no spurious checkpoint-error is
+   * emitted and no enqueued checkpoint is dropped. Deliberately does not stop inner services (validator/HA
+   * signer, publishers), so the slashing-protection store stays open and the sequencer stays restartable.
+   * Used by tests that pause sequencers around an L1 clock warp. Idempotent.
+   */ async pause() {
+        if (!this.runningPromise?.isRunning()) {
+            this.log.debug('Sequencer not running, ignoring pause');
+            return;
+        }
+        this.log.info('Pausing sequencer');
+        // Halt the poll loop and let the in-flight iteration finish naturally — no interrupt, and no STOPPING
+        // state, since entering STOPPING would make the iteration's own setState calls throw and fail it.
+        // work() registers its fire-and-forget requests synchronously before returning, so once the loop has
+        // stopped pendingRequests holds every request that will ever exist; awaiting it lets them all finish.
+        await this.runningPromise.stop();
+        await this.pendingRequests.awaitRequests();
+        this.log.info('Paused sequencer');
+    }
     /** Main sequencer loop with a try/catch */ async safeWork() {
         try {
             await this.work();
@@ -508,19 +672,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.emit('checkpoint-error', {
                 error: err
             });
-            if (err instanceof SequencerTooSlowError) {
-                // Log as warn only if we had to abort halfway through the block proposal
-                const logLvl = [
-                    SequencerState.INITIALIZING_CHECKPOINT,
-                    SequencerState.PROPOSER_CHECK
-                ].includes(err.proposedState) ? 'debug' : 'warn';
-                this.log[logLvl](err.message, {
-                    now: this.dateProvider.nowInSeconds()
-                });
-            } else {
-                // Re-throw other errors
-                throw err;
-            }
+            throw err;
         } finally{
             this.setState(SequencerState.IDLE, undefined);
         }
@@ -539,13 +691,14 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
    * - Submit checkpoint
    */ async work() {
         this.setState(SequencerState.SYNCHRONIZING, undefined);
-        const { slot, ts, nowSeconds, epoch } = this.epochCache.getEpochAndSlotInNextL1Slot();
-        const { slot: targetSlot, epoch: targetEpoch } = this.epochCache.getTargetEpochAndSlotInNextL1Slot();
+        const { slot, targetSlot, epoch, targetEpoch, ts, nowSeconds } = this.getSlotContextInNextL1Slot();
         // Check if we are synced and it's our slot, grab a publisher, check previous block invalidation, etc
         const checkpointProposalJob = await this.prepareCheckpointProposal(slot, targetSlot, epoch, targetEpoch, ts, nowSeconds);
         if (!checkpointProposalJob) {
             return;
         }
+        // Track the job so we can await its pending L1 submission during shutdown
+        this.lastCheckpointProposalJob = checkpointProposalJob;
         // Execute the checkpoint proposal job
         const checkpoint = await checkpointProposalJob.execute();
         // Update last checkpoint proposed (currently unused)
@@ -559,15 +712,25 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         }
         return checkpoint;
     }
+    /** Returns slot and target slot from a single clock snapshot. */ getSlotContextInNextL1Slot() {
+        const { slot, ts, nowSeconds, epoch } = this.epochCache.getEpochAndSlotInNextL1Slot();
+        const targetSlot = SlotNumber(slot + PROPOSER_PIPELINING_SLOT_OFFSET);
+        return {
+            slot,
+            targetSlot,
+            epoch,
+            targetEpoch: getEpochAtSlot(targetSlot, this.l1Constants),
+            ts,
+            nowSeconds
+        };
+    }
     /**
    * Prepares the checkpoint proposal by performing all necessary checks and setup.
    * This is the initial step in the main loop.
    * @returns CheckpointProposalJob if successful, undefined if we are not yet synced or are not the proposer.
    */ async prepareCheckpointProposal(slot, targetSlot, epoch, targetEpoch, ts, nowSeconds) {
-        // Check we have not already processed this target slot (cheapest check)
-        // We only check this if enforce timetable is set, since we want to keep processing the same slot if we are not
-        // running against actual time (eg when we use sandbox-style automining)
-        if (this.lastSlotForCheckpointProposalJob && this.lastSlotForCheckpointProposalJob >= targetSlot && this.config.enforceTimeTable) {
+        // Check we have not already processed this target slot (cheapest check).
+        if (this.lastSlotForCheckpointProposalJob && this.lastSlotForCheckpointProposalJob >= targetSlot) {
             this.log.trace(`Target slot ${targetSlot} has already been processed`);
             return undefined;
         }
@@ -576,29 +739,28 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.log.trace(`Slot ${targetSlot} has already been published as checkpoint ${this.lastCheckpointProposed.number}`);
             return undefined;
         }
-        // Check all components are synced to latest as seen by the archiver (queries all subsystems)
-        const syncedTo = await this.checkSync({
-            ts,
-            slot
-        });
-        if (!syncedTo) {
-            await this.tryVoteWhenSyncFails({
-                slot,
-                targetSlot,
-                ts
+        // Test-only: skip proposing for explicitly paused slots. Attestation paths run in the validator
+        // client and are not gated by this hook, so paused proposers still attest to others' proposals.
+        if (this.config.pauseProposingForSlots?.some((s)=>s === targetSlot)) {
+            this.log.warn(`Skipping proposal for paused slot ${targetSlot} (test-only pauseProposingForSlots hook)`, {
+                targetSlot
             });
             return undefined;
         }
+        // Cheap proposer check first: most nodes are not the proposer for most slots, so gate the
+        // expensive multi-subsystem checkSync (and the rest of the build path) behind it. Computed once
+        // here and reused for the escape-hatch voting path below. No setState/timing gate on this path:
+        // the build-start deadline gate runs only on the proposer build path after a successful checkSync.
+        const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
         // If escape hatch is open for the target epoch, do not start checkpoint proposal work and do not attempt invalidations.
         // Still perform governance/slashing voting (as proposer) once per slot.
         // When pipelining, we check the target epoch (slot+1's epoch) since that's the epoch we're building for.
         const isEscapeHatchOpen = await this.epochCache.isEscapeHatchOpen(targetEpoch);
         if (isEscapeHatchOpen) {
-            this.setState(SequencerState.PROPOSER_CHECK, slot);
-            const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
             if (canPropose) {
                 await this.tryVoteWhenEscapeHatchOpen({
                     slot,
+                    targetSlot,
                     proposer
                 });
             } else {
@@ -610,6 +772,57 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             }
             return undefined;
         }
+        // If we are not the proposer, check whether we should invalidate an invalid pending chain (a
+        // liveness backstop) and bail before any sync work or build-timing gate. This reads only the
+        // archiver's pending-chain validation status, which is authoritative on its own, instead of
+        // running the full sync check. Wrapped in try/catch because this leaner path skips the broader
+        // proposed-checkpoint/tip coherence screen that checkSync applied, so transient archiver
+        // incoherence surfaces as a quiet skip rather than a work-loop error.
+        if (!canPropose) {
+            try {
+                const pendingChainValidationStatus = await this.l2BlockSource.getPendingChainValidationStatus();
+                await this.considerInvalidatingCheckpoint(pendingChainValidationStatus, slot);
+            } catch (err) {
+                this.log.warn(`Failed to consider invalidating checkpoint`, {
+                    err,
+                    slot,
+                    targetSlot
+                });
+            }
+            return undefined;
+        }
+        // Explicit build-loop entry gate: if we are past the latest useful block-building start for the
+        // target slot, abandon building for this slot. The proposer prioritizes the ideal L1-publish path
+        // and does not plan around the late consensus-handoff path. This is the proposer build path's
+        // timing gate; it runs only after we know we are the synced proposer, so non-proposer invalidation
+        // and escape-hatch voting (which returned above) are never gated by build timing. Vote-only paths
+        // still run when block building is abandoned.
+        const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
+        const nowForStartGate = this.dateProvider.now() / 1000;
+        if (nowForStartGate > startDeadline) {
+            this.log.debug(`Past start deadline for slot ${targetSlot}, abandoning block building`, {
+                targetSlot,
+                nowForStartGate,
+                startDeadline
+            });
+            // Mark the slot as attempted so a deadline abort is not retried within the same slot. Vote-only actions
+            // still need to run because sync can succeed even when it is too late to start building a checkpoint.
+            await this.tryVoteAndPruneWhenCannotBuild({
+                slot,
+                targetSlot
+            });
+            this.lastSlotForCheckpointProposalJob = targetSlot;
+            return undefined;
+        }
+        // We are the proposer, the escape hatch is closed, and we have time before the build start deadline.
+        // Now run the full sync check before building.
+        const syncedTo = await this.checkSync({
+            ts,
+            slot
+        });
+        if (!syncedTo) {
+            return undefined;
+        }
         // Next checkpoint follows from the last synced one
         const checkpointNumber = CheckpointNumber(syncedTo.checkpointNumber + 1);
         const logCtx = {
@@ -621,12 +834,13 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             checkpointNumber,
             isPendingChainValid: pick(syncedTo.pendingChainValidationStatus, 'valid', 'reason', 'invalidIndex')
         };
-        // Check that we are a proposer for the target slot.
-        this.setState(SequencerState.PROPOSER_CHECK, slot);
-        const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
-        // If we are not a proposer check if we should invalidate an invalid checkpoint, and bail
-        if (!canPropose) {
-            await this.considerInvalidatingCheckpoint(syncedTo, slot);
+        // We are the synced proposer within the build window; enter the proposer-check state and build.
+        this.setState(SequencerState.PROPOSER_CHECK, targetSlot);
+        // Guard: don't exceed 1-deep pipeline. Without a proposed checkpoint, we can only build
+        // confirmed + 1. With a proposed checkpoint, we can build confirmed + 2.
+        const confirmedCkpt = syncedTo.checkpointedCheckpointNumber;
+        if (checkpointNumber > confirmedCkpt + 2) {
+            this.log.verbose(`Skipping slot ${targetSlot}: checkpoint ${checkpointNumber} exceeds max pipeline depth (confirmed=${confirmedCkpt})`);
             return undefined;
         }
         // Check that the target slot is not taken by a block already (should never happen, since only us can propose for this slot)
@@ -645,20 +859,84 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         const proposerForPublisher = this.config.fishermanMode ? undefined : proposer;
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposerForPublisher);
         this.log.verbose(`Created publisher at address ${publisher.getSenderAddress()} for attestor ${attestorAddress}`);
-        // In fisherman mode, set the actual proposer's address for simulations
-        if (this.config.fishermanMode && proposer) {
-            publisher.setProposerAddressForSimulation(proposer);
-            this.log.debug(`Set proposer address ${proposer} for simulation in fisherman mode`);
-        }
-        // Prepare invalidation request if the pending chain is invalid (returns undefined if no need)
-        const invalidateCheckpoint = await publisher.simulateInvalidateCheckpoint(syncedTo.pendingChainValidationStatus);
-        // Check with the rollup contract if we can indeed propose at the target slot. This check should not fail
-        // if all the previous checks are good, but we do it just in case.
-        const canProposeCheck = await publisher.canProposeAt(syncedTo.archive, proposer ?? EthAddress.ZERO, {
-            ...invalidateCheckpoint
+        // Prepare invalidation request if the pending chain is invalid (returns undefined if no need).
+        // Only simulate invalidation when there's no proposed parent, since we assume the proposed parent
+        // will invalidate the currently invalid checkpoint on L1.
+        const invalidateCheckpoint = syncedTo.hasProposedCheckpoint || syncedTo.pendingChainValidationStatus.valid ? undefined : await publisher.simulateInvalidateCheckpoint(syncedTo.pendingChainValidationStatus);
+        // Determine the correct archive and L1 state overrides for the canProposeAt check.
+        // The L1 contract reads archives[proposedCheckpointNumber] and compares it with the provided archive.
+        // When invalidating or pipelining, the local archive may differ from L1's, so we adjust accordingly.
+        let archiveForCheck = syncedTo.archive;
+        if (syncedTo.hasProposedCheckpoint) {
+            this.metrics.recordPipelineDepth(syncedTo.checkpointNumber - syncedTo.checkpointedCheckpointNumber);
+            this.log.verbose(`Building on top of proposed checkpoint (pending=${syncedTo.proposedCheckpointData?.checkpointNumber}) for target slot ${targetSlot}`, {
+                targetSlot,
+                parentCheckpointNumber: CheckpointNumber(checkpointNumber - 1)
+            });
+            // Match what L1 will see at archives[pending] once the proposed parent lands: the parent's
+            // own archive root from the gossiped proposal. `syncedTo.archive` is the world-state-local
+            // view and can transiently diverge from the proposed parent (e.g. before the proposed
+            // parent's blocks have been applied locally); diverging here would cause the canProposeAt
+            // override to set archives[pending] to one value while we present another for comparison.
+            archiveForCheck = syncedTo.proposedCheckpointData.archive.root;
+        } else if (invalidateCheckpoint) {
+            // After invalidation, L1 will roll back to checkpoint N-1. The archive at N-1 already
+            // exists on L1, so we just pass the matching archive (the lastArchive of the invalid checkpoint).
+            archiveForCheck = invalidateCheckpoint.lastArchive;
+            this.metrics.recordPipelineDepth(0);
+        } else {
+            this.metrics.recordPipelineDepth(0);
+        }
+        // Build the simulation plan: pending/proven override from pipelining or invalidation (or the
+        // current snapshot when neither applies, to short-circuit any pending prune in simulation),
+        // plus the parent checkpoint cell and fee header when pipelining.
+        const simulationOverridesPlan = await buildCheckpointSimulationOverridesPlan({
+            checkpointNumber,
+            proposedCheckpointData: syncedTo.hasProposedCheckpoint ? syncedTo.proposedCheckpointData : undefined,
+            invalidateToPendingCheckpointNumber: invalidateCheckpoint?.forcePendingCheckpointNumber,
+            checkpointedCheckpointNumber: syncedTo.checkpointedCheckpointNumber,
+            rollup: this.rollupContract,
+            signatureContext: this.signatureContext,
+            log: this.log
         });
+        // The plan always pins both pending/proven (to short-circuit `canPruneAtTime` in simulation),
+        // so `provenOverride` always reflects the assumed proven checkpoint we are pinning the
+        // simulation to. We additionally warn when the pin is load-bearing — i.e. when a prune would
+        // actually fire at the target slot without it — so observers can spot "we are building
+        // optimistically across a pruning boundary" in the logs.
+        const provenOverride = simulationOverridesPlan?.chainTipsOverride?.proven;
+        if (provenOverride !== undefined && await this.l2BlockSource.isPruneDueAtSlot(targetSlot)) {
+            this.log.warn(`Assuming proof for epoch ending at checkpoint ${provenOverride} lands by target slot ${targetSlot}`, {
+                checkpointNumber,
+                slot,
+                targetSlot,
+                provenOverride
+            });
+        }
+        this.emit('preparing-checkpoint', {
+            targetSlot,
+            checkpointNumber,
+            hadProposedParent: syncedTo.hasProposedCheckpoint,
+            provenOverride,
+            simulatedPending: simulationOverridesPlan?.chainTipsOverride?.pending
+        });
+        const canProposeCheck = await publisher.canProposeAt(archiveForCheck, proposer ?? EthAddress.ZERO, simulationOverridesPlan);
+        const proposeContext = {
+            hasProposedCheckpoint: syncedTo.hasProposedCheckpoint,
+            proposedCheckpointNumber: syncedTo.proposedCheckpointData?.checkpointNumber,
+            checkpointedCheckpointNumber: syncedTo.checkpointedCheckpointNumber,
+            isInvalidating: !!invalidateCheckpoint,
+            invalidatingCheckpointNumber: invalidateCheckpoint?.checkpointNumber,
+            archiveForCheck: archiveForCheck.toString(),
+            overridePendingCheckpointNumber: simulationOverridesPlan?.chainTipsOverride?.pending,
+            overrideArchive: simulationOverridesPlan?.pendingCheckpointState?.archive,
+            overrideFeeHeader: simulationOverridesPlan?.pendingCheckpointState?.feeHeader
+        };
         if (canProposeCheck === undefined) {
-            this.log.warn(`Cannot propose checkpoint ${checkpointNumber} at slot ${slot} due to failed rollup contract check`, logCtx);
+            this.log.warn(`Cannot propose checkpoint ${checkpointNumber} at slot ${slot} due to failed rollup contract check`, {
+                ...logCtx,
+                ...proposeContext
+            });
             this.emit('proposer-rollup-check-failed', {
                 reason: 'Rollup contract check failed',
                 slot
@@ -669,6 +947,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         if (canProposeCheck.slot !== targetSlot) {
             this.log.warn(`Cannot propose block due to slot mismatch with rollup contract (this can be caused by a clock out of sync). Expected slot ${targetSlot} but got ${canProposeCheck.slot}.`, {
                 ...logCtx,
+                ...proposeContext,
                 rollup: canProposeCheck,
                 expectedSlot: targetSlot
             });
@@ -682,6 +961,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         if (canProposeCheck.checkpointNumber !== checkpointNumber) {
             this.log.warn(`Cannot propose due to block mismatch with rollup contract (this can be caused by a pending archiver sync). Expected checkpoint ${checkpointNumber} but got ${canProposeCheck.checkpointNumber}.`, {
                 ...logCtx,
+                ...proposeContext,
                 rollup: canProposeCheck,
                 expectedSlot: slot
             });
@@ -696,14 +976,14 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         await this.p2pClient.prepareForSlot(targetSlot);
         this.log.info(`Preparing checkpoint proposal ${checkpointNumber} for target slot ${targetSlot} during wall-clock slot ${slot}`, {
             ...logCtx,
-            proposer,
-            pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled()
+            ...proposeContext,
+            proposer
         });
         // Create and return the checkpoint proposal job
-        return this.createCheckpointProposalJob(slot, targetSlot, epoch, targetEpoch, checkpointNumber, syncedTo.blockNumber, proposer, publisher, attestorAddress, invalidateCheckpoint);
+        return this.createCheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedTo.blockNumber, syncedTo.checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, syncedTo.proposedCheckpointData);
     }
-    createCheckpointProposalJob(slot, targetSlot, epoch, targetEpoch, checkpointNumber, syncedToBlockNumber, proposer, publisher, attestorAddress, invalidateCheckpoint) {
-        return new CheckpointProposalJob(slot, targetSlot, epoch, targetEpoch, checkpointNumber, syncedToBlockNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, this.validatorClient, this.globalsBuilder, this.p2pClient, this.worldState, this.l1ToL2MessageSource, this.l2BlockSource, this.checkpointsBuilder, this.l2BlockSource, this.l1Constants, this.config, this.timetable, this.slasherClient, this.epochCache, this.dateProvider, this.metrics, this, this.setState.bind(this), this.tracer, this.log.getBindings());
+    createCheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, proposedCheckpointData) {
+        return new CheckpointProposalJob(targetSlot, targetEpoch, checkpointNumber, syncedToBlockNumber, checkpointedCheckpointNumber, proposer, publisher, attestorAddress, invalidateCheckpoint, this.validatorClient, this.globalsBuilder, this.p2pClient, this.worldState, this.l1ToL2MessageSource, this.l2BlockSource, this.checkpointsBuilder, this.l2BlockSource, this.l1Constants, this.signatureContext, this.config, this.timetable, this.slasherClient, this.epochCache, this.dateProvider, this.metrics, this.checkpointProposalJobMetrics.createRecorder(), this, this.pendingRequests, this.setState.bind(this), this.tracer, this.log.getBindings(), proposedCheckpointData);
     }
     /**
    * Returns the current sequencer state.
@@ -711,9 +991,11 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         return this.state;
     }
     /**
-   * Internal helper for setting the sequencer state and checks if we have enough time left in the slot to transition to the new state.
+   * Internal helper for setting the sequencer state. Pure: sets the state, emits `state-changed`, and
+   * records metrics. Timing deadlines are queried explicitly at the relevant call sites, not gated here.
    * @param proposedState - The new state to transition to.
-   * @param slotNumber - The current slot number.
+   * @param slotNumber - The target slot being proposed for, emitted as `targetSlot` on the event payload
+   * and used to anchor `secondsIntoBuildFrame`. Undefined for lifecycle states with no associated slot.
    * @param force - Whether to force the transition even if the sequencer is stopped.
    */ setState(proposedState, slotNumber, opts = {}) {
         if (this.state === SequencerState.STOPPING && proposedState !== SequencerState.STOPPED && !opts.force) {
@@ -724,26 +1006,40 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.log.warn(`Cannot set sequencer from ${this.state} to ${proposedState} as it is stopped.`);
             return;
         }
-        let secondsIntoSlot = undefined;
-        if (slotNumber !== undefined) {
-            secondsIntoSlot = this.getSecondsIntoSlot(slotNumber);
-            this.timetable.assertTimeLeft(proposedState, secondsIntoSlot);
-        }
+        const secondsIntoBuildFrame = slotNumber !== undefined ? this.getSecondsIntoBuildFrame(slotNumber) : undefined;
+        const oldState = this.state;
+        const oldStateSlotNumber = this.stateSlotNumber;
+        const stateChanged = proposedState !== oldState;
+        // Wall-clock time spent in the previous state: the delta between consecutive state-changing setState
+        // calls, read from the date provider so it tracks simulated time under a test/manual clock.
+        const transitionAtMs = this.dateProvider.now();
+        const stateDurationMs = transitionAtMs - this.stateEnteredAtMs;
         const boringStates = [
             SequencerState.IDLE,
             SequencerState.SYNCHRONIZING
         ];
-        const logLevel = boringStates.includes(proposedState) && boringStates.includes(this.state) ? 'trace' : 'debug';
-        this.log[logLevel](`Transitioning from ${this.state} to ${proposedState}`, {
+        const logLevel = boringStates.includes(proposedState) && boringStates.includes(oldState) ? 'trace' : 'debug';
+        this.stateLog[logLevel](`Transitioning from ${oldState} to ${proposedState}`, {
+            oldState,
+            newState: proposedState,
             slotNumber,
-            secondsIntoSlot
+            stateSlotNumber: oldStateSlotNumber,
+            secondsIntoBuildFrame,
+            ...stateChanged && {
+                stateDurationMs: Math.ceil(stateDurationMs)
+            }
         });
         this.emit('state-changed', {
-            oldState: this.state,
+            oldState,
             newState: proposedState,
-            secondsIntoSlot,
-            slot: slotNumber
+            secondsIntoBuildFrame,
+            targetSlot: slotNumber
         });
+        if (stateChanged) {
+            this.metrics.recordStateDuration(stateDurationMs, oldState);
+            this.stateEnteredAtMs = transitionAtMs;
+            this.stateSlotNumber = slotNumber;
+        }
         this.state = proposedState;
     }
     /**
@@ -767,48 +1063,84 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
                     number: syncSummary.latestBlockNumber,
                     hash: syncSummary.latestBlockHash
                 })),
-            this.l2BlockSource.getL2Tips().then((t)=>t.proposed),
+            this.l2BlockSource.getL2Tips().then((t)=>({
+                    proposed: t.proposed,
+                    checkpointed: t.checkpointed
+                })),
             this.p2pClient.getStatus().then((p2p)=>p2p.syncedToL2Block),
-            this.l1ToL2MessageSource.getL2Tips().then((t)=>t.proposed),
-            this.l2BlockSource.getPendingChainValidationStatus()
+            this.l1ToL2MessageSource.getL2Tips().then((t)=>({
+                    proposed: t.proposed,
+                    checkpointed: t.checkpointed
+                })),
+            this.l2BlockSource.getPendingChainValidationStatus(),
+            this.l2BlockSource.getProposedCheckpointData()
         ]);
-        const [worldState, l2BlockSource, p2p, l1ToL2MessageSource, pendingChainValidationStatus] = syncedBlocks;
-        // Handle zero as a special case, since the block hash won't match across services if we're changing the prefilled data for the genesis block,
-        // as the world state can compute the new genesis block hash, but other components use the hardcoded constant.
-        // TODO(palla/mbps): Fix the above. All components should be able to handle dynamic genesis block hashes.
-        const result = l2BlockSource.number === 0 && worldState.number === 0 && p2p.number === 0 && l1ToL2MessageSource.number === 0 || worldState.hash === l2BlockSource.hash && p2p.hash === l2BlockSource.hash && l1ToL2MessageSource.hash === l2BlockSource.hash;
+        const [worldState, l2Tips, p2p, l1ToL2MessageSourceTips, pendingChainValidationStatus, proposedCheckpointData] = syncedBlocks;
+        const result = worldState.hash === l2Tips.proposed.hash && p2p.hash === l2Tips.proposed.hash && l1ToL2MessageSourceTips.proposed.hash === l2Tips.proposed.hash && l1ToL2MessageSourceTips.checkpointed.block.hash === l2Tips.checkpointed.block.hash && l1ToL2MessageSourceTips.checkpointed.checkpoint.hash === l2Tips.checkpointed.checkpoint.hash;
         if (!result) {
             this.log.debug(`Sequencer sync check failed`, {
                 worldState,
-                l2BlockSource,
+                l2BlockSource: l2Tips.proposed,
                 p2p,
-                l1ToL2MessageSource
+                l1ToL2MessageSourceTips
             });
             return undefined;
         }
-        // Special case for genesis state
         const blockNumber = worldState.number;
-        if (blockNumber < INITIAL_L2_BLOCK_NUM) {
-            const archive = new Fr((await this.worldState.getCommitted().getTreeInfo(MerkleTreeId.ARCHIVE)).root);
-            return {
-                checkpointNumber: CheckpointNumber.ZERO,
-                blockNumber: BlockNumber.ZERO,
-                archive,
+        const blockData = await this.l2BlockSource.getBlockData({
+            number: blockNumber
+        });
+        if (!blockData) {
+            this.log.warn(`Sequencer sync check failed: failed to get L2 block data ${blockNumber} from the archiver`, {
+                blockNumber,
+                l2Tips,
+                syncedL2Slot,
+                ...args
+            });
+            return undefined;
+        }
+        // Refuse to build a checkpoint on top of a proposed block whose enclosing checkpoint was never
+        // proposed. Under pipelining we may have received and reexecuted such a block locally — advancing
+        // our world-state tip past the checkpointed tip — while the proposing node never published the
+        // matching proposed checkpoint (e.g. it crashed before assembling it). Building on this orphan block
+        // would fork the chain off a tip no other node can follow. The archiver prunes these orphan blocks
+        // once their build slot ends; this guard is the correctness barrier during the grace window before.
+        // `getProposedCheckpointData()` returns the latest proposed checkpoint payload, which is always
+        // the leading one (a proposed entry is only stored beyond the confirmed frontier and is deleted
+        // on confirmation). It carries no tip, so there is no tip-vs-payload split read to reconcile.
+        if (blockData.checkpointNumber > l2Tips.checkpointed.checkpoint.number && proposedCheckpointData?.checkpointNumber !== blockData.checkpointNumber) {
+            const logCtx = {
+                blockCheckpointNumber: blockData.checkpointNumber,
+                checkpointedCheckpointNumber: l2Tips.checkpointed.checkpoint.number,
+                proposedCheckpointTipNumber: proposedCheckpointData?.checkpointNumber,
+                blockNumber: blockData.header.getBlockNumber(),
+                blockSlot: blockData.header.getSlot(),
                 syncedL2Slot,
-                pendingChainValidationStatus
+                ...args
             };
+            this.log.debug(`Waiting for proposed checkpoint to catch up with reexecuted block`, logCtx);
+            return undefined;
         }
-        const blockData = await this.l2BlockSource.getBlockData(blockNumber);
-        if (!blockData) {
-            // this shouldn't really happen because a moment ago we checked that all components were in sync
-            this.log.error(`Failed to get L2 block data ${blockNumber} from the archiver with all components in sync`);
+        const hasProposedCheckpoint = proposedCheckpointData !== undefined;
+        // Check that the proposed checkpoint is indeed the parent of the checkpoint we'll be building
+        // The checkpoint number to build is derived as blockData.checkpointNumber + 1
+        if (proposedCheckpointData && proposedCheckpointData.checkpointNumber !== blockData.checkpointNumber) {
+            this.log.warn(`Sequencer sync check failed: proposed checkpoint number mismatch`, {
+                proposedCheckpointNumber: proposedCheckpointData.checkpointNumber,
+                blockCheckpointNumber: blockData.checkpointNumber,
+                syncedL2Slot,
+                ...args
+            });
             return undefined;
         }
         return {
             blockData,
             blockNumber: blockData.header.getBlockNumber(),
             checkpointNumber: blockData.checkpointNumber,
+            checkpointedCheckpointNumber: l2Tips.checkpointed.checkpoint.number,
             archive: blockData.archive.root,
+            hasProposedCheckpoint,
+            proposedCheckpointData,
             syncedL2Slot,
             pendingChainValidationStatus
         };
@@ -864,7 +1196,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
                 proposer
             ];
         }
-        this.log.debug(`We are the proposer for target slot ${targetSlot}`, {
+        this.log.info(`We are the proposer for pipeline slot ${targetSlot}`, {
             targetSlot,
             proposer
         });
@@ -874,30 +1206,24 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         ];
     }
     /**
-   * Tries to vote on slashing actions and governance when the sync check fails but we're past the max time for initializing a proposal.
-   * This allows the sequencer to participate in governance/slashing votes even when it cannot build blocks.
-   */ async tryVoteWhenSyncFails(args) {
+   * Tries to vote on slashing actions and governance and to prune when we cannot build and are past the
+   * block-building window. This allows the sequencer to participate in governance/slashing votes even when it
+   * cannot build blocks, and to prune the pending chain so it can recover from bad data that is blocking sync.
+   */ async tryVoteAndPruneWhenCannotBuild(args) {
         const { slot, targetSlot } = args;
         // Prevent duplicate attempts in the same slot
-        if (this.lastSlotForFallbackVote === slot) {
-            this.log.trace(`Already attempted to vote in slot ${slot} (skipping)`);
+        if (this.lastSlotForFallbackAction === slot) {
+            this.log.trace(`Already attempted fallback actions in slot ${slot} (skipping)`);
             return;
         }
-        // Check if we're past the max time for initializing a proposal
-        const secondsIntoSlot = this.getSecondsIntoSlot(slot);
-        const maxAllowedTime = this.timetable.getMaxAllowedTime(SequencerState.INITIALIZING_CHECKPOINT);
-        // If we haven't exceeded the time limit for initializing a proposal, don't proceed with voting
-        // We use INITIALIZING_PROPOSAL time limit because if we're past that, we can't build a block anyway
-        if (maxAllowedTime === undefined || secondsIntoSlot <= maxAllowedTime) {
-            this.log.trace(`Not attempting to vote since there is still time for block building`, {
-                secondsIntoSlot,
-                maxAllowedTime
-            });
-            return;
-        }
-        this.log.trace(`Sync for slot ${slot} failed, checking for voting opportunities`, {
-            secondsIntoSlot,
-            maxAllowedTime
+        // Vote-only actions do not give up the slot: if sync recovers, a later work-loop iteration can still build.
+        // Under proposer pipelining the work loop reasons about the next L1 slot, so waiting for the target slot's
+        // build-start deadline can miss the whole fallback window when the target advances with the clock.
+        const nowSeconds = this.dateProvider.now() / 1000;
+        const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
+        this.log.trace(`Cannot build for slot ${slot}, checking for voting opportunities`, {
+            nowSeconds,
+            startDeadline
         });
         // Check if we're a proposer or proposal is open
         const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
@@ -909,7 +1235,7 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             return;
         }
         // Mark this slot as attempted
-        this.lastSlotForFallbackVote = slot;
+        this.lastSlotForFallbackAction = slot;
         // Get a publisher for voting
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
         this.log.debug(`Attempting to vote despite sync failure at slot ${slot}`, {
@@ -920,33 +1246,65 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
         const voter = new CheckpointVoter(targetSlot, publisher, attestorAddress, this.validatorClient, this.slasherClient, this.l1Constants, this.config, this.metrics, this.log);
         const votesPromises = voter.enqueueVotes();
         const votes = await Promise.all(votesPromises);
-        if (votes.every((p)=>!p)) {
-            this.log.debug(`No votes to enqueue for slot ${slot}`);
+        // Even if we cannot build, try to prune so a stuck pending chain (e.g. bad data blocking sync) can
+        // recover. prune() is permissionless, so it rides the same fallback multicall as the votes.
+        const pruneEnqueued = await this.tryEnqueuePruneIfPrunable(targetSlot, publisher);
+        // Bail if nothing to do
+        if (votes.every((p)=>!p) && !pruneEnqueued) {
+            this.log.debug(`Nothing to enqueue for slot ${slot} (no votes, not prunable)`);
             return;
         }
-        this.log.info(`Voting in slot ${slot} despite sync failure`, {
-            slot
+        const [governanceVoteEnqueued, slashingVoteEnqueued] = votes;
+        this.log.info(`Submitting fallback requests in slot ${slot} despite sync failure`, {
+            slot,
+            pruneEnqueued,
+            governanceVoteEnqueued: !!governanceVoteEnqueued,
+            slashingVoteEnqueued: !!slashingVoteEnqueued
+        });
+        // Votes are EIP-712-signed for `targetSlot` (the pipelined slot in which the multicall is
+        // expected to mine). Delay submission to the start of `targetSlot` so the tx mines in the
+        // slot the votes were signed for. We fire-and-forget so we don't block the sequencer's
+        // work loop while waiting for the target slot to start, but track it so stop() can drain it.
+        const send = publisher.sendRequestsAt(targetSlot).catch((err)=>{
+            this.log.error(`Failed to publish fallback requests despite sync failure for slot ${slot}`, err, {
+                slot
+            });
         });
-        await publisher.sendRequests();
+        this.pendingRequests.trackRequest(send, ()=>publisher.interrupt());
+    }
+    async tryEnqueuePruneIfPrunable(targetSlot, publisher) {
+        try {
+            return await publisher.enqueuePruneIfPrunable(targetSlot);
+        } catch (err) {
+            this.log.error(`Failed to enqueue rollup prune for slot ${targetSlot}`, err, {
+                targetSlot
+            });
+            return false;
+        }
     }
     /**
    * Tries to vote on slashing actions and governance proposals when escape hatch is open.
    * This allows the sequencer to participate in voting without performing checkpoint proposal work.
    */ async tryVoteWhenEscapeHatchOpen(args) {
-        const { slot, proposer } = args;
+        const { slot, targetSlot, proposer } = args;
         // Prevent duplicate attempts in the same slot
-        if (this.lastSlotForFallbackVote === slot) {
+        if (this.lastSlotForFallbackAction === slot) {
             this.log.trace(`Already attempted to vote in slot ${slot} (escape hatch open, skipping)`);
             return;
         }
         // Mark this slot as attempted
-        this.lastSlotForFallbackVote = slot;
+        this.lastSlotForFallbackAction = slot;
         const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
         this.log.debug(`Escape hatch open for slot ${slot}, attempting vote-only actions`, {
             slot,
+            targetSlot,
             attestorAddress
         });
-        const voter = new CheckpointVoter(slot, publisher, attestorAddress, this.validatorClient, this.slasherClient, this.l1Constants, this.config, this.metrics, this.log);
+        // Under proposer pipelining, the multicall is expected to mine in `targetSlot` (slot + 1).
+        // Governance and slashing votes are EIP-712-signed against the slot they will mine in, and the
+        // L1 contract checks `msg.sender == getCurrentProposer()` using the mining slot. So we must
+        // sign for `targetSlot` and delay submission to the start of `targetSlot`.
+        const voter = new CheckpointVoter(targetSlot, publisher, attestorAddress, this.validatorClient, this.slasherClient, this.l1Constants, this.config, this.metrics, this.log);
         const votesPromises = voter.enqueueVotes();
         const votes = await Promise.all(votesPromises);
         if (votes.every((p)=>!p)) {
@@ -954,28 +1312,52 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             return;
         }
         this.log.info(`Voting in slot ${slot} (escape hatch open)`, {
-            slot
+            slot,
+            targetSlot
+        });
+        // Votes are EIP-712-signed for `targetSlot`. Delay submission to the start of `targetSlot` so
+        // the multicall mines in the slot the votes were signed for; otherwise the L1 contract reads
+        // `signaler = getCurrentProposer()` against the wrong slot and signature verification fails
+        // silently inside Multicall3. Fire-and-forget so we don't block the sequencer's work loop while
+        // waiting for the target slot to start, mirroring tryVoteAndPruneWhenCannotBuild, but tracked so
+        // stop() can drain it.
+        const send = publisher.sendRequestsAt(targetSlot).catch((err)=>{
+            this.log.error(`Failed to publish escape-hatch votes for slot ${slot}`, err, {
+                slot,
+                targetSlot
+            });
         });
-        await publisher.sendRequests();
+        this.pendingRequests.trackRequest(send, ()=>publisher.interrupt());
     }
     /**
    * Considers invalidating a block if the pending chain is invalid. Depends on how long the invalid block
    * has been there without being invalidated and whether the sequencer is in the committee or not. We always
    * have the proposer try to invalidate, but if they fail, the sequencers in the committee are expected to try,
    * and if they fail, any sequencer will try as well.
-   */ async considerInvalidatingCheckpoint(syncedTo, currentSlot) {
-        const { pendingChainValidationStatus, syncedL2Slot } = syncedTo;
+   * @param pendingChainValidationStatus - The archiver's pending-chain validation status, authoritative on its own.
+   * @param currentSlot - The wall-clock slot, used for committee lookup, the per-(checkpoint, slot) dedup guard, and logging.
+   */ async considerInvalidatingCheckpoint(pendingChainValidationStatus, currentSlot) {
         if (pendingChainValidationStatus.valid) {
             return;
         }
         const invalidCheckpointNumber = pendingChainValidationStatus.checkpoint.checkpointNumber;
+        // Avoid re-running the committee lookup, simulation, and submission on every tick within a slot.
+        // The guard is keyed by (checkpoint, slot) — so a different invalid checkpoint surfacing later in
+        // the same slot is not suppressed — and is set only after a request is successfully simulated below,
+        // so a transient simulation failure (or thresholds not yet met) still retries on the next tick.
+        if (this.lastInvalidationAttempt?.slot === currentSlot && this.lastInvalidationAttempt.checkpointNumber === invalidCheckpointNumber) {
+            this.log.trace(`Already attempted to invalidate checkpoint ${invalidCheckpointNumber} in slot ${currentSlot}`, {
+                currentSlot,
+                invalidCheckpointNumber
+            });
+            return;
+        }
         const invalidCheckpointTimestamp = pendingChainValidationStatus.checkpoint.timestamp;
         const timeSinceChainInvalid = this.dateProvider.nowInSeconds() - Number(invalidCheckpointTimestamp);
         const ourValidatorAddresses = this.validatorClient.getValidatorAddresses();
         const { secondsBeforeInvalidatingBlockAsCommitteeMember, secondsBeforeInvalidatingBlockAsNonCommitteeMember } = this.config;
         const logData = {
             invalidL1Timestamp: invalidCheckpointTimestamp,
-            syncedL2Slot,
             invalidCheckpoint: pendingChainValidationStatus.checkpoint,
             secondsBeforeInvalidatingBlockAsCommitteeMember,
             secondsBeforeInvalidatingBlockAsNonCommitteeMember,
@@ -1009,6 +1391,12 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
             this.log.warn(`Failed to simulate invalidate checkpoint`, logData);
             return;
         }
+        // We produced a valid invalidation request; record it so further ticks within this slot skip the
+        // committee lookup, simulation, and submission above for this same invalid checkpoint.
+        this.lastInvalidationAttempt = {
+            slot: currentSlot,
+            checkpointNumber: invalidCheckpointNumber
+        };
         this.log.info(invalidateAsCommitteeMember ? `Invalidating checkpoint ${invalidCheckpointNumber} as committee member` : `Invalidating checkpoint ${invalidCheckpointNumber} as non-committee member`, logData);
         publisher.enqueueInvalidateCheckpoint(invalidateCheckpoint);
         if (!this.config.fishermanMode) {
@@ -1044,12 +1432,12 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
                 }))
         });
     }
-    getSlotStartBuildTimestamp(slotNumber) {
-        return getSlotStartBuildTimestamp(slotNumber, this.l1Constants);
-    }
-    getSecondsIntoSlot(slotNumber) {
-        const slotStartTimestamp = this.getSlotStartBuildTimestamp(slotNumber);
-        return Number((this.dateProvider.now() / 1000 - slotStartTimestamp).toFixed(3));
+    /**
+   * Wall-clock seconds elapsed since the build-frame start of the given target slot
+   * (`now − getBuildFrameStart(targetSlot)`). May be negative if called before the build frame opens.
+   */ getSecondsIntoBuildFrame(targetSlot) {
+        const buildFrameStart = this.timetable.getBuildFrameStart(targetSlot);
+        return Number((this.dateProvider.now() / 1000 - buildFrameStart).toFixed(3));
     }
     get aztecSlotDuration() {
         return this.l1Constants.slotDuration;
@@ -1072,7 +1460,4 @@ _dec = trackSpan('Sequencer.work'), _dec1 = trackSpan('Sequencer.prepareCheckpoi
     getConfig() {
         return this.config;
     }
-    get l1PublishingTime() {
-        return this.config.l1PublishingTime ?? this.l1Constants.ethereumSlotDuration;
-    }
 }