@aztec/sequencer-client 0.0.1-commit.d3ec352c → 0.0.1-commit.d58ff9d0

package/src/sequencer/sequencer.ts

@@ -1,566 +1,804 @@
-import { L2Block } from '@aztec/aztec.js/block';
-import { BLOBS_PER_CHECKPOINT, FIELDS_PER_BLOB, INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
-import type { EpochCache } from '@aztec/epoch-cache';
-import { FormattedViemError, NoCommitteeError, type RollupContract } from '@aztec/ethereum';
+import { getKzg } from '@aztec/blob-lib';
+import { type EpochCache, PROPOSER_PIPELINING_SLOT_OFFSET } from '@aztec/epoch-cache';
+import { NoCommitteeError, type RollupContract } from '@aztec/ethereum/contracts';
 import { BlockNumber, CheckpointNumber, EpochNumber, SlotNumber } from '@aztec/foundation/branded-types';
-import { omit, pick } from '@aztec/foundation/collection';
-import { randomInt } from '@aztec/foundation/crypto';
+import { merge, omit, pick } from '@aztec/foundation/collection';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import { EthAddress } from '@aztec/foundation/eth-address';
-import { Signature } from '@aztec/foundation/eth-signature';
-import { Fr } from '@aztec/foundation/fields';
-import { createLogger } from '@aztec/foundation/log';
+import { type Logger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
-import { type DateProvider, Timer } from '@aztec/foundation/timer';
-import { type TypedEventEmitter, unfreeze } from '@aztec/foundation/types';
+import type { DateProvider } from '@aztec/foundation/timer';
+import type { TypedEventEmitter } from '@aztec/foundation/types';
 import type { P2P } from '@aztec/p2p';
 import type { SlasherClientInterface } from '@aztec/slasher';
-import {
-  CommitteeAttestation,
-  CommitteeAttestationsAndSigners,
-  type L2BlockSource,
-  MaliciousCommitteeAttestationsAndSigners,
-  type ValidateBlockResult,
+import type {
+  BlockData,
+  L2BlockSink,
+  L2BlockSource,
+  ProposedCheckpointSink,
+  ValidateCheckpointResult,
 } from '@aztec/stdlib/block';
-import { type L1RollupConstants, getSlotAtTimestamp, getSlotStartBuildTimestamp } from '@aztec/stdlib/epoch-helpers';
-import { Gas } from '@aztec/stdlib/gas';
 import {
-  type IFullNodeBlockBuilder,
-  type PublicProcessorLimits,
+  type Checkpoint,
+  type ProposedCheckpointData,
+  buildCheckpointSimulationOverridesPlan,
+} from '@aztec/stdlib/checkpoint';
+import type { ChainConfig } from '@aztec/stdlib/config';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
+import {
+  MIN_PER_BLOCK_ALLOCATION_MULTIPLIER,
+  MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER,
+  computeNetworkTxGasLimits,
+} from '@aztec/stdlib/gas';
+import {
+  type ResolvedSequencerConfig,
+  type SequencerConfig,
   SequencerConfigSchema,
   type WorldStateSynchronizer,
 } from '@aztec/stdlib/interfaces/server';
 import type { L1ToL2MessageSource } from '@aztec/stdlib/messaging';
-import type { BlockProposalOptions } from '@aztec/stdlib/p2p';
-import { orderAttestations } from '@aztec/stdlib/p2p';
-import { CheckpointHeader } from '@aztec/stdlib/rollup';
+import type { CoordinationSignatureContext } from '@aztec/stdlib/p2p';
 import { pickFromSchema } from '@aztec/stdlib/schemas';
-import type { L2BlockBuiltStats } from '@aztec/stdlib/stats';
-import { MerkleTreeId } from '@aztec/stdlib/trees';
-import { ContentCommitment, type FailedTx, GlobalVariables, Tx } from '@aztec/stdlib/tx';
-import { AttestationTimeoutError } from '@aztec/stdlib/validators';
+import { ProposerTimetable, buildProposerTimetable } from '@aztec/stdlib/timetable';
 import { Attributes, type TelemetryClient, type Tracer, getTelemetryClient, trackSpan } from '@aztec/telemetry-client';
-import type { ValidatorClient } from '@aztec/validator-client';
+import { FullNodeCheckpointsBuilder, NodeKeystoreAdapter, type ValidatorClient } from '@aztec/validator-client';
 
 import EventEmitter from 'node:events';
-import type { TypedDataDefinition } from 'viem';
 
+import { DefaultSequencerConfig } from '../config.js';
 import type { GlobalVariableBuilder } from '../global_variable_builder/global_builder.js';
 import type { SequencerPublisherFactory } from '../publisher/sequencer-publisher-factory.js';
-import type { Action, InvalidateBlockRequest, SequencerPublisher } from '../publisher/sequencer-publisher.js';
-import type { SequencerConfig } from './config.js';
-import { SequencerInterruptedError, SequencerTooSlowError } from './errors.js';
+import type { InvalidateCheckpointRequest, SequencerPublisher } from '../publisher/sequencer-publisher.js';
+import { CheckpointProposalJob } from './checkpoint_proposal_job.js';
+import { CheckpointProposalJobMetrics } from './checkpoint_proposal_job_metrics.js';
+import { CheckpointVoter } from './checkpoint_voter.js';
+import { SequencerInterruptedError } from './errors.js';
+import type { SequencerEvents } from './events.js';
 import { SequencerMetrics } from './metrics.js';
-import { SequencerTimetable } from './timetable.js';
-import { SequencerState, type SequencerStateWithSlot } from './utils.js';
+import { RequestsTracker } from './requests_tracker.js';
+import type { SequencerRollupConstants } from './types.js';
+import { SequencerState } from './utils.js';
 
 export { SequencerState };
 
-type SequencerRollupConstants = Pick<L1RollupConstants, 'ethereumSlotDuration' | 'l1GenesisTime' | 'slotDuration'>;
-
-export type SequencerEvents = {
-  ['state-changed']: (args: {
-    oldState: SequencerState;
-    newState: SequencerState;
-    secondsIntoSlot?: number;
-    slotNumber?: SlotNumber;
-  }) => void;
-  ['proposer-rollup-check-failed']: (args: { reason: string }) => void;
-  ['tx-count-check-failed']: (args: { minTxs: number; availableTxs: number }) => void;
-  ['block-build-failed']: (args: { reason: string }) => void;
-  ['block-publish-failed']: (args: {
-    successfulActions?: Action[];
-    failedActions?: Action[];
-    sentActions?: Action[];
-    expiredActions?: Action[];
-  }) => void;
-  ['block-published']: (args: { blockNumber: BlockNumber; slot: number }) => void;
+/** Slot snapshot used to prepare a checkpoint proposal. */
+type SequencerSlotContext = {
+  slot: SlotNumber;
+  targetSlot: SlotNumber;
+  epoch: EpochNumber;
+  targetEpoch: EpochNumber;
+  ts: bigint;
+  nowSeconds: bigint;
 };
 
 /**
  * Sequencer client
- * - Wins a period of time to become the sequencer (depending on finalized protocol).
- * - Chooses a set of txs from the tx pool to be in the rollup.
- * - Simulate the rollup of txs.
- * - Adds proof requests to the request pool (not for this milestone).
- * - Receives results to those proofs from the network (repeats as necessary) (not for this milestone).
- * - Publishes L1 tx(s) to the rollup contract via RollupPublisher.
+ * - Checks whether it is elected as proposer for the next slot
+ * - Builds multiple blocks and broadcasts them
+ * - Collects attestations for the checkpoint
+ * - Publishes the checkpoint to L1
+ * - Votes for proposals and slashes on L1
  */
 export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<SequencerEvents>) {
-  private runningPromise?: RunningPromise;
-  private pollingIntervalMs: number = 1000;
-  private maxTxsPerBlock = 32;
-  private minTxsPerBlock = 1;
-  private maxL1TxInclusionTimeIntoSlot = 0;
+  protected runningPromise?: RunningPromise;
   private state = SequencerState.STOPPED;
-  private maxBlockSizeInBytes: number = 1024 * 1024;
-  private maxBlockGas: Gas = new Gas(100e9, 100e9);
+  private stateSlotNumber: SlotNumber | undefined;
+  /** Wall-clock time (ms, via the date provider) at which the current state was entered. */
+  private stateEnteredAtMs: number;
   private metrics: SequencerMetrics;
+  private checkpointProposalJobMetrics: CheckpointProposalJobMetrics;
+  private readonly stateLog: Logger;
+
+  /** The last slot for which we attempted to perform our fallback duties (votes and/or prune) with degraded block production */
+  private lastSlotForFallbackAction: SlotNumber | undefined;
+
+  /** The (checkpoint, slot) of the last invalidation request we successfully simulated, to prevent
+   * re-simulating and re-submitting the same invalidation across the many ticks within a single slot. */
+  private lastInvalidationAttempt: { slot: SlotNumber; checkpointNumber: CheckpointNumber } | undefined;
+
+  /** The last slot for which we logged "no committee" warning, to avoid spam */
+  private lastSlotForNoCommitteeWarning: SlotNumber | undefined;
+
+  /** The last slot for which we triggered a checkpoint proposal job, to prevent duplicate attempts. */
+  protected lastSlotForCheckpointProposalJob: SlotNumber | undefined;
 
-  private lastBlockPublished: L2Block | undefined;
+  /** Last successful checkpoint proposed */
+  private lastCheckpointProposed: Checkpoint | undefined;
 
-  private governanceProposerPayload: EthAddress | undefined;
+  /** The last epoch for which we logged strategy comparison in fisherman mode. */
+  private lastEpochForStrategyComparison: EpochNumber | undefined;
 
-  /** The last slot for which we attempted to vote when sync failed, to prevent duplicate attempts. */
-  private lastSlotForVoteWhenSyncFailed: SlotNumber | undefined;
+  /** The last checkpoint proposal job, tracked so we can await its pending L1 submission during shutdown. */
+  protected lastCheckpointProposalJob: CheckpointProposalJob | undefined;
 
-  /** The last slot for which we built a validation block in fisherman mode, to prevent duplicate attempts. */
-  private lastSlotForValidationBlock: SlotNumber | undefined;
+  /**
+   * In-flight fire-and-forget requests that {@link stop} interrupts and drains, and {@link pause} awaits
+   * untouched: the checkpoint proposal jobs' backgrounded L1 submissions (each job is handed this shared
+   * tracker) plus the sequencer's own fallback submissions (votes/prune when we cannot build, or
+   * escape-hatch votes). Each fallback send is gated by its wrapper publisher's interruptible target-slot
+   * sleep; the tracked interrupt wakes that sleep so the send short-circuits without publishing. A wrapper
+   * is created for a single send and is never restarted, so once interrupted its sleeper can never publish
+   * a stale-slot tx, even after the pooled publishers are restarted by a later {@link start}.
+   */
+  protected readonly pendingRequests = new RequestsTracker();
 
-  /** The maximum number of seconds that the sequencer can be into a slot to transition to a particular state. */
-  protected timetable!: SequencerTimetable;
-  protected enforceTimeTable: boolean = false;
+  /** Proposer schedule and block sub-slot timetable for the sequencer, rebuilt on every config update. */
+  protected timetable!: ProposerTimetable;
 
-  // This shouldn't be here as this gets re-created each time we build/propose a block.
-  // But we have a number of tests that abuse/rely on this class having a permanent publisher.
-  // As long as those tests only configure a single publisher they will continue to work.
-  // This will get re-assigned every time the sequencer goes to build a new block to a publisher that is valid
-  // for the block proposer.
-  protected publisher: SequencerPublisher | undefined;
+  /** Config for the sequencer */
+  protected config: ResolvedSequencerConfig = DefaultSequencerConfig;
+  private readonly signatureContext: CoordinationSignatureContext;
 
   constructor(
     protected publisherFactory: SequencerPublisherFactory,
-    protected validatorClient: ValidatorClient | undefined, // During migration the validator client can be inactive
+    protected validatorClient: ValidatorClient,
     protected globalsBuilder: GlobalVariableBuilder,
     protected p2pClient: P2P,
     protected worldState: WorldStateSynchronizer,
     protected slasherClient: SlasherClientInterface | undefined,
-    protected l2BlockSource: L2BlockSource,
+    protected l2BlockSource: L2BlockSource & L2BlockSink & ProposedCheckpointSink,
     protected l1ToL2MessageSource: L1ToL2MessageSource,
-    protected blockBuilder: IFullNodeBlockBuilder,
+    protected checkpointsBuilder: FullNodeCheckpointsBuilder,
     protected l1Constants: SequencerRollupConstants,
     protected dateProvider: DateProvider,
     protected epochCache: EpochCache,
     protected rollupContract: RollupContract,
-    protected config: SequencerConfig,
+    config: SequencerConfig & Pick<ChainConfig, 'l1ChainId' | 'rollupAddress'>,
     protected telemetry: TelemetryClient = getTelemetryClient(),
     protected log = createLogger('sequencer'),
   ) {
     super();
+    this.stateLog = log.createChild('state');
+    this.stateEnteredAtMs = this.dateProvider.now();
 
     // Add [FISHERMAN] prefix to logger if in fisherman mode
-    if (this.config.fishermanMode) {
+    if (config.fishermanMode) {
       this.log = log.createChild('[FISHERMAN]');
     }
 
+    this.signatureContext = {
+      chainId: config.l1ChainId,
+      rollupAddress: config.rollupAddress,
+    };
     this.metrics = new SequencerMetrics(telemetry, this.rollupContract, 'Sequencer');
-    // Initialize config
-    this.updateConfig(this.config);
+    this.checkpointProposalJobMetrics = new CheckpointProposalJobMetrics(telemetry);
+    this.updateConfig(config);
   }
 
-  get tracer(): Tracer {
-    return this.metrics.tracer;
+  /**
+   * Updates sequencer config by the defined values and rebuilds the timetable.
+   *
+   * The merged config is validated against a candidate before being committed: {@link buildTimetable} may
+   * reject the candidate (invalid timing geometry, or per-block allocation multipliers below the network
+   * minimums). On rejection we leave `this.config` and `this.timetable` untouched and rethrow, so a bad update
+   * never leaves the sequencer running with a rejected config and a stale timetable.
+   */
+  public updateConfig(config: Partial<SequencerConfig>) {
+    const filteredConfig = pickFromSchema(config, SequencerConfigSchema);
+    const candidate = merge(this.config, filteredConfig);
+    let timetable: ProposerTimetable;
+    try {
+      timetable = this.buildTimetable(candidate);
+    } catch (err) {
+      this.log.warn(`Rejecting sequencer config update: ${(err as Error).message}`, {
+        rejectedConfig: omit(filteredConfig, 'txPublicSetupAllowListExtend'),
+      });
+      throw err;
+    }
+    this.config = candidate;
+    this.timetable = timetable;
+    this.log.info(`Updated sequencer config`, omit(filteredConfig, 'txPublicSetupAllowListExtend'));
   }
 
-  public getValidatorAddresses() {
-    return this.validatorClient?.getValidatorAddresses();
-  }
+  /**
+   * Builds the proposer timetable from the given config and L1 constants via the shared
+   * {@link buildProposerTimetable} helper, so the sequencer derives the same blocks-per-checkpoint as the p2p
+   * layer and `getNodeInfo`. The fast local/e2e profile and budget clamping happen inside
+   * {@link ProposerTimetable}.
+   *
+   * Throws if the timing geometry is invalid or the per-block allocation multipliers are below the network
+   * minimums; callers must treat a throw as a rejected config and not commit it.
+   */
+  private buildTimetable(config: ResolvedSequencerConfig): ProposerTimetable {
+    const timetable = buildProposerTimetable(config, this.l1Constants);
+
+    const maxNumberOfBlocks = timetable.getMaxBlocksPerCheckpoint();
+    this.log.info(`Sequencer timetable initialized with ${maxNumberOfBlocks} blocks per slot`, {
+      aztecSlotDuration: timetable.aztecSlotDuration,
+      ethereumSlotDuration: timetable.ethereumSlotDuration,
+      blockDuration: timetable.blockDuration,
+      minBlockDuration: timetable.minBlockDuration,
+      p2pPropagationTime: timetable.p2pPropagationTime,
+      checkpointProposalPrepareTime: timetable.checkpointProposalPrepareTime,
+      maxNumberOfBlocks,
+    });
 
-  public getConfig() {
-    return this.config;
+    this.assertConfigMeetsNetworkTxLimits(config, maxNumberOfBlocks);
+
+    return timetable;
   }
 
   /**
-   * Updates sequencer config by the defined values in the config on input.
-   * @param config - New parameters.
+   * Checks this node's configured per-block allocation against the network admission limit. A node
+   * advertises and admits txs up to the limit derived from the network-minimum multipliers (see
+   * {@link computeNetworkTxGasLimits}).
+   *
+   * Fails startup (and runtime config updates) only when the configured per-block allocation *multipliers*
+   * (`perBlockAllocationMultiplier` / `perBlockDAAllocationMultiplier`) are below the network minimums: such
+   * a node would accept txs over RPC/gossip that its builder can never pack into a block regardless of block
+   * size. Operators may configure a higher (more generous) multiplier, but not a lower one.
+   *
+   * When the multipliers meet the floor but an absolute per-block gas cap (`maxDABlockGas` / `maxL2BlockGas`)
+   * shrinks the builder's effective grant below the network limit, this is legitimate operator
+   * restrictiveness — the node simply builds smaller blocks and such txs stay in the pool for other
+   * proposers — so we only log a warning rather than failing startup. Restrictive tx-count caps
+   * (`maxTxsPerBlock` / `maxTxsPerCheckpoint`) can likewise make the builder skip admitted txs; they are
+   * intentionally not modeled here for the same reason.
    */
-  public updateConfig(config: SequencerConfig) {
-    this.log.info(
-      `Sequencer config set`,
-      omit(pickFromSchema(config, SequencerConfigSchema), 'txPublicSetupAllowList'),
-    );
-
-    if (config.transactionPollingIntervalMS !== undefined) {
-      this.pollingIntervalMs = config.transactionPollingIntervalMS;
-    }
-    if (config.maxTxsPerBlock !== undefined) {
-      this.maxTxsPerBlock = config.maxTxsPerBlock;
-    }
-    if (config.minTxsPerBlock !== undefined) {
-      this.minTxsPerBlock = config.minTxsPerBlock;
-    }
-    if (config.maxDABlockGas !== undefined) {
-      this.maxBlockGas = new Gas(config.maxDABlockGas, this.maxBlockGas.l2Gas);
-    }
-    if (config.maxL2BlockGas !== undefined) {
-      this.maxBlockGas = new Gas(this.maxBlockGas.daGas, config.maxL2BlockGas);
-    }
-    if (config.maxBlockSizeInBytes !== undefined) {
-      this.maxBlockSizeInBytes = config.maxBlockSizeInBytes;
+  private assertConfigMeetsNetworkTxLimits(config: ResolvedSequencerConfig, maxBlocksPerCheckpoint: number) {
+    // Mirror CheckpointBuilder.capLimitsByCheckpointBudgets: DA falls back to the general multiplier.
+    const l2Multiplier = config.perBlockAllocationMultiplier;
+    const daMultiplier = config.perBlockDAAllocationMultiplier ?? l2Multiplier;
+
+    // The allocation is monotonic in the multiplier, so a multiplier at or above the network minimum
+    // guarantees the builder grants at least the network admission limit. Checking the multipliers directly
+    // is sufficient (and strictly more conservative than modeling the resulting gas grant).
+    if (daMultiplier < MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER) {
+      throw new Error(
+        `perBlockDAAllocationMultiplier (${daMultiplier}) is below the network minimum ` +
+          `${MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`,
+      );
     }
-    if (config.governanceProposerPayload) {
-      this.governanceProposerPayload = config.governanceProposerPayload;
+    if (l2Multiplier < MIN_PER_BLOCK_ALLOCATION_MULTIPLIER) {
+      throw new Error(
+        `perBlockAllocationMultiplier (${l2Multiplier}) is below the network minimum ` +
+          `${MIN_PER_BLOCK_ALLOCATION_MULTIPLIER}; the node would admit txs its own builder can never include.`,
+      );
     }
-    if (config.maxL1TxInclusionTimeIntoSlot !== undefined) {
-      this.maxL1TxInclusionTimeIntoSlot = config.maxL1TxInclusionTimeIntoSlot;
+
+    // Absolute per-block gas caps below the network admission limit are legitimate operator restrictiveness:
+    // the node simply builds smaller blocks and such txs stay in the pool for other proposers. Warn only.
+    const networkLimit = computeNetworkTxGasLimits({
+      maxBlocksPerCheckpoint,
+      manaCheckpointBudget: this.l1Constants.rollupManaLimit,
+    });
+    if (config.maxDABlockGas !== undefined && config.maxDABlockGas < networkLimit.daGas) {
+      this.log.warn(
+        `Sequencer maxDABlockGas (${config.maxDABlockGas}) is below the network DA admission limit ` +
+          `(${networkLimit.daGas}): txs declaring more DA gas are admitted over RPC/gossip but will be skipped ` +
+          `by this proposer's own blocks and left in the pool for other proposers.`,
+        { maxDABlockGas: config.maxDABlockGas, networkDaGas: networkLimit.daGas, maxBlocksPerCheckpoint },
+      );
     }
-    if (config.enforceTimeTable !== undefined) {
-      this.enforceTimeTable = config.enforceTimeTable;
+    if (config.maxL2BlockGas !== undefined && config.maxL2BlockGas < networkLimit.l2Gas) {
+      this.log.warn(
+        `Sequencer maxL2BlockGas (${config.maxL2BlockGas}) is below the network L2 admission limit ` +
+          `(${networkLimit.l2Gas}): txs declaring more L2 gas are admitted over RPC/gossip but will be skipped ` +
+          `by this proposer's own blocks and left in the pool for other proposers.`,
+        { maxL2BlockGas: config.maxL2BlockGas, networkL2Gas: networkLimit.l2Gas, maxBlocksPerCheckpoint },
+      );
     }
-
-    this.setTimeTable();
-
-    // TODO: Just read everything from the config object as needed instead of copying everything into local vars.
-
-    // Update all values on this.config that are populated in the config object.
-    Object.assign(this.config, config);
   }
 
-  private setTimeTable() {
-    this.timetable = new SequencerTimetable(
-      {
-        ethereumSlotDuration: this.l1Constants.ethereumSlotDuration,
-        aztecSlotDuration: this.aztecSlotDuration,
-        maxL1TxInclusionTimeIntoSlot: this.maxL1TxInclusionTimeIntoSlot,
-        attestationPropagationTime: this.config.attestationPropagationTime,
-        enforce: this.enforceTimeTable,
-      },
-      this.metrics,
-      this.log,
-    );
-  }
-
-  public async init() {
-    this.publisher = (await this.publisherFactory.create(undefined)).publisher;
+  /** Initializes the sequencer (precomputes tables). Takes about 3s. */
+  public init() {
+    getKzg();
   }
 
   /**
-   * Starts the sequencer and moves to IDLE state.
+   * Starts (or restarts) the sequencer and moves it to the IDLE state. Idempotent: a start while already
+   * running is a no-op, so it never orphans the previous poll loop. A start while STOPPING throws, since the
+   * in-flight stop would mark the fresh loop's state STOPPED and orphan it — silently doing nothing would
+   * leave the caller believing the sequencer is running when it is on its way to STOPPED. Safe to call after
+   * a previous {@link stop} has resolved; the caller must also restart the publishers (see
+   * {@link SequencerClient.start}) so L1 publishing is re-enabled.
    */
   public start() {
-    this.runningPromise = new RunningPromise(this.safeWork.bind(this), this.log, this.pollingIntervalMs);
+    if (this.state === SequencerState.STOPPING) {
+      throw new Error('Cannot start sequencer while it is stopping');
+    }
+    if (this.runningPromise?.isRunning()) {
+      this.log.warn('Attempted to start sequencer that is already running');
+      return;
+    }
+    this.runningPromise = new RunningPromise(
+      this.safeWork.bind(this),
+      this.log,
+      this.config.sequencerPollingIntervalMS,
+    );
     this.setState(SequencerState.IDLE, undefined, { force: true });
     this.runningPromise.start();
     this.log.info('Started sequencer');
   }
 
+  /** Triggers an immediate run of the sequencer, bypassing the polling interval. */
+  public trigger() {
+    return this.runningPromise?.trigger();
+  }
+
   /**
-   * Stops the sequencer from processing txs and moves to STOPPED state.
+   * Stops the sequencer from building blocks and moves it to STOPPED state, interrupting the in-flight
+   * work() iteration and its pending L1 submissions for a fast shutdown, then draining before returning.
+   * Idempotent: a second call while already stopped or stopping is a no-op. Lifecycle calls are expected
+   * to be serialized by the caller. For a restartable pause that lets in-flight work finish untouched
+   * (e.g. around a test clock warp), use {@link pause} instead.
    */
   public async stop(): Promise<void> {
+    if (this.state === SequencerState.STOPPED || this.state === SequencerState.STOPPING) {
+      this.log.debug(`Sequencer already ${this.state.toLowerCase()}, ignoring stop`);
+      return;
+    }
     this.log.info(`Stopping sequencer`);
     this.setState(SequencerState.STOPPING, undefined, { force: true });
-    this.publisher?.interrupt();
+    this.lastCheckpointProposalJob?.interrupt();
+    await this.publisherFactory.stopAll();
+    // Stop the poll loop and await the in-flight work() iteration. work() registers its fire-and-forget
+    // requests synchronously before returning, so once the loop has stopped, pendingRequests holds every
+    // request that will ever exist. Interrupting any earlier could miss a request registered by the last
+    // in-flight iteration.
     await this.runningPromise?.stop();
+    this.pendingRequests.interruptRequests();
+    await this.pendingRequests.awaitRequests();
     this.setState(SequencerState.STOPPED, undefined, { force: true });
     this.log.info('Stopped sequencer');
   }
 
   /**
-   * Returns the current state of the sequencer.
-   * @returns An object with a state entry with one of SequencerState.
+   * Gracefully pauses block production so the sequencer can later be resumed with {@link start}: halts the
+   * poll loop and waits for the in-flight work() iteration and every pending L1 submission / fallback send
+   * to finish, without interrupting them. No interrupt lands mid-build, so no spurious checkpoint-error is
+   * emitted and no enqueued checkpoint is dropped. Deliberately does not stop inner services (validator/HA
+   * signer, publishers), so the slashing-protection store stays open and the sequencer stays restartable.
+   * Used by tests that pause sequencers around an L1 clock warp. Idempotent.
    */
+  public async pause(): Promise<void> {
+    if (!this.runningPromise?.isRunning()) {
+      this.log.debug('Sequencer not running, ignoring pause');
+      return;
+    }
+    this.log.info('Pausing sequencer');
+    // Halt the poll loop and let the in-flight iteration finish naturally — no interrupt, and no STOPPING
+    // state, since entering STOPPING would make the iteration's own setState calls throw and fail it.
+    // work() registers its fire-and-forget requests synchronously before returning, so once the loop has
+    // stopped pendingRequests holds every request that will ever exist; awaiting it lets them all finish.
+    await this.runningPromise.stop();
+    await this.pendingRequests.awaitRequests();
+    this.log.info('Paused sequencer');
+  }
+
+  /** Main sequencer loop with a try/catch */
+  protected async safeWork() {
+    try {
+      await this.work();
+    } catch (err) {
+      this.emit('checkpoint-error', { error: err as Error });
+      throw err;
+    } finally {
+      this.setState(SequencerState.IDLE, undefined);
+    }
+  }
+
+  /** Returns the current state of the sequencer. */
   public status() {
     return { state: this.state };
   }
 
   /**
-   * @notice  Performs most of the sequencer duties:
-   *          - Checks if we are up to date
-   *          - If we are and we are the sequencer, collect txs and build a block
-   *          - Collect attestations for the block
-   *          - Submit block
-   *          - If our block for some reason is not included, revert the state
+   * Main sequencer loop:
+   * - Checks if we are up to date
+   * - If we are and we are the sequencer, collect txs and build blocks
+   * - Build multiple blocks per slot when configured
+   * - Collect attestations for the final block
+   * - Submit checkpoint
    */
+  @trackSpan('Sequencer.work')
   protected async work() {
     this.setState(SequencerState.SYNCHRONIZING, undefined);
-    const { slot, ts, now } = this.epochCache.getEpochAndSlotInNextL1Slot();
+    const { slot, targetSlot, epoch, targetEpoch, ts, nowSeconds } = this.getSlotContextInNextL1Slot();
 
-    // Check we have not already published a block for this slot (cheapest check)
-    if (this.lastBlockPublished && this.lastBlockPublished.header.getSlot() >= slot) {
-      this.log.debug(
-        `Cannot propose block at next L2 slot ${slot} since that slot was taken by our own block ${this.lastBlockPublished.number}`,
-      );
+    // Check if we are synced and it's our slot, grab a publisher, check previous block invalidation, etc
+    const checkpointProposalJob = await this.prepareCheckpointProposal(
+      slot,
+      targetSlot,
+      epoch,
+      targetEpoch,
+      ts,
+      nowSeconds,
+    );
+    if (!checkpointProposalJob) {
       return;
     }
 
-    // Check all components are synced to latest as seen by the archiver (queries all subsystems)
+    // Track the job so we can await its pending L1 submission during shutdown
+    this.lastCheckpointProposalJob = checkpointProposalJob;
+
+    // Execute the checkpoint proposal job
+    const checkpoint = await checkpointProposalJob.execute();
+
+    // Update last checkpoint proposed (currently unused)
+    if (checkpoint) {
+      this.lastCheckpointProposed = checkpoint;
+    }
+
+    // Log fee strategy comparison if on fisherman (uses target epoch since we mirror the proposer's perspective)
+    if (
+      this.config.fishermanMode &&
+      (this.lastEpochForStrategyComparison === undefined || targetEpoch > this.lastEpochForStrategyComparison)
+    ) {
+      this.logStrategyComparison(targetEpoch, checkpointProposalJob.getPublisher());
+      this.lastEpochForStrategyComparison = targetEpoch;
+    }
+
+    return checkpoint;
+  }
+
+  /** Returns slot and target slot from a single clock snapshot. */
+  protected getSlotContextInNextL1Slot(): SequencerSlotContext {
+    const { slot, ts, nowSeconds, epoch } = this.epochCache.getEpochAndSlotInNextL1Slot();
+    const targetSlot = SlotNumber(slot + PROPOSER_PIPELINING_SLOT_OFFSET);
+    return { slot, targetSlot, epoch, targetEpoch: getEpochAtSlot(targetSlot, this.l1Constants), ts, nowSeconds };
+  }
+
+  /**
+   * Prepares the checkpoint proposal by performing all necessary checks and setup.
+   * This is the initial step in the main loop.
+   * @returns CheckpointProposalJob if successful, undefined if we are not yet synced or are not the proposer.
+   */
+  @trackSpan('Sequencer.prepareCheckpointProposal')
+  protected async prepareCheckpointProposal(
+    slot: SlotNumber,
+    targetSlot: SlotNumber,
+    epoch: EpochNumber,
+    targetEpoch: EpochNumber,
+    ts: bigint,
+    nowSeconds: bigint,
+  ): Promise<CheckpointProposalJob | undefined> {
+    // Check we have not already processed this target slot (cheapest check).
+    if (this.lastSlotForCheckpointProposalJob && this.lastSlotForCheckpointProposalJob >= targetSlot) {
+      this.log.trace(`Target slot ${targetSlot} has already been processed`);
+      return undefined;
+    }
+
+    // But if we have already proposed for this slot, then we definitely have to skip it, automining or not
+    if (this.lastCheckpointProposed && this.lastCheckpointProposed.header.slotNumber >= targetSlot) {
+      this.log.trace(
+        `Slot ${targetSlot} has already been published as checkpoint ${this.lastCheckpointProposed.number}`,
+      );
+      return undefined;
+    }
+
+    // Test-only: skip proposing for explicitly paused slots. Attestation paths run in the validator
+    // client and are not gated by this hook, so paused proposers still attest to others' proposals.
+    if (this.config.pauseProposingForSlots?.some(s => s === targetSlot)) {
+      this.log.warn(`Skipping proposal for paused slot ${targetSlot} (test-only pauseProposingForSlots hook)`, {
+        targetSlot,
+      });
+      return undefined;
+    }
+
+    // Cheap proposer check first: most nodes are not the proposer for most slots, so gate the
+    // expensive multi-subsystem checkSync (and the rest of the build path) behind it. Computed once
+    // here and reused for the escape-hatch voting path below. No setState/timing gate on this path:
+    // the build-start deadline gate runs only on the proposer build path after a successful checkSync.
+    const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
+
+    // If escape hatch is open for the target epoch, do not start checkpoint proposal work and do not attempt invalidations.
+    // Still perform governance/slashing voting (as proposer) once per slot.
+    // When pipelining, we check the target epoch (slot+1's epoch) since that's the epoch we're building for.
+    const isEscapeHatchOpen = await this.epochCache.isEscapeHatchOpen(targetEpoch);
+
+    if (isEscapeHatchOpen) {
+      if (canPropose) {
+        await this.tryVoteWhenEscapeHatchOpen({ slot, targetSlot, proposer });
+      } else {
+        this.log.trace(`Escape hatch open but we are not proposer, skipping vote-only actions`, {
+          slot,
+          epoch,
+          proposer,
+        });
+      }
+      return undefined;
+    }
+
+    // If we are not the proposer, check whether we should invalidate an invalid pending chain (a
+    // liveness backstop) and bail before any sync work or build-timing gate. This reads only the
+    // archiver's pending-chain validation status, which is authoritative on its own, instead of
+    // running the full sync check. Wrapped in try/catch because this leaner path skips the broader
+    // proposed-checkpoint/tip coherence screen that checkSync applied, so transient archiver
+    // incoherence surfaces as a quiet skip rather than a work-loop error.
+    if (!canPropose) {
+      try {
+        const pendingChainValidationStatus = await this.l2BlockSource.getPendingChainValidationStatus();
+        await this.considerInvalidatingCheckpoint(pendingChainValidationStatus, slot);
+      } catch (err) {
+        this.log.warn(`Failed to consider invalidating checkpoint`, { err, slot, targetSlot });
+      }
+      return undefined;
+    }
+
+    // Explicit build-loop entry gate: if we are past the latest useful block-building start for the
+    // target slot, abandon building for this slot. The proposer prioritizes the ideal L1-publish path
+    // and does not plan around the late consensus-handoff path. This is the proposer build path's
+    // timing gate; it runs only after we know we are the synced proposer, so non-proposer invalidation
+    // and escape-hatch voting (which returned above) are never gated by build timing. Vote-only paths
+    // still run when block building is abandoned.
+    const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
+    const nowForStartGate = this.dateProvider.now() / 1000;
+    if (nowForStartGate > startDeadline) {
+      this.log.debug(`Past start deadline for slot ${targetSlot}, abandoning block building`, {
+        targetSlot,
+        nowForStartGate,
+        startDeadline,
+      });
+      // Mark the slot as attempted so a deadline abort is not retried within the same slot. Vote-only actions
+      // still need to run because sync can succeed even when it is too late to start building a checkpoint.
+      await this.tryVoteAndPruneWhenCannotBuild({ slot, targetSlot });
+      this.lastSlotForCheckpointProposalJob = targetSlot;
+      return undefined;
+    }
+
+    // We are the proposer, the escape hatch is closed, and we have time before the build start deadline.
+    // Now run the full sync check before building.
     const syncedTo = await this.checkSync({ ts, slot });
     if (!syncedTo) {
-      await this.tryVoteWhenSyncFails({ slot, ts });
-      return;
+      return undefined;
     }
 
-    const chainTipArchive = syncedTo.archive;
-    const newBlockNumber = BlockNumber(syncedTo.blockNumber + 1);
-
-    const syncLogData = {
-      now,
-      syncedToL1Ts: syncedTo.l1Timestamp,
-      syncedToL2Slot: getSlotAtTimestamp(syncedTo.l1Timestamp, this.l1Constants),
-      nextL2Slot: slot,
-      nextL2SlotTs: ts,
-      l1SlotDuration: this.l1Constants.ethereumSlotDuration,
-      newBlockNumber,
+    // Next checkpoint follows from the last synced one
+    const checkpointNumber = CheckpointNumber(syncedTo.checkpointNumber + 1);
+
+    const logCtx = {
+      nowSeconds,
+      syncedToL2Slot: syncedTo.syncedL2Slot,
+      slot,
+      targetSlot,
+      slotTs: ts,
+      checkpointNumber,
       isPendingChainValid: pick(syncedTo.pendingChainValidationStatus, 'valid', 'reason', 'invalidIndex'),
     };
 
-    // Check that we are a proposer for the next slot
-    this.setState(SequencerState.PROPOSER_CHECK, slot);
-    const [canPropose, proposer] = await this.checkCanPropose(slot);
-
-    // If we are not a proposer check if we should invalidate a invalid block, and bail
-    if (!canPropose) {
-      await this.considerInvalidatingBlock(syncedTo, slot);
-      return;
-    }
+    // We are the synced proposer within the build window; enter the proposer-check state and build.
+    this.setState(SequencerState.PROPOSER_CHECK, targetSlot);
 
-    // In fisherman mode, check if we've already validated this slot to prevent duplicate attempts
-    if (this.config.fishermanMode) {
-      if (this.lastSlotForValidationBlock === slot) {
-        this.log.trace(`Already validated block building for slot ${slot} (skipping)`, { slot });
-        return;
-      }
-      this.log.debug(
-        `Building validation block for slot ${slot} (actual proposer: ${proposer?.toString() ?? 'none'})`,
-        { slot, proposer: proposer?.toString() },
+    // Guard: don't exceed 1-deep pipeline. Without a proposed checkpoint, we can only build
+    // confirmed + 1. With a proposed checkpoint, we can build confirmed + 2.
+    const confirmedCkpt = syncedTo.checkpointedCheckpointNumber;
+    if (checkpointNumber > confirmedCkpt + 2) {
+      this.log.verbose(
+        `Skipping slot ${targetSlot}: checkpoint ${checkpointNumber} exceeds max pipeline depth (confirmed=${confirmedCkpt})`,
       );
-      // Mark this slot as being validated
-      this.lastSlotForValidationBlock = slot;
+      return undefined;
     }
 
-    // Check that the slot is not taken by a block already (should never happen, since only us can propose for this slot)
-    if (syncedTo.block && syncedTo.block.header.getSlot() >= slot) {
+    // Check that the target slot is not taken by a block already (should never happen, since only us can propose for this slot)
+    if (syncedTo.blockData && syncedTo.blockData.header.getSlot() >= targetSlot) {
       this.log.warn(
-        `Cannot propose block at next L2 slot ${slot} since that slot was taken by block ${syncedTo.blockNumber}`,
-        { ...syncLogData, block: syncedTo.block.header.toInspect() },
+        `Cannot propose block at target slot ${targetSlot} since that slot was taken by block ${syncedTo.blockNumber}`,
+        { ...logCtx, block: syncedTo.blockData.header.toInspect() },
       );
-      this.metrics.recordBlockProposalPrecheckFailed('slot_already_taken');
-      return;
+      this.metrics.recordCheckpointPrecheckFailed('slot_already_taken');
+      return undefined;
     }
 
     // We now need to get ourselves a publisher.
     // The returned attestor will be the one we provided if we provided one.
     // Otherwise it will be a valid attestor for the returned publisher.
     // In fisherman mode, pass undefined to use the fisherman's own keystore instead of the actual proposer's
-    const { attestorAddress, publisher } = await this.publisherFactory.create(
-      this.config.fishermanMode ? undefined : proposer,
-    );
+    const proposerForPublisher = this.config.fishermanMode ? undefined : proposer;
+    const { attestorAddress, publisher } = await this.publisherFactory.create(proposerForPublisher);
     this.log.verbose(`Created publisher at address ${publisher.getSenderAddress()} for attestor ${attestorAddress}`);
-    this.publisher = publisher;
 
-    // In fisherman mode, set the actual proposer's address for simulations
-    if (this.config.fishermanMode) {
-      if (proposer) {
-        publisher.setProposerAddressForSimulation(proposer);
-        this.log.debug(`Set proposer address ${proposer} for simulation in fisherman mode`);
-      }
+    // Prepare invalidation request if the pending chain is invalid (returns undefined if no need).
+    // Only simulate invalidation when there's no proposed parent, since we assume the proposed parent
+    // will invalidate the currently invalid checkpoint on L1.
+    const invalidateCheckpoint =
+      syncedTo.hasProposedCheckpoint || syncedTo.pendingChainValidationStatus.valid
+        ? undefined
+        : await publisher.simulateInvalidateCheckpoint(syncedTo.pendingChainValidationStatus);
+
+    // Determine the correct archive and L1 state overrides for the canProposeAt check.
+    // The L1 contract reads archives[proposedCheckpointNumber] and compares it with the provided archive.
+    // When invalidating or pipelining, the local archive may differ from L1's, so we adjust accordingly.
+    let archiveForCheck = syncedTo.archive;
+
+    if (syncedTo.hasProposedCheckpoint) {
+      this.metrics.recordPipelineDepth(syncedTo.checkpointNumber - syncedTo.checkpointedCheckpointNumber);
+      this.log.verbose(
+        `Building on top of proposed checkpoint (pending=${syncedTo.proposedCheckpointData?.checkpointNumber}) for target slot ${targetSlot}`,
+        { targetSlot, parentCheckpointNumber: CheckpointNumber(checkpointNumber - 1) },
+      );
+      // Match what L1 will see at archives[pending] once the proposed parent lands: the parent's
+      // own archive root from the gossiped proposal. `syncedTo.archive` is the world-state-local
+      // view and can transiently diverge from the proposed parent (e.g. before the proposed
+      // parent's blocks have been applied locally); diverging here would cause the canProposeAt
+      // override to set archives[pending] to one value while we present another for comparison.
+      archiveForCheck = syncedTo.proposedCheckpointData!.archive.root;
+    } else if (invalidateCheckpoint) {
+      // After invalidation, L1 will roll back to checkpoint N-1. The archive at N-1 already
+      // exists on L1, so we just pass the matching archive (the lastArchive of the invalid checkpoint).
+      archiveForCheck = invalidateCheckpoint.lastArchive;
+      this.metrics.recordPipelineDepth(0);
+    } else {
+      this.metrics.recordPipelineDepth(0);
     }
 
-    // Get proposer credentials
-    const coinbase = this.validatorClient!.getCoinbaseForAttestor(attestorAddress);
-    const feeRecipient = this.validatorClient!.getFeeRecipientForAttestor(attestorAddress);
+    // Build the simulation plan: pending/proven override from pipelining or invalidation (or the
+    // current snapshot when neither applies, to short-circuit any pending prune in simulation),
+    // plus the parent checkpoint cell and fee header when pipelining.
+    const simulationOverridesPlan = await buildCheckpointSimulationOverridesPlan({
+      checkpointNumber,
+      proposedCheckpointData: syncedTo.hasProposedCheckpoint ? syncedTo.proposedCheckpointData : undefined,
+      invalidateToPendingCheckpointNumber: invalidateCheckpoint?.forcePendingCheckpointNumber,
+      checkpointedCheckpointNumber: syncedTo.checkpointedCheckpointNumber,
+      rollup: this.rollupContract,
+      signatureContext: this.signatureContext,
+      log: this.log,
+    });
 
-    // Prepare invalidation request if the pending chain is invalid (returns undefined if no need)
-    const invalidateBlock = await publisher.simulateInvalidateBlock(syncedTo.pendingChainValidationStatus);
+    // The plan always pins both pending/proven (to short-circuit `canPruneAtTime` in simulation),
+    // so `provenOverride` always reflects the assumed proven checkpoint we are pinning the
+    // simulation to. We additionally warn when the pin is load-bearing — i.e. when a prune would
+    // actually fire at the target slot without it — so observers can spot "we are building
+    // optimistically across a pruning boundary" in the logs.
+    const provenOverride = simulationOverridesPlan?.chainTipsOverride?.proven;
+    if (provenOverride !== undefined && (await this.l2BlockSource.isPruneDueAtSlot(targetSlot))) {
+      this.log.warn(
+        `Assuming proof for epoch ending at checkpoint ${provenOverride} lands by target slot ${targetSlot}`,
+        { checkpointNumber, slot, targetSlot, provenOverride },
+      );
+    }
+
+    this.emit('preparing-checkpoint', {
+      targetSlot,
+      checkpointNumber,
+      hadProposedParent: syncedTo.hasProposedCheckpoint,
+      provenOverride,
+      simulatedPending: simulationOverridesPlan?.chainTipsOverride?.pending,
+    });
 
-    // Check with the rollup if we can indeed propose at the next L2 slot. This check should not fail
-    // if all the previous checks are good, but we do it just in case.
-    const canProposeCheck = await publisher.canProposeAtNextEthBlock(
-      chainTipArchive,
+    const canProposeCheck = await publisher.canProposeAt(
+      archiveForCheck,
       proposer ?? EthAddress.ZERO,
-      invalidateBlock,
+      simulationOverridesPlan,
     );
 
+    const proposeContext = {
+      hasProposedCheckpoint: syncedTo.hasProposedCheckpoint,
+      proposedCheckpointNumber: syncedTo.proposedCheckpointData?.checkpointNumber,
+      checkpointedCheckpointNumber: syncedTo.checkpointedCheckpointNumber,
+      isInvalidating: !!invalidateCheckpoint,
+      invalidatingCheckpointNumber: invalidateCheckpoint?.checkpointNumber,
+      archiveForCheck: archiveForCheck.toString(),
+      overridePendingCheckpointNumber: simulationOverridesPlan?.chainTipsOverride?.pending,
+      overrideArchive: simulationOverridesPlan?.pendingCheckpointState?.archive,
+      overrideFeeHeader: simulationOverridesPlan?.pendingCheckpointState?.feeHeader,
+    };
+
     if (canProposeCheck === undefined) {
       this.log.warn(
-        `Cannot propose block ${newBlockNumber} at slot ${slot} due to failed rollup contract check`,
-        syncLogData,
+        `Cannot propose checkpoint ${checkpointNumber} at slot ${slot} due to failed rollup contract check`,
+        { ...logCtx, ...proposeContext },
       );
-      this.emit('proposer-rollup-check-failed', { reason: 'Rollup contract check failed' });
-      this.metrics.recordBlockProposalPrecheckFailed('rollup_contract_check_failed');
-      return;
-    } else if (canProposeCheck.slot !== slot) {
+      this.emit('proposer-rollup-check-failed', { reason: 'Rollup contract check failed', slot });
+      this.metrics.recordCheckpointPrecheckFailed('rollup_contract_check_failed');
+      return undefined;
+    }
+
+    if (canProposeCheck.slot !== targetSlot) {
       this.log.warn(
-        `Cannot propose block due to slot mismatch with rollup contract (this can be caused by a clock out of sync). Expected slot ${slot} but got ${canProposeCheck.slot}.`,
-        { ...syncLogData, rollup: canProposeCheck, newBlockNumber, expectedSlot: slot },
+        `Cannot propose block due to slot mismatch with rollup contract (this can be caused by a clock out of sync). Expected slot ${targetSlot} but got ${canProposeCheck.slot}.`,
+        { ...logCtx, ...proposeContext, rollup: canProposeCheck, expectedSlot: targetSlot },
       );
-      this.emit('proposer-rollup-check-failed', { reason: 'Slot mismatch' });
-      this.metrics.recordBlockProposalPrecheckFailed('slot_mismatch');
-      return;
-    } else if (canProposeCheck.checkpointNumber !== CheckpointNumber.fromBlockNumber(newBlockNumber)) {
+      this.emit('proposer-rollup-check-failed', { reason: 'Slot mismatch', slot });
+      this.metrics.recordCheckpointPrecheckFailed('slot_mismatch');
+      return undefined;
+    }
+
+    if (canProposeCheck.checkpointNumber !== checkpointNumber) {
       this.log.warn(
-        `Cannot propose block due to block mismatch with rollup contract (this can be caused by a pending archiver sync). Expected block ${newBlockNumber} but got ${canProposeCheck.checkpointNumber}.`,
-        { ...syncLogData, rollup: canProposeCheck, newBlockNumber, expectedSlot: slot },
+        `Cannot propose due to block mismatch with rollup contract (this can be caused by a pending archiver sync). Expected checkpoint ${checkpointNumber} but got ${canProposeCheck.checkpointNumber}.`,
+        { ...logCtx, ...proposeContext, rollup: canProposeCheck, expectedSlot: slot },
       );
-      this.emit('proposer-rollup-check-failed', { reason: 'Block mismatch' });
-      this.metrics.recordBlockProposalPrecheckFailed('block_number_mismatch');
-      return;
+      this.emit('proposer-rollup-check-failed', { reason: 'Block mismatch', slot });
+      this.metrics.recordCheckpointPrecheckFailed('block_number_mismatch');
+      return undefined;
     }
 
-    this.log.debug(`Can propose block ${newBlockNumber} at slot ${slot} as ${proposer}`, { ...syncLogData });
+    this.lastSlotForCheckpointProposalJob = targetSlot;
 
-    const newGlobalVariables = await this.globalsBuilder.buildGlobalVariables(
-      newBlockNumber,
-      coinbase,
-      feeRecipient,
-      slot,
-    );
-
-    // Enqueue governance and slashing votes (returns promises that will be awaited later)
-    // In fisherman mode, we simulate slashing but don't actually publish to L1
-    const votesPromises = this.enqueueGovernanceAndSlashingVotes(
-      publisher,
-      attestorAddress,
-      slot,
-      newGlobalVariables.timestamp,
+    await this.p2pClient.prepareForSlot(targetSlot);
+    this.log.info(
+      `Preparing checkpoint proposal ${checkpointNumber} for target slot ${targetSlot} during wall-clock slot ${slot}`,
+      {
+        ...logCtx,
+        ...proposeContext,
+        proposer,
+      },
     );
 
-    // Enqueues block invalidation
-    if (invalidateBlock && !this.config.skipInvalidateBlockAsProposer) {
-      publisher.enqueueInvalidateBlock(invalidateBlock);
-    }
-
-    // Actual block building
-    this.setState(SequencerState.INITIALIZING_PROPOSAL, slot);
-    this.metrics.incOpenSlot(slot, proposer?.toString() ?? 'unknown');
-    const block: L2Block | undefined = await this.tryBuildBlockAndEnqueuePublish(
-      slot,
+    // Create and return the checkpoint proposal job
+    return this.createCheckpointProposalJob(
+      targetSlot,
+      targetEpoch,
+      checkpointNumber,
+      syncedTo.blockNumber,
+      syncedTo.checkpointedCheckpointNumber,
       proposer,
-      newBlockNumber,
       publisher,
-      newGlobalVariables,
-      chainTipArchive,
-      invalidateBlock,
+      attestorAddress,
+      invalidateCheckpoint,
+      syncedTo.proposedCheckpointData,
     );
-
-    // Wait until the voting promises have resolved, so all requests are enqueued
-    await Promise.all(votesPromises);
-
-    // In fisherman mode, we don't publish to L1
-    if (this.config.fishermanMode) {
-      // Clear pending requests
-      publisher.clearPendingRequests();
-
-      if (block) {
-        this.log.info(`Validation block building SUCCEEDED for slot ${slot}`, {
-          blockNumber: newBlockNumber,
-          slot: Number(slot),
-          archive: block.archive.toString(),
-          txCount: block.body.txEffects.length,
-        });
-        this.lastBlockPublished = block;
-        this.metrics.recordBlockProposalSuccess();
-      } else {
-        // Block building failed in fisherman mode
-        this.log.warn(`Validation block building FAILED for slot ${slot}`, {
-          blockNumber: newBlockNumber,
-          slot: Number(slot),
-        });
-        this.metrics.recordBlockProposalFailed('block_build_failed');
-      }
-    } else {
-      // Normal mode: send the tx to L1
-      const l1Response = await publisher.sendRequests();
-      const proposedBlock = l1Response?.successfulActions.find(a => a === 'propose');
-      if (proposedBlock) {
-        this.lastBlockPublished = block;
-        this.emit('block-published', { blockNumber: newBlockNumber, slot: Number(slot) });
-        await this.metrics.incFilledSlot(publisher.getSenderAddress().toString(), coinbase);
-      } else if (block) {
-        this.emit('block-publish-failed', l1Response ?? {});
-      }
-    }
-
-    this.setState(SequencerState.IDLE, undefined);
   }
 
-  /** Tries building a block proposal, and if successful, enqueues it for publishing. */
-  private async tryBuildBlockAndEnqueuePublish(
-    slot: SlotNumber,
+  protected createCheckpointProposalJob(
+    targetSlot: SlotNumber,
+    targetEpoch: EpochNumber,
+    checkpointNumber: CheckpointNumber,
+    syncedToBlockNumber: BlockNumber,
+    checkpointedCheckpointNumber: CheckpointNumber,
     proposer: EthAddress | undefined,
-    newBlockNumber: BlockNumber,
     publisher: SequencerPublisher,
-    newGlobalVariables: GlobalVariables,
-    chainTipArchive: Fr,
-    invalidateBlock: InvalidateBlockRequest | undefined,
-  ) {
-    this.log.verbose(`Preparing proposal for block ${newBlockNumber} at slot ${slot}`, {
+    attestorAddress: EthAddress,
+    invalidateCheckpoint: InvalidateCheckpointRequest | undefined,
+    proposedCheckpointData?: ProposedCheckpointData,
+  ): CheckpointProposalJob {
+    return new CheckpointProposalJob(
+      targetSlot,
+      targetEpoch,
+      checkpointNumber,
+      syncedToBlockNumber,
+      checkpointedCheckpointNumber,
       proposer,
-      publisher: publisher.getSenderAddress(),
-      globalVariables: newGlobalVariables.toInspect(),
-      chainTipArchive,
-      blockNumber: newBlockNumber,
-      slot,
-    });
-
-    const proposalHeader = CheckpointHeader.from({
-      ...newGlobalVariables,
-      timestamp: newGlobalVariables.timestamp,
-      lastArchiveRoot: chainTipArchive,
-      blockHeadersHash: Fr.ZERO,
-      contentCommitment: ContentCommitment.empty(),
-      totalManaUsed: Fr.ZERO,
-    });
-
-    let block: L2Block | undefined;
-
-    const pendingTxCount = await this.p2pClient.getPendingTxCount();
-    if (pendingTxCount >= this.minTxsPerBlock) {
-      // We don't fetch exactly maxTxsPerBlock txs here because we may not need all of them if we hit a limit before,
-      // and also we may need to fetch more if we don't have enough valid txs.
-      const pendingTxs = this.p2pClient.iteratePendingTxs();
-      try {
-        block = await this.buildBlockAndEnqueuePublish(
-          pendingTxs,
-          proposalHeader,
-          newGlobalVariables,
-          proposer,
-          invalidateBlock,
-          publisher,
-        );
-      } catch (err: any) {
-        this.emit('block-build-failed', { reason: err.message });
-        if (err instanceof FormattedViemError) {
-          this.log.verbose(`Unable to build/enqueue block ${err.message}`);
-        } else {
-          this.log.error(`Error building/enqueuing block`, err, { blockNumber: newBlockNumber, slot });
-        }
-        this.metrics.recordBlockProposalFailed(err.name || 'unknown_error');
-      }
-    } else {
-      this.log.verbose(
-        `Not enough txs to build block ${newBlockNumber} at slot ${slot} (got ${pendingTxCount} txs, need ${this.minTxsPerBlock})`,
-        { chainTipArchive, blockNumber: newBlockNumber, slot },
-      );
-      this.emit('tx-count-check-failed', { minTxs: this.minTxsPerBlock, availableTxs: pendingTxCount });
-      this.metrics.recordBlockProposalFailed('insufficient_txs');
-    }
-    return block;
+      publisher,
+      attestorAddress,
+      invalidateCheckpoint,
+      this.validatorClient,
+      this.globalsBuilder,
+      this.p2pClient,
+      this.worldState,
+      this.l1ToL2MessageSource,
+      this.l2BlockSource,
+      this.checkpointsBuilder,
+      this.l2BlockSource,
+      this.l1Constants,
+      this.signatureContext,
+      this.config,
+      this.timetable,
+      this.slasherClient,
+      this.epochCache,
+      this.dateProvider,
+      this.metrics,
+      this.checkpointProposalJobMetrics.createRecorder(),
+      this,
+      this.pendingRequests,
+      this.setState.bind(this),
+      this.tracer,
+      this.log.getBindings(),
+      proposedCheckpointData,
+    );
   }
 
-  @trackSpan('Sequencer.work')
-  protected async safeWork() {
-    try {
-      await this.work();
-    } catch (err) {
-      if (err instanceof SequencerTooSlowError) {
-        // Log as warn only if we had to abort halfway through the block proposal
-        const logLvl = [SequencerState.INITIALIZING_PROPOSAL, SequencerState.PROPOSER_CHECK].includes(err.proposedState)
-          ? ('debug' as const)
-          : ('warn' as const);
-        this.log[logLvl](err.message, { now: this.dateProvider.nowInSeconds() });
-      } else {
-        // Re-throw other errors
-        throw err;
-      }
-    } finally {
-      this.setState(SequencerState.IDLE, undefined);
-    }
+  /**
+   * Returns the current sequencer state.
+   */
+  public getState(): SequencerState {
+    return this.state;
   }
 
   /**
-   * Sets the sequencer state and checks if we have enough time left in the slot to transition to the new state.
+   * Internal helper for setting the sequencer state. Pure: sets the state, emits `state-changed`, and
+   * records metrics. Timing deadlines are queried explicitly at the relevant call sites, not gated here.
    * @param proposedState - The new state to transition to.
-   * @param slotNumber - The current slot number.
+   * @param slotNumber - The target slot being proposed for, emitted as `targetSlot` on the event payload
+   * and used to anchor `secondsIntoBuildFrame`. Undefined for lifecycle states with no associated slot.
    * @param force - Whether to force the transition even if the sequencer is stopped.
    */
-  setState(proposedState: SequencerStateWithSlot, slotNumber: SlotNumber, opts?: { force?: boolean }): void;
-  setState(
-    proposedState: Exclude<SequencerState, SequencerStateWithSlot>,
-    slotNumber?: undefined,
-    opts?: { force?: boolean },
-  ): void;
-  setState(proposedState: SequencerState, slotNumber: SlotNumber | undefined, opts: { force?: boolean } = {}): void {
+  protected setState(
+    proposedState: SequencerState,
+    slotNumber: SlotNumber | undefined,
+    opts: { force?: boolean } = {},
+  ): void {
     if (this.state === SequencerState.STOPPING && proposedState !== SequencerState.STOPPED && !opts.force) {
       this.log.warn(`Cannot set sequencer to ${proposedState} as it is stopping.`);
       throw new SequencerInterruptedError();
@@ -569,378 +807,56 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
       this.log.warn(`Cannot set sequencer from ${this.state} to ${proposedState} as it is stopped.`);
       return;
     }
-    let secondsIntoSlot = undefined;
-    if (slotNumber !== undefined) {
-      secondsIntoSlot = this.getSecondsIntoSlot(slotNumber);
-      this.timetable.assertTimeLeft(proposedState, secondsIntoSlot);
-    }
+    const secondsIntoBuildFrame = slotNumber !== undefined ? this.getSecondsIntoBuildFrame(slotNumber) : undefined;
+
+    const oldState = this.state;
+    const oldStateSlotNumber = this.stateSlotNumber;
+    const stateChanged = proposedState !== oldState;
+    // Wall-clock time spent in the previous state: the delta between consecutive state-changing setState
+    // calls, read from the date provider so it tracks simulated time under a test/manual clock.
+    const transitionAtMs = this.dateProvider.now();
+    const stateDurationMs = transitionAtMs - this.stateEnteredAtMs;
 
     const boringStates = [SequencerState.IDLE, SequencerState.SYNCHRONIZING];
     const logLevel =
-      boringStates.includes(proposedState) && boringStates.includes(this.state)
-        ? ('trace' as const)
-        : ('debug' as const);
-    this.log[logLevel](`Transitioning from ${this.state} to ${proposedState}`, { slotNumber, secondsIntoSlot });
-
-    this.emit('state-changed', {
-      oldState: this.state,
+      boringStates.includes(proposedState) && boringStates.includes(oldState) ? ('trace' as const) : ('debug' as const);
+    this.stateLog[logLevel](`Transitioning from ${oldState} to ${proposedState}`, {
+      oldState,
       newState: proposedState,
-      secondsIntoSlot,
       slotNumber,
+      stateSlotNumber: oldStateSlotNumber,
+      secondsIntoBuildFrame,
+      ...(stateChanged && { stateDurationMs: Math.ceil(stateDurationMs) }),
     });
-    this.state = proposedState;
-  }
-
-  private async dropFailedTxsFromP2P(failedTxs: FailedTx[]) {
-    if (failedTxs.length === 0) {
-      return;
-    }
-    const failedTxData = failedTxs.map(fail => fail.tx);
-    const failedTxHashes = failedTxData.map(tx => tx.getTxHash());
-    this.log.verbose(`Dropping failed txs ${failedTxHashes.join(', ')}`);
-    await this.p2pClient.deleteTxs(failedTxHashes);
-  }
-
-  protected getBlockBuilderOptions(slot: SlotNumber): PublicProcessorLimits {
-    // Deadline for processing depends on whether we're proposing a block
-    const secondsIntoSlot = this.getSecondsIntoSlot(slot);
-    const processingEndTimeWithinSlot = this.timetable.getBlockProposalExecTimeEnd(secondsIntoSlot);
-
-    // Deadline is only set if enforceTimeTable is enabled.
-    const deadline = this.enforceTimeTable
-      ? new Date((this.getSlotStartBuildTimestamp(slot) + processingEndTimeWithinSlot) * 1000)
-      : undefined;
-    return {
-      maxTransactions: this.maxTxsPerBlock,
-      maxBlockSize: this.maxBlockSizeInBytes,
-      maxBlockGas: this.maxBlockGas,
-      maxBlobFields: BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB,
-      deadline,
-    };
-  }
-
-  /**
-   * @notice  Build and propose a block to the chain
-   *
-   * @dev     MUST throw instead of exiting early to ensure that world-state
-   *          is being rolled back if the block is dropped.
-   *
-   * @param pendingTxs - Iterable of pending transactions to construct the block from
-   * @param proposalHeader - The partial header constructed for the proposal
-   * @param newGlobalVariables - The global variables for the new block
-   * @param proposerAddress - The address of the proposer
-   */
-  @trackSpan('Sequencer.buildBlockAndEnqueuePublish', (_validTxs, _proposalHeader, newGlobalVariables) => ({
-    [Attributes.BLOCK_NUMBER]: newGlobalVariables.blockNumber,
-  }))
-  private async buildBlockAndEnqueuePublish(
-    pendingTxs: Iterable<Tx> | AsyncIterable<Tx>,
-    proposalHeader: CheckpointHeader,
-    newGlobalVariables: GlobalVariables,
-    proposerAddress: EthAddress | undefined,
-    invalidateBlock: InvalidateBlockRequest | undefined,
-    publisher: SequencerPublisher,
-  ): Promise<L2Block> {
-    await publisher.validateBlockHeader(proposalHeader, invalidateBlock);
-
-    const blockNumber = newGlobalVariables.blockNumber;
-    const slot = proposalHeader.slotNumber;
-    const l1ToL2Messages = await this.l1ToL2MessageSource.getL1ToL2Messages(blockNumber);
-
-    const workTimer = new Timer();
-    this.setState(SequencerState.CREATING_BLOCK, slot);
-
-    try {
-      const blockBuilderOptions = this.getBlockBuilderOptions(slot);
-      const buildBlockRes = await this.blockBuilder.buildBlock(
-        pendingTxs,
-        l1ToL2Messages,
-        newGlobalVariables,
-        blockBuilderOptions,
-      );
-      const { publicGas, block, publicProcessorDuration, numTxs, numMsgs, blockBuildingTimer, usedTxs, failedTxs } =
-        buildBlockRes;
-      const blockBuildDuration = workTimer.ms();
-      await this.dropFailedTxsFromP2P(failedTxs);
-
-      const minTxsPerBlock = this.minTxsPerBlock;
-      if (numTxs < minTxsPerBlock) {
-        this.log.warn(
-          `Block ${blockNumber} has too few txs to be proposed (got ${numTxs} but required ${minTxsPerBlock})`,
-          { slot, blockNumber, numTxs },
-        );
-        throw new Error(`Block has too few successful txs to be proposed`);
-      }
-
-      // TODO(@PhilWindle) We should probably periodically check for things like another
-      // block being published before ours instead of just waiting on our block
-      await publisher.validateBlockHeader(block.getCheckpointHeader(), invalidateBlock);
-
-      const blockStats: L2BlockBuiltStats = {
-        eventName: 'l2-block-built',
-        creator: proposerAddress?.toString() ?? publisher.getSenderAddress().toString(),
-        duration: workTimer.ms(),
-        publicProcessDuration: publicProcessorDuration,
-        rollupCircuitsDuration: blockBuildingTimer.ms(),
-        ...block.getStats(),
-      };
-
-      const blockHash = await block.hash();
-      const txHashes = block.body.txEffects.map(tx => tx.txHash);
-      this.log.info(
-        `Built block ${block.number} for slot ${slot} with ${numTxs} txs and ${numMsgs} messages. ${
-          publicGas.l2Gas / workTimer.s()
-        } mana/s`,
-        {
-          blockHash,
-          globalVariables: block.header.globalVariables.toInspect(),
-          txHashes,
-          ...blockStats,
-        },
-      );
-
-      // In fisherman mode, skip attestation collection
-      let attestationsAndSigners: CommitteeAttestationsAndSigners;
-      if (this.config.fishermanMode) {
-        this.log.debug('Skipping attestation collection');
-        attestationsAndSigners = CommitteeAttestationsAndSigners.empty();
-      } else {
-        this.log.debug('Collecting attestations');
-        attestationsAndSigners = await this.collectAttestations(block, usedTxs, proposerAddress);
-        this.log.verbose(
-          `Collected ${attestationsAndSigners.attestations.length} attestations for block ${blockNumber} at slot ${slot}`,
-          { blockHash, blockNumber, slot },
-        );
-      }
-
-      // In fisherman mode, skip attestation signing
-      const attestationsAndSignersSignature =
-        this.config.fishermanMode || !this.validatorClient
-          ? Signature.empty()
-          : await this.validatorClient.signAttestationsAndSigners(
-              attestationsAndSigners,
-              proposerAddress ?? publisher.getSenderAddress(),
-            );
-
-      await this.enqueuePublishL2Block(
-        block,
-        attestationsAndSigners,
-        attestationsAndSignersSignature,
-        invalidateBlock,
-        publisher,
-      );
-      this.metrics.recordBuiltBlock(blockBuildDuration, publicGas.l2Gas);
-      return block;
-    } catch (err) {
-      this.metrics.recordFailedBlock();
-      throw err;
-    }
-  }
-
-  @trackSpan('Sequencer.collectAttestations', (block, txHashes) => ({
-    [Attributes.BLOCK_NUMBER]: block.number,
-    [Attributes.BLOCK_ARCHIVE]: block.archive.toString(),
-    [Attributes.BLOCK_TXS_COUNT]: txHashes.length,
-  }))
-  protected async collectAttestations(
-    block: L2Block,
-    txs: Tx[],
-    proposerAddress: EthAddress | undefined,
-  ): Promise<CommitteeAttestationsAndSigners> {
-    const { committee, seed, epoch } = await this.epochCache.getCommittee(block.slot);
-
-    // We checked above that the committee is defined, so this should never happen.
-    if (!committee) {
-      throw new Error('No committee when collecting attestations');
-    }
-
-    if (committee.length === 0) {
-      this.log.verbose(`Attesting committee is empty`);
-      return CommitteeAttestationsAndSigners.empty();
-    } else {
-      this.log.debug(`Attesting committee length is ${committee.length}`);
-    }
-
-    if (!this.validatorClient) {
-      throw new Error('Missing validator client: Cannot collect attestations');
-    }
 
-    const numberOfRequiredAttestations = Math.floor((committee.length * 2) / 3) + 1;
-
-    const slotNumber = block.header.globalVariables.slotNumber;
-    this.setState(SequencerState.COLLECTING_ATTESTATIONS, slotNumber);
-
-    this.log.debug('Creating block proposal for validators');
-    const blockProposalOptions: BlockProposalOptions = {
-      publishFullTxs: !!this.config.publishTxsWithProposals,
-      broadcastInvalidBlockProposal: this.config.broadcastInvalidBlockProposal,
-    };
-    const proposal = await this.validatorClient.createBlockProposal(
-      block.header.globalVariables.blockNumber,
-      block.getCheckpointHeader(),
-      block.archive.root,
-      txs,
-      proposerAddress,
-      blockProposalOptions,
-    );
-
-    if (!proposal) {
-      throw new Error(`Failed to create block proposal`);
-    }
-
-    if (this.config.skipCollectingAttestations) {
-      this.log.warn('Skipping attestation collection as per config (attesting with own keys only)');
-      const attestations = await this.validatorClient?.collectOwnAttestations(proposal);
-      return new CommitteeAttestationsAndSigners(orderAttestations(attestations ?? [], committee));
-    }
-
-    this.log.debug('Broadcasting block proposal to validators');
-    await this.validatorClient.broadcastBlockProposal(proposal);
-
-    const attestationTimeAllowed = this.enforceTimeTable
-      ? this.timetable.getMaxAllowedTime(SequencerState.PUBLISHING_BLOCK)!
-      : this.aztecSlotDuration;
-
-    this.metrics.recordRequiredAttestations(numberOfRequiredAttestations, attestationTimeAllowed);
-
-    const timer = new Timer();
-    let collectedAttestationsCount: number = 0;
-    try {
-      const attestationDeadline = new Date(this.dateProvider.now() + attestationTimeAllowed * 1000);
-      const attestations = await this.validatorClient.collectAttestations(
-        proposal,
-        numberOfRequiredAttestations,
-        attestationDeadline,
-      );
-
-      collectedAttestationsCount = attestations.length;
-
-      // note: the smart contract requires that the signatures are provided in the order of the committee
-      const sorted = orderAttestations(attestations, committee);
-
-      // manipulate the attestations if we've been configured to do so
-      if (this.config.injectFakeAttestation || this.config.shuffleAttestationOrdering) {
-        return this.manipulateAttestations(block, epoch, seed, committee, sorted);
-      }
-
-      return new CommitteeAttestationsAndSigners(sorted);
-    } catch (err) {
-      if (err && err instanceof AttestationTimeoutError) {
-        collectedAttestationsCount = err.collectedCount;
-      }
-      throw err;
-    } finally {
-      this.metrics.recordCollectedAttestations(collectedAttestationsCount, timer.ms());
-    }
-  }
-
-  /** Breaks the attestations before publishing based on attack configs */
-  private manipulateAttestations(
-    block: L2Block,
-    epoch: EpochNumber,
-    seed: bigint,
-    committee: EthAddress[],
-    attestations: CommitteeAttestation[],
-  ) {
-    // Compute the proposer index in the committee, since we dont want to tweak it.
-    // Otherwise, the L1 rollup contract will reject the block outright.
-    const proposerIndex = Number(
-      this.epochCache.computeProposerIndex(block.slot, epoch, seed, BigInt(committee.length)),
-    );
-
-    if (this.config.injectFakeAttestation) {
-      // Find non-empty attestations that are not from the proposer
-      const nonProposerIndices: number[] = [];
-      for (let i = 0; i < attestations.length; i++) {
-        if (!attestations[i].signature.isEmpty() && i !== proposerIndex) {
-          nonProposerIndices.push(i);
-        }
-      }
-      if (nonProposerIndices.length > 0) {
-        const targetIndex = nonProposerIndices[randomInt(nonProposerIndices.length)];
-        this.log.warn(`Injecting fake attestation in block ${block.number} at index ${targetIndex}`);
-        unfreeze(attestations[targetIndex]).signature = Signature.random();
-      }
-      return new CommitteeAttestationsAndSigners(attestations);
-    }
-
-    if (this.config.shuffleAttestationOrdering) {
-      this.log.warn(`Shuffling attestation ordering in block ${block.number} (proposer index ${proposerIndex})`);
-
-      const shuffled = [...attestations];
-      const [i, j] = [(proposerIndex + 1) % shuffled.length, (proposerIndex + 2) % shuffled.length];
-      const valueI = shuffled[i];
-      const valueJ = shuffled[j];
-      shuffled[i] = valueJ;
-      shuffled[j] = valueI;
-
-      const signers = new CommitteeAttestationsAndSigners(attestations).getSigners();
-      return new MaliciousCommitteeAttestationsAndSigners(shuffled, signers);
-    }
-
-    return new CommitteeAttestationsAndSigners(attestations);
-  }
-
-  /**
-   * Publishes the L2Block to the rollup contract.
-   * @param block - The L2Block to be published.
-   */
-  @trackSpan('Sequencer.enqueuePublishL2Block', block => ({
-    [Attributes.BLOCK_NUMBER]: block.number,
-  }))
-  protected async enqueuePublishL2Block(
-    block: L2Block,
-    attestationsAndSigners: CommitteeAttestationsAndSigners,
-    attestationsAndSignersSignature: Signature,
-    invalidateBlock: InvalidateBlockRequest | undefined,
-    publisher: SequencerPublisher,
-  ): Promise<void> {
-    // Publishes new block to the network and awaits the tx to be mined
-    this.setState(SequencerState.PUBLISHING_BLOCK, block.header.globalVariables.slotNumber);
-
-    // Time out tx at the end of the slot
-    const slot = block.header.globalVariables.slotNumber;
-    const txTimeoutAt = new Date((this.getSlotStartBuildTimestamp(slot) + this.aztecSlotDuration) * 1000);
-
-    const enqueued = await publisher.enqueueProposeL2Block(
-      block,
-      attestationsAndSigners,
-      attestationsAndSignersSignature,
-      {
-        txTimeoutAt,
-        forcePendingBlockNumber: invalidateBlock?.forcePendingBlockNumber,
-      },
-    );
-
-    if (!enqueued) {
-      throw new Error(`Failed to enqueue publish of block ${block.number}`);
+    this.emit('state-changed', {
+      oldState,
+      newState: proposedState,
+      secondsIntoBuildFrame,
+      targetSlot: slotNumber,
+    });
+    if (stateChanged) {
+      this.metrics.recordStateDuration(stateDurationMs, oldState);
+      this.stateEnteredAtMs = transitionAtMs;
+      this.stateSlotNumber = slotNumber;
     }
+    this.state = proposedState;
   }
 
   /**
    * Returns whether all dependencies have caught up.
    * We don't check against the previous block submitted since it may have been reorg'd out.
    */
-  protected async checkSync(args: { ts: bigint; slot: SlotNumber }): Promise<
-    | {
-        block?: L2Block;
-        blockNumber: BlockNumber;
-        archive: Fr;
-        l1Timestamp: bigint;
-        pendingChainValidationStatus: ValidateBlockResult;
-      }
-    | undefined
-  > {
-    // Check that the archiver and dependencies have synced to the previous L1 slot at least
-    // TODO(#14766): Archiver reports L1 timestamp based on L1 blocks seen, which means that a missed L1 block will
-    // cause the archiver L1 timestamp to fall behind, and cause this sequencer to start processing one L1 slot later.
-    const l1Timestamp = await this.l2BlockSource.getL1Timestamp();
-    const { slot, ts } = args;
-    if (l1Timestamp === undefined || l1Timestamp + BigInt(this.l1Constants.ethereumSlotDuration) < ts) {
+  protected async checkSync(args: { ts: bigint; slot: SlotNumber }): Promise<SequencerSyncCheckResult | undefined> {
+    // Check that the archiver has fully synced the L2 slot before the one we want to propose in.
+    // The archiver reports sync progress via L1 block timestamps and synced checkpoint slots.
+    // See getSyncedL2SlotNumber for how missed L1 blocks are handled.
+    const syncedL2Slot = await this.l2BlockSource.getSyncedL2SlotNumber();
+    const { slot } = args;
+    if (syncedL2Slot === undefined || syncedL2Slot + 1 < slot) {
       this.log.debug(`Cannot propose block at next L2 slot ${slot} due to pending sync from L1`, {
         slot,
-        ts,
-        l1Timestamp,
+        syncedL2Slot,
       });
       return undefined;
     }
@@ -950,122 +866,117 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
         number: syncSummary.latestBlockNumber,
         hash: syncSummary.latestBlockHash,
       })),
-      this.l2BlockSource.getL2Tips().then(t => t.latest),
+      this.l2BlockSource.getL2Tips().then(t => ({ proposed: t.proposed, checkpointed: t.checkpointed })),
       this.p2pClient.getStatus().then(p2p => p2p.syncedToL2Block),
-      this.l1ToL2MessageSource.getL2Tips().then(t => t.latest),
+      this.l1ToL2MessageSource.getL2Tips().then(t => ({ proposed: t.proposed, checkpointed: t.checkpointed })),
       this.l2BlockSource.getPendingChainValidationStatus(),
+      this.l2BlockSource.getProposedCheckpointData(),
     ] as const);
 
-    const [worldState, l2BlockSource, p2p, l1ToL2MessageSource, pendingChainValidationStatus] = syncedBlocks;
+    const [worldState, l2Tips, p2p, l1ToL2MessageSourceTips, pendingChainValidationStatus, proposedCheckpointData] =
+      syncedBlocks;
 
-    // Handle zero as a special case, since the block hash won't match across services if we're changing the prefilled data for the genesis block,
-    // as the world state can compute the new genesis block hash, but other components use the hardcoded constant.
     const result =
-      (l2BlockSource.number === 0 && worldState.number === 0 && p2p.number === 0 && l1ToL2MessageSource.number === 0) ||
-      (worldState.hash === l2BlockSource.hash &&
-        p2p.hash === l2BlockSource.hash &&
-        l1ToL2MessageSource.hash === l2BlockSource.hash);
+      worldState.hash === l2Tips.proposed.hash &&
+      p2p.hash === l2Tips.proposed.hash &&
+      l1ToL2MessageSourceTips.proposed.hash === l2Tips.proposed.hash &&
+      l1ToL2MessageSourceTips.checkpointed.block.hash === l2Tips.checkpointed.block.hash &&
+      l1ToL2MessageSourceTips.checkpointed.checkpoint.hash === l2Tips.checkpointed.checkpoint.hash;
 
     if (!result) {
-      this.log.debug(`Sequencer sync check failed`, { worldState, l2BlockSource, p2p, l1ToL2MessageSource });
+      this.log.debug(`Sequencer sync check failed`, {
+        worldState,
+        l2BlockSource: l2Tips.proposed,
+        p2p,
+        l1ToL2MessageSourceTips,
+      });
       return undefined;
     }
 
-    // Special case for genesis state
     const blockNumber = worldState.number;
-    if (blockNumber < INITIAL_L2_BLOCK_NUM) {
-      const archive = new Fr((await this.worldState.getCommitted().getTreeInfo(MerkleTreeId.ARCHIVE)).root);
-      return { blockNumber: BlockNumber(INITIAL_L2_BLOCK_NUM - 1), archive, l1Timestamp, pendingChainValidationStatus };
+    const blockData = await this.l2BlockSource.getBlockData({ number: blockNumber });
+    if (!blockData) {
+      this.log.warn(`Sequencer sync check failed: failed to get L2 block data ${blockNumber} from the archiver`, {
+        blockNumber,
+        l2Tips,
+        syncedL2Slot,
+        ...args,
+      });
+      return undefined;
+    }
+
+    // Refuse to build a checkpoint on top of a proposed block whose enclosing checkpoint was never
+    // proposed. Under pipelining we may have received and reexecuted such a block locally — advancing
+    // our world-state tip past the checkpointed tip — while the proposing node never published the
+    // matching proposed checkpoint (e.g. it crashed before assembling it). Building on this orphan block
+    // would fork the chain off a tip no other node can follow. The archiver prunes these orphan blocks
+    // once their build slot ends; this guard is the correctness barrier during the grace window before.
+    // `getProposedCheckpointData()` returns the latest proposed checkpoint payload, which is always
+    // the leading one (a proposed entry is only stored beyond the confirmed frontier and is deleted
+    // on confirmation). It carries no tip, so there is no tip-vs-payload split read to reconcile.
+    if (
+      blockData.checkpointNumber > l2Tips.checkpointed.checkpoint.number &&
+      proposedCheckpointData?.checkpointNumber !== blockData.checkpointNumber
+    ) {
+      const logCtx = {
+        blockCheckpointNumber: blockData.checkpointNumber,
+        checkpointedCheckpointNumber: l2Tips.checkpointed.checkpoint.number,
+        proposedCheckpointTipNumber: proposedCheckpointData?.checkpointNumber,
+        blockNumber: blockData.header.getBlockNumber(),
+        blockSlot: blockData.header.getSlot(),
+        syncedL2Slot,
+        ...args,
+      };
+
+      this.log.debug(`Waiting for proposed checkpoint to catch up with reexecuted block`, logCtx);
+      return undefined;
     }
 
-    const block = await this.l2BlockSource.getBlock(blockNumber);
-    if (!block) {
-      // this shouldn't really happen because a moment ago we checked that all components were in sync
-      this.log.error(`Failed to get L2 block ${blockNumber} from the archiver with all components in sync`);
+    const hasProposedCheckpoint = proposedCheckpointData !== undefined;
+
+    // Check that the proposed checkpoint is indeed the parent of the checkpoint we'll be building
+    // The checkpoint number to build is derived as blockData.checkpointNumber + 1
+    if (proposedCheckpointData && proposedCheckpointData.checkpointNumber !== blockData.checkpointNumber) {
+      this.log.warn(`Sequencer sync check failed: proposed checkpoint number mismatch`, {
+        proposedCheckpointNumber: proposedCheckpointData.checkpointNumber,
+        blockCheckpointNumber: blockData.checkpointNumber,
+        syncedL2Slot,
+        ...args,
+      });
       return undefined;
     }
 
     return {
-      block,
-      blockNumber: block.number,
-      archive: block.archive.root,
-      l1Timestamp,
+      blockData,
+      blockNumber: blockData.header.getBlockNumber(),
+      checkpointNumber: blockData.checkpointNumber,
+      checkpointedCheckpointNumber: l2Tips.checkpointed.checkpoint.number,
+      archive: blockData.archive.root,
+      hasProposedCheckpoint,
+      proposedCheckpointData,
+      syncedL2Slot,
       pendingChainValidationStatus,
     };
   }
 
-  /**
-   * Enqueues governance and slashing votes with the publisher. Does not block.
-   * @param publisher - The publisher to enqueue votes with
-   * @param attestorAddress - The attestor address to use for signing
-   * @param slot - The slot number
-   * @param timestamp - The timestamp for the votes
-   * @param context - Optional context for logging (e.g., block number)
-   * @returns A tuple of [governanceEnqueued, slashingEnqueued]
-   */
-  protected enqueueGovernanceAndSlashingVotes(
-    publisher: SequencerPublisher,
-    attestorAddress: EthAddress,
-    slot: SlotNumber,
-    timestamp: bigint,
-  ): [Promise<boolean> | undefined, Promise<boolean> | undefined] {
-    try {
-      const signerFn = (msg: TypedDataDefinition) =>
-        this.validatorClient!.signWithAddress(attestorAddress, msg).then(s => s.toString());
-
-      const enqueueGovernancePromise =
-        this.governanceProposerPayload && !this.governanceProposerPayload.isZero()
-          ? publisher
-              .enqueueGovernanceCastSignal(this.governanceProposerPayload, slot, timestamp, attestorAddress, signerFn)
-              .catch(err => {
-                this.log.error(`Error enqueuing governance vote`, err, { slot });
-                return false;
-              })
-          : undefined;
-
-      const enqueueSlashingPromise = this.slasherClient
-        ? this.slasherClient
-            .getProposerActions(slot)
-            .then(actions => {
-              // Record metrics for fisherman mode
-              if (this.config.fishermanMode && actions.length > 0) {
-                this.log.debug(`Fisherman mode: simulating ${actions.length} slashing action(s) for slot ${slot}`, {
-                  slot,
-                  actionCount: actions.length,
-                });
-                this.metrics.recordSlashingAttempt(actions.length);
-              }
-              // Enqueue the actions to fully simulate L1 tx building (they won't be sent in fisherman mode)
-              return publisher.enqueueSlashingActions(actions, slot, timestamp, attestorAddress, signerFn);
-            })
-            .catch(err => {
-              this.log.error(`Error enqueuing slashing actions`, err, { slot });
-              return false;
-            })
-        : undefined;
-
-      return [enqueueGovernancePromise, enqueueSlashingPromise];
-    } catch (err) {
-      this.log.error(`Error enqueueing governance and slashing votes`, err);
-      return [undefined, undefined];
-    }
-  }
-
   /**
    * Checks if we are the proposer for the next slot.
    * @returns True if we can propose, and the proposer address (undefined if anyone can propose)
    */
-  protected async checkCanPropose(slot: SlotNumber): Promise<[boolean, EthAddress | undefined]> {
+  protected async checkCanPropose(targetSlot: SlotNumber): Promise<[boolean, EthAddress | undefined]> {
     let proposer: EthAddress | undefined;
 
     try {
-      proposer = await this.epochCache.getProposerAttesterAddressInSlot(slot);
+      proposer = await this.epochCache.getProposerAttesterAddressInSlot(targetSlot);
     } catch (e) {
       if (e instanceof NoCommitteeError) {
-        this.log.warn(`Cannot propose at next L2 slot ${slot} since the committee does not exist on L1`);
+        if (this.lastSlotForNoCommitteeWarning !== targetSlot) {
+          this.lastSlotForNoCommitteeWarning = targetSlot;
+          this.log.warn(`Cannot propose at target slot ${targetSlot} since the committee does not exist on L1`);
+        }
         return [false, undefined];
       }
-      this.log.error(`Error getting proposer for slot ${slot}`, e);
+      this.log.error(`Error getting proposer for target slot ${targetSlot}`, e);
       return [false, undefined];
     }
 
@@ -1078,58 +989,60 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
       return [true, proposer];
     }
 
-    const validatorAddresses = this.validatorClient!.getValidatorAddresses();
+    const validatorAddresses = this.validatorClient.getValidatorAddresses();
     const weAreProposer = validatorAddresses.some(addr => addr.equals(proposer));
 
     if (!weAreProposer) {
-      this.log.debug(`Cannot propose at slot ${slot} since we are not a proposer`, { validatorAddresses, proposer });
+      this.log.debug(`Cannot propose at target slot ${targetSlot} since we are not a proposer`, {
+        targetSlot,
+        validatorAddresses,
+        proposer,
+      });
       return [false, proposer];
     }
 
+    this.log.info(`We are the proposer for pipeline slot ${targetSlot}`, {
+      targetSlot,
+      proposer,
+    });
     return [true, proposer];
   }
 
   /**
-   * Tries to vote on slashing actions and governance when the sync check fails but we're past the max time for initializing a proposal.
-   * This allows the sequencer to participate in governance/slashing votes even when it cannot build blocks.
+   * Tries to vote on slashing actions and governance and to prune when we cannot build and are past the
+   * block-building window. This allows the sequencer to participate in governance/slashing votes even when it
+   * cannot build blocks, and to prune the pending chain so it can recover from bad data that is blocking sync.
    */
-  protected async tryVoteWhenSyncFails(args: { slot: SlotNumber; ts: bigint }): Promise<void> {
-    const { slot, ts } = args;
+  @trackSpan('Sequencer.tryVoteAndPruneWhenCannotBuild', ({ slot }) => ({ [Attributes.SLOT_NUMBER]: slot }))
+  protected async tryVoteAndPruneWhenCannotBuild(args: { slot: SlotNumber; targetSlot: SlotNumber }): Promise<void> {
+    const { slot, targetSlot } = args;
 
     // Prevent duplicate attempts in the same slot
-    if (this.lastSlotForVoteWhenSyncFailed === slot) {
-      this.log.debug(`Already attempted to vote in slot ${slot} (skipping)`);
+    if (this.lastSlotForFallbackAction === slot) {
+      this.log.trace(`Already attempted fallback actions in slot ${slot} (skipping)`);
       return;
     }
 
-    // Check if we're past the max time for initializing a proposal
-    const secondsIntoSlot = this.getSecondsIntoSlot(slot);
-    const maxAllowedTime = this.timetable.getMaxAllowedTime(SequencerState.INITIALIZING_PROPOSAL);
+    // Vote-only actions do not give up the slot: if sync recovers, a later work-loop iteration can still build.
+    // Under proposer pipelining the work loop reasons about the next L1 slot, so waiting for the target slot's
+    // build-start deadline can miss the whole fallback window when the target advances with the clock.
+    const nowSeconds = this.dateProvider.now() / 1000;
+    const startDeadline = this.timetable.getBuildStartDeadline(targetSlot);
 
-    // If we haven't exceeded the time limit for initializing a proposal, don't proceed with voting
-    // We use INITIALIZING_PROPOSAL time limit because if we're past that, we can't build a block anyway
-    if (maxAllowedTime === undefined || secondsIntoSlot <= maxAllowedTime) {
-      this.log.trace(`Not attempting to vote since there is still for block building`, {
-        secondsIntoSlot,
-        maxAllowedTime,
-      });
-      return;
-    }
-
-    this.log.debug(`Sync for slot ${slot} failed, checking for voting opportunities`, {
-      secondsIntoSlot,
-      maxAllowedTime,
+    this.log.trace(`Cannot build for slot ${slot}, checking for voting opportunities`, {
+      nowSeconds,
+      startDeadline,
     });
 
     // Check if we're a proposer or proposal is open
-    const [canPropose, proposer] = await this.checkCanPropose(slot);
+    const [canPropose, proposer] = await this.checkCanPropose(targetSlot);
     if (!canPropose) {
-      this.log.debug(`Cannot vote in slot ${slot} since we are not a proposer`, { slot, proposer });
+      this.log.trace(`Cannot vote in slot ${slot} since we are not a proposer`, { slot, proposer });
       return;
     }
 
     // Mark this slot as attempted
-    this.lastSlotForVoteWhenSyncFailed = slot;
+    this.lastSlotForFallbackAction = slot;
 
     // Get a publisher for voting
     const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
@@ -1139,17 +1052,122 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
       slot,
     });
 
-    // Enqueue governance and slashing votes using the shared helper method
-    const votesPromises = this.enqueueGovernanceAndSlashingVotes(publisher, attestorAddress, slot, ts);
-    await Promise.all(votesPromises);
+    // Enqueue governance and slashing votes (voter uses the target slot for L1 submission)
+    const voter = new CheckpointVoter(
+      targetSlot,
+      publisher,
+      attestorAddress,
+      this.validatorClient,
+      this.slasherClient,
+      this.l1Constants,
+      this.config,
+      this.metrics,
+      this.log,
+    );
+    const votesPromises = voter.enqueueVotes();
+    const votes = await Promise.all(votesPromises);
+
+    // Even if we cannot build, try to prune so a stuck pending chain (e.g. bad data blocking sync) can
+    // recover. prune() is permissionless, so it rides the same fallback multicall as the votes.
+    const pruneEnqueued = await this.tryEnqueuePruneIfPrunable(targetSlot, publisher);
 
-    if (votesPromises.every(p => !p)) {
-      this.log.debug(`No votes to enqueue for slot ${slot}`);
+    // Bail if nothing to do
+    if (votes.every(p => !p) && !pruneEnqueued) {
+      this.log.debug(`Nothing to enqueue for slot ${slot} (no votes, not prunable)`);
       return;
     }
 
-    this.log.info(`Voting in slot ${slot} despite sync failure`, { slot });
-    await publisher.sendRequests();
+    const [governanceVoteEnqueued, slashingVoteEnqueued] = votes;
+    this.log.info(`Submitting fallback requests in slot ${slot} despite sync failure`, {
+      slot,
+      pruneEnqueued,
+      governanceVoteEnqueued: !!governanceVoteEnqueued,
+      slashingVoteEnqueued: !!slashingVoteEnqueued,
+    });
+
+    // Votes are EIP-712-signed for `targetSlot` (the pipelined slot in which the multicall is
+    // expected to mine). Delay submission to the start of `targetSlot` so the tx mines in the
+    // slot the votes were signed for. We fire-and-forget so we don't block the sequencer's
+    // work loop while waiting for the target slot to start, but track it so stop() can drain it.
+    const send = publisher.sendRequestsAt(targetSlot).catch(err => {
+      this.log.error(`Failed to publish fallback requests despite sync failure for slot ${slot}`, err, { slot });
+    });
+    this.pendingRequests.trackRequest(send, () => publisher.interrupt());
+  }
+
+  private async tryEnqueuePruneIfPrunable(targetSlot: SlotNumber, publisher: SequencerPublisher): Promise<boolean> {
+    try {
+      return await publisher.enqueuePruneIfPrunable(targetSlot);
+    } catch (err) {
+      this.log.error(`Failed to enqueue rollup prune for slot ${targetSlot}`, err, { targetSlot });
+      return false;
+    }
+  }
+
+  /**
+   * Tries to vote on slashing actions and governance proposals when escape hatch is open.
+   * This allows the sequencer to participate in voting without performing checkpoint proposal work.
+   */
+  @trackSpan('Sequencer.tryVoteWhenEscapeHatchOpen', ({ slot }) => ({ [Attributes.SLOT_NUMBER]: slot }))
+  protected async tryVoteWhenEscapeHatchOpen(args: {
+    slot: SlotNumber;
+    targetSlot: SlotNumber;
+    proposer: EthAddress | undefined;
+  }): Promise<void> {
+    const { slot, targetSlot, proposer } = args;
+
+    // Prevent duplicate attempts in the same slot
+    if (this.lastSlotForFallbackAction === slot) {
+      this.log.trace(`Already attempted to vote in slot ${slot} (escape hatch open, skipping)`);
+      return;
+    }
+
+    // Mark this slot as attempted
+    this.lastSlotForFallbackAction = slot;
+
+    const { attestorAddress, publisher } = await this.publisherFactory.create(proposer);
+
+    this.log.debug(`Escape hatch open for slot ${slot}, attempting vote-only actions`, {
+      slot,
+      targetSlot,
+      attestorAddress,
+    });
+
+    // Under proposer pipelining, the multicall is expected to mine in `targetSlot` (slot + 1).
+    // Governance and slashing votes are EIP-712-signed against the slot they will mine in, and the
+    // L1 contract checks `msg.sender == getCurrentProposer()` using the mining slot. So we must
+    // sign for `targetSlot` and delay submission to the start of `targetSlot`.
+    const voter = new CheckpointVoter(
+      targetSlot,
+      publisher,
+      attestorAddress,
+      this.validatorClient,
+      this.slasherClient,
+      this.l1Constants,
+      this.config,
+      this.metrics,
+      this.log,
+    );
+
+    const votesPromises = voter.enqueueVotes();
+    const votes = await Promise.all(votesPromises);
+
+    if (votes.every(p => !p)) {
+      this.log.debug(`No votes to enqueue for slot ${slot} (escape hatch open)`);
+      return;
+    }
+
+    this.log.info(`Voting in slot ${slot} (escape hatch open)`, { slot, targetSlot });
+    // Votes are EIP-712-signed for `targetSlot`. Delay submission to the start of `targetSlot` so
+    // the multicall mines in the slot the votes were signed for; otherwise the L1 contract reads
+    // `signaler = getCurrentProposer()` against the wrong slot and signature verification fails
+    // silently inside Multicall3. Fire-and-forget so we don't block the sequencer's work loop while
+    // waiting for the target slot to start, mirroring tryVoteAndPruneWhenCannotBuild, but tracked so
+    // stop() can drain it.
+    const send = publisher.sendRequestsAt(targetSlot).catch(err => {
+      this.log.error(`Failed to publish escape-hatch votes for slot ${slot}`, err, { slot, targetSlot });
+    });
+    this.pendingRequests.trackRequest(send, () => publisher.interrupt());
   }
 
   /**
@@ -1157,29 +1175,44 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
    * has been there without being invalidated and whether the sequencer is in the committee or not. We always
    * have the proposer try to invalidate, but if they fail, the sequencers in the committee are expected to try,
    * and if they fail, any sequencer will try as well.
+   * @param pendingChainValidationStatus - The archiver's pending-chain validation status, authoritative on its own.
+   * @param currentSlot - The wall-clock slot, used for committee lookup, the per-(checkpoint, slot) dedup guard, and logging.
    */
-  protected async considerInvalidatingBlock(
-    syncedTo: NonNullable<Awaited<ReturnType<Sequencer['checkSync']>>>,
+  protected async considerInvalidatingCheckpoint(
+    pendingChainValidationStatus: ValidateCheckpointResult,
     currentSlot: SlotNumber,
   ): Promise<void> {
-    const { pendingChainValidationStatus, l1Timestamp } = syncedTo;
     if (pendingChainValidationStatus.valid) {
       return;
     }
 
-    const { publisher } = await this.publisherFactory.create(undefined);
-    const invalidBlockNumber = pendingChainValidationStatus.block.blockNumber;
-    const invalidBlockTimestamp = pendingChainValidationStatus.block.timestamp;
-    const timeSinceChainInvalid = this.dateProvider.nowInSeconds() - Number(invalidBlockTimestamp);
-    const ourValidatorAddresses = this.validatorClient!.getValidatorAddresses();
+    const invalidCheckpointNumber = pendingChainValidationStatus.checkpoint.checkpointNumber;
+
+    // Avoid re-running the committee lookup, simulation, and submission on every tick within a slot.
+    // The guard is keyed by (checkpoint, slot) — so a different invalid checkpoint surfacing later in
+    // the same slot is not suppressed — and is set only after a request is successfully simulated below,
+    // so a transient simulation failure (or thresholds not yet met) still retries on the next tick.
+    if (
+      this.lastInvalidationAttempt?.slot === currentSlot &&
+      this.lastInvalidationAttempt.checkpointNumber === invalidCheckpointNumber
+    ) {
+      this.log.trace(`Already attempted to invalidate checkpoint ${invalidCheckpointNumber} in slot ${currentSlot}`, {
+        currentSlot,
+        invalidCheckpointNumber,
+      });
+      return;
+    }
+
+    const invalidCheckpointTimestamp = pendingChainValidationStatus.checkpoint.timestamp;
+    const timeSinceChainInvalid = this.dateProvider.nowInSeconds() - Number(invalidCheckpointTimestamp);
+    const ourValidatorAddresses = this.validatorClient.getValidatorAddresses();
 
     const { secondsBeforeInvalidatingBlockAsCommitteeMember, secondsBeforeInvalidatingBlockAsNonCommitteeMember } =
       this.config;
 
     const logData = {
-      invalidL1Timestamp: invalidBlockTimestamp,
-      l1Timestamp,
-      invalidBlock: pendingChainValidationStatus.block,
+      invalidL1Timestamp: invalidCheckpointTimestamp,
+      invalidCheckpoint: pendingChainValidationStatus.checkpoint,
       secondsBeforeInvalidatingBlockAsCommitteeMember,
       secondsBeforeInvalidatingBlockAsNonCommitteeMember,
       ourValidatorAddresses,
@@ -1207,47 +1240,127 @@ export class Sequencer extends (EventEmitter as new () => TypedEventEmitter<Sequ
       return;
     }
 
-    const invalidateBlock = await publisher.simulateInvalidateBlock(pendingChainValidationStatus);
-    if (!invalidateBlock) {
-      this.log.warn(`Failed to simulate invalidate block`, logData);
+    let validatorToUse: EthAddress;
+    if (invalidateAsCommitteeMember) {
+      // When invalidating as a committee member, use first validator that's actually in the committee
+      const { committee } = await this.epochCache.getCommittee(currentSlot);
+      if (committee) {
+        const committeeSet = new Set(committee.map(addr => addr.toString()));
+        validatorToUse =
+          ourValidatorAddresses.find(addr => committeeSet.has(addr.toString())) ?? ourValidatorAddresses[0];
+      } else {
+        validatorToUse = ourValidatorAddresses[0];
+      }
+    } else {
+      // When invalidating as a non-committee member, use the first validator
+      validatorToUse = ourValidatorAddresses[0];
+    }
+
+    const { publisher } = await this.publisherFactory.create(validatorToUse);
+
+    const invalidateCheckpoint = await publisher.simulateInvalidateCheckpoint(pendingChainValidationStatus);
+    if (!invalidateCheckpoint) {
+      this.log.warn(`Failed to simulate invalidate checkpoint`, logData);
       return;
     }
 
+    // We produced a valid invalidation request; record it so further ticks within this slot skip the
+    // committee lookup, simulation, and submission above for this same invalid checkpoint.
+    this.lastInvalidationAttempt = { slot: currentSlot, checkpointNumber: invalidCheckpointNumber };
+
     this.log.info(
       invalidateAsCommitteeMember
-        ? `Invalidating block ${invalidBlockNumber} as committee member`
-        : `Invalidating block ${invalidBlockNumber} as non-committee member`,
+        ? `Invalidating checkpoint ${invalidCheckpointNumber} as committee member`
+        : `Invalidating checkpoint ${invalidCheckpointNumber} as non-committee member`,
       logData,
     );
 
-    publisher.enqueueInvalidateBlock(invalidateBlock);
+    publisher.enqueueInvalidateCheckpoint(invalidateCheckpoint);
 
     if (!this.config.fishermanMode) {
       await publisher.sendRequests();
     } else {
-      this.log.info('Invalidating block in fisherman mode, clearing pending requests');
+      this.log.info('Invalidating checkpoint in fisherman mode, clearing pending requests');
       publisher.clearPendingRequests();
     }
   }
 
-  private getSlotStartBuildTimestamp(slotNumber: SlotNumber): number {
-    return getSlotStartBuildTimestamp(slotNumber, this.l1Constants);
+  private logStrategyComparison(epoch: EpochNumber, publisher: SequencerPublisher): void {
+    const feeAnalyzer = publisher.getL1FeeAnalyzer();
+    if (!feeAnalyzer) {
+      return;
+    }
+
+    const comparison = feeAnalyzer.getStrategyComparison();
+    if (comparison.length === 0) {
+      this.log.debug(`No strategy data available yet for epoch ${epoch}`);
+      return;
+    }
+
+    this.log.info(`L1 Fee Strategy Performance Report - End of Epoch ${epoch}`, {
+      epoch: Number(epoch),
+      totalAnalyses: comparison[0]?.totalAnalyses,
+      strategies: comparison.map(s => ({
+        id: s.strategyId,
+        name: s.strategyName,
+        inclusionRate: `${(s.inclusionRate * 100).toFixed(1)}%`,
+        inclusionCount: `${s.inclusionCount}/${s.totalAnalyses}`,
+        avgCostEth: s.avgEstimatedCostEth.toFixed(6),
+        totalCostEth: s.totalEstimatedCostEth.toFixed(6),
+        avgOverpaymentEth: s.avgOverpaymentEth.toFixed(6),
+        totalOverpaymentEth: s.totalOverpaymentEth.toFixed(6),
+        avgPriorityFeeDeltaGwei: s.avgPriorityFeeDeltaGwei.toFixed(2),
+      })),
+    });
   }
 
-  private getSecondsIntoSlot(slotNumber: SlotNumber): number {
-    const slotStartTimestamp = this.getSlotStartBuildTimestamp(slotNumber);
-    return Number((this.dateProvider.now() / 1000 - slotStartTimestamp).toFixed(3));
+  /**
+   * Wall-clock seconds elapsed since the build-frame start of the given target slot
+   * (`now − getBuildFrameStart(targetSlot)`). May be negative if called before the build frame opens.
+   */
+  private getSecondsIntoBuildFrame(targetSlot: SlotNumber): number {
+    const buildFrameStart = this.timetable.getBuildFrameStart(targetSlot);
+    return Number((this.dateProvider.now() / 1000 - buildFrameStart).toFixed(3));
   }
 
-  get aztecSlotDuration() {
+  public get aztecSlotDuration() {
     return this.l1Constants.slotDuration;
   }
 
-  get maxL2BlockGas(): number | undefined {
+  public get maxL2BlockGas(): number | undefined {
     return this.config.maxL2BlockGas;
   }
 
   public getSlasherClient(): SlasherClientInterface | undefined {
     return this.slasherClient;
   }
+
+  public get tracer(): Tracer {
+    return this.metrics.tracer;
+  }
+
+  public getValidatorAddresses() {
+    return this.validatorClient?.getValidatorAddresses();
+  }
+
+  /** Updates the publisher factory's node keystore adapter after a keystore reload. */
+  public updatePublisherNodeKeyStore(adapter: NodeKeystoreAdapter): void {
+    this.publisherFactory.updateNodeKeyStore(adapter);
+  }
+
+  public getConfig() {
+    return this.config;
+  }
 }
+
+type SequencerSyncCheckResult = {
+  blockData?: BlockData;
+  checkpointNumber: CheckpointNumber;
+  checkpointedCheckpointNumber: CheckpointNumber;
+  blockNumber: BlockNumber;
+  archive: Fr;
+  hasProposedCheckpoint: boolean;
+  proposedCheckpointData?: ProposedCheckpointData;
+  syncedL2Slot: SlotNumber;
+  pendingChainValidationStatus: ValidateCheckpointResult;
+};