@aztec/stdlib 0.0.1-commit.b9865e97 → 0.0.1-commit.be03c316

package/src/gas/README.md

@@ -1,47 +1,69 @@
 # Aztec Gas and Fee Model
 
 The minimum fee per mana and its components are computed on L1 in
-`l1-contracts/src/core/libraries/rollup/FeeLib.sol`. This document describes the
-formulas, the oracle lag/lifetime mechanism, and the TypeScript types in this directory.
+`l1-contracts/src/core/libraries/rollup/FeeLib.sol` (`fee_math.ts` in this directory is a
+TypeScript port of those formulas, used to predict fees a few slots ahead). This document
+describes the formulas, the oracle lag/lifetime mechanism, how a transaction's fee is
+derived from them, the gas and data limits, and the TypeScript types in this directory.
 
 ## Mana
 
-Aztec uses **mana** as its unit of work (analogous to Ethereum gas). Transactions consume
-mana in two dimensions: **DA** (data availability) and **L2** (execution). The total fee
-is `gasUsed * feePerMana` summed across both dimensions.
+Aztec meters work as gas in two dimensions: **DA** (data availability, i.e. blob data
+published to L1) and **L2** (execution). The L2 dimension is called **mana** (analogous to
+Ethereum gas): block headers track `totalManaUsed`, and the fee model below prices one unit
+of mana. The total fee is `gasUsed * feePerGas` summed across both dimensions.
+
+### The DA dimension is priced at zero
+
+Only the L2 dimension currently carries a price. When building checkpoint global variables,
+the sequencer sets `feePerDaGas = 0` and sets `feePerL2Gas` to the L1-computed minimum fee
+per mana (`sequencer-client/src/global_variable_builder/global_builder.ts` and
+`fee_provider.ts` in the same directory). The cost of publishing data is still recovered:
+the blob gas a checkpoint pays on L1 is part of the *sequencer cost* component of the mana
+fee below. DA gas remains fully metered and limited (see
+[Gas and Data Limits](#gas-and-data-limits)) — it bounds how much data a tx or checkpoint
+may publish — it just contributes nothing to the fee today.
 
 ## Fee Components
 
-The minimum fee per mana has four components:
+The minimum fee per mana has four components. All are computed in ETH (wei) per mana and
+converted to the fee asset at the end (see [Fee Asset Price](#fee-asset-price)).
 
 ### Sequencer Cost
 
 L1 cost to propose a checkpoint (calldata gas + blob data), amortized over `manaTarget`:
 
 ```
-sequencerCost = ((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
+sequencerCost = ceil(((L1_GAS_PER_CHECKPOINT_PROPOSED * baseFee)
               + (BLOBS_PER_CHECKPOINT * BLOB_GAS_PER_BLOB * blobFee))
-              / manaTarget
+              / manaTarget)
 ```
 
+Note that `BLOBS_PER_CHECKPOINT` here is FeeLib's own constant (3), not the protocol blob
+capacity of the same name (6) — see the note under [Key Constants](#key-constants).
+
 ### Prover Cost
 
 L1 cost to verify an epoch proof, amortized over epoch duration and `manaTarget`, plus a
 governance-set proving cost that compensates for off-chain proof generation:
 
 ```
-proverCost = (L1_GAS_PER_EPOCH_VERIFIED * baseFee / epochDuration) / manaTarget
+proverCost = ceil(ceil((L1_GAS_PER_EPOCH_VERIFIED * baseFee) / epochDuration) / manaTarget)
            + provingCostPerMana
 ```
 
+Updates to `provingCostPerMana` are rate-limited on L1 (`FeeLib.updateProvingCostPerMana`):
+at most one update every 30 days, each moving the value by at most ×1.5 (or ÷1.5), with a
+floor of 2 wei per mana.
+
 ### Congestion Cost
 
 An exponential surcharge when the network is congested (inspired by EIP-1559; the
 implementation uses the `fakeExponential` Taylor series approximation from EIP-4844):
 
 ```
-baseCost          = sequencerCost + proverCost
-congestionCost    = baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER - baseCost
+baseCost       = sequencerCost + proverCost
+congestionCost = floor(baseCost * congestionMultiplier / MINIMUM_CONGESTION_MULTIPLIER) - baseCost
 ```
 
 When there is no congestion the multiplier equals `MINIMUM_CONGESTION_MULTIPLIER` (1e9)
@@ -50,11 +72,15 @@ and congestion cost is zero.
 ### Congestion Multiplier
 
 ```
-excessMana          = max(0, prevExcessMana + prevManaUsed - manaTarget)
-congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER, excessMana, denominator)
+excessMana           = max(0, prevExcessMana + prevManaUsed - manaTarget)
+denominator          = manaTarget * 854,700,854 / 1e8    ≈ 8.547 * manaTarget
+congestionMultiplier = fakeExponential(MINIMUM_CONGESTION_MULTIPLIER,
+                                       min(excessMana, 100 * denominator), denominator)
 ```
 
-Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
+Each additional `manaTarget` of excess mana multiplies the fee by `e^(1/8.547) ≈ 1.124`,
+i.e. ~12.5%. The exponent is capped at 100 (multiplier ≤ ~2.7e43 × the minimum) to keep
+the Taylor series from overflowing.
 
 ### Total
 
@@ -62,6 +88,11 @@ Each additional `manaTarget` of excess mana increases the multiplier by ~12.5%.
 minFeePerMana = sequencerCost + proverCost + congestionCost
 ```
 
+Each component is converted from ETH to the fee asset individually (rounding up) before
+summing. The sum is capped at `type(uint128).max` (`FeeLib.summedMinFee`) so it always fits
+the proposal header's `feePerL2Gas` field — without the cap, extreme congestion could
+produce a fee no valid header can represent, halting the chain.
+
 ## L1 Gas Oracle: Lag and Lifetime
 
 The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a two-phase
@@ -70,9 +101,9 @@ The oracle feeds Ethereum's `baseFee` and `blobFee` into the fee model using a t
 - **LAG = 2 slots** — when new L1 fees are observed, they activate `LAG` slots later
   (`slotOfChange = currentSlot + LAG`). This gives mempool transactions time to land
   before fees change.
-- **LIFETIME = 5 slots** — after an oracle update, the next update is rejected until
-  `slotOfChange + (LIFETIME - LAG)` = 3 more slots have passed. This rate-limits how
-  frequently L1 fee data can change.
+- **LIFETIME = 5 slots** — after an oracle update, further updates are ignored
+  (`updateL1GasFeeOracle` returns without effect) until `slotOfChange + (LIFETIME - LAG)`
+  = 3 more slots have passed. This rate-limits how frequently L1 fee data can change.
 
 Fee resolution at a given timestamp:
 
@@ -84,6 +115,12 @@ else                    →  use post (new fees)
 **Net effect**: L1 fee changes reach L2 with a 2-slot delay and can update at most once
 every 5 slots.
 
+Because queued values only activate `LAG` slots later, the min fee for the next `LAG`
+slots is fully determined by current on-chain state. `fee_math.ts` ports the FeeLib
+formulas so the sequencer can predict min fees over that window (`FeePredictor` in
+`sequencer-client/src/global_variable_builder`), under a configurable mana-usage
+assumption (`ManaUsageEstimate`: none / target / limit).
+
 ### Worked Example
 
 Suppose the oracle is updated at slot 10 with new L1 fees. Here is the timeline:
@@ -117,38 +154,165 @@ Key observations:
 
 ## Fee Asset Price
 
-Fees are computed in ETH internally but converted to the fee asset (Fee Juice) via
-`ethPerFeeAsset` (1e12 precision). The price updates at most ±1% (±100 bps) per
-checkpoint:
+Fees are computed in ETH (wei) internally and converted to the fee asset (Fee Juice) via
+`ethPerFeeAsset` (1e12 precision), rounding up (`PriceLib.toFeeAsset` in
+`l1-contracts/src/core/libraries/compressed-data/fees/FeeConfig.sol`).
+
+Each checkpoint proposal carries a fee-asset price modifier (`OracleInput`) chosen by the
+proposer, bounded to ±1% (±100 bps) per checkpoint:
 
 ```
 newPrice = currentPrice * (10000 + modifierBps) / 10000
 ```
 
+The result is clamped to [`MIN_ETH_PER_FEE_ASSET` = 100, `MAX_ETH_PER_FEE_ASSET` = 1e14],
+i.e. 1e-10 to 100 ETH per fee asset. The floor of 100 guarantees a ±1% step always moves
+the integer price by at least 1.
+
+## Transaction Fees
+
+The checkpoint's `gasFees` (the L1-computed min fee per mana, with DA priced at zero) act
+as a base fee. Senders declare `GasSettings`: gas limits, teardown gas limits,
+`maxFeesPerGas`, and `maxPriorityFeesPerGas`. A tx is only includable if `maxFeesPerGas`
+covers the checkpoint's `gasFees` in both dimensions. The effective fee adds an
+EIP-1559-style priority fee on top of the base, capped by the max
+(`computeEffectiveGasFees` in `stdlib/src/fees/transaction_fee.ts`):
+
+```
+effectiveFeePerGas = gasFees + min(maxPriorityFeePerGas, maxFeesPerGas - gasFees)   (per dimension)
+transactionFee     = billedGas.daGas * effectiveFeePerDaGas + billedGas.l2Gas * effectiveFeePerL2Gas
+```
+
+`billedGas` is actual consumption except for the teardown phase, which is billed at the
+declared `teardownGasLimits` rather than actual usage — the fee is charged during teardown
+itself, before actual teardown consumption is known.
+
 ## Maximum Fee Change Rate
 
-| Component              | Bound                                                   |
-| ---------------------- | ------------------------------------------------------- |
-| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)            |
-| Fee asset price        | ±1% per checkpoint                                      |
+| Component              | Bound                                                    |
+| ---------------------- | -------------------------------------------------------- |
+| L1 base fee / blob fee | At most once every 5 slots (oracle LIFETIME)             |
+| Fee asset price        | ±1% per checkpoint                                       |
+| Proving cost per mana  | At most ×1.5 (or ÷1.5) per update, one update per 30 days |
 | Congestion multiplier  | Depends on excess mana accumulation/drain per checkpoint |
-| Sequencer/prover costs | Scale linearly with L1 fees                             |
+| Sequencer/prover costs | Scale linearly with L1 fees                              |
 
 ## Key Constants
 
-| Constant                       | Value          |
-| ------------------------------ | -------------- |
-| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000      |
-| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000    |
-| `BLOBS_PER_CHECKPOINT`          | 3            |
-| `BLOB_GAS_PER_BLOB`             | 2^17         |
-| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9          |
-| `LAG`                           | 2 slots      |
-| `LIFETIME`                      | 5 slots      |
+| Constant                        | Value          |
+| ------------------------------- | -------------- |
+| `L1_GAS_PER_CHECKPOINT_PROPOSED` | 300,000       |
+| `L1_GAS_PER_EPOCH_VERIFIED`     | 3,600,000      |
+| `BLOBS_PER_CHECKPOINT` (FeeLib) | 3              |
+| `BLOB_GAS_PER_BLOB`             | 2^17           |
+| `MINIMUM_CONGESTION_MULTIPLIER` | 1e9            |
+| `LAG`                           | 2 slots        |
+| `LIFETIME`                      | 5 slots        |
+| `MIN_ETH_PER_FEE_ASSET`         | 100 (1e-10 ETH) |
+| `MAX_ETH_PER_FEE_ASSET`         | 1e14 (100 ETH) |
+
+⚠️ Name clash: `FeeLib.sol` (and its port `fee_math.ts`) defines `BLOBS_PER_CHECKPOINT = 3`,
+used only to price the sequencer's blob costs. The protocol constant of the same name in
+`@aztec/constants` is **6** — the actual blob capacity of a checkpoint, used throughout the
+limits section below. The FeeLib value is a holdover from the pre-checkpoint
+`BLOBS_PER_BLOCK`, so the fee model prices half of a full checkpoint's blobs.
+
+## Gas and Data Limits
+
+The fee model above is *how much you pay* per unit of gas; this section is *how much you may use*. Limits
+form a hierarchy from a single transaction up to a whole checkpoint, and a tx that is admissible for relay
+must also be buildable into a block and fit a valid checkpoint.
+
+### Per-tx protocol maxima
+
+Hard ceilings on what any single tx may declare, independent of network configuration. Declaring more is
+rejected everywhere a tx is validated.
+
+- **`MAX_TX_DA_GAS`** (271,200) — `MAX_TX_BLOB_DATA_SIZE_IN_FIELDS` (8,475) × `DA_GAS_PER_FIELD` (32). This
+  is the most DA a single tx's effects can encode into a blob, so it is the most DA gas a tx could ever use.
+  Defined in `constants/src/constants.ts`.
+- **`MAX_PROCESSABLE_L2_GAS`** (6,540,000) — the AVM's maximum processable L2 gas, derived in Noir as
+  `PUBLIC_TX_L2_GAS_OVERHEAD + AVM_MAX_PROCESSABLE_L2_GAS` (`constants/src/constants.gen.ts`).
+
+### Network admission limits
+
+The most a single tx may *declare* and still be relayed across the network. Computed by
+`computeNetworkTxGasLimits` in `tx_gas_limits.ts` per dimension as:
+
+```
+min(per-tx max, ceil(checkpointBudget / blocksPerCheckpoint * minMultiplier))
+```
+
+The per-block share mirrors what a proposer grants the first block of a checkpoint
+(`CheckpointBuilder.capLimitsByCheckpointBudgets`), so a tx declaring this much is packable into a block.
+The network-minimum multipliers are `MIN_PER_BLOCK_ALLOCATION_MULTIPLIER` (1.2, L2 and tx count) and
+`MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER` (1.5, DA). DA's is higher so a maximal contract class
+registration (~97k DA gas) fits a single block at mainnet geometry (72s slots, 6s blocks → 10 blocks per
+checkpoint).
+
+The DA budget is `getDaCheckpointBudgetForTxs(maxBlocksPerCheckpoint)`, not the raw
+`MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT` (786,432). Blob encoding spends overhead fields that no tx pays DA
+gas for — one checkpoint-end marker field and the per-block block-end fields (7 for the first block, 6 for
+each subsequent block, `blob-lib/src/encoding/block_blob_data.ts`) — so the raw constant is unattainable. The
+getter nets out the full overhead for a checkpoint of `maxBlocksPerCheckpoint` blocks: at mainnet geometry
+(10 blocks) that is `(24,576 − 1 − 7 − 9×6) × 32 = 24,514 × 32 = 784,448` DA gas. Subtracting every block's
+overhead (not just the first) keeps admission at or below the builder's first-block blob-field cap at every
+geometry — the builder is the most generous for the first block (it only reserves that block's own block-end
+overhead), so being conservative here is what guarantees admitted ⇒ buildable. Without this netting a tx
+near the raw limit would be admitted but never buildable.
+
+These limits depend on network-wide inputs only (timetable-derived blocks-per-checkpoint, checkpoint
+budgets, the network-minimum multipliers), never on a node's local restrictiveness. Every node always
+advertises them in `NodeInfo.txsLimits` (a required field); wallets read it and pass `txsLimits.gas` to
+`GasSettings.fallback` as the default gas limits when sending without explicit limits, and they are enforced
+by `GasLimitsValidator` (clamped to the per-tx protocol maxima) at three points: RPC tx acceptance
+(`aztec-node/src/aztec-node/server.ts`), gossip validation (`p2p/src/services/libp2p/libp2p_service.ts`),
+and pending-pool admission (`p2p/src/client/factory.ts`). They are deliberately *not* enforced at req/resp or
+block-proposal validation — admission is relay policy, not block validity.
+
+### Per-block builder budgets
+
+While packing a checkpoint, `CheckpointBuilder.capLimitsByCheckpointBudgets`
+(`validator-client/src/checkpoint_builder.ts`) computes each block's budget as a fair share of the remaining
+checkpoint budget across the remaining blocks, scaled by the configured multipliers. Operators may raise the
+multipliers above the network minimums but not lower them — the sequencer fails startup otherwise
+(`assertConfigMeetsNetworkTxLimits` in `sequencer-client/src/sequencer/sequencer.ts`), since a node that
+allocates less than it admits would accept txs over RPC/gossip that its builder can never pack.
+
+The fair share is then min'ed with the operator's absolute per-block caps `maxL2BlockGas` / `maxDABlockGas`
+and the blob-field cap (checkpoint capacity net of the checkpoint-end marker and this block's block-end
+overhead). The absolute caps are allowed to be restrictive: a cap below the network admission limit only
+produces a startup warning, not a failure, because such txs simply stay in the pool for other proposers to
+include.
+
+### Per-checkpoint budgets
+
+The outermost limits, enforced as proposal validity in `validateCheckpointLimits`
+(`stdlib/src/checkpoint/validate.ts`) and physically by blob encoding:
+
+- **Mana** — total L2 gas across all blocks ≤ `rollupManaLimit` (= `manaTarget × 2` on L1,
+  `l1-contracts/src/core/libraries/rollup/FeeLib.sol`).
+- **DA gas** — total DA gas ≤ raw `MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT` (786,432).
+- **Blob fields** — total ≤ `BLOBS_PER_CHECKPOINT × FIELDS_PER_BLOB` (6 × 4,096 = 24,576).
+- **Tx counts** — total txs ≤ `maxTxsPerCheckpoint` when configured.
+
+### Summary
+
+| Limit                                   | Value (mainnet defaults)        | Scope         | Where enforced                                              |
+| --------------------------------------- | ------------------------------- | ------------- | ----------------------------------------------------------- |
+| `MAX_TX_DA_GAS`                         | 271,200                         | per-tx        | every gas validator (hard ceiling)                          |
+| `MAX_PROCESSABLE_L2_GAS`                | 6,540,000                       | per-tx        | every gas validator (hard ceiling)                          |
+| Network DA admission limit              | min(271,200, ceil(784,448/10×1.5)) = 117,668 | per-tx (relay) | RPC, gossip, pending pool (`GasLimitsValidator`)         |
+| Network L2 admission limit              | min(6,540,000, ceil(manaLimit/10×1.2)) | per-tx (relay) | RPC, gossip, pending pool (`GasLimitsValidator`)         |
+| Per-block fair share + caps             | remaining budget / blocks × multiplier, min absolute caps & blob-field cap | per-block | `CheckpointBuilder.capLimitsByCheckpointBudgets`         |
+| `rollupManaLimit`                       | `manaTarget × 2`                | per-checkpoint | `validateCheckpointLimits`                                |
+| `MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT` | 786,432                         | per-checkpoint | `validateCheckpointLimits` + blob encoding                |
+| `BLOBS_PER_CHECKPOINT × FIELDS_PER_BLOB`| 24,576                          | per-checkpoint | `validateCheckpointLimits` + blob encoding                |
 
 ## TypeScript Types
 
-- **`Gas`** — mana quantity in two dimensions (`daGas`, `l2Gas`).
+- **`Gas`** — gas quantity in two dimensions (`daGas`, `l2Gas`).
 - **`GasFees`** — per-unit price in each dimension (`feePerDaGas`, `feePerL2Gas`).
 - **`GasSettings`** — sender-chosen fee parameters: gas limits, teardown limits, max fees, priority fees.
 - **`GasUsed`** — actual consumption after execution. Note: `billedGas` uses the teardown gas *limit*, not actual usage.
+- **`fee_math.ts`** — TypeScript port of the FeeLib formulas, used for fee prediction over the oracle LAG window.

package/src/gas/gas_settings.ts

@@ -8,13 +8,6 @@ import { z } from 'zod';
 import { Gas, GasDimensions } from './gas.js';
 import { GasFees } from './gas_fees.js';
 
-/** Approximate max DA gas limit. Arbitrary, assuming 4 blocks per checkpoint — users should use gas estimation. */
-export const APPROXIMATE_MAX_DA_GAS_PER_BLOCK = Math.floor(MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT / 4);
-/** Fallback teardown L2 gas limit. Arbitrary — users should use gas estimation. */
-export const FALLBACK_TEARDOWN_L2_GAS_LIMIT = Math.floor(MAX_PROCESSABLE_L2_GAS / 8);
-/** Fallback teardown DA gas limit. Arbitrary — users should use gas estimation. */
-export const FALLBACK_TEARDOWN_DA_GAS_LIMIT = Math.floor(APPROXIMATE_MAX_DA_GAS_PER_BLOCK / 2);
-
 // For gas estimation, we use intentionally high limits above what the network can process,
 // so the simulation runs without hitting gas caps. Since teardown gas is counted towards total,
 // the total estimation limit is teardown + max processable.
@@ -106,31 +99,28 @@ export class GasSettings {
 
   /**
    * Fills in gas limits high enough for transactions to be included in most cases.
-   * gasLimits is set to the maximum the protocol allows; since teardown gas is reserved
-   * from gasLimits during private execution (see gas_meter.nr), the effective gas available
-   * for app logic will be gasLimits - teardownGasLimits - privateOverhead.
-   * The DA gas limit is set to an approximate max per block assuming 4 blocks per checkpoint,
-   * since using the maximum per checkpoint would cause nodes to reject transactions.
+   * Callers must supply `gasLimits` — typically the most a single tx may declare on the network
+   * (`min(per-tx max, per-block allocation)`), i.e. a node's advertised `txsLimits.gas`. Since teardown gas
+   * is reserved from gasLimits during private execution (see gas_meter.nr), the effective gas available for
+   * app logic is gasLimits - teardownGasLimits - privateOverhead; the teardown default is derived from the
+   * effective total so it always stays below it.
    * These values won't work if:
    *  - Teardown consumes more than the arbitrarily assigned fallback limits
    *  - The rest of the transaction consumes more than the remaining gas after teardown
    *  - The DA gas limit is too low for the transaction, while still within the checkpoint limit
    */
   static fallback(overrides: {
-    gasLimits?: Gas;
+    gasLimits: Gas;
     teardownGasLimits?: Gas;
     maxFeesPerGas: GasFees;
     maxPriorityFeesPerGas?: GasFees;
   }) {
+    const gasLimits = overrides.gasLimits;
+    const teardownGasLimits =
+      overrides.teardownGasLimits ?? new Gas(Math.floor(gasLimits.daGas / 2), Math.floor(gasLimits.l2Gas / 8));
     return GasSettings.from({
-      gasLimits: overrides.gasLimits ?? {
-        l2Gas: MAX_PROCESSABLE_L2_GAS,
-        daGas: APPROXIMATE_MAX_DA_GAS_PER_BLOCK,
-      },
-      teardownGasLimits: overrides.teardownGasLimits ?? {
-        l2Gas: FALLBACK_TEARDOWN_L2_GAS_LIMIT,
-        daGas: FALLBACK_TEARDOWN_DA_GAS_LIMIT,
-      },
+      gasLimits,
+      teardownGasLimits,
       maxFeesPerGas: overrides.maxFeesPerGas,
       maxPriorityFeesPerGas: overrides.maxPriorityFeesPerGas ?? GasFees.empty(),
     });

package/src/gas/index.ts

@@ -3,3 +3,4 @@ export * from './gas.js';
 export * from './gas_fees.js';
 export * from './gas_settings.js';
 export * from './gas_used.js';
+export * from './tx_gas_limits.js';

package/src/gas/tx_gas_limits.ts

@@ -0,0 +1,123 @@
+import {
+  NUM_BLOCK_END_BLOB_FIELDS,
+  NUM_CHECKPOINT_END_MARKER_FIELDS,
+  NUM_FIRST_BLOCK_END_BLOB_FIELDS,
+} from '@aztec/blob-lib/encoding';
+import {
+  BLOBS_PER_CHECKPOINT,
+  DA_GAS_PER_FIELD,
+  FIELDS_PER_BLOB,
+  MAX_PROCESSABLE_L2_GAS,
+  MAX_TX_DA_GAS,
+} from '@aztec/constants';
+
+import { type ProposerTimetableConfig, buildProposerTimetable } from '../timetable/build_proposer_timetable.js';
+import type { SlotTimingConstants } from '../timetable/consensus_timetable.js';
+import { Gas } from './gas.js';
+
+/**
+ * Network-minimum per-block budget multiplier for L2 gas and tx-count allocation. A block packer must
+ * grant at least this share of the even per-block split to a single tx; operators may configure a higher
+ * multiplier (more generous), but not a lower one — enforced at sequencer startup. Also used as the default
+ * for `SequencerConfig.perBlockAllocationMultiplier`.
+ */
+export const MIN_PER_BLOCK_ALLOCATION_MULTIPLIER = 1.2;
+
+/**
+ * Network-minimum per-block budget multiplier for DA gas, applied in place of the general
+ * {@link MIN_PER_BLOCK_ALLOCATION_MULTIPLIER}. Higher than the general multiplier so the largest tx we
+ * want to support — a maximal contract class registration (~97k DA gas) — fits a single block under v5
+ * mainnet geometry (72s slots, 6s blocks → 10 blocks per checkpoint). A builder may configure a higher
+ * multiplier but never a lower one. Also used as the default for
+ * `SequencerConfig.perBlockDAAllocationMultiplier`.
+ */
+export const MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER = 1.5;
+
+/**
+ * The DA gas budget available to tx data within a checkpoint of `maxBlocksPerCheckpoint` blocks. This is the
+ * raw blob capacity (`BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB * DA_GAS_PER_FIELD`) minus the fields the blob
+ * encoding reserves for overhead that no tx pays DA gas for:
+ *
+ * - one checkpoint-end marker field (`NUM_CHECKPOINT_END_MARKER_FIELDS`),
+ * - the first block's block-end fields (`NUM_FIRST_BLOCK_END_BLOB_FIELDS`, 7), and
+ * - `NUM_BLOCK_END_BLOB_FIELDS` (6) for each of the `blocks - 1` subsequent blocks.
+ *
+ * Subtracting the overhead for every block (not just the first) keeps the network DA admission limit at or
+ * below the builder's first-block blob-field cap at every geometry. The builder is the MOST generous for the
+ * first block — it only reserves that block's own block-end overhead — so being conservative here (assuming
+ * the checkpoint is full of blocks, each spending its share) is what guarantees admitted ⇒ buildable: a tx
+ * admitted under this budget always fits the first block's blob-field cap, regardless of how many blocks the
+ * builder ends up packing.
+ *
+ * @param maxBlocksPerCheckpoint - Number of blocks the checkpoint may contain; clamped to at least 1.
+ */
+export function getDaCheckpointBudgetForTxs(maxBlocksPerCheckpoint: number): number {
+  const blocks = Math.max(1, maxBlocksPerCheckpoint);
+  // Clamp at zero: for absurd geometries (blocks greater than ~4094) the per-block overhead alone exceeds the
+  // raw blob capacity, which would otherwise yield a negative advertised DA budget.
+  const fields = Math.max(
+    0,
+    BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB -
+      NUM_CHECKPOINT_END_MARKER_FIELDS -
+      NUM_FIRST_BLOCK_END_BLOB_FIELDS -
+      (blocks - 1) * NUM_BLOCK_END_BLOB_FIELDS,
+  );
+  return fields * DA_GAS_PER_FIELD;
+}
+
+/**
+ * Computes the maximum gas a single tx may declare on a network: the smaller of the per-tx protocol
+ * maximum and the per-block allocation a proposer grants to the first block of a checkpoint. The per-block
+ * allocation mirrors `CheckpointBuilder.capLimitsByCheckpointBudgets`
+ * (`ceil(checkpointBudget / maxBlocksPerCheckpoint * multiplier)`) using the network-minimum multipliers, so
+ * a tx declaring this much is admissible into a block under that geometry.
+ *
+ * This is a *network* limit: a function of network-wide constants only (timetable-derived
+ * blocks-per-checkpoint, checkpoint budgets, the network-minimum multipliers). It must NOT depend on a
+ * node's local restrictiveness — its multipliers configured above the network minimum, or its
+ * `maxDABlockGas` / `validateMaxDABlockGas` caps — because those make a node stricter at block-building
+ * time but cannot define what the network considers a valid tx for relay. The same value is advertised by
+ * `getNodeInfo` and enforced by the RPC/gossip/pool gas validators.
+ *
+ * The DA budget is {@link getDaCheckpointBudgetForTxs} evaluated at the clamped blocks-per-checkpoint — the
+ * raw blob capacity net of encoding overhead for every block — so the admission limit is consistent with the
+ * builder's blob-field cap.
+ *
+ * @param manaCheckpointBudget - L2 (mana) budget per checkpoint (`rollupManaLimit`).
+ */
+export function computeNetworkTxGasLimits(opts: { maxBlocksPerCheckpoint: number; manaCheckpointBudget: number }): Gas {
+  const blocks = Math.max(1, opts.maxBlocksPerCheckpoint);
+  const daBudget = getDaCheckpointBudgetForTxs(blocks);
+
+  // Clamp by the whole-checkpoint budget too: at small block counts the per-block share scaled by the
+  // multiplier can exceed the checkpoint budget itself (e.g. at blocks=1 a >1 multiplier overshoots), which
+  // would admit a tx no builder can ever pack — the builder caps each block by the remaining budget. Clamping
+  // by the budget makes "admitted ⇒ buildable" unconditional. (For DA the per-tx maximum always binds first,
+  // so the budget clamp is currently moot, but it keeps the invariant explicit.)
+  const daGas = Math.min(
+    MAX_TX_DA_GAS,
+    daBudget,
+    Math.ceil((daBudget / blocks) * MIN_PER_BLOCK_DA_ALLOCATION_MULTIPLIER),
+  );
+  const l2Gas = Math.min(
+    MAX_PROCESSABLE_L2_GAS,
+    opts.manaCheckpointBudget,
+    Math.ceil((opts.manaCheckpointBudget / blocks) * MIN_PER_BLOCK_ALLOCATION_MULTIPLIER),
+  );
+
+  return new Gas(daGas, l2Gas);
+}
+
+/**
+ * Network tx gas limits derived from a sequencer/p2p config and the L1 slot-timing + mana constants. The
+ * single source of truth shared by `getNodeInfo` (advertising) and the RPC/gossip/pool gas validators
+ * (enforcing), so a node never rejects a tx it advertised as admissible. Always uses the network-minimum
+ * multipliers, never the node's (possibly higher) configured multipliers.
+ */
+export function getNetworkTxGasLimits(
+  config: ProposerTimetableConfig,
+  l1Constants: SlotTimingConstants & { rollupManaLimit: number },
+): Gas {
+  const maxBlocksPerCheckpoint = buildProposerTimetable(config, l1Constants).getMaxBlocksPerCheckpoint();
+  return computeNetworkTxGasLimits({ maxBlocksPerCheckpoint, manaCheckpointBudget: l1Constants.rollupManaLimit });
+}

package/src/ha-signing/config.ts

@@ -25,8 +25,20 @@ export type BaseSignerConfig = {
   nodeId: string;
   /** How long to wait between polls when a duty is being signed (ms) */
   pollingIntervalMs: number;
-  /** Maximum time to wait for a duty being signed to complete (ms) */
-  signingTimeoutMs: number;
+  /**
+   * How long (ms) to wait for a peer node's in-progress signing before giving up and treating the
+   * duty as already handled. This is the cross-node wait/poll timeout, distinct from
+   * signerCallTimeoutMs (the hard upper bound on this node's own signer call).
+   */
+  peerSigningTimeoutMs: number;
+  /**
+   * Hard upper bound (ms) on a single signer call made by this node. If the (possibly remote)
+   * signer does not return within this time, the call is aborted, the duty lock is released, and
+   * signing fails so it can be safely retried. The effective value is clamped to
+   * maxStuckDutiesAgeMs / 2 at construction, so a slow signer's lock is always released before
+   * stuck-duty cleanup could reclaim it. Defaults to 30_000 when unset.
+   */
+  signerCallTimeoutMs?: number;
   /** Maximum age of a stuck duty in ms (defaults to 2x hardcoded Aztec slot duration if not set) */
   maxStuckDutiesAgeMs?: number;
   /** Optional: clean up old duties after this many hours (disabled if not set) */
@@ -44,11 +56,16 @@ export const baseSignerConfigMappings: ConfigMappingsType<BaseSignerConfig> = {
     description: 'The number of ms to wait between polls when a duty is being signed',
     ...numberConfigHelper(100),
   },
-  signingTimeoutMs: {
+  peerSigningTimeoutMs: {
     env: 'VALIDATOR_HA_SIGNING_TIMEOUT_MS',
-    description: 'The maximum time to wait for a duty being signed to complete',
+    description: "How long to wait for a peer node's in-progress signing before giving up",
     ...numberConfigHelper(3_000),
   },
+  signerCallTimeoutMs: {
+    env: 'VALIDATOR_SIGNER_CALL_TIMEOUT_MS',
+    description: 'Hard upper bound in ms on a single signer call before it is aborted (default 30000)',
+    ...numberConfigHelper(30_000),
+  },
   maxStuckDutiesAgeMs: {
     env: 'VALIDATOR_HA_MAX_STUCK_DUTIES_AGE_MS',
     description: 'The maximum age of a stuck duty in ms (defaults to 2x Aztec slot duration)',
@@ -65,7 +82,8 @@ export const baseSignerConfigMappings: ConfigMappingsType<BaseSignerConfig> = {
 export const BaseSignerConfigSchema = z.object({
   nodeId: z.string(),
   pollingIntervalMs: z.number().min(0),
-  signingTimeoutMs: z.number().min(0),
+  peerSigningTimeoutMs: z.number().min(0),
+  signerCallTimeoutMs: z.number().min(0).optional(),
   maxStuckDutiesAgeMs: z.number().min(0).optional(),
   cleanupOldDutiesAfterHours: z.number().min(0).optional(),
   ...pickL1ContractAddressesSchema('rollupAddress'),

package/src/ha-signing/local_config.ts

@@ -1,4 +1,9 @@
-import { type ConfigMappingsType, getConfigFromMappings, optionalNumberConfigHelper } from '@aztec/foundation/config';
+import {
+  type ConfigMappingsType,
+  booleanConfigHelper,
+  getConfigFromMappings,
+  optionalNumberConfigHelper,
+} from '@aztec/foundation/config';
 import { zodFor } from '@aztec/foundation/schemas';
 import { type DataStoreConfig, dataConfigMappings } from '@aztec/stdlib/kv-store';
 
@@ -17,6 +22,12 @@ export type LocalSignerConfig = BaseSignerConfig &
   DataStoreConfig & {
     /** Maximum size of the local signing-protection LMDB store in KB. Overwrites the general dataStoreMapSizeKb. */
     signingProtectionMapSizeKb?: number;
+    /**
+     * Allow local signing protection to run against an ephemeral store when no data directory is set.
+     * Without this, a missing data directory fails startup, since ephemeral protection does not survive
+     * restarts. Intended for dev/test networks only; production validators must persist to disk.
+     */
+    allowEphemeralSigningProtection?: boolean;
   };
 
 export const localSignerConfigMappings: ConfigMappingsType<LocalSignerConfig> = {
@@ -28,6 +39,13 @@ export const localSignerConfigMappings: ConfigMappingsType<LocalSignerConfig> =
       'Maximum size of the local signing-protection LMDB store in KB. Overwrites the general dataStoreMapSizeKb.',
     ...optionalNumberConfigHelper(),
   },
+  allowEphemeralSigningProtection: {
+    env: 'VALIDATOR_ALLOW_EPHEMERAL_SIGNING_PROTECTION',
+    description:
+      'Allow local signing protection to run against an ephemeral store when no data directory is set (dev/test only). ' +
+      'Ephemeral protection does not survive restarts, so this is unsafe for production validators.',
+    ...booleanConfigHelper(false),
+  },
 };
 
 export const LocalSignerConfigSchema = zodFor<LocalSignerConfig>()(
@@ -35,6 +53,7 @@ export const LocalSignerConfigSchema = zodFor<LocalSignerConfig>()(
     dataDirectory: z.string().optional(),
     dataStoreMapSizeKb: z.number(),
     signingProtectionMapSizeKb: z.number().optional(),
+    allowEphemeralSigningProtection: z.boolean().optional(),
   }),
 );
 

package/src/hash/hash.ts

@@ -188,14 +188,6 @@ export function computeSecretHash(secret: Fr): Promise<Fr> {
   return poseidon2HashWithSeparator([secret], DomainSeparator.SECRET_HASH);
 }
 
-export async function computeL1ToL2MessageNullifier(contract: AztecAddress, messageHash: Fr, secret: Fr) {
-  const innerMessageNullifier = await poseidon2HashWithSeparator(
-    [messageHash, secret],
-    DomainSeparator.MESSAGE_NULLIFIER,
-  );
-  return siloNullifier(contract, innerMessageNullifier);
-}
-
 /**
  * Calculates a siloed hash of a scoped l2 to l1 message.
  * @returns Fr containing 248 bits of information of sha256 hash.