@aztec/validator-client 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/dest/proposal_handler.js

@@ -66,19 +66,21 @@ function _ts_dispose_resources(env) {
 import { encodeCheckpointBlobDataFromBlocks, getBlobsPerL1Block } from '@aztec/blob-lib';
 import { INITIAL_L2_BLOCK_NUM } from '@aztec/constants';
 import { validateFeeAssetPriceModifier } from '@aztec/ethereum/contracts';
-import { BlockNumber, CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { BlockNumber, CheckpointNumber } from '@aztec/foundation/branded-types';
 import { pick } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { TimeoutError } from '@aztec/foundation/error';
+import { FifoSet } from '@aztec/foundation/fifo-set';
 import { createLogger } from '@aztec/foundation/log';
 import { retryUntil } from '@aztec/foundation/retry';
 import { DateProvider, Timer } from '@aztec/foundation/timer';
+import { isErrorClass } from '@aztec/foundation/types';
 import { getPreviousCheckpointOutHashes, validateCheckpoint } from '@aztec/stdlib/checkpoint';
-import { getEpochAtSlot, getTimestampForSlot } from '@aztec/stdlib/epoch-helpers';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
 import { Gas } from '@aztec/stdlib/gas';
 import { accumulateCheckpointOutHashes, computeInHashFromL1ToL2Messages } from '@aztec/stdlib/messaging';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
-import { ReExFailedTxsError, ReExInitialStateMismatchError, ReExStateMismatchError, ReExTimeoutError, TransactionsNotAvailableError } from '@aztec/stdlib/validators';
+import { InvalidBlockProposalTxsError, ReExFailedTxsError, ReExInitialStateMismatchError, ReExStateMismatchError, ReExTimeoutError, TransactionsNotAvailableError } from '@aztec/stdlib/validators';
 import { getTelemetryClient } from '@aztec/telemetry-client';
 /**
  * Mapping from a checkpoint-proposal validation failure reason to the tracker outcome that
@@ -90,6 +92,8 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     checkpoint_already_published: undefined,
     last_block_not_found: 'unvalidated',
     block_fetch_error: 'unvalidated',
+    world_state_not_synced: 'unvalidated',
+    initial_archive_mismatch: 'unvalidated',
     no_blocks_for_slot: 'unvalidated',
     last_block_archive_mismatch: 'invalid',
     too_many_blocks_in_checkpoint: 'invalid',
@@ -98,7 +102,45 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     out_hash_mismatch: 'invalid',
     checkpoint_validation_failed: 'invalid'
 };
-/** Handles block and checkpoint proposals for both validator and non-validator nodes. */ export class ProposalHandler {
+const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
+/** Block-proposal validation failures that constitute a slashable invalid-block offense. */ export const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT = [
+    'state_mismatch',
+    'failed_txs',
+    'global_variables_mismatch',
+    'invalid_proposal',
+    'parent_block_wrong_slot',
+    'in_hash_mismatch',
+    'duplicate_txs',
+    'invalid_embedded_txs'
+];
+/** Checkpoint-proposal validation failures that constitute a slashable invalid-checkpoint offense. */ export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT = {
+    // enabled
+    ['invalid_fee_asset_price_modifier']: true,
+    ['checkpoint_header_mismatch']: true,
+    // These late mismatches should normally be caught by earlier checks, but if reached after validating the local
+    // checkpoint inputs, the proposer-signed payload disagrees with deterministic recomputation.
+    ['archive_mismatch']: true,
+    ['out_hash_mismatch']: true,
+    ['no_blocks_for_slot']: true,
+    ['too_many_blocks_in_checkpoint']: true,
+    ['checkpoint_validation_failed']: true,
+    ['last_block_archive_mismatch']: true,
+    // disabled
+    ['invalid_signature']: false,
+    ['last_block_not_found']: false,
+    ['block_fetch_error']: false,
+    ['world_state_not_synced']: false,
+    // A reorg / divergent local chain, not a proposer offense (mirrors the block path's initial_state_mismatch).
+    ['initial_archive_mismatch']: false,
+    ['checkpoint_already_published']: false
+};
+/**
+ * Handles block and checkpoint proposals for both validator and non-validator nodes. Also tracks which slots
+ * had a slashable invalid proposal or a proposal equivocation, exposing them via the
+ * `InvalidProposalSlotSource` interface consumed by the attested-invalid-proposal slashing watcher. The
+ * tracking is populated as a side effect of validating/re-executing proposals, so any node that re-executes
+ * proposals (the default) can serve it — not only validators.
+ */ export class ProposalHandler {
     checkpointsBuilder;
     worldState;
     blockSource;
@@ -106,6 +148,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     txProvider;
     blockProposalValidator;
     epochCache;
+    timetable;
     config;
     blobClient;
     reexecutionTracker;
@@ -120,7 +163,9 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     /** Returns current validator addresses for own-proposal detection. Set via register(). */ getOwnValidatorAddresses;
     /** P2P proposal pool access for deciding when retained proposals should block archiver processing. */ p2pClient;
     checkpointProposalValidationFailureCallback;
-    constructor(checkpointsBuilder, worldState, blockSource, l1ToL2MessageSource, txProvider, blockProposalValidator, epochCache, config, blobClient, reexecutionTracker, metrics, dateProvider = new DateProvider(), telemetry = getTelemetryClient(), log = createLogger('validator:proposal-handler')){
+    /** Slots at which a slashable invalid block or checkpoint proposal was observed. */ slotsWithInvalidProposals;
+    /** Slots at which a proposal equivocation was observed; suppresses attested-to-invalid-proposal slashing. */ slotsWithProposalEquivocation;
+    constructor(checkpointsBuilder, worldState, blockSource, l1ToL2MessageSource, txProvider, blockProposalValidator, epochCache, timetable, config, blobClient, reexecutionTracker, metrics, dateProvider = new DateProvider(), telemetry = getTelemetryClient(), log = createLogger('validator:proposal-handler')){
         this.checkpointsBuilder = checkpointsBuilder;
         this.worldState = worldState;
         this.blockSource = blockSource;
@@ -128,12 +173,15 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         this.txProvider = txProvider;
         this.blockProposalValidator = blockProposalValidator;
         this.epochCache = epochCache;
+        this.timetable = timetable;
         this.config = config;
         this.blobClient = blobClient;
         this.reexecutionTracker = reexecutionTracker;
         this.metrics = metrics;
         this.dateProvider = dateProvider;
         this.log = log;
+        this.slotsWithInvalidProposals = FifoSet.withLimit(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+        this.slotsWithProposalEquivocation = FifoSet.withLimit(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
         if (config.fishermanMode) {
             this.log = this.log.createChild('[FISHERMAN]');
         }
@@ -161,6 +209,18 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
    */ recordOwnCheckpointProposalAsValid(slot, archive, checkpointNumber) {
         this.reexecutionTracker.recordOutcome(slot, archive, 'valid', checkpointNumber);
     }
+    /** Whether a slashable invalid block or checkpoint proposal was observed at the given slot (InvalidProposalSlotSource). */ hasInvalidProposals(slotNumber) {
+        return this.slotsWithInvalidProposals.has(slotNumber);
+    }
+    /** Whether a proposal equivocation was observed at the given slot (InvalidProposalSlotSource). */ hasProposalEquivocation(slotNumber) {
+        return this.slotsWithProposalEquivocation.has(slotNumber);
+    }
+    /** Records a slot as having a slashable invalid proposal, for offense observers (sentinel/slasher watchers). */ markInvalidProposalSlot(slotNumber) {
+        this.slotsWithInvalidProposals.add(slotNumber);
+    }
+    /** Records a slot as having a proposal equivocation, which suppresses attested-to-invalid-proposal slashing. */ markProposalEquivocation(slotNumber) {
+        this.slotsWithProposalEquivocation.add(slotNumber);
+    }
     /**
    * Registers handlers for block and checkpoint proposals on the p2p client.
    * Records the p2p client so validation can inspect retained proposals.
@@ -189,6 +249,15 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                     });
                     return true;
                 } else {
+                    // Track invalid proposals / equivocations so offense observers (the attested-invalid-proposal
+                    // watcher) work on non-validator nodes too. Validators populate these via their own handlers.
+                    // Skip invalid-proposal marking while the escape hatch is open, matching the validator path,
+                    // which intentionally disables invalid-block slashing then.
+                    if (result.reason === 'checkpoint_proposal_equivocation') {
+                        this.markProposalEquivocation(slotNumber);
+                    } else if (SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(result.reason) && !await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber)) {
+                        this.markInvalidProposalSlot(slotNumber);
+                    }
                     this.log.warn(`Non-validator block proposal ${blockNumber} at slot ${slotNumber} failed processing with ${result.reason}`, {
                         blockNumber: result.blockNumber,
                         slotNumber,
@@ -202,6 +271,10 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             }
         };
         p2pClient.registerBlockProposalHandler(blockHandler);
+        // p2p detects duplicate (equivocated) proposals without routing them through the handlers above, so mark
+        // the slot as equivocated here. This suppresses false-positive attested-to-invalid-proposal slashing on
+        // non-validator offense collectors. Validators overwrite this with their own richer handler.
+        p2pClient.registerDuplicateProposalCallback((info)=>this.markProposalEquivocation(info.slot));
         // All-nodes checkpoint proposal handler: validates, caches, and sets proposed checkpoint for pipelining.
         // Runs for all nodes (validators and non-validators). Validators get the cached result in the
         // validator-specific callback (attestToCheckpointProposal) which runs after this one.
@@ -221,23 +294,35 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                     this.log.warn(`Escape hatch open for slot ${proposal.slotNumber}, skipping checkpoint proposal validation`, proposalInfo);
                     return undefined;
                 }
-                // For own proposals, skip validation and return: the proposer already built and validated the
-                // checkpoint, and the sequencer's checkpoint proposal job pushed the proposed checkpoint to the
-                // archiver from local data before broadcasting. Gossipsub doesn't echo our own messages back, so
-                // this branch is normally unreachable — it remains as defense if an own proposal arrives by some
-                // other path.
+                // A proposal is "own" when it was signed by a validator key this node also owns. The true local
+                // proposer already built, validated, and stored this checkpoint before broadcasting, so a matching
+                // proposed checkpoint is already in its archiver — skip the redundant re-validation. An HA peer that
+                // shares the proposer's keys sees the same "own" proposal over gossip but never built it, so it has
+                // nothing stored; it falls through to the normal validate-and-persist path below to hydrate the
+                // proposed-checkpoint metadata it needs to build the next slot on top of this checkpoint.
                 const proposer = proposal.getSender();
                 const ownAddresses = this.getOwnValidatorAddresses?.();
                 const isOwnProposal = proposer && ownAddresses?.some((addr)=>addr === proposer.toString());
                 if (isOwnProposal) {
-                    this.log.debug(`Skipping validation for own checkpoint proposal at slot ${proposal.slotNumber}`);
-                    return undefined;
+                    const existing = await this.archiver?.getProposedCheckpointData({
+                        slot: proposal.slotNumber
+                    });
+                    if (existing?.archive.root.equals(proposal.archive)) {
+                        this.log.debug(`Skipping sync for existing own checkpoint proposal at slot ${proposal.slotNumber}`);
+                        return undefined;
+                    }
                 }
                 const result = await this.handleCheckpointProposal(proposal, proposalInfo);
                 if (!result.isValid) {
+                    // Track invalid checkpoint proposals so offense observers (the attested-invalid-proposal watcher)
+                    // work on non-validator nodes too. This handler runs for all nodes; validators also mark via the
+                    // failure callback below (idempotent).
+                    if (SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason]) {
+                        this.markInvalidProposalSlot(proposal.slotNumber);
+                    }
                     await this.checkpointProposalValidationFailureCallback?.(proposal, result, proposalInfo);
-                } else if (this.archiver && this.epochCache.isProposerPipeliningEnabled()) {
-                    const set = await this.setProposedCheckpointFromValidation(proposal);
+                } else if (this.archiver) {
+                    const set = await this.setProposedCheckpoint(proposal);
                     if (set) {
                         this.metrics?.recordCheckpointProposalToPipelinedStateDuration(pipeliningTimer.ms());
                     }
@@ -255,7 +340,6 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     async handleBlockProposal(proposal, proposalSender, shouldReexecute) {
         const slotNumber = proposal.slotNumber;
         const proposer = proposal.getSender();
-        const config = this.checkpointsBuilder.getConfig();
         // Reject proposals with invalid signatures
         if (!proposer) {
             this.log.warn(`Received proposal with invalid signature for slot ${slotNumber}`);
@@ -284,6 +368,22 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                 reason: 'invalid_proposal'
             };
         }
+        // A tx can only appear once in a block: the second copy would emit nullifiers already emitted by the
+        // first. This is not a relaying-peer fault, so it passes gossip validation and is classified here as
+        // proposer misbehavior. Tx collection also reconciles a deduplicated hash set against the full list,
+        // so it must not be handed a proposal with repeated hashes.
+        const uniqueTxHashes = new Set(proposal.txHashes.map((txHash)=>txHash.toString()));
+        if (uniqueTxHashes.size !== proposal.txHashes.length) {
+            this.log.warn(`Proposal lists duplicate tx hashes, skipping processing`, {
+                ...proposalInfo,
+                txCount: proposal.txHashes.length,
+                uniqueTxCount: uniqueTxHashes.size
+            });
+            return {
+                isValid: false,
+                reason: 'duplicate_txs'
+            };
+        }
         const retainedSlotValidation = await this.validateNewBlockInSlot(proposal);
         if (!retainedSlotValidation.isValid) {
             this.log.info(`Block proposal conflicts with retained proposals, skipping archiver processing`, {
@@ -297,23 +397,9 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                 reason: retainedSlotValidation.reason
             };
         }
-        // Ensure the block source is synced before checking for existing blocks,
-        // since a proposed checkpoint prune may remove blocks we'd otherwise find.
-        // This affects mostly the block_number_already_exists check, since a pending
-        // checkpoint prune could remove a block that would conflict with this proposal.
-        // When pipelining is enabled, the proposer builds ahead of L1 submission, so the
-        // block source won't have synced to the proposed slot yet. Skip the sync wait to
-        // avoid eating into the attestation window.
-        if (!this.epochCache.isProposerPipeliningEnabled()) {
-            const blockSourceSync = await this.waitForBlockSourceSync(slotNumber);
-            if (!blockSourceSync) {
-                this.log.warn(`Block source is not synced, skipping processing`, proposalInfo);
-                return {
-                    isValid: false,
-                    reason: 'block_source_not_synced'
-                };
-            }
-        }
+        // The proposer builds ahead of L1 submission under pipelining, so the block source won't have
+        // synced to the proposed slot yet. We deliberately do not wait for it to sync here, to avoid
+        // eating into the attestation window.
         // Check that the parent proposal is a block we know, otherwise reexecution would fail.
         // If we don't find it immediately, we keep retrying for a while; it may be we still
         // need to process other block proposals to get to it.
@@ -340,10 +426,12 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         // Compute the block number based on the parent block
         const blockNumber = parentBlock === 'genesis' ? BlockNumber(INITIAL_L2_BLOCK_NUM) : BlockNumber(parentBlock.header.getBlockNumber() + 1);
         proposalInfo.blockNumber = blockNumber;
-        // Check that this block number does not exist already
-        const existingBlock = await this.blockSource.getBlockData({
-            number: blockNumber
-        });
+        // Check that this block number does not exist already. During a reorg the archiver can still hold a
+        // stale block at this number (a different archive, about to be pruned) while the proposal carries the
+        // rebuilt replacement; resolveExistingBlockAtNumber waits for the local prune in that case so the
+        // rebuilt block is processed in time to attest, rather than being permanently dropped on a bare
+        // number collision.
+        const existingBlock = await this.resolveExistingBlockAtNumber(blockNumber, proposal.archive, slotNumber);
         if (existingBlock) {
             this.log.warn(`Block number ${blockNumber} already exists, skipping processing`, proposalInfo);
             return {
@@ -354,10 +442,15 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         }
         // Collect txs from the proposal. We start doing this as early as possible,
         // and we do it even if we don't plan to re-execute the txs, so that we have them if another node needs them.
-        const { txs, missingTxs } = await this.txProvider.getTxsForBlockProposal(proposal, blockNumber, {
-            pinnedPeer: proposalSender,
-            deadline: this.getReexecutionDeadline(slotNumber, config)
-        });
+        const collected = await this.collectProposalTxs(proposal, blockNumber, proposalSender, proposalInfo);
+        if (collected === 'invalid_embedded_txs') {
+            return {
+                isValid: false,
+                blockNumber,
+                reason: collected
+            };
+        }
+        const { txs, missingTxs } = collected;
         // Record the tx-collection outcome on the re-execution tracker
         this.reexecutionTracker.recordTxsCollected(slotNumber, proposal.indexWithinCheckpoint, missingTxs.length === 0);
         // If reexecution is disabled, bail. We were just interested in triggering tx collection.
@@ -416,7 +509,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             epoch,
             checkpointNumber,
             l1Constants: this.epochCache.getL1Constants(),
-            pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled(),
+            pipeliningEnabled: true,
             log: this.log
         });
         // Try re-executing the transactions in the proposal if needed
@@ -435,7 +528,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             };
         }
         // If we succeeded, push this block into the archiver (unless disabled)
-        if (reexecutionResult?.block && this.config.skipPushProposedBlocksToArchiver === false) {
+        if (reexecutionResult?.block && !this.config.skipPushProposedBlocksToArchiver) {
             await this.blockSource.addBlock(reexecutionResult.block);
         }
         this.log.info(`Successfully re-executed block ${blockNumber} proposal at index ${proposal.indexWithinCheckpoint} on slot ${slotNumber}`, {
@@ -448,6 +541,32 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             reexecutionResult
         };
     }
+    /**
+   * Collects the txs for a proposal, returning `invalid_embedded_txs` if the proposal carries a tx that fails
+   * minimum integrity validation. That is proposer misbehavior — the proposal signs both the tx hashes and the
+   * tx objects — so the caller turns it into an invalid-proposal result that reaches slashing and invalid-slot
+   * accounting, rather than letting it escape as an exception. Any other collection error is a local failure
+   * and keeps propagating.
+   */ async collectProposalTxs(proposal, blockNumber, proposalSender, proposalInfo) {
+        try {
+            return await this.txProvider.getTxsForBlockProposal(proposal, blockNumber, {
+                pinnedPeer: proposalSender,
+                deadline: this.getReexecutionDeadline(proposal.slotNumber)
+            });
+        } catch (error) {
+            if (!isErrorClass(error, InvalidBlockProposalTxsError)) {
+                throw error;
+            }
+            this.log.warn(`Block proposal carries ${error.invalidTxs.length} invalid txs`, {
+                ...proposalInfo,
+                invalidTxs: error.invalidTxs.map(({ txHash, reasons })=>({
+                        txHash: txHash.toString(),
+                        reasons
+                    }))
+            });
+            return 'invalid_embedded_txs';
+        }
+    }
     async validateNewBlockInSlot(blockProposal) {
         if (!this.p2pClient) {
             return {
@@ -477,20 +596,21 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
     }
     async getParentBlock(proposal) {
         const parentArchive = proposal.blockHeader.lastArchive.root;
-        const config = this.checkpointsBuilder.getConfig();
         const { genesisArchiveRoot } = await this.blockSource.getGenesisValues();
         if (parentArchive.equals(genesisArchiveRoot)) {
             return 'genesis';
         }
-        const deadline = this.getReexecutionDeadline(proposal.slotNumber, config);
-        const currentTime = this.dateProvider.now();
-        const timeoutDurationMs = deadline.getTime() - currentTime;
+        const deadline = this.getReexecutionDeadline(proposal.slotNumber);
+        const timeoutDurationMs = deadline.getTime() - this.dateProvider.now();
         try {
             return await this.blockSource.getBlockData({
                 archive: parentArchive
             }) ?? (timeoutDurationMs <= 0 ? undefined : await retryUntil(()=>this.blockSource.syncImmediate().then(()=>this.blockSource.getBlockData({
                         archive: parentArchive
-                    })), 'force archiver sync', timeoutDurationMs / 1000, 0.5));
+                    })), 'force archiver sync', {
+                deadline,
+                dateProvider: this.dateProvider
+            }, 0.5));
         } catch (err) {
             if (err instanceof TimeoutError) {
                 this.log.debug(`Timed out getting parent block by archive root`, {
@@ -504,6 +624,60 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             return undefined;
         }
     }
+    /**
+   * Resolves whether a block genuinely already exists at `blockNumber`. Returns the existing block only if
+   * it is a true duplicate of the proposal (matching archive). During a reorg the archiver can still hold a
+   * stale fork at this number (different archive) that is about to be pruned; in that case this forces L1
+   * sync and waits, bounded by the re-execution deadline, for the prune to land, then returns `undefined` so
+   * the rebuilt block proposal can be processed in time to attest. If the prune does not complete before the
+   * deadline it returns the stale block, so the caller falls back to the safe `block_number_already_exists`
+   * rejection.
+   */ async resolveExistingBlockAtNumber(blockNumber, proposalArchive, slotNumber) {
+        const existingBlock = await this.blockSource.getBlockData({
+            number: blockNumber
+        });
+        if (!existingBlock || existingBlock.archive.root.equals(proposalArchive)) {
+            return existingBlock;
+        }
+        // A different block already occupies this number: it may be a stale fork being pruned during a reorg, not a
+        // genuine duplicate. Wait for the local prune rather than permanently rejecting the proposal.
+        const deadline = this.getReexecutionDeadline(slotNumber);
+        if (deadline.getTime() - this.dateProvider.now() <= 0) {
+            return existingBlock;
+        }
+        this.log.warn(`Block number ${blockNumber} already exists, awaiting potential prune`, {
+            blockNumber,
+            existingArchive: existingBlock.archive.root.toString(),
+            proposalArchive: proposalArchive.toString()
+        });
+        try {
+            const { block } = await retryUntil(async ()=>{
+                await this.blockSource.syncImmediate();
+                const block = await this.blockSource.getBlockData({
+                    number: blockNumber
+                });
+                // Resolve once the existing block is gone (pruned) or has been replaced by one matching the
+                // proposal — the same condition as the early return above. A matching block is returned so the
+                // caller still treats it as a genuine duplicate; an `undefined` (pruned) block lets the proposal
+                // be processed. Wrap in an object so the `undefined` case is still a truthy retry result.
+                return block === undefined || block.archive.root.equals(proposalArchive) ? {
+                    block
+                } : undefined;
+            }, `prune of stale block ${blockNumber}`, {
+                deadline,
+                dateProvider: this.dateProvider
+            }, 0.5);
+            return block;
+        } catch (err) {
+            if (err instanceof TimeoutError) {
+                this.log.warn(`Timed out waiting for stale block ${blockNumber} to be pruned`, {
+                    blockNumber
+                });
+                return existingBlock;
+            }
+            throw err;
+        }
+    }
     computeCheckpointNumber(proposal, parentBlock, proposalInfo) {
         if (parentBlock === 'genesis') {
             // First block is in checkpoint 1
@@ -632,40 +806,13 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         }
         return undefined;
     }
-    getReexecutionDeadline(slotNumber, config) {
-        // Under proposer pipelining, the proposal slot may be ahead of wall clock time.
-        // Reexecution budgets should still be bounded by the current slot we are in now.
-        const wallclockSlot = slotNumber - this.epochCache.pipeliningOffset();
-        const nextSlotTimestampSeconds = Number(getTimestampForSlot(SlotNumber(wallclockSlot + 1), config));
-        return new Date(nextSlotTimestampSeconds * 1000);
-    }
-    /** Waits for the block source to sync L1 data up to at least the slot before the given one. */ async waitForBlockSourceSync(slot) {
-        const deadline = this.getReexecutionDeadline(slot, this.checkpointsBuilder.getConfig());
-        const timeoutMs = deadline.getTime() - this.dateProvider.now();
-        if (slot === 0) {
-            return true;
-        }
-        // Make a quick check before triggering an archiver sync
-        // If we are pipelining and have a pending checkpoint number stored, we will allow the block proposal to be for a slot further
-        const syncedSlot = await this.blockSource.getSyncedL2SlotNumber();
-        if (syncedSlot !== undefined && syncedSlot + 1 + this.epochCache.pipeliningOffset() >= slot) {
-            return true;
-        }
-        try {
-            // Trigger an immediate sync of the block source, and wait until it reports being synced to the required slot
-            return await retryUntil(async ()=>{
-                await this.blockSource.syncImmediate();
-                const updatedSyncedSlot = await this.blockSource.getSyncedL2SlotNumber();
-                return updatedSyncedSlot !== undefined && updatedSyncedSlot + 1 >= slot;
-            }, 'wait for block source sync', timeoutMs / 1000, 0.5);
-        } catch (err) {
-            if (err instanceof TimeoutError) {
-                this.log.warn(`Timed out waiting for block source to sync to slot ${slot}`);
-                return false;
-            } else {
-                throw err;
-            }
-        }
+    /**
+   * Hard re-execution/validation deadline for any block or checkpoint proposal targeting `slotNumber`:
+   * the single consensus `attestation_deadline` (`target_slot_start + S - 2E`). This is the latest the
+   * checkpoint can land on L1 in the target slot; all nodes agree on it. Loosened from the previous
+   * next-wall-clock-slot-boundary bound (see the timetable spec / refactor notes).
+   */ getReexecutionDeadline(slotNumber) {
+        return new Date(this.timetable.getAttestationDeadline(slotNumber) * 1000);
     }
     getReexecuteFailureReason(err) {
         if (err instanceof TransactionsNotAvailableError) {
@@ -725,7 +872,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
             // Create checkpoint builder with prior blocks
             const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, 0n, l1ToL2Messages, previousCheckpointOutHashes, fork, priorBlocks, this.log.getBindings());
             // Build the new block
-            const deadline = this.getReexecutionDeadline(slot, config);
+            const deadline = this.getReexecutionDeadline(slot);
             const maxBlockGas = this.config.validateMaxL2BlockGas !== undefined || this.config.validateMaxDABlockGas !== undefined ? new Gas(this.config.validateMaxDABlockGas ?? Infinity, this.config.validateMaxL2BlockGas ?? Infinity) : undefined;
             const result = await checkpointBuilder.buildBlock(txs, blockNumber, blockHeader.globalVariables.timestamp, {
                 isBuildingProposal: false,
@@ -848,14 +995,14 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         };
         try {
             const slot = proposal.slotNumber;
-            // Block-sync deadline = the moment the proposer can no longer publish this checkpoint to L1.
-            // With pipelining off that's the end of the proposal's own slot; with pipelining on the
-            // proposal is built one slot ahead, so the publication deadline is the start of the target
-            // slot. `getReexecutionDeadline` handles both cases.
-            const config = this.checkpointsBuilder.getConfig();
-            const deadline = this.getReexecutionDeadline(slot, config);
-            const timeoutSeconds = Math.max(1, Math.floor((deadline.getTime() - this.dateProvider.now()) / 1000));
-            // Wait for last block to sync by archive
+            // Block-sync/validation deadline = the single consensus attestation_deadline (target_slot_start + S
+            // - 2E): the latest moment the proposer can submit this checkpoint and still have it land on L1 in
+            // the target slot. Keeping validation/attestation alive until then lets validators keep attesting
+            // right up to the proposer's real publish cutoff.
+            const deadline = this.getReexecutionDeadline(slot);
+            // Wait for last block to sync by archive. The deadline is passed to retryUntil as an absolute date so
+            // the remaining budget is derived from the date provider; a deadline already in the past times out
+            // after a single attempt instead of looping (the immediate-timeout semantics of the deadline overload).
             let lastBlockData;
             try {
                 lastBlockData = await retryUntil(async ()=>{
@@ -863,7 +1010,10 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                     return await this.blockSource.getBlockData({
                         archive: proposal.archive
                     });
-                }, `waiting for block with archive ${proposal.archive.toString()} for slot ${slot}`, timeoutSeconds, 0.5);
+                }, `waiting for block with archive ${proposal.archive.toString()} for slot ${slot}`, {
+                    deadline,
+                    dateProvider: this.dateProvider
+                }, 0.5);
             } catch (err) {
                 if (err instanceof TimeoutError) {
                     this.log.warn(`Timed out waiting for block with archive matching checkpoint proposal`, proposalInfo);
@@ -919,6 +1069,7 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                     checkpointNumber: lastBlockData.checkpointNumber
                 };
             }
+            // Note this condition should never trigger, since we dont process block proposals that exceed indexWithinCheckpoint
             const maxBlocksPerCheckpoint = this.config.maxBlocksPerCheckpoint;
             if (maxBlocksPerCheckpoint !== undefined && blocks.length > maxBlocksPerCheckpoint) {
                 this.log.warn(`Checkpoint proposal exceeds maxBlocksPerCheckpoint`, {
@@ -950,12 +1101,53 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
                 epoch,
                 checkpointNumber,
                 l1Constants: this.epochCache.getL1Constants(),
-                pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled(),
+                pipeliningEnabled: true,
                 log: this.log
             });
-            // Fork world state at the block before the first block
+            // Fork world state at the block before the first block. getFork syncs world state to the parent block
+            // first (see its doc): the block source (archiver) can already hold the block while world state still
+            // trails it by one, and forking a not-yet-applied block throws a raw tree error that would otherwise
+            // escape as an uncaught gossipsub error. We pass the parent's expected block hash so the sync detects a
+            // world-state reorg (undefined for the genesis parent, where no block exists to pin). On failure we map
+            // to a clean validation result rather than letting it escape.
             const parentBlockNumber = BlockNumber(firstBlock.number - 1);
-            const fork = _ts_add_disposable_resource(env, await this.checkpointsBuilder.getFork(parentBlockNumber), true);
+            let forkResult;
+            try {
+                const parentBlockHash = (await this.blockSource.getBlockData({
+                    number: parentBlockNumber
+                }))?.blockHash;
+                forkResult = await this.checkpointsBuilder.getFork(parentBlockNumber, parentBlockHash);
+            } catch (err) {
+                this.log.warn(`Failed to fork world state at block ${parentBlockNumber} for checkpoint proposal`, {
+                    ...proposalInfo,
+                    parentBlockNumber,
+                    err
+                });
+                return {
+                    isValid: false,
+                    reason: 'world_state_not_synced',
+                    checkpointNumber
+                };
+            }
+            const fork = _ts_add_disposable_resource(env, forkResult, true);
+            // Verify the fork's archive root matches the checkpoint's expected starting archive (the archive after
+            // the parent block). A mismatch means world state forked from a different chain than the proposal was
+            // built on (e.g. a reorg), so recomputing the checkpoint against it would be meaningless. This mirrors
+            // the block-proposal re-execution check and fails fast with a clean, non-slashable result instead of a
+            // confusing downstream mismatch.
+            const forkArchiveRoot = new Fr((await fork.getTreeInfo(MerkleTreeId.ARCHIVE)).root);
+            if (!forkArchiveRoot.equals(proposal.checkpointHeader.lastArchiveRoot)) {
+                this.log.warn(`Fork archive root does not match checkpoint proposal's last archive`, {
+                    ...proposalInfo,
+                    forkArchiveRoot: forkArchiveRoot.toString(),
+                    expectedLastArchiveRoot: proposal.checkpointHeader.lastArchiveRoot.toString()
+                });
+                return {
+                    isValid: false,
+                    reason: 'initial_archive_mismatch',
+                    checkpointNumber
+                };
+            }
             // Create checkpoint builder with all existing blocks
             const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(checkpointNumber, constants, proposal.feeAssetPriceModifier, l1ToL2Messages, previousCheckpointOutHashes, fork, blocks, this.log.getBindings());
             // Complete the checkpoint to get computed values
@@ -1082,10 +1274,10 @@ import { getTelemetryClient } from '@aztec/telemetry-client';
         }
     }
     /**
-   * Derives proposed checkpoint data from validated blocks and sets it on the archiver.
-   * Used after successful validation of a foreign proposal.
-   * Does not retry since we already waited for the block during validation.
-   */ async setProposedCheckpointFromValidation(proposal) {
+   * Derives proposed checkpoint data from validated blocks and sets it on the archiver, so this node can
+   * pipeline building on top of the checkpoint. Does not retry, since validation already waited for the
+   * last block to sync.
+   */ async setProposedCheckpoint(proposal) {
         if (!this.archiver) {
             return false;
         }