fix(fast-inbox): address the review findings across archiver, sequencer, validator and prover

[spalladino]

Context

The bucketless Fast Inbox rebuild (#25413 → #25414 → #25415) changed what the node does with L1-to-L2 messages: every
L2 block consumes the messages the proposer's archiver has observed, blocks may end at any message prefix, only a
checkpoint's final position must be a live Inbox bucket end, validators authenticate content and never penalise a
local prefix disagreement, and the archiver stores a plain message log whose reorg recovery rolls back to the newest
message still on L1 and refetches.

This PR carries the code fixes that came out of reviewing that stack, plus the behaviour-preserving cleanups. The
documentation corrections are below it in #25416; the three changes that alter node acceptance policy or proposer
packing are deliberately not here — they are stacked above as #25436, #25437 and #25438 so each can be reviewed
and taken or dropped on its own.

Review fixes

Prover lifecycle. A checkpoint's proofs can be ready before the local work that uses the sub-tree has finished: an
empty block's root rollup is enqueued as soon as the block starts, and a cached identical-input proof returns
immediately. The sub-tree result could therefore resolve while the caller still held a block's processing fork, and the
consumer it resolved to would then tear the sub-tree down underneath that caller. A block now counts as done only once
its proof output has been compared against the locally built header and archive, and the prover node joins the sub-tree
result with its own block loop before handing proofs over or starting teardown; a processing failure rejects the join,
so failure always wins over a later success. A second, narrower instance of the same race is fixed separately: the
archive snapshot has to be read from the block's fork, so it existed before close() returned — a proof landing inside
that close found every piece present and resolved with the fork still open. The snapshot is now published after the
close, which removes the window rather than guarding it.

Validator duty bounds. retryUntil only consults its deadline once an attempt returns, so an attempt that never
settles never reaches it. A per-slot DutyBudget — one absolute deadline, shared by every stage instead of each read
starting a timeout of its own — now races the whole all-nodes checkpoint callback, the direct attestation path, and
every await inside them: the published-checkpoint and checkpoint-start reads, the previous-checkpoint lookups, the
world-state fork, the reconstruction, the Inbox prefix wait including the retry loop itself, and the signer. An
already-expired budget still allows the single attempt callers rely on, but that grace is now one absolute
allowance for the whole duty rather than a fresh second per stage.

Racing a read does not stop its continuation, so the losing side is guarded too. A fork opened after the caller gave up
is disposed by the continuation that opened it, rather than leaking one world-state fork per abandoned duty; a late
reconstruction refuses to start against a fork the caller is already closing; and a block read that lands after the
deadline cannot go on to install a pipelining parent. Attestation signing is gated in the one place attestations are
produced: nothing is signed after the slot's attestation deadline, a remote signer returning past it has its output
discarded rather than pooled and gossiped, and the equivocation record is written before the request goes out so a
signer that never answers still leaves the slot protected. Bundle retries nobody is waiting for are stopped when tx
collection rejects.

Proposal send budget. The pre-gossip preflight was budgeted against the attestation deadline, which is later than
the point at which peers stop accepting proposals for the slot. It now uses a send deadline (receive deadline minus
propagation time), and the job re-checks it after the two steps that can take arbitrarily long — building the proposal
and inserting it into the archiver — so a proposal that became pointless while those ran is not gossiped.

Archiver. RPC uncertainty was indistinguishable from chain replacement: a failed lookup looked like "this block is
gone". The canonicality check is now tri-state — canonical, replaced, unknown — and any RPC error or missing hash is
unknown, which keeps progress rather than starting recovery. Only a positive replacement clears recovery state. A
lagged-view guard sits before the shorter-head truncation, and it carries all three answers rather than collapsing them
to a boolean: a certified syncpoint above the head that cannot be read is no evidence that the messages above it are
gone, so the node waits instead of truncating. An older canonical ancestor cannot prove a later one was replaced, and
deleting on that basis would prune the speculative blocks that consumed those messages for nothing. Only a syncpoint
that reads back as a different block lets the shorter head be treated as a replacement. Separately, ingestion skipped
the Inbox deployment block itself, so a message emitted in that block was never scanned; the first scan range is now
inclusive of it.

Proposer accounting. A slot this node could not assess is now recorded as such instead of being charged to the
proposer. ReexecutionOutcome gains unverifiable and ValidatorStatusInSlot gains checkpoint-unverifiable, for a
proposal that was seen but could not be checked against anything outside this node — today, a duty whose budget ran
out. Recording nothing was not an option: with no record and no checkpoint on L1, the sentinel reads the slot as one
the proposer never proposed in, which is counted against it. The new status is in neither half of the missed-proposal
rate, so unknowns can neither charge a proposer for an observer's failure nor dilute the misses that are real, and they
do not break a miss streak. Real missed and invalid proposals keep exactly the accounting they had. SentinelStore's
status encoding gains value 9, so histories written by this version are not readable by older nodes and the new status
does not decode on them.

Configuration. A node whose effective per-checkpoint block count falls below the Inbox catch-up floor cannot clear
a mandatory backlog. That is now rejected at startup — but only on a production profile: dev and e2e configurations
legitimately derive one or two blocks per slot, so those warn instead. This is a deliberate deviation from a plain
floor check, which rejected every local configuration including the e2e pipelining setup — and it is wider than the
sandbox it is for: isFastLocalProfile is a threshold on the Ethereum slot duration, not a declaration that the node
is a development one, and no such signal reaches the sequencer. A real network running short Ethereum slots is
therefore exempted too, and faster L1 slots do not raise the per-block message cap, so such a sequencer can still be
unable to clear an aged backlog. The deviation is stated in the code and its boundary is pinned by a test; it needs
explicit acceptance rather than being a completed guard.

Accounting and artifacts. The serialized proposal size undercounted the 32-byte fee modifier as 8; it is now
measured from the serialization itself. The exported generic Rollup artifact was missing EpochProofExtLib and
carried a stale ValidatorSelectionLib entry, so a generic deployer could not link it; a test now asserts the link
references and the library map agree in both directions.

Diagnostics. Every failure of the validator's Inbox bundle range read produces the same non-punitive verdict, but a
store fault is not the same thing as a node that is behind L1. Unexpected failures now carry bounded structured
context; genuine lag stays at debug and stays non-punitive.

Cleanups. An unused pre-gossip bucket hint and its fisherman dummy, a dead recovery field and an unreachable
post-continuation branch, a duplicated range read when a bundle ends exactly on the resolved endpoint, hand-restated
override field types, a Noir fixture builder with no callers, a dead single-block resolution branch, and a global
log-dedupe cache. Net removal.

Test and fixture corrections

Three fixtures asserted less than their names claimed. The archiver re-mine test moved messages between L1 blocks
without replacing any block identity, so it passed as an ordinary forward append and never reached recovery. The e2e
helper that identifies which block inserted a message sampled its lower scan bound after observing the message, so
the first block it found was where the search started, not where the insertion happened; it now bisects the chain and
confirms membership at the block and absence at its actual parent. The rollup sample generator captured data[0] — the
first block, with an empty inherited sponge — for a scenario that intends the continuation block; samples are now
selected by shape and the selector fails loudly when nothing or several things match. The committed Prover.toml is
unchanged: correcting it needs the owning generator workflow, which was not run here.

The developer proving-time simulation gated Inbox parity behind the first block root and refused zero-transaction
blocks anywhere but first. Production does neither, so the model is brought in line — parity is independent, the join
is at checkpoint-root readiness, and zero-tx blocks queue their own roots at any position. This is a developer model,
not a measured production regression.

What is deliberately not fixed here

• The automine aged-backlog escape hatch is deferred, per the recorded decision. No fix in this PR.
• The message-count prediction a public simulation makes can still overestimate what a checkpoint's final block
  consumes. Only the documented contract is corrected, in docs(fast-inbox): document message-prefix consumption and correct the streaming Inbox docs #25416: it is best effort, and a bound in neither direction.
  With the cursor at 0 and live buckets ending at 200 and 400, simulation appends 256 while the final block lands on
  200, so a public call reading message index 220 simulates and then fails. Sharing selection between the simulator
  and the sequencer is deferred.
• Recovery still discards unchanged work that moved outside the bounded lookup window, since rollback precedes
  refetch. That is the accepted conservative-recovery tradeoff, now described honestly in the tests and docs.

Testing

Focused regressions accompany each fix, and the ones where a behavioural change could be demonstrated were confirmed
red before green — the prover join and the fork-close window, the send budget, the archiver canonicality and deployment
block, proposal size, the fixtures and the proving-time model.

Package suites, all passing: archiver 639, stdlib 1094, sequencer-client 293, validator-client 338, aztec-node 183,
prover-client 257, prover-node 188. The full-package archiver run exits 129 (SIGHUP) with zero failures; it does so
identically on the untouched base, so it is an artifact of the runner rather than of this branch.

yarn format --check and yarn lint exit 0. yarn build exits 1, on one error:

end-to-end/src/single-node/cross-chain/streaming_inbox_load.test.ts(12,10): error TS2305:
  Module '"@aztec/stdlib/messaging"' has no exported member 'getInboxCutoffTimestamp'

That file is untracked, unrelated, in-progress work that was deliberately left alone. No other compilation error is
reported, and no worktree or exclusion was used to manufacture a clean build — so nothing in this branch fails to
compile, but the command did not pass and is not claimed to have.

No e2e test was run — CI covers those, which leaves the findInsertingBlock correction unverified locally. The
anvil-backed @aztec/ethereum suites need single-worker execution and were not run to completion locally; the two
files this PR changes there pass. No Solidity compile, circuit proving or generator run was performed, and no
generated file or source pin moved.

F11c is only partly repaired: the sample generator now selects the continuation-shaped capture, but
noir-projects/fnd/noir-protocol-circuits/crates/rollup-block-root/Prover.toml still holds the old first-block,
empty-inherited-sponge sample. Finishing it needs regeneration through the owning AZTEC_GENERATE_TEST_DATA=1
workflow plus nargo execute verification, which was deliberately not run here.

Stacked on #25416 (spl/fi2-message-only-docs). #25436, #25437 and #25438 stack above this one.

Part of A-1928
Fixes A-1926

🤖 Generated with Claude Code