fix(archiver): validate checkpoint attestations before fetching blobs (A-1252)

[PhilWindle]

Summary

During L1 sync the archiver fetched and decoded checkpoint blob data before validating committee attestations. A selected L1 proposer could publish a checkpoint with invalid/insufficient attestations plus malformed-but-hash-matching blob data; the blob decode threw BlobDeserializationError before the invalid-attestation skip path ran, so the checkpoint was never recorded as rejected and the L1 sync point never advanced past it. The archiver then re-queried the same L1 blocks every poll and re-threw forever — taking any valid checkpoints in the same batch down with it. This is a sync-liveness / DoS issue at the L1 ingestion boundary (no invalid state accepted, no asset loss).

Fix

Validate attestations from L1 calldata first — the signed consensus payload (header, archive root, fee asset price modifier) is fully available without blobs. Reject invalid and descendant-of-rejected checkpoints (emitting the same events and persisting the same rejected entries as before) without fetching their blobs, then fetch blobs in parallel only for the surviving checkpoints and ingest.

• validation.ts: add validateCheckpointAttestationsFromCalldata and extract the shared core validator (validateCheckpointAttestations now delegates to it).
• l1_synchronizer.ts: reorder handleCheckpoints to validate-then-fetch; lastSeenCheckpoint is tracked from calldata ({ checkpointNumber, l1 }) since rejected checkpoints are no longer built into PublishedCheckpoints.
• archiver-sync.test.ts: regression test — a checkpoint with invalid attestations and malformed blob data is rejected without a BlobDeserializationError retry loop.

Verification

• New regression test fails on the unfixed code (BlobDeserializationError) and passes with the fix.
• Stuck-without-fix behavior verified empirically: with the fix reverted, repeated syncImmediate() throws every time, the sync point never advances (syncedL1=undefined), and no checkpoint is ingested or rejected.
• Full archiver-sync.test.ts + validation.test.ts: 68/68 pass. tsc --noEmit clean.

Source: AztecProtocol/aztec-claude#1553

---

Follow-up: blob-failure liveness hardening (rows 4/5)

The reorder above fixes the case of a checkpoint with invalid attestations + a bad blob. A checkpoint with valid attestations (a ≥2/3 committee bribe) but a malformed or withheld blob still threw during blob decode — passing attestation validation, then aborting the whole syncFromL1 iteration. Because this.l1Timestamp is only advanced at the end of syncFromL1, the L1 sync clock froze, so every honest proposer's checkSync failed and nobody proposed — meaning the epoch-prune recovery never fired. A single bribed-committee + gossip-withholding attack could permanently halt the chain.

Fix (l1_synchronizer.ts, handleCheckpoints): gate the blob fetch/decode failure on rollup.canPruneAtTime.

• Epoch still provable (cannot prune yet): keep treating the failure as fatal and retry — the blob is canonical and must eventually become available (transient beacon unavailability must not be skipped).
• Proof window expired (rollup can prune on the next L1 block): the checkpoint is destined for pruning, so skip it and every later checkpoint this iteration and let the existing epoch-prune machinery run. Sync no longer throws, the clock advances, honest proposers resume, prune-on-propose fires on L1, and the bad checkpoint is dropped — automatic recovery.

Only NoBlobBodiesFoundError / BlobDeserializationError are caught; other errors propagate as before.

Tests

• archiver-sync.test.ts: malformed blob + valid attestations while the epoch can still be proven → still throws; once prunable → does not throw, the checkpoint is skipped, the pending chain rolls back to the proven tip, and the sync clock advances; a matching local proposed checkpoint is still promoted (blob fetch skipped) even when its on-chain blob is malformed.
• e2e_epochs/epochs_invalidate_block (invalid attestations): an invalid-attestations checkpoint is detected from calldata before any blob fetch and a fresh node syncs past it with its blob withheld from the shared store.
• e2e_epochs/epochs_blob_unavailable_prune (valid attestations, rows 4/5): a gossip-disabled observer whose copy of a valid-attestations checkpoint's blob is withheld keeps its L1 sync clock frozen while the epoch is still provable, then unfreezes and advances past the checkpoint once its proof window expires (it becomes prunable) — instead of looping on the blob fetch forever.