test(fast-inbox): rewrite l1_to_l2_inbox_drift for the streaming inbox (A-1384)

The test encoded the pre-flip protocol: it asserted an L1-to-L2 message had no
membership witness during a proposed-chain drift and could not be consumed until
the chain re-reached the message's insertion-time checkpoint. Post-flip messages
carry a compact L1-assigned leaf index and stream into the tree in insertion order,
so there is no per-message assigned checkpoint and the witness legitimately appears
as the chain catches up. Rewrite the scenario to assert the genuinely regression-worthy
post-flip invariants: after the rollup prunes the drifted chain, the message is still
re-consumed on the new chain (bucket and rolling-hash state surviving the L2 reorg) from
both private and public scope, and its witness leaf index still equals the L1-assigned
global index. Drop the witness-absent and cannot-consume-early probes and the fragile
proven-block destructure; retitle and refresh the scenario comments.

Author: spalladino

yarn-project/end-to-end/src/single-node/cross-chain/l1_to_l2_inbox_drift.test.ts

@@ -3,7 +3,6 @@ import { generateClaimSecret } from '@aztec/aztec.js/ethereum';
 import { Fr } from '@aztec/aztec.js/fields';
 import type { Logger } from '@aztec/aztec.js/log';
 import type { AztecNode } from '@aztec/aztec.js/node';
-import { TxExecutionResult } from '@aztec/aztec.js/tx';
 import type { Wallet } from '@aztec/aztec.js/wallet';
 import type { BlockNumber } from '@aztec/foundation/branded-types';
 import { timesAsync } from '@aztec/foundation/collection';
@@ -19,11 +18,13 @@ import { type L1ToL2MessageScope, createL1ToL2MessageHelpers } from './message_t
 
 jest.setTimeout(300_000);
 
-// L1→L2 messaging via Inbox: inbox checkpoint drift after a rollup reorg. Uses CrossChainMessagingTest
+// L1→L2 messaging via Inbox: an L1→L2 message survives a rollup prune. Uses CrossChainMessagingTest
 // (prod sequencer, pipelining preset: ethSlot=4s, aztecSlot=12s, inboxLag=2, minTxsPerBlock=1,
-// aztecProofSubmissionEpochs=2, aztecEpochDuration=4) with EpochTestSettler for auto-proving and
-// CrossChainTestHarness for L1↔L2 token portal bridging. The drift scenario runs over private and
-// public scope via it.each, all sharing one node stood up once in beforeAll.
+// aztecProofSubmissionEpochs=2, aztecEpochDuration=4) with EpochTestSettler for auto-proving. Post-flip
+// (AZIP-22) messages carry a compact L1-assigned index and stream in by insertion order rather than
+// pinning to a checkpoint, so a message inserted while the proposed chain drifts must still be
+// re-consumed with a stable index after the chain prunes back. Runs over private and public scope via
+// it.each, sharing one node stood up once in beforeAll.
 describe('single-node/cross-chain/l1_to_l2_inbox_drift', () => {
   let t: CrossChainMessagingTest;
 
@@ -35,7 +36,6 @@ describe('single-node/cross-chain/l1_to_l2_inbox_drift', () => {
 
   let sendMessageToL2: ReturnType<typeof createL1ToL2MessageHelpers>['sendMessageToL2'];
   let advanceBlock: ReturnType<typeof createL1ToL2MessageHelpers>['advanceBlock'];
-  let waitForMessageFetched: ReturnType<typeof createL1ToL2MessageHelpers>['waitForMessageFetched'];
   let waitForMessageReady: ReturnType<typeof createL1ToL2MessageHelpers>['waitForMessageReady'];
 
   // Whether explicit mark-as-proven calls are honored. The inbox-drift scenario flips this to
@@ -73,7 +73,7 @@ describe('single-node/cross-chain/l1_to_l2_inbox_drift', () => {
     ({ logger: log, wallet, user1Address, aztecNode } = t);
     ({ contract: testContract } = await TestContract.deploy(wallet).send({ from: user1Address }));
 
-    ({ sendMessageToL2, advanceBlock, waitForMessageFetched, waitForMessageReady } = createL1ToL2MessageHelpers({
+    ({ sendMessageToL2, advanceBlock, waitForMessageReady } = createL1ToL2MessageHelpers({
       t,
       aztecNode,
       wallet,
@@ -127,108 +127,100 @@ describe('single-node/cross-chain/l1_to_l2_inbox_drift', () => {
     }
   };
 
-  // Inbox checkpoint number can drift on two scenarios: if the rollup reorgs and rolls back its own
-  // checkpoint number, or if the inbox receives too many messages and they are inserted faster than
-  // they are consumed. In this test, we mine several checkpoints without marking them as proven until
-  // we can trigger a reorg, and then wait until the message can be processed to consume it.
-  const canConsumeMessageAfterInboxDrift = async (scope: L1ToL2MessageScope) => {
+  // Post-flip (AZIP-22), L1→L2 messages carry a compact, L1-assigned global leaf index and are streamed
+  // into the L2 tree in insertion order (subject to inbox lag and per-block/checkpoint caps) rather than
+  // being pinned to a fixed checkpoint. This scenario stresses that message state survives an L2 reorg:
+  // we let the proposed chain drift by mining several unproven checkpoints, insert a message during the
+  // drift, then force the rollup to prune back to the pre-drift block. After the prune, the message must
+  // still be re-consumed on the new chain and its witness leaf index must remain the L1-assigned index.
+  const canConsumeMessageAfterRollupPrune = async (scope: L1ToL2MessageScope) => {
     // Stop the background epoch test settler so the drift scenario below can proceed without
     // an auto-prover racing it.
     await t.epochTestSettler?.stop();
 
     // Reset the L1 proof window by marking the current pending tip as proven, so L1's prune
-    // deadline doesn't fire mid-test before we finish mining the 4 drift checkpoints below.
+    // deadline doesn't fire mid-test before we finish mining the drift checkpoints below.
     await markAsProven();
 
-    // Stop proving
+    // Snapshot the block we will prune back to, then stop proving so the proposed chain can drift.
     const lastProven = await aztecNode.getBlockNumber();
-    const [checkpointedProvenBlock] = await aztecNode.getBlocks(lastProven, 1, {
-      includeL1PublishInfo: true,
-      includeAttestations: true,
-      onlyCheckpointed: true,
-    });
-    log.warn(`Stopping proof submission at checkpoint ${checkpointedProvenBlock.checkpointNumber} to allow drift`);
+    log.warn(`Stopping proof submission at block ${lastProven} to allow drift`);
     markProvenEnabled = false;
 
     // Mine several checkpoints to ensure drift
     log.warn(`Mining blocks to allow drift`);
     await timesAsync(4, advanceCheckpoint);
 
-    // Generate and send the message to the L1 contract
+    // Generate and send the message to the L1 contract during the drift
     log.warn(`Sending L1 to L2 message`);
     const [secret, secretHash] = await generateClaimSecret();
     const message = { recipient: testContract.address, content: Fr.random(), secretHash };
     const { msgHash, globalLeafIndex } = await sendMessageToL2(message);
 
-    // Wait until the Aztec node has synced it
-    const msgCheckpointNumber = await waitForMessageFetched(msgHash);
-    log.warn(`Message synced for checkpoint ${msgCheckpointNumber}`);
-    expect(checkpointedProvenBlock.checkpointNumber + 4).toBeLessThan(msgCheckpointNumber);
-
-    // And keep mining until we prune back to the original block number. Now the "waiting for two blocks"
-    // strategy for the message to be ready to use shouldn't work, since the lastProven block is more than
-    // two blocks behind the message block. This is the scenario we want to test.
+    // The drift's current L1 pending checkpoint. The node prunes its local view as soon as the proof
+    // window lapses, but L1 only commits the prune when the rebuilt chain proposes its first checkpoint
+    // on top of the pre-drift block. Wait for that on-chain commit — L1's pending tip dropping back
+    // below the drift — before re-enabling proving: marking proven while the drift is still the pending
+    // tip would pin the drift proven and wedge the rebuild forever with Rollup__InvalidArchive.
+    const driftPendingCheckpoint = (await t.cheatCodes.rollup.getTips()).pending;
+
+    // Keep mining until the rollup prunes the drifted proposed chain back to the pre-drift block. L1's
+    // pending tip dropping below the drift is the unambiguous signal that the on-chain prune committed
+    // (a new checkpoint was proposed on top of the pre-drift block); the node's faster local prune is
+    // not, which is why we gate on L1 here rather than on the node's block number.
     log.warn(`Waiting until we prune back to ${lastProven}`);
     await retryUntil(
-      async () =>
-        (await aztecNode.getBlockNumber().then(b => b === lastProven || b === lastProven + 1)) ||
-        (await tryAdvanceBlock()),
+      async () => {
+        await tryAdvanceBlock();
+        return (await t.cheatCodes.rollup.getTips()).pending < driftPendingCheckpoint;
+      },
       'wait for prune',
       180,
     );
-    // The drift condition has been established. Re-enable explicit proving so the catch-up blocks
-    // below are not pruned a second time before the message checkpoint becomes ready.
+    // The prune has committed on L1. Re-enable explicit proving so the catch-up chain that re-consumes
+    // the message is not pruned a second time before we can consume it — safe now that L1's pending tip
+    // is the rebuilt chain rather than the drift.
     markProvenEnabled = true;
     await markAsProven();
 
-    // Check that there is no witness yet
-    expect(await aztecNode.getL1ToL2MessageMembershipWitness('latest', msgHash)).toBeUndefined();
-
-    // Define L2 function to consume the message
-    const consume = () => getConsumeMethod(scope)(message.content, secret, t.ethAccount, globalLeafIndex);
+    // Post-flip invariant: the compact-indexed message survives the L2 prune and is re-consumed on the
+    // new chain within a reasonable window (its bucket and rolling-hash state must persist across the
+    // reorg), becoming consumable from the requested scope.
+    await waitForMessageReady(msgHash, scope);
 
-    // Wait until the message is ready to be consumed, checking that it cannot be consumed beforehand
-    await waitForMessageReady(msgHash, scope, async () => {
-      if (scope === 'private') {
-        // On private, we simulate the tx locally and check that we get a missing message error, then we advance to the next block
-        await expect(() => consume().simulate({ from: user1Address })).rejects.toThrow(/No L1 to L2 message found/);
-        await tryAdvanceBlock();
-      } else {
-        // In public it is harder to determine when a message becomes consumable.
-        // We send a transaction, this advances the chain and the message MIGHT be consumed in the new block.
-        // If it does get consumed then we check that the block contains the message.
-        // If it fails we check that the block doesn't contain the message
-        const { receipt } = await consume().send({ from: user1Address, wait: { dontThrowOnRevert: true } });
-        if (receipt.executionResult === TxExecutionResult.SUCCESS) {
-          // The consume tx must not succeed before the message checkpoint. It can land in a later
-          // checkpoint if the node catches up between the readiness poll and the tx being built.
-          const block = await aztecNode.getBlock(receipt.blockNumber!);
-          expect(block).toBeDefined();
-          expect(block!.checkpointNumber).toBeGreaterThanOrEqual(msgCheckpointNumber);
-        } else {
-          expect(receipt.executionResult).toEqual(TxExecutionResult.REVERTED);
+    // The PXE is anchored to the checkpointed tip (syncChainTip: 'checkpointed'), so the re-consumed
+    // message only becomes visible to the consume simulation once its block is checkpointed — not merely
+    // proposed at 'latest'. Drive the rebuilt chain forward (advanceBlock marks each step proven so it
+    // is not pruned again) until the checkpointed tip covers the block that re-consumed the message.
+    const messageBlock = await aztecNode.getBlockNumber();
+    await retryUntil(
+      async () => {
+        if ((await aztecNode.getBlockNumber('checkpointed')) >= messageBlock) {
+          return true;
         }
-      }
-      await markAsProven();
-    });
+        await tryAdvanceBlock();
+        return false;
+      },
+      'wait for message block to be checkpointed',
+      180,
+    );
 
-    // Verify the membership witness is available for creating the tx (private-land only)
-    if (scope === 'private') {
-      const [messageIndex] = (await aztecNode.getL1ToL2MessageMembershipWitness('latest', msgHash))!;
-      expect(messageIndex).toEqual(globalLeafIndex.toBigInt());
-      // And consume the message for private, public was already consumed.
-      await consume().send({ from: user1Address });
-    }
+    // The witness leaf index is the L1-assigned compact global index and must be stable across the prune.
+    const [messageIndex] = (await aztecNode.getL1ToL2MessageMembershipWitness('latest', msgHash))!;
+    expect(messageIndex).toEqual(globalLeafIndex.toBigInt());
+
+    // The message is consumable on L2 from the requested scope.
+    const consume = () => getConsumeMethod(scope)(message.content, secret, t.ethAccount, globalLeafIndex);
+    await consume().send({ from: user1Address });
   };
 
-  // Mines four checkpoints without proving, inserting an L1→L2 message after the drift, then
-  // triggers a rollup prune back to the pre-drift block. Verifies the message can be consumed only
-  // after the chain re-syncs to the message's checkpoint, not before, from both private and public
-  // scope (public uses a send+dontThrowOnRevert loop to probe when the message becomes consumable).
+  // Mines several unproven checkpoints, inserts an L1→L2 message during the drift, then triggers a
+  // rollup prune back to the pre-drift block and verifies the message is still re-consumed on the new
+  // chain — with its L1-assigned witness index intact — from both private and public scope.
   it.each(['private', 'public'] as const)(
-    'can consume L1 to L2 message in %s after inbox drifts away from the rollup',
+    'consumes an L1 to L2 message after a rollup prune drops the drifted chain (%s)',
     async scope => {
-      await canConsumeMessageAfterInboxDrift(scope);
+      await canConsumeMessageAfterRollupPrune(scope);
     },
   );
 });