fix(node): push the startup head rewind to the execution node (PR review pass 67)

Codex review pass 67 raised one P1 on the issue #38 CI-stabilization branch.

The pass-66 startup reconciliation dragged the in-memory ForkchoiceState mirror
down to the persisted head and updated the database, but never sent
engine_forkchoiceUpdated to the execution node. Engine::new only stores the
mirror, ChainOrchestrator::new issues no forkchoice update, and the run loop
reissues a head FCU only in response to derivation/finalization/peer events — so
on a quiescent or non-producing node the execution client kept its canonical
head (and its RPC) on the discarded block indefinitely, letting remote followers
still import the block the repair intended to drop. The same latent gap existed
in the pre-existing repair loop whenever the execution node ran ahead of the
database above finalized.

Fix: capture the execution node's live head before any startup head-repair, and
after the engine is built, if a repair rewound the mirror BELOW that live head,
issue a checked forkchoice update to the execution node to actually rewind its
canonical head. A VALID answer confirms the rewind; INVALID (the execution node
rejecting a head recovered from the node's own persisted state) fails startup; a
SYNCING/ACCEPTED answer is left to be reasserted by later FCUs. Skipped when the
provider forkchoice could not be read (engine unreachable / genesis fallback),
since there is no live head to rewind. This covers both the pass-66 addition and
the pre-existing repair loop with a single push.

The lack of automated coverage for this startup-rewind path (it needs an e2e
restart with the execution node ahead of the database) is recorded in
.claude/vmark-pr-review-follow-ups.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: vmarkushin

.claude/vmark-pr-review-follow-ups.md

@@ -5,6 +5,27 @@ from every pass is either fixed in the PR or recorded here.
 
 ## Unresolved
 
+- **No e2e coverage for the startup rewind of an execution node that ran ahead
+  of the persisted head** (`crates/node/src/args.rs` startup head-repair + the
+  new post-`Engine::new` forkchoice push)
+  - Impact/evidence: Codex pass 67 P1 (2026-09-03) found that the pass-66
+    startup reconciliation only moved the in-memory mirror and the database, and
+    never pushed `engine_forkchoiceUpdated` to Reth, so a quiescent node would
+    keep serving — and followers keep importing — the discarded head. FIXED this
+    pass by issuing a checked FCU to the execution node after the engine is
+    built whenever startup repair lowered the mirror below the execution node's
+    live head (also closes the same latent gap in the pre-existing repair loop).
+    The new path has no automated test: it needs an e2e restart where the
+    execution node holds a block above the persisted L2 head (an unsigned
+    sequenced block left by a crash between commit and sign), asserting the
+    execution node's RPC head is rewound on restart.
+  - First/most-recent pass: Codex pass 67 (2026-09-03).
+  - Why unaddressed: exercising it requires a full node restart against a real
+    execution client with a head deliberately ahead of the database — an e2e
+    harness addition beyond this review loop's local-fix scope; the production
+    fix itself is landed and verified by build/clippy.
+  - Suggested Linear title: "rollup-node: e2e test for startup rewind when the execution node runs ahead of the persisted head"
+
 - **Remote block source has no metrics** (`crates/node/src/add_ons/remote_block_source.rs`)
   - Impact/evidence: Claude pass 1 m6 and pass 5 m2 — the add-on exports no
     metrics and `ChainOrchestratorStatus` does not model it, so a node can

crates/node/src/args.rs

@@ -582,6 +582,13 @@ impl ScrollRollupNodeConfig {
             }
         };
 
+        // The execution node's live head, before any startup head-repair below
+        // moves the in-memory mirror. If a repair rewinds the mirror BELOW this,
+        // the rewind must be pushed to the execution node (see the FCU after the
+        // engine is built); otherwise only the mirror and database move and the
+        // execution node keeps serving the discarded head.
+        let provider_head_number = fcs.head_block_info().number;
+
         let (l1_block_startup_info, mut l2_head_block_number) = db
             .tx_mut(move |tx| async move {
                 // On startup we replay the latest batch of blocks from the database as such we set
@@ -723,7 +730,59 @@ impl ScrollRollupNodeConfig {
         ctx.task_executor.spawn_task(scroll_network_manager.run());
 
         tracing::info!(target: "scroll::node::args", fcs = ?fcs, payload_building_duration = ?self.sequencer_args.payload_building_duration, "Starting engine driver");
-        let engine = Engine::new(Arc::new(engine_api), fcs);
+        let mut engine = Engine::new(Arc::new(engine_api), fcs);
+
+        // If the startup head-repair above rewound the mirror BELOW the
+        // execution node's live head, the repair so far has only moved the
+        // in-memory mirror and the database — the execution node still holds the
+        // discarded head (e.g. an unsigned block committed to the engine by a
+        // crash between commit and sign, or an EL that simply ran ahead). Push
+        // and validate the rewind against the execution node now, before
+        // launching: otherwise a quiescent node keeps serving — and followers
+        // keep importing — the block this repair discarded, because nothing in
+        // the run loop reissues a head FCU on an idle chain. Skipped when the
+        // provider forkchoice could not be read (engine unreachable / genesis
+        // fallback), since there is no live head to rewind.
+        if !provider_fcs_missing && engine.fcs().head_block_info().number < provider_head_number {
+            let head = *engine.fcs().head_block_info();
+            match engine.update_fcs_checked(Some(head), None, None).await {
+                Ok(result) if result.is_valid() => {
+                    tracing::info!(
+                        target: "scroll::node::args",
+                        ?head,
+                        provider_head_number,
+                        "Rewound the execution node head to the recovered startup head"
+                    );
+                }
+                Ok(result) if result.is_invalid() => {
+                    // The execution node actively rejected a head the node
+                    // recovered from its own persisted state — a genuine
+                    // divergence that must not launch.
+                    eyre::bail!(
+                        "execution node rejected the recovered startup head {head:?} as INVALID: \
+                         {:?}",
+                        result.payload_status.status
+                    );
+                }
+                Ok(_result) => {
+                    // SYNCING/ACCEPTED: the execution node took the head but has
+                    // not finished adopting it. The mirror already holds it and
+                    // every later FCU reasserts it, so do not fail startup.
+                    tracing::warn!(
+                        target: "scroll::node::args",
+                        ?head,
+                        "Execution node has not yet adopted the recovered startup head; it will \
+                         be reasserted"
+                    );
+                }
+                Err(err) => {
+                    eyre::bail!(
+                        "failed to push the recovered startup head {head:?} to the execution \
+                         node: {err}"
+                    );
+                }
+            }
+        }
 
         // Create the consensus.
         let authorized_signer = if let Some(provider) = l1_provider.as_ref() {