From 6d4779b275cab5369941051014abafba5df3de78 Mon Sep 17 00:00:00 2001
From: roman <roman@osmosis.team>
Date: Thu, 2 Jul 2026 13:47:40 -0600
Subject: [PATCH] remaining

---
 .github/workflows/checkpoint-update.yml       |   53 +
 .vscode/settings.json                         |   17 +
 CHANGELOG.md                                  |   32 +-
 Cargo.lock                                    |   20 +
 Cargo.toml                                    |    1 +
 Makefile                                      |    7 +
 deploy/runner/replay_run.sh                   |  179 ++
 docs/design/verified-commitment-trees.md      |   30 +-
 docs/specs/blocksync/congestion_control.md    |  183 ++
 make/perf.mk                                  |   58 +
 zebra-consensus/src/block.rs                  |   10 +-
 zebra-consensus/src/block/request.rs          |   73 +-
 zebra-consensus/src/block/tests.rs            |   65 +-
 zebra-consensus/src/checkpoint.rs             |  321 +--
 zebra-consensus/src/config.rs                 |   95 +-
 zebra-consensus/src/lib.rs                    |    3 +-
 zebra-consensus/src/router.rs                 |   11 +
 zebra-consensus/src/router/tests.rs           |    2 +
 zebra-network/src/config/tests/vectors.rs     |   18 +
 zebra-network/src/peer/connection.rs          |   38 +-
 .../src/peer/connection/tests/vectors.rs      |   62 +-
 zebra-network/src/peer/handshake/tests.rs     |    6 +-
 zebra-network/src/peer_set/set.rs             |   90 +-
 .../src/peer_set/set/tests/vectors.rs         |   78 +
 .../src/protocol/internal/request.rs          |   36 +-
 zebra-network/src/zakura/testkit/cluster.rs   |  199 +-
 zebra-replay-bench/Cargo.toml                 |   42 +
 zebra-replay-bench/README.md                  |  164 ++
 zebra-replay-bench/RESULTS.md                 |  283 +++
 zebra-replay-bench/src/apply.rs               |  202 ++
 zebra-replay-bench/src/apply_sequencer.rs     |  353 ++++
 zebra-replay-bench/src/apply_verifier.rs      |  340 ++++
 zebra-replay-bench/src/apply_worker.rs        |  272 +++
 zebra-replay-bench/src/cache.rs               |  186 ++
 zebra-replay-bench/src/config.rs              |   26 +
 zebra-replay-bench/src/index.rs               |  161 ++
 zebra-replay-bench/src/main.rs                |  296 +++
 zebra-replay-bench/src/prefetch.rs            |  106 +
 zebra-replay-bench/src/rollback.rs            |   37 +
 zebra-replay-bench/src/roots_cache.rs         |  110 +
 zebra-replay-bench/src/stats.rs               |   56 +
 zebra-state/CHANGELOG.md                      |   32 +-
 zebra-state/src/error.rs                      |  137 ++
 zebra-state/src/lib.rs                        |    7 +-
 zebra-state/src/request.rs                    |  308 ++-
 zebra-state/src/service.rs                    |  153 +-
 zebra-state/src/service/check.rs              |   26 +-
 .../src/service/check/tests/nullifier.rs      |   21 +-
 zebra-state/src/service/check/tests/utxo.rs   |    8 +-
 zebra-state/src/service/finalized_state.rs    |  766 ++++++-
 .../service/finalized_state/commitment_aux.rs |  391 +++-
 .../finalized_state/commitment_aux_verify.rs  |   49 +-
 .../finalized_state/disk_format/chain.rs      |   30 +-
 .../disk_format/tests/snapshot.rs             |    2 +-
 .../upgrade/cache_genesis_roots.rs            |   25 +-
 .../src/service/finalized_state/tests/prop.rs | 1771 ++++++++++++++++-
 .../service/finalized_state/tests/rollback.rs |    2 +-
 .../src/service/finalized_state/vct.rs        |  675 +++++++
 .../finalized_state/vct/mainnet-frontier.bin  |  Bin 0 -> 1675 bytes
 .../src/service/finalized_state/zebra_db.rs   |   14 +
 .../service/finalized_state/zebra_db/block.rs |   35 +-
 .../zebra_db/block/tests/prune.rs             |   48 +-
 .../zebra_db/block/tests/snapshot.rs          |    2 +-
 .../zebra_db/block/tests/vectors.rs           |    1 +
 .../service/finalized_state/zebra_db/chain.rs |   36 +-
 .../service/finalized_state/zebra_db/prune.rs |    2 +-
 .../finalized_state/zebra_db/rollback.rs      |   74 +
 .../finalized_state/zebra_db/shielded.rs      |   19 +-
 .../src/service/non_finalized_state.rs        |    1 +
 zebra-state/src/service/read/block.rs         |    8 +-
 zebra-state/src/service/tests.rs              |  118 +-
 zebra-state/src/service/write.rs              |  209 +-
 zebra-state/src/tests/setup.rs                |    2 +-
 zebra-utils/Cargo.toml                        |    4 +-
 zebra-utils/src/bin/zebra-checkpoints/args.rs |   66 +-
 zebra-utils/src/bin/zebra-checkpoints/main.rs |   75 +-
 zebrad/src/commands/start.rs                  |   37 +
 zebrad/src/components/sync/tests/vectors.rs   |   16 +-
 zebrad/tests/common/cached_state.rs           |    4 +-
 zebrad/tests/common/checkpoints.rs            |    9 +-
 80 files changed, 8835 insertions(+), 669 deletions(-)
 create mode 100644 .vscode/settings.json
 create mode 100755 deploy/runner/replay_run.sh
 create mode 100644 docs/specs/blocksync/congestion_control.md
 create mode 100644 zebra-replay-bench/Cargo.toml
 create mode 100644 zebra-replay-bench/README.md
 create mode 100644 zebra-replay-bench/RESULTS.md
 create mode 100644 zebra-replay-bench/src/apply.rs
 create mode 100644 zebra-replay-bench/src/apply_sequencer.rs
 create mode 100644 zebra-replay-bench/src/apply_verifier.rs
 create mode 100644 zebra-replay-bench/src/apply_worker.rs
 create mode 100644 zebra-replay-bench/src/cache.rs
 create mode 100644 zebra-replay-bench/src/config.rs
 create mode 100644 zebra-replay-bench/src/index.rs
 create mode 100644 zebra-replay-bench/src/main.rs
 create mode 100644 zebra-replay-bench/src/prefetch.rs
 create mode 100644 zebra-replay-bench/src/rollback.rs
 create mode 100644 zebra-replay-bench/src/roots_cache.rs
 create mode 100644 zebra-replay-bench/src/stats.rs
 create mode 100644 zebra-state/src/service/finalized_state/vct.rs
 create mode 100644 zebra-state/src/service/finalized_state/vct/mainnet-frontier.bin

diff --git a/.github/workflows/checkpoint-update.yml b/.github/workflows/checkpoint-update.yml
index 61489e26ed3..28e33c8360f 100644
--- a/.github/workflows/checkpoint-update.yml
+++ b/.github/workflows/checkpoint-update.yml
@@ -35,6 +35,7 @@ jobs:
     env:
       MAINNET_CHECKPOINTS: zebra-chain/src/parameters/checkpoint/main-checkpoints.txt
       TESTNET_CHECKPOINTS: zebra-chain/src/parameters/checkpoint/test-checkpoints.txt
+      MAINNET_FRONTIER: zebra-state/src/service/finalized_state/vct/mainnet-frontier.bin
       EOS_FILE: zebrad/src/components/sync/end_of_support.rs
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
@@ -87,6 +88,15 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true
 
+      - name: Download mainnet frontier artifact
+        id: mainnet-frontier-artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+        with:
+          name: generate-checkpoints-mainnet-frontier
+          run-id: ${{ steps.resolve-run.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        continue-on-error: true
+
       - name: Download testnet checkpoint artifact
         id: testnet-artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
@@ -112,6 +122,11 @@ jobs:
             HAS_MAINNET="true"
           fi
 
+          if [ -f "mainnet-frontier.bin" ]; then
+            BYTES=$(wc -c < mainnet-frontier.bin | tr -d ' ')
+            echo "Mainnet frontier artifact: ${BYTES} bytes"
+          fi
+
           if [ -f "test-checkpoints.txt" ]; then
             LINES=$(wc -l < test-checkpoints.txt | tr -d ' ')
             echo "Testnet artifact: ${LINES} checkpoint lines"
@@ -130,6 +145,7 @@ jobs:
 
       # Append new mainnet checkpoints (entries with heights higher than current last)
       - name: Append new mainnet checkpoints
+        id: append-mainnet
         if: steps.check-artifacts.outputs.has_mainnet == 'true'
         run: |
           CURRENT_LAST=$(tail -1 "${MAINNET_CHECKPOINTS}" | awk '{print $1}')
@@ -138,13 +154,48 @@ jobs:
           # Extract only new entries (height > current last)
           NEW_COUNT=$(awk -v last="$CURRENT_LAST" '$1 > last' main-checkpoints.txt | wc -l | tr -d ' ')
           echo "New mainnet checkpoints to append: ${NEW_COUNT}"
+          echo "new_count=${NEW_COUNT}" >> "$GITHUB_OUTPUT"
 
           if [ "$NEW_COUNT" -gt 0 ]; then
             awk -v last="$CURRENT_LAST" '$1 > last' main-checkpoints.txt >> "${MAINNET_CHECKPOINTS}"
             NEW_LAST=$(tail -1 "${MAINNET_CHECKPOINTS}" | awk '{print $1}')
             echo "Updated last mainnet checkpoint: ${NEW_LAST}"
+            echo "new_last=${NEW_LAST}" >> "$GITHUB_OUTPUT"
+          else
+            echo "new_last=${CURRENT_LAST}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Update Mainnet VCT frontier
+        if: >-
+          steps.check-artifacts.outputs.has_mainnet == 'true' &&
+          steps.append-mainnet.outputs.new_count != '0'
+        env:
+          EXPECTED_HEIGHT: ${{ steps.append-mainnet.outputs.new_last }}
+        run: |
+          if [ ! -s "mainnet-frontier.bin" ]; then
+            echo "Mainnet checkpoints advanced, but mainnet-frontier.bin is missing or empty"
+            exit 1
+          fi
+
+          FRONTIER_HEIGHT=$(python3 - <<'PY'
+          import struct
+
+          with open("mainnet-frontier.bin", "rb") as frontier:
+              height_bytes = frontier.read(4)
+          if len(height_bytes) != 4:
+              raise SystemExit("frontier artifact is shorter than its height prefix")
+          print(struct.unpack("<I", height_bytes)[0])
+          PY
+          )
+
+          if [ "${FRONTIER_HEIGHT}" != "${EXPECTED_HEIGHT}" ]; then
+            echo "Frontier height ${FRONTIER_HEIGHT} does not match updated Mainnet checkpoint ${EXPECTED_HEIGHT}"
+            exit 1
           fi
 
+          cp mainnet-frontier.bin "${MAINNET_FRONTIER}"
+          echo "Updated ${MAINNET_FRONTIER} for checkpoint height ${EXPECTED_HEIGHT}"
+
       # Append new testnet checkpoints
       - name: Append new testnet checkpoints
         if: steps.check-artifacts.outputs.has_testnet == 'true'
@@ -214,6 +265,7 @@ jobs:
             ### Changes
 
             - Updated mainnet and/or testnet checkpoint files with new entries
+            - Updated `mainnet-frontier.bin` when Mainnet checkpoints advanced
             - Updated `ESTIMATED_RELEASE_HEIGHT` in `end_of_support.rs` to match the latest mainnet checkpoint
 
             ### Validation
@@ -223,6 +275,7 @@ jobs:
             - Heights are monotonically increasing
             - No gaps exceed 400 blocks
             - No duplicate heights or hashes
+            - Mainnet frontier height matches the updated Mainnet checkpoint height, when present
 
             ### Review
 
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 00000000000..bbd880b47ac
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,17 @@
+{
+  // Rust build artifacts (~140G in target/, ~5G in unity-node/target/) saturate
+  // the file watcher and index, which hangs the extension host (agents + terminal).
+  // These dirs are gitignored, so hiding them from the editor is safe.
+  "files.watcherExclude": {
+    "**/target/**": true,
+    "**/.git/objects/**": true
+  },
+  "search.exclude": {
+    "**/target": true
+  },
+  "files.exclude": {
+    "**/target": true
+  },
+  // Let rust-analyzer manage the workspace without a redundant cargo check storm.
+  "rust-analyzer.files.excludeDirs": ["target"]
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 695c17045cf..4431d6c7389 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 
 ### Fixed
 
+- Reject `consensus.checkpoint_sync = false` with
+  `consensus.vct_fast_sync = true` at startup, because VCT fast sync relies on
+  the full checkpoint-sync verification range.
 - Fixed an out-of-memory crash during Zakura block sync when the header chain
   runs far ahead of the commit tip. The block-sync applying buffer holds decoded
   block bodies ahead of the in-order committer; its look-ahead budget counted
@@ -116,9 +119,6 @@ and this project adheres to [Semantic Versioning](https://semver.org).
   commitment roots and transaction counts.
 - Reject transactions that add net value to the Orchard pool after NU6.3
   activation.
-- V6 transactions with supported NU6.3-or-later consensus branch IDs now
-  serialize and deserialize successfully, while unsupported later placeholders
-  are rejected.
 - Route post-NU6.3 coinbase rewards for Orchard receivers in unified miner
   addresses to the Ironwood pool instead of rejecting them or falling back to a
   lower-priority receiver.
@@ -167,6 +167,24 @@ and this project adheres to [Semantic Versioning](https://semver.org).
   duplicate-peer handling scaffolding.
 - Added bounded Zakura header-sync stream-5 wire messages, stateless header
   validation, and the default `network.zakura.header_sync` config surface.
+- Verified-commitment-trees fast checkpoint sync. Below the last checkpoint Zebra
+  now fetches per-block Sapling/Orchard commitment roots from peers over a new
+  header-sync-aligned `tree_aux` stream, verifies each root against the node's own
+  checkpoint-committed block headers (the ZIP-221 ChainHistory MMR plus direct
+  below-Heartwood/below-NU5 checks), and folds the verified roots into the anchor
+  set and history tree — skipping the per-block note-commitment frontier recompute
+  that dominates checkpoint-sync CPU cost. At the checkpoint handoff an embedded
+  final frontier, verified against that block's proven root, is written as the tip
+  treestate and normal per-block recompute resumes. The resulting consensus state
+  is byte-identical to the legacy recompute; a root that cannot be obtained or
+  verified is rejected rather than recomputed against the stale frozen frontier, so
+  no untrusted data can influence consensus state. This is the default whenever
+  `consensus.checkpoint_sync = true` on a network with an embedded handoff frontier
+  (Mainnet), for both Archive and Pruned storage modes. The new
+  `consensus.vct_fast_sync` flag (default `true`) selects this fast path; set it to
+  `false` to keep checkpoint sync enabled while forcing the legacy per-block
+  recompute. Bumps the state database
+  format to 27.3.0 (new column families only; no data migration).
 - Include the `zebra-rollback-state` and `zebra-prune-state` utilities alongside
   `zebrad` in release Docker images and Docker CI builds.
 - Use the `5.0.0-rc.3` release identity for this fork's v5 rollback build.
@@ -225,6 +243,14 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 
 ### Fixed
 
+- Stop the database format-validity check from panicking with "just checked for
+  genesis block" while a verified-commitment-trees fast sync is in progress. The
+  check runs on a background thread, concurrently with block commits, and could
+  read its `is_vct_synced()` guard as `false` and then read an absent genesis
+  note-commitment tree once a concurrent fast-sync commit set the marker in
+  between. It now treats an absent genesis tree as a (mid-flight) fast-synced
+  database — where the genesis-root-caching invariant does not apply — instead of
+  panicking.
 - Use network protocol version 170160 as the NU6.3 minimum on Mainnet, Testnet,
   and Regtest, matching Zebra's advertised current protocol version.
 - Avoid panics in the block write task when RPC users invalidate a non-finalized
diff --git a/Cargo.lock b/Cargo.lock
index afb5d1bf6f1..7d0bba23b05 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9317,6 +9317,25 @@ dependencies = [
  "zebra-chain",
 ]
 
+[[package]]
+name = "zebra-replay-bench"
+version = "0.1.0"
+dependencies = [
+ "clap 4.6.1",
+ "color-eyre",
+ "futures",
+ "metrics-exporter-prometheus",
+ "tempfile",
+ "tokio",
+ "tower 0.4.13",
+ "tracing",
+ "tracing-subscriber",
+ "zebra-chain",
+ "zebra-consensus",
+ "zebra-network",
+ "zebra-state",
+]
+
 [[package]]
 name = "zebra-rpc"
 version = "9.0.0"
@@ -9503,6 +9522,7 @@ dependencies = [
  "zebra-chain",
  "zebra-node-services",
  "zebra-rpc",
+ "zebra-state",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 6a8ab9ffe33..c87956a0c9c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,6 +4,7 @@ members = [
         "zebra-chain",
         "zebra-network",
         "zebra-state",
+        "zebra-replay-bench",
         "zebra-script",
         "zebra-consensus",
         "zebra-rpc",
diff --git a/Makefile b/Makefile
index 9571344c5d8..3d4fc069d46 100644
--- a/Makefile
+++ b/Makefile
@@ -11,6 +11,13 @@ help:
 	@echo "  perf-build-stage-bin <name>      Build + stage the bench binary as perf-artifacts/<name>"
 	@echo "  perf-run [bin-name]              Run an isolated bench (PERF_LABEL/PERF_STOP, optional staged bin)"
 	@echo "  perf-run-mainnet [bin-name]      Run against public Mainnet Zakura peers (PERF_MAINNET_LABEL/PERF_STOP)"
+	@echo "  perf-build-replay-bench          Build the offline commit-replay bench (commit-metrics)"
+	@echo "  perf-replay-index                One-time: dump the REPLAY_START..REPLAY_END window to a cache"
+	@echo "  perf-replay                      Replay the cache through the committer, no networking"
+	@echo "  perf-replay-worker               Replay through the real write worker (one rung up)"
+	@echo "  perf-replay-verifier             Replay through the checkpoint verifier (adds PoW + Merkle)"
+	@echo "  perf-replay-sequencer            Replay through the Zakura block-sync Sequencer (VCT-only,"
+	@echo "                                   pruned by default; REPLAY_ARCHIVE=1 for archive, REPLAY_TRACE_DIR=<dir> for traces)"
 	@echo "  perf-analyze                     Bottleneck attribution over the CSV window (PERF_LABEL/PERF_LO/PERF_HI)"
 	@echo "  perf-dashboard                   Live metrics dashboard for the running bench node"
 	@echo "  perf-verify-isolation            Confirm the bench sees only the two cohort peers"
diff --git a/deploy/runner/replay_run.sh b/deploy/runner/replay_run.sh
new file mode 100755
index 00000000000..546ee9d9565
--- /dev/null
+++ b/deploy/runner/replay_run.sh
@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+# Offline commit-pipeline replay bench (zebra-replay-bench).
+#
+# Replays real mainnet blocks through the state committer with NO networking, to
+# benchmark the write-assembler + disk-writer in isolation. Forward model (no
+# rollback): the base snapshot's tip must equal REPLAY_START-1, and blocks are
+# replayed onto a fork of it.
+#
+#   replay_run.sh index             # fork the block source, dump the window to a cache
+#   replay_run.sh index-roots       # fork the source, derive per-height roots -> VCT sidecar
+#   replay_run.sh run <label> BIN   # fork the base, apply the cache, time it
+#
+# `index` (and `index-roots` for VCT) are one-time setup. `run` is the repeatable
+# A/B step — it re-forks the base each time so commits never touch the source.
+# Set REPLAY_VCT_SIDECAR to a sidecar path to drive the VCT fast path in `run`.
+#
+# All host paths come from cohort.env (REPLAY_* / BENCH_* vars) or the environment.
+#
+# NOTE: rolling a single snapshot back to manufacture a lower base is intentionally
+# NOT used here — rollback of a large span builds one giant in-memory delete batch
+# and OOMs. Use two snapshots (a near-tip source + a base at START-1) instead. The
+# binary still exposes a `rollback` subcommand for small spans if ever needed.
+set -uo pipefail
+
+RUNNER_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=/dev/null
+[ -f "$RUNNER_DIR/cohort.env" ] && source "$RUNNER_DIR/cohort.env"
+
+DBREL="${BENCH_DB_REL:-state/v27/mainnet}"
+SRC="${REPLAY_SRC:-/mnt/roman-dev-2-data/zebra-cache}"
+BASE_SRC="${REPLAY_BASE_SRC:-/mnt/roman-dev-2-data/zebra-ckpt-1800000-warm}"
+CACHE="${REPLAY_CACHE:-/mnt/roman-dev-2-data/win-fwd.zrb}"
+SIDECAR="${REPLAY_SIDECAR:-/mnt/roman-dev-2-data/win-fwd.vct}"
+START="${REPLAY_START:-1802001}"
+END="${REPLAY_END:-1832000}"
+FORK_DIR="${BENCH_FORK_DIR:-/mnt/roman-dev-2-data}"
+BIN_DEFAULT="${REPLAY_BIN:-/root/wal-bench/zebra-replay-bench}"
+
+die()  { echo "FATAL: $*" >&2; exit 1; }
+note() { echo "[replay] $*" >&2; }
+
+# Hard-link fork SRC -> DST, breaking links on RocksDB mutable metadata so writes
+# to the fork can never reach the source snapshot (same trick as feed_run.sh).
+clone_fork() {
+  local src="$1" dst="$2"
+  [ -d "$src/$DBREL" ] || die "source DB missing: $src/$DBREL"
+  rm -rf "$dst"
+  mkdir -p "$dst/$(dirname "$DBREL")"
+  cp -al "$src/$DBREL" "$dst/$DBREL"
+  ( cd "$dst/$DBREL"
+    for f in CURRENT IDENTITY LOG LOCK OPTIONS-* MANIFEST-* *.log version; do
+      [ -e "$f" ] || continue
+      cp -p "$f" "$f.unlink" && mv -f "$f.unlink" "$f"
+    done )
+}
+
+cmd_index() {
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin"
+  local src="$FORK_DIR/replay-src-fork"
+  note "fork $SRC -> $src; index $START..$END -> $CACHE"
+  clone_fork "$SRC" "$src"
+  "$bin" index --src "$src" --cache "$CACHE" --start "$START" --end "$END"
+  rm -rf "$src"
+  note "index done: $CACHE"
+}
+
+cmd_index_roots() {
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin"
+  local src="$FORK_DIR/replay-src-fork"
+  note "fork $SRC -> $src; derive roots $START..$END -> $SIDECAR"
+  clone_fork "$SRC" "$src"
+  "$bin" index-roots --src "$src" --sidecar "$SIDECAR" --start "$START" --end "$END"
+  rm -rf "$src"
+  note "roots sidecar done: $SIDECAR"
+}
+
+cmd_run() {
+  local label="${1:?usage: replay_run.sh run <label> [bin]}"; shift || true
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin (build with 'make perf-build-replay-bench')"
+  [ -f "$CACHE" ] || die "cache missing: $CACHE (run 'replay_run.sh index' first)"
+  local fork="$FORK_DIR/replay-run-$label"
+  note "fork base $BASE_SRC -> $fork; apply $CACHE (expects base tip $((START - 1)))"
+  clone_fork "$BASE_SRC" "$fork"
+  if [ -n "${REPLAY_VCT_SIDECAR:-}" ]; then
+    [ -f "$REPLAY_VCT_SIDECAR" ] || die "VCT sidecar missing: $REPLAY_VCT_SIDECAR (run 'replay_run.sh index-roots')"
+    note "VCT mode: --vct-sidecar $REPLAY_VCT_SIDECAR"
+    "$bin" apply --base "$fork" --cache "$CACHE" --vct-sidecar "$REPLAY_VCT_SIDECAR"
+  else
+    "$bin" apply --base "$fork" --cache "$CACHE"
+  fi
+  note "cleanup: rm -rf $fork"
+  rm -rf "$fork"
+}
+
+# Like cmd_run, but replays through the real zebra-state write worker
+# (apply-worker), one altitude above the direct committer.
+cmd_run_worker() {
+  local label="${1:?usage: replay_run.sh run-worker <label> [bin]}"; shift || true
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin (build with 'make perf-build-replay-bench')"
+  [ -f "$CACHE" ] || die "cache missing: $CACHE (run 'replay_run.sh index' first)"
+  local fork="$FORK_DIR/replay-worker-$label"
+  note "fork base $BASE_SRC -> $fork; apply-worker $CACHE (expects base tip $((START - 1)))"
+  clone_fork "$BASE_SRC" "$fork"
+  if [ -n "${REPLAY_VCT_SIDECAR:-}" ]; then
+    [ -f "$REPLAY_VCT_SIDECAR" ] || die "VCT sidecar missing: $REPLAY_VCT_SIDECAR (run 'replay_run.sh index-roots')"
+    note "VCT mode: --vct-sidecar $REPLAY_VCT_SIDECAR"
+    "$bin" apply-worker --base "$fork" --cache "$CACHE" --vct-sidecar "$REPLAY_VCT_SIDECAR"
+  else
+    "$bin" apply-worker --base "$fork" --cache "$CACHE"
+  fi
+  note "cleanup: rm -rf $fork"
+  rm -rf "$fork"
+}
+
+# Like cmd_run_worker, but replays through the real zebra-consensus checkpoint
+# verifier (which commits to a real StateService), one altitude above the worker.
+cmd_run_verifier() {
+  local label="${1:?usage: replay_run.sh run-verifier <label> [bin]}"; shift || true
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin (build with 'make perf-build-replay-bench')"
+  [ -f "$CACHE" ] || die "cache missing: $CACHE (run 'replay_run.sh index' first)"
+  local fork="$FORK_DIR/replay-verifier-$label"
+  note "fork base $BASE_SRC -> $fork; apply-verifier $CACHE (expects base tip $((START - 1)))"
+  clone_fork "$BASE_SRC" "$fork"
+  if [ -n "${REPLAY_VCT_SIDECAR:-}" ]; then
+    [ -f "$REPLAY_VCT_SIDECAR" ] || die "VCT sidecar missing: $REPLAY_VCT_SIDECAR (run 'replay_run.sh index-roots')"
+    note "VCT mode: --vct-sidecar $REPLAY_VCT_SIDECAR"
+    "$bin" apply-verifier --base "$fork" --cache "$CACHE" --vct-sidecar "$REPLAY_VCT_SIDECAR"
+  else
+    "$bin" apply-verifier --base "$fork" --cache "$CACHE"
+  fi
+  note "cleanup: rm -rf $fork"
+  rm -rf "$fork"
+}
+
+# Like cmd_run_verifier, but replays through the real Zakura block-sync Sequencer
+# (reorder + ordered submit to the verifier->state). VCT-only.
+cmd_run_sequencer() {
+  local label="${1:?usage: replay_run.sh run-sequencer <label> [bin]}"; shift || true
+  local bin="${1:-$BIN_DEFAULT}"
+  [ -x "$bin" ] || die "binary not executable: $bin (build with 'make perf-build-replay-bench')"
+  [ -f "$CACHE" ] || die "cache missing: $CACHE (run 'replay_run.sh index' first)"
+  [ -n "${REPLAY_VCT_SIDECAR:-}" ] || die "apply-sequencer is VCT-only; set REPLAY_VCT_SIDECAR (run 'replay_run.sh index-roots')"
+  [ -f "$REPLAY_VCT_SIDECAR" ] || die "VCT sidecar missing: $REPLAY_VCT_SIDECAR"
+  local fork="$FORK_DIR/replay-sequencer-$label"
+  note "fork base $BASE_SRC -> $fork; apply-sequencer $CACHE (VCT; expects base tip $((START - 1)))"
+  clone_fork "$BASE_SRC" "$fork"
+  local args=(apply-sequencer --base "$fork" --cache "$CACHE" --vct-sidecar "$REPLAY_VCT_SIDECAR")
+  # Storage mode: Pruned by default (BASE_SRC must already be a pruned snapshot; pruning
+  # is one-way). REPLAY_ARCHIVE=1 opts back into Archive (needs an archive base).
+  if [ -n "${REPLAY_ARCHIVE:-}" ]; then
+    note "storage mode: archive"
+    args+=(--archive)
+  else
+    note "storage mode: pruned (default)"
+  fi
+  # Structured Zakura JSONL traces, like perf-run-mainnet's [network.zakura] trace_dir.
+  if [ -n "${REPLAY_TRACE_DIR:-}" ]; then
+    note "Zakura JSONL traces -> $REPLAY_TRACE_DIR"
+    args+=(--trace-dir "$REPLAY_TRACE_DIR")
+  fi
+  "$bin" "${args[@]}"
+  note "cleanup: rm -rf $fork"
+  rm -rf "$fork"
+}
+
+case "${1:-}" in
+  index)         shift; cmd_index "$@" ;;
+  index-roots)   shift; cmd_index_roots "$@" ;;
+  run)           shift; cmd_run "$@" ;;
+  run-worker)    shift; cmd_run_worker "$@" ;;
+  run-verifier)  shift; cmd_run_verifier "$@" ;;
+  run-sequencer) shift; cmd_run_sequencer "$@" ;;
+  *) echo "usage: replay_run.sh {index|index-roots|run <label> [bin]|run-worker <label> [bin]|run-verifier <label> [bin]|run-sequencer <label> [bin]}" >&2; exit 2 ;;
+esac
diff --git a/docs/design/verified-commitment-trees.md b/docs/design/verified-commitment-trees.md
index 4601dd6d13d..750454f7e05 100644
--- a/docs/design/verified-commitment-trees.md
+++ b/docs/design/verified-commitment-trees.md
@@ -187,12 +187,14 @@ orthogonal pruning axis). The resulting modes:
 | **Archive** (default) | `consensus.checkpoint_sync = true`, `consensus.vct_fast_sync = true`, `storage_mode = archive` | Fast — verified roots folded in, recompute skipped. Unpruned (raw tx + indexes kept). No per-height tree history below the last checkpoint height _for now_ (§7, §10). |
 | **Pruning** | `consensus.checkpoint_sync = true`, `consensus.vct_fast_sync = true`, `storage_mode.pruned` | Fast — same as Archive, **plus** raw-tx/index pruning outside the retention window. |
 | **Force-disabled VCT** | `consensus.checkpoint_sync = true`, `consensus.vct_fast_sync = false` (any storage mode) | Legacy — keeps checkpoint sync enabled but fully reconstructs the Sapling/Orchard trees per block. |
-| **Checkpoint sync disabled** | `consensus.checkpoint_sync = false` (any storage mode) | Legacy — fully reconstructs the Sapling/Orchard trees per block, using only mandatory checkpoints. |
+| **Checkpoint sync disabled** | `consensus.checkpoint_sync = false`, `consensus.vct_fast_sync = false` (any storage mode) | Legacy — fully reconstructs the Sapling/Orchard trees per block, using only mandatory checkpoints. |
 
 Gating fast on `checkpoint_sync` is also a correctness precondition: the embedded last checkpoint height
 frontier is pinned to the network's **full** max checkpoint height (§5.2), which only applies
 when `checkpoint_sync = true` (with it `false`, the effective max checkpoint drops to the
-Canopy mandatory checkpoint, so there is no valid last checkpoint height to resume from). zebrad mirrors
+Canopy mandatory checkpoint, so there is no valid last checkpoint height to resume from). For
+that reason, zebrad rejects `consensus.checkpoint_sync = false` together with
+`consensus.vct_fast_sync = true` at startup. zebrad mirrors
 `consensus.checkpoint_sync` into the state config at startup
 (`state_config.checkpoint_sync`), so the state makes the decision without depending on
 `zebra-consensus`.
@@ -201,7 +203,7 @@ Precedence is resolved by a pure, unit-tested `select_source_mode` (no process e
 files in the decision — `consensus.checkpoint_sync`, `consensus.vct_fast_sync`, and the
 embedded-frontier presence are passed in as plain inputs):
 
-1. `consensus.checkpoint_sync = false`, `consensus.vct_fast_sync = false`, or a network
+1. `consensus.vct_fast_sync = false` or a network
    with **no embedded frontier** → **legacy** (no VCT state, zero overhead);
 2. else → **peer** (the default under checkpoint sync where embedded frontiers exist).
 
@@ -427,16 +429,16 @@ occurred — the needed `H+1` witness is merely not buffered yet.
 to `pruning_metadata`, not a reuse — pruning drops tx bytes and keeps trees, fast-sync drops the
 per-height trees; a DB can be both. Because fast sync deletes nothing, a **completed** fast-synced
 DB (tip at/above the last checkpoint height) **reopens in any storage mode** — a reopen loses no servable data,
-and `consensus.vct_fast_sync = false` or `consensus.checkpoint_sync = false` simply resumes
-the legacy recompute from the real tip frontier.
+and `consensus.vct_fast_sync = false` simply resumes the legacy recompute from the real tip
+frontier.
 
 The one reopen that _is_ refused is an **interrupted** fast sync (frozen frontier, tip below the
 last checkpoint height) reopened with the fast path disabled (legacy mode —
-`consensus.vct_fast_sync = false`, `consensus.checkpoint_sync = false`, or no embedded
-frontier). The on-disk frontier is stale and no source can supply the verified roots, so the
-fail-closed policy (§8) would refuse every below-last checkpoint height block forever. The open guard refuses
-with a clear recovery path (finish the fast sync under `consensus.checkpoint_sync = true` and
-`consensus.vct_fast_sync = true`, or re-sync from genesis) instead of stalling silently.
+`consensus.vct_fast_sync = false` or no embedded frontier). The on-disk frontier is stale and no
+source can supply the verified roots, so the fail-closed policy (§8) would refuse every below-last
+checkpoint height block forever. The open guard refuses with a clear recovery path (finish the fast
+sync under `consensus.checkpoint_sync = true` and `consensus.vct_fast_sync = true`, or re-sync from
+genesis) instead of stalling silently.
 Guards: per-height tree reads return `None` below the last checkpoint height (before the backward search, so no
 stale tree and no panic); `z_gettreestate` returns a typed archive-mode error below the last checkpoint height;
 genesis-root and subtree format-validity checks skip fast-synced DBs.
@@ -623,7 +625,7 @@ Live commit-path counters distinguish the fast and legacy paths and the failure
 | Metric | Meaning |
 | --- | --- |
 | `state.vct.fast.block.count` | block folded supplied roots, skipped the recompute |
-| `state.vct.legacy.block.count` | block recomputed the frontier (`consensus.vct_fast_sync = false`, `consensus.checkpoint_sync = false`, or fell back outside the frozen window) |
+| `state.vct.legacy.block.count` | block recomputed the frontier (`consensus.vct_fast_sync = false` or fell back outside the frozen window) |
 | `state.vct.prevalidated.block.count` | dedup sub-case: the previous fast block's look-ahead already validated this header |
 | `state.vct.root.rejected.count` | supplied root failed verification and was deleted for re-delivery |
 | `state.vct.root.unavailable.count` | frozen-frontier height with no valid root; commit refused (retryable) |
@@ -644,9 +646,9 @@ asserts to prove roots actually came over the wire rather than a silent legacy s
   invalid-marker / unrequested-roots rejections
   (`decode_rejects_tree_aux_roots_when_not_requested`,
   `non_finalized_response_carrying_tree_aux_roots_is_malformed`) and the byte-budget clamp with
-  roots requested; `select_source_mode` precedence (`consensus.vct_fast_sync = false` or
-  `consensus.checkpoint_sync = false` ⇒ legacy regardless of storage mode or embedded frontier;
-  checkpoint sync + enabled VCT + embedded frontier ⇒ peer); a completed fast-synced DB reopens
+  roots requested; `select_source_mode` precedence (`consensus.vct_fast_sync = false` ⇒ legacy
+  regardless of storage mode or embedded frontier; checkpoint sync + enabled VCT + embedded
+  frontier ⇒ peer); a completed fast-synced DB reopens
   in archive mode (`reopening_fast_synced_database_in_archive_mode_succeeds`) while an interrupted
   one reopened with the fast path off is refused
   (`reopening_interrupted_fast_sync_without_a_root_source_panics`); the below-NU5 Orchard pin and
diff --git a/docs/specs/blocksync/congestion_control.md b/docs/specs/blocksync/congestion_control.md
new file mode 100644
index 00000000000..731d71ab1fb
--- /dev/null
+++ b/docs/specs/blocksync/congestion_control.md
@@ -0,0 +1,183 @@
+# Block-Sync BBR Congestion Control — Specification
+
+## Overview
+
+The controller runs **per peer** and is **byte-denominated**: it measures how fast a
+peer delivers block bodies (bytes/second) and how quickly it answers (round-trip
+time), and from those it sizes a per-peer **in-flight window** — the amount of
+outstanding body bytes we allow that peer at any moment. One request fetches one
+block body, so the in-flight _request count_ is simply `window ÷ body size`.
+
+It pursues three goals:
+
+1. **Responsiveness** — when we must re-request ("rescue") a block from a different
+   peer because its current carrier is slow, that peer can serve it almost
+   immediately. This only holds if the peer's queue is shallow: a freshly issued
+   request sits near the front instead of behind a long backlog.
+2. **Throughput** — every peer's link stays full.
+3. **Bounded memory** — total outstanding data is capped no matter how peers behave.
+
+The key insight is that responsiveness and throughput are **not** in tension at the
+right window size. The smallest window that still keeps a link full is exactly **one
+BDP** (byte delivery rate × base round-trip). At that point the pipe is saturated
+(full throughput) and almost nothing is queued (full responsiveness); any larger
+window adds only queue — latency — for zero extra throughput.
+
+So the controller:
+
+- **maximizes throughput** by growing the window toward `BDP × gain`, probing just
+  above the measured pipe so it finds and fills available bandwidth;
+- **maximizes responsiveness** by never growing it further — periodically draining
+  the queue (ProbeRtt) to re-confirm the true base round-trip, and trimming the
+  window the instant a standing queue starts to form (the delay gradient); and
+- **bounds memory** with a global in-flight byte budget and per-peer caps, kept
+  independent of the window logic.
+
+## Glossary
+
+The names below are the plain-language terms used throughout this document; the
+BBR/code identifier follows in parentheses.
+
+- **In-flight window** (`cwnd`, "congestion window") — the maximum body bytes a single
+  peer may have outstanding to us at once. A larger window means more parallel
+  requests to that peer.
+- **Base round-trip** (`RTprop`) — the _minimum_ recent round-trip time to a peer:
+  how long send-then-receive takes when nothing is queued. It is a latency, **not** a
+  window size, but it sizes the window (see BDP). "RT" = round trip.
+- **BDR — byte delivery rate** (`BtlBw`, "bottleneck bandwidth") — the _maximum_
+  recent rate, in bytes/second, at which a peer delivers bodies: the speed of the
+  bottleneck link to that peer.
+- **BDP — bandwidth-delay product** = `BDR × base round-trip` — the amount of
+  in-flight data that exactly fills the pipe to a peer. Hold this much outstanding and
+  the link is busy with no standing queue; hold less and it idles, hold more and the
+  excess only sits in a queue. This is the window's natural target.
+- **Gain** — a multiplier above 1 applied to the BDP so the window probes slightly
+  past the measured capacity, letting it discover newly available bandwidth.
+- **Measurement horizon** — the recent time span (10 s) over which we take the min
+  (base round-trip) and max (BDR). The `*_window` config knobs set these.
+- **ProbeBw / ProbeRtt** — the two operating modes. ProbeBw is steady state (window ≈
+  BDP). ProbeRtt briefly drains the queue to re-measure an honest base round-trip.
+- **Delay gradient** — the signal that a queue is forming: the recent round-trip has
+  risen above the base round-trip by more than a set ratio. It trims the window down.
+- **Floor** — the lowest block height we still need; the chain cannot commit past it.
+  A "floor request" fetches it, and if its carrier is slow the height is _rescued_ —
+  re-requested from a faster peer.
+
+## Measured signals (per peer)
+
+- **Base round-trip** — windowed _min_ of the raw request round-trip
+  (`bbr_rtprop_window`, 10 s). The propagation floor; never collapses to zero.
+- **BDR** — windowed _max_ of the per-response delivery rate in bytes/s
+  (`bbr_delivery_rate_window`, 10 s).
+- **BDP** = `BDR × base round-trip` (bytes). Window target =
+  `max(min window, BDP × gain)` (`gain = 200%`).
+- **Delay gradient** — a smoothed round-trip compared against a size-aware healthy
+  baseline (`base round-trip + bytes/BDR`), used to detect a building queue.
+
+In-flight admission compares a peer's **reserved body bytes** against its window; the
+in-flight _request count_ falls out as `window ÷ body size`.
+
+## Control law — MUST
+
+- A peer's outstanding reserved bytes MUST NOT exceed its window (plus the bounded
+  floor bypass below).
+- **ProbeBw** (steady state): the window tracks `BDP × gain`, clamped above by the
+  delay-gradient ceiling and below by the minimum window.
+- **ProbeRtt**: every `bbr_probe_rtt_interval` (10 s) the window MUST drain to the
+  minimum and hold for `bbr_probe_rtt_duration` (200 ms) so one uncontended request
+  yields a fresh base round-trip. Without this, a sustained queue inflates the
+  base-round-trip min and the window never collapses for a genuinely slow peer.
+
+## Control law — SHOULD
+
+- On a real request timeout the window SHOULD take one multiplicative dip (`×0.85`,
+  bounded by the minimum) and pull the delay ceiling down to the dipped value. A
+  timeout is merely congestion evidence, it should not trigger backoff.
+- When the smoothed round-trip exceeds `base round-trip × delay_gradient` (150%) the
+  queue is building, so the window ceiling SHOULD ratchet down (`×0.9`); when there is
+  headroom it SHOULD relax up (~12% per response, saturating) so a cleared queue
+  re-probes for bandwidth.
+
+---
+
+## Edge cases and security bounds
+
+### Problem: a fast peer's base round-trip can collapse toward zero and void the BDP
+
+On a fast link, subtracting a body's transmission time from its round-trip leaves
+almost nothing, which would zero `BDR × base round-trip` and pin the window at its
+floor.
+
+- The BDP MUST be sized from the **raw** round-trip minimum, never a
+  transmission-stripped residual (the residual is used only by the delay gate, so a
+  big body's honest transfer time is not mistaken for a queue).
+- The window MUST be floored at `bbr_min_cwnd_bytes` (4 MiB, the primary tuning
+  lever) so a near-zero BDP still keeps the pipe primed.
+
+### Problem: a burst of buffered bodies inflates the BDR
+
+Many bodies arriving in one tick would read as an impossibly high rate.
+
+- The delivery-rate interval MUST be floored at the previous base round-trip, so a
+  single-tick burst cannot inflate the BDR max.
+
+### Problem: a slow peer holding the contiguous floor stalls the whole sync
+
+The lowest missing height gates commit; one slow carrier must not pin it. This is the
+responsiveness goal made concrete — a shallow per-peer window is what lets a rescue
+land fast.
+
+- A **floor** request MUST carry a short fixed leash (`floor_rescue_timeout`, 2 s);
+  on expiry its height MUST be returned to the queue and the peer retry-avoided —
+  rescued to a faster carrier, **not** disconnected (record-only).
+- The floor MAY borrow up to `floor_bypass_slots` (2) representative bodies beyond a
+  saturated window so it is fetched even when every peer is at its window; the borrow
+  MUST stay within the advertised request-count cap and reserve real budget.
+- **Above-floor** speculation SHOULD use a patient, size-aware deadline
+  (`request_timeout + estimated_bytes ÷ BDR`) and MUST NOT gate the floor.
+
+### Problem: unbounded memory under attacker-controlled bodies or stalls
+
+- Total in-flight + reorder + applying bytes MUST be bounded by the global
+  `max_inflight_block_bytes` budget (6 GiB). Concurrent reservations MUST NOT
+  over-commit it.
+- Every per-request size estimate MUST be clamped to `[floor, MAX_BLOCK_BYTES]`;
+  untrusted header size hints MUST NOT exceed the per-block worst case.
+- The advertised request-count cap (≤ `MAX_BS_INFLIGHT_REQUESTS = 32 768`) MUST bind
+  even when byte headroom remains, so a peer serving tiny bodies cannot be issued an
+  unbounded request count.
+- The reorder look-ahead and the serving-request heap MUST be bounded.
+
+### Problem: an unbounded wait wedges a peer
+
+- Every outbound request MUST have a network deadline — the **only** sanctioned timer
+  (and itself an event). The above-floor deadline assumes a minimum delivery rate when
+  a peer's measured BDR is still near zero, so the deadline is finite (~16 s worst
+  case), never unbounded.
+
+### Numeric safety — MUST
+
+- Arithmetic over external/untrusted values MUST saturate or be checked — never wrap
+  or panic.
+- Rates and BDP products MUST be clamped to finite, non-negative values before they
+  size a window.
+
+---
+
+## Defaults
+
+| Knob | Default | Meaning |
+| --- | --- | --- |
+| `bbr_cwnd_unit` | `bytes` | window budgets header-hinted body bytes |
+| `bbr_cwnd_gain_percent` | 200 | window target = 2 × BDP |
+| `bbr_min_cwnd_bytes` | 4 MiB | window floor / cold-start (primary lever) |
+| `bbr_min_cwnd` | 4 | window floor in blocks (A/B baseline unit) |
+| `bbr_rtprop_window` | 10 s | base-round-trip measurement horizon |
+| `bbr_delivery_rate_window` | 10 s | BDR measurement horizon |
+| `bbr_probe_rtt_interval` | 10 s | ProbeRtt cadence |
+| `bbr_probe_rtt_duration` | 200 ms | drained hold to refresh base round-trip |
+| `bbr_delay_gradient_percent` | 150 | queue-building round-trip ratio |
+| `floor_rescue_timeout` | 2 s | floor leash before rescue |
+| `floor_bypass_slots` | 2 | floor borrow beyond the window |
+| `max_inflight_block_bytes` | 6 GiB | global in-flight byte ceiling |
+| timeout dip / delay-cap down / EWMA α | ×0.85 / ×0.9 / 0.25 | (constants) |
diff --git a/make/perf.mk b/make/perf.mk
index 2abd72fc3ec..f55226e626c 100644
--- a/make/perf.mk
+++ b/make/perf.mk
@@ -12,6 +12,12 @@
 .PHONY: \
 	perf-build-local \
 	perf-build-stage-bin \
+	perf-build-replay-bench \
+	perf-replay-index \
+	perf-replay \
+	perf-replay-worker \
+	perf-replay-verifier \
+	perf-replay-sequencer \
 	perf-run \
 	perf-run-mainnet \
 	perf-analyze \
@@ -62,6 +68,58 @@ perf-run:
 perf-run-mainnet:
 	bin="$$(PERF_BIN_NAME="$(PERF_BIN_NAME)" "$(PERF_SH)" bench-bin)" && CONFIG_SRC="$(PERF_MAINNET_CONFIG)" "$(FEED_RUN)" $(PERF_MAINNET_LABEL) "$$bin" $(PERF_STOP)
 
+# ─── Offline commit-pipeline replay bench (zebra-replay-bench) ────────────────
+# Replays real mainnet blocks through the state committer with NO networking, to
+# benchmark the committer (write-assembler + disk-writer) in isolation. Forward
+# model: the base snapshot's tip must equal REPLAY_START-1 (no rollback). Paths
+# come from deploy/runner/cohort.env (REPLAY_* vars). `perf-replay-index` is a
+# one-time setup; `perf-replay` is the repeatable A/B step. Add --vct-sidecar via
+# REPLAY_VCT_SIDECAR to exercise the VCT fast path.
+#   make perf-build-replay-bench   # build the bench binary (commit-metrics)
+#   make perf-replay-index         # one-time: dump the window to a block cache
+#   make perf-replay               # replay the cache through the committer
+#   make perf-replay-worker        # same window, through the write worker
+#   make perf-replay-verifier      # same window, through the checkpoint verifier
+#   make perf-replay-sequencer     # same window, through the block-sync Sequencer (VCT)
+
+PERF_REPLAY_RUN   ?= $(CURDIR)/deploy/runner/replay_run.sh
+REPLAY_BIN        ?= $(CURDIR)/target/release/zebra-replay-bench
+PERF_REPLAY_LABEL ?= r1-replay
+
+# Build the replay bench binary (commit-metrics) into the default target dir.
+perf-build-replay-bench:
+	cargo build --release -p zebra-replay-bench --features commit-metrics --locked
+
+# One-time: dump the configured window from the block source into the cache.
+perf-replay-index:
+	REPLAY_BIN="$(REPLAY_BIN)" "$(PERF_REPLAY_RUN)" index "$(REPLAY_BIN)"
+
+# Repeatable: fork the base snapshot, apply the cache, report throughput.
+perf-replay:
+	REPLAY_BIN="$(REPLAY_BIN)" "$(PERF_REPLAY_RUN)" run $(PERF_REPLAY_LABEL) "$(REPLAY_BIN)"
+
+# Repeatable: same window, but replayed through the real zebra-state write worker
+# (one altitude above the direct committer). Set REPLAY_VCT_SIDECAR for VCT mode.
+perf-replay-worker:
+	REPLAY_BIN="$(REPLAY_BIN)" "$(PERF_REPLAY_RUN)" run-worker $(PERF_REPLAY_LABEL) "$(REPLAY_BIN)"
+
+# Repeatable: same window, through the real zebra-consensus checkpoint verifier
+# (commits to a real StateService; one altitude above the worker). Adds PoW/
+# equihash + Merkle verification. Set REPLAY_VCT_SIDECAR for VCT mode.
+perf-replay-verifier:
+	REPLAY_BIN="$(REPLAY_BIN)" "$(PERF_REPLAY_RUN)" run-verifier $(PERF_REPLAY_LABEL) "$(REPLAY_BIN)"
+
+# Repeatable: same window, through the real Zakura block-sync Sequencer (reorder +
+# ordered submit to the verifier->state; one altitude above the verifier). VCT-only:
+# requires REPLAY_VCT_SIDECAR. Commits in Pruned storage mode by default (BASE_SRC must
+# be a pruned snapshot), matching the production mainnet config. Optional knobs:
+#   REPLAY_ARCHIVE=1          commit in Archive storage mode instead (needs an archive base)
+#   REPLAY_TRACE_DIR=<dir>    write structured Zakura JSONL traces (block_sync.jsonl),
+#                             the same tables perf-run-mainnet emits via trace_dir; plot
+#                             with .cursor/skills/zakura-trace-plots
+perf-replay-sequencer:
+	REPLAY_BIN="$(REPLAY_BIN)" "$(PERF_REPLAY_RUN)" run-sequencer $(PERF_REPLAY_LABEL) "$(REPLAY_BIN)"
+
 # Steady-state bottleneck attribution over the CSV window [PERF_LO, PERF_HI].
 perf-analyze:
 	"$(PERF_SH)" analyze $(PERF_LABEL) $(PERF_LO) $(PERF_HI)
diff --git a/zebra-consensus/src/block.rs b/zebra-consensus/src/block.rs
index ad8c16556f8..4b0134ae114 100644
--- a/zebra-consensus/src/block.rs
+++ b/zebra-consensus/src/block.rs
@@ -353,15 +353,17 @@ where
             let new_outputs = Arc::into_inner(known_utxos)
                 .expect("all verification tasks using known_utxos are complete");
 
-            let prepared_block = zs::SemanticallyVerifiedBlock {
+            // The semantic verifier checks the auth-data commitment during
+            // contextual validation, so the auth-data root isn't precomputed here
+            // (`from_semantic_data` leaves it unset).
+            let prepared_block = zs::SemanticallyVerifiedBlock::from_semantic_data(
                 block,
                 hash,
                 height,
                 new_outputs,
                 transaction_hashes,
-                deferred_pool_balance_change: Some(deferred_pool_balance_change),
-                auth_data_root: None,
-            };
+                Some(deferred_pool_balance_change),
+            );
 
             // Return early for proposal requests.
             if request.is_proposal() {
diff --git a/zebra-consensus/src/block/request.rs b/zebra-consensus/src/block/request.rs
index 534f6c599b8..d03abc2de26 100644
--- a/zebra-consensus/src/block/request.rs
+++ b/zebra-consensus/src/block/request.rs
@@ -2,13 +2,30 @@
 
 use std::sync::Arc;
 
-use zebra_chain::block::Block;
+use zebra_chain::{
+    block::{self, Block},
+    parameters::Network,
+};
+use zebra_state::CheckpointVerifiedBlock;
+
+use crate::checkpoint::VerifyCheckpointError;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 /// A request to the chain or block verifier
 pub enum Request {
     /// Performs semantic validation, then asks the state to perform contextual validation and commit the block
     Commit(Arc<Block>),
+
+    /// Like [`Request::Commit`], but the (CPU-heavy) checkpoint-verifier
+    /// precomputation — the per-transaction txids and the auth data root — has
+    /// already been done by the caller, off the single-threaded checkpoint
+    /// verifier.
+    ///
+    /// Only valid below the checkpoint height; the verifier still performs all
+    /// validity checks (proof of work, Merkle root, height). Used by the syncer,
+    /// which can build these blocks concurrently across many download tasks.
+    CommitCheckpointPrecomputed(CheckpointVerifiedBlock),
+
     /// Performs semantic validation but skips checking proof of work,
     /// then asks the state to perform contextual validation.
     /// Does not commit the block to the state.
@@ -16,18 +33,62 @@ pub enum Request {
 }
 
 impl Request {
+    /// Creates a commit request for the downloaded block.
+    ///
+    /// For checkpoint-height blocks, precompute the checkpoint-verified block
+    /// off the verifier's single-threaded buffer worker. Callers should do this
+    /// before reserving verifier readiness, so the CPU-heavy work does not hold a
+    /// verifier slot.
+    pub async fn create_commit_request(
+        block: Arc<Block>,
+        block_height: block::Height,
+        max_checkpoint_height: block::Height,
+        network: Network,
+    ) -> Result<Self, VerifyCheckpointError> {
+        if block_height <= max_checkpoint_height {
+            let hash = block.hash();
+
+            // Keep checkpoint sync's cheap proof-of-work gate before the
+            // per-transaction precomputation, matching the verifier path.
+            // Security: This prevents attackers from flooding the verifier with invalid blocks
+            // only to reject afterwards.
+            if network.disable_pow() {
+                super::check::difficulty_threshold_is_valid(
+                    &block.header,
+                    &network,
+                    &block_height,
+                    &hash,
+                )?;
+            } else {
+                super::check::difficulty_is_valid(&block.header, &network, &block_height, &hash)?;
+                super::check::equihash_solution_is_valid(&block.header)?;
+            }
+
+            let checkpoint_block = tokio::task::spawn_blocking(move || {
+                CheckpointVerifiedBlock::with_hash(block, hash)
+            })
+            .await
+            .expect("checkpoint block precomputation should not panic");
+
+            Ok(Request::CommitCheckpointPrecomputed(checkpoint_block))
+        } else {
+            Ok(Request::Commit(block))
+        }
+    }
+
     /// Returns inner block
     pub fn block(&self) -> Arc<Block> {
-        Arc::clone(match self {
-            Request::Commit(block) => block,
-            Request::CheckProposal(block) => block,
-        })
+        match self {
+            Request::Commit(block) => Arc::clone(block),
+            Request::CommitCheckpointPrecomputed(block) => Arc::clone(&block.block),
+            Request::CheckProposal(block) => Arc::clone(block),
+        }
     }
 
     /// Returns `true` if the request is a proposal
     pub fn is_proposal(&self) -> bool {
         match self {
-            Request::Commit(_) => false,
+            Request::Commit(_) | Request::CommitCheckpointPrecomputed(_) => false,
             Request::CheckProposal(_) => true,
         }
     }
diff --git a/zebra-consensus/src/block/tests.rs b/zebra-consensus/src/block/tests.rs
index 35d6e3b5172..b6631ffde25 100644
--- a/zebra-consensus/src/block/tests.rs
+++ b/zebra-consensus/src/block/tests.rs
@@ -19,7 +19,7 @@ use zebra_chain::{
     parameters::{
         subsidy::block_subsidy,
         testnet::{ConfiguredActivationHeights, Parameters},
-        NetworkUpgrade,
+        Network, NetworkUpgrade,
     },
     primitives::Halo2Proof,
     serialization::{ZcashDeserialize, ZcashDeserializeInto},
@@ -168,6 +168,69 @@ async fn check_transcripts() -> Result<(), Report> {
     Ok(())
 }
 
+#[tokio::test]
+async fn create_commit_request_selects_checkpoint_precomputation() -> Result<(), Report> {
+    let _init_guard = zebra_test::init();
+
+    let block: Arc<Block> =
+        Block::zcash_deserialize(&zebra_test::vectors::BLOCK_MAINNET_GENESIS_BYTES[..])?.into();
+    let max_checkpoint_height = Height(1);
+
+    let request = Request::create_commit_request(
+        block.clone(),
+        Height(0),
+        max_checkpoint_height,
+        Network::Mainnet,
+    )
+    .await?;
+    assert!(matches!(request, Request::CommitCheckpointPrecomputed(_)));
+    assert_eq!(request.block(), block);
+
+    let request = Request::create_commit_request(
+        block.clone(),
+        max_checkpoint_height,
+        max_checkpoint_height,
+        Network::Mainnet,
+    )
+    .await?;
+    assert!(matches!(request, Request::CommitCheckpointPrecomputed(_)));
+    assert_eq!(request.block(), block);
+
+    let request = Request::create_commit_request(
+        block.clone(),
+        Height(2),
+        max_checkpoint_height,
+        Network::Mainnet,
+    )
+    .await?;
+    assert_eq!(request, Request::Commit(block));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn create_commit_request_rejects_invalid_checkpoint_pow() -> Result<(), Report> {
+    let _init_guard = zebra_test::init();
+
+    let block =
+        Arc::<Block>::zcash_deserialize(&zebra_test::vectors::BLOCK_MAINNET_GENESIS_BYTES[..])?;
+    let mut block = Arc::try_unwrap(block).expect("genesis block should have no other references");
+    let block_height = block.coinbase_height().expect("genesis block has height");
+
+    Arc::make_mut(&mut block.header).difficulty_threshold = INVALID_COMPACT_DIFFICULTY;
+
+    let request =
+        Request::create_commit_request(block.into(), block_height, block_height, Network::Mainnet)
+            .await;
+
+    assert!(
+        request.is_err(),
+        "invalid checkpoint proof of work must be rejected before precomputation"
+    );
+
+    Ok(())
+}
+
 #[test]
 fn coinbase_is_first_for_historical_blocks() -> Result<(), Report> {
     let _init_guard = zebra_test::init();
diff --git a/zebra-consensus/src/checkpoint.rs b/zebra-consensus/src/checkpoint.rs
index bcb4d201575..31de33bfbf3 100644
--- a/zebra-consensus/src/checkpoint.rs
+++ b/zebra-consensus/src/checkpoint.rs
@@ -33,7 +33,7 @@ use zebra_chain::{
     parameters::{
         checkpoint::list::CheckpointList,
         subsidy::{block_subsidy, funding_stream_values, FundingStreamReceiver, SubsidyError},
-        Network, NetworkUpgrade, GENESIS_PREVIOUS_BLOCK_HASH,
+        Network, GENESIS_PREVIOUS_BLOCK_HASH,
     },
     work::equihash,
 };
@@ -601,30 +601,75 @@ where
             .ok_or(VerifyCheckpointError::CoinbaseHeight { hash })?;
         self.check_height(height)?;
 
+        // Cheap proof-of-work checks run *before* the expensive precomputation,
+        // so a flood of invalid-PoW blocks can't make us do per-transaction work.
+        self.check_proof_of_work(&block.header, height, hash)?;
+
+        // Precompute the per-transaction hashes and auth data root, which scale
+        // with block weight. (The precomputed path does this concurrently in the
+        // caller and skips it here.)
+        let block = CheckpointVerifiedBlock::with_hash(block, hash);
+
+        self.finish_validation(block)
+    }
+
+    /// Check a [`CheckpointVerifiedBlock`] whose precomputation (txids, auth data
+    /// root) was already done by the caller, off the single-threaded verifier.
+    ///
+    /// Runs the same validity checks as [`Self::check_block`] (height, proof of
+    /// work, Merkle root) against the precomputed block.
+    fn validate_precomputed_block(
+        &self,
+        block: CheckpointVerifiedBlock,
+    ) -> Result<CheckpointVerifiedBlock, VerifyCheckpointError> {
+        let hash = block.hash;
+        let height = block.height;
+        self.check_height(height)?;
+        self.check_proof_of_work(&block.block.header, height, hash)?;
+        self.finish_validation(block)
+    }
+
+    /// Check the block's proof of work (difficulty, and equihash unless disabled).
+    fn check_proof_of_work(
+        &self,
+        header: &block::Header,
+        height: block::Height,
+        hash: block::Hash,
+    ) -> Result<(), VerifyCheckpointError> {
         if self.network.disable_pow() {
             crate::block::check::difficulty_threshold_is_valid(
-                &block.header,
+                header,
                 &self.network,
                 &height,
                 &hash,
             )?;
         } else {
-            crate::block::check::difficulty_is_valid(&block.header, &self.network, &height, &hash)?;
-            crate::block::check::equihash_solution_is_valid(&block.header)?;
+            crate::block::check::difficulty_is_valid(header, &self.network, &height, &hash)?;
+            crate::block::check::equihash_solution_is_valid(header)?;
         }
 
+        Ok(())
+    }
+
+    /// Finish validating a (precomputed) checkpoint block: set its deferred pool
+    /// balance change and check its Merkle root.
+    fn finish_validation(
+        &self,
+        mut block: CheckpointVerifiedBlock,
+    ) -> Result<CheckpointVerifiedBlock, VerifyCheckpointError> {
+        let height = block.height;
+
         // See [ZIP-1015](https://zips.z.cash/zip-1015).
         let expected_deferred_amount =
             funding_stream_values(height, &self.network, block_subsidy(height, &self.network)?)?
                 .remove(&FundingStreamReceiver::Deferred);
 
-        let deferred_pool_balance_change = expected_deferred_amount
-            .unwrap_or_default()
-            .checked_sub(self.network.lockbox_disbursement_total_amount(height))
-            .map(DeferredPoolBalanceChange::new);
-
-        // don't do precalculation until the block passes basic difficulty checks
-        let block = CheckpointVerifiedBlock::new(block, Some(hash), deferred_pool_balance_change);
+        block.set_deferred_pool_balance_change(
+            expected_deferred_amount
+                .unwrap_or_default()
+                .checked_sub(self.network.lockbox_disbursement_total_amount(height))
+                .map(DeferredPoolBalanceChange::new),
+        );
 
         crate::block::check::merkle_root_validity(
             &self.network,
@@ -647,11 +692,31 @@ where
     /// returns an error immediately.
     #[allow(clippy::unwrap_in_result)]
     fn queue_block(&mut self, block: Arc<Block>) -> Result<RequestBlock, VerifyCheckpointError> {
+        let block = self.check_block(block)?;
+        self.enqueue(block)
+    }
+
+    /// Like [`Self::queue_block`], but for a block whose precomputation was
+    /// already done by the caller (off the single-threaded verifier).
+    #[allow(clippy::unwrap_in_result)]
+    fn queue_precomputed_block(
+        &mut self,
+        block: CheckpointVerifiedBlock,
+    ) -> Result<RequestBlock, VerifyCheckpointError> {
+        let block = self.validate_precomputed_block(block)?;
+        self.enqueue(block)
+    }
+
+    /// Add an already-validated checkpoint block to the queue of blocks waiting
+    /// to be verified against a checkpoint.
+    #[allow(clippy::unwrap_in_result)]
+    fn enqueue(
+        &mut self,
+        block: CheckpointVerifiedBlock,
+    ) -> Result<RequestBlock, VerifyCheckpointError> {
         // Set up a oneshot channel to send results
         let (tx, rx) = oneshot::channel();
 
-        // Check that the height and Merkle roots are valid.
-        let block = self.check_block(block)?;
         let height = block.height;
         let hash = block.hash;
 
@@ -707,6 +772,134 @@ where
         Ok(req_block)
     }
 
+    /// Verify a checkpoint block whose precomputation (per-transaction txids and
+    /// auth data root) was already done concurrently by the caller, off this
+    /// single-threaded verifier. The verifier still performs all validity checks.
+    ///
+    /// This is the fast path used by the syncer: only the cheap checks and the
+    /// queue/commit bookkeeping run here, while the expensive precomputation has
+    /// already happened across many concurrent download tasks.
+    pub(crate) fn call_precomputed(
+        &mut self,
+        block: CheckpointVerifiedBlock,
+    ) -> Pin<Box<dyn Future<Output = Result<block::Hash, VerifyCheckpointError>> + Send + 'static>>
+    {
+        // Reset the verifier back to the state tip if requested
+        // (e.g. due to an error when committing a block to the state)
+        if let Ok(tip) = self.reset_receiver.try_recv() {
+            self.reset_progress(tip);
+        }
+
+        // Immediately reject all incoming blocks that arrive after we've finished.
+        if let FinalCheckpoint = self.previous_checkpoint_height() {
+            return async { Err(VerifyCheckpointError::Finished) }.boxed();
+        }
+
+        let req_block = match self.queue_precomputed_block(block) {
+            Ok(req_block) => req_block,
+            Err(e) => return async { Err(e) }.boxed(),
+        };
+
+        self.verify_and_commit(req_block)
+    }
+
+    /// Process a queued checkpoint block: advance checkpoint-range verification
+    /// and spawn the task that commits the block to the state once its range is
+    /// verified. Shared by the [`Service`] and precomputed entry points.
+    fn verify_and_commit(
+        &mut self,
+        req_block: RequestBlock,
+    ) -> Pin<Box<dyn Future<Output = Result<block::Hash, VerifyCheckpointError>> + Send + 'static>>
+    {
+        self.process_checkpoint_range();
+
+        metrics::gauge!("checkpoint.queued_slots").set(self.queued.len() as f64);
+
+        // Because the checkpoint verifier duplicates state from the state
+        // service (it tracks which checkpoints have been verified), we must
+        // commit blocks transactionally on a per-checkpoint basis. Otherwise,
+        // the checkpoint verifier's state could desync from the underlying
+        // state service. Among other problems, this could cause the checkpoint
+        // verifier to reject blocks not already in the state as
+        // already-verified.
+        //
+        // # Dropped Receivers
+        //
+        // To commit blocks transactionally on a per-checkpoint basis, we must
+        // commit all verified blocks in a checkpoint range, regardless of
+        // whether or not the response futures for each block were dropped.
+        //
+        // We accomplish this by spawning a new task containing the
+        // commit-if-verified logic. This task will always execute, except if
+        // the program is interrupted, in which case there is no longer a
+        // checkpoint verifier to keep in sync with the state.
+        //
+        // # State Commit Failures
+        //
+        // If the state commit fails due to corrupt block data,
+        // we don't reject the entire checkpoint.
+        // Instead, we reset the verifier to the successfully committed state tip.
+        let state_service = self.state_service.clone();
+        let commit_checkpoint_verified = tokio::spawn(async move {
+            let hash = req_block
+                .rx
+                .await
+                .map_err(Into::into)
+                .map_err(VerifyCheckpointError::CommitCheckpointVerified)
+                .expect("CheckpointVerifier does not leave dangling receivers")?;
+
+            // We use a `ServiceExt::oneshot`, so that every state service
+            // `poll_ready` has a corresponding `call`. See #1593.
+            match state_service
+                .oneshot(zs::Request::CommitCheckpointVerifiedBlock(req_block.block))
+                .map_err(VerifyCheckpointError::CommitCheckpointVerified)
+                .await?
+            {
+                zs::Response::Committed(committed_hash) => {
+                    assert_eq!(committed_hash, hash, "state must commit correct hash");
+                    Ok(hash)
+                }
+                _ => unreachable!("wrong response for CommitCheckpointVerifiedBlock"),
+            }
+        });
+
+        let state_service = self.state_service.clone();
+        let reset_sender = self.reset_sender.clone();
+        async move {
+            let result = commit_checkpoint_verified.await;
+            // Avoid a panic on shutdown
+            //
+            // When `zebrad` is terminated using Ctrl-C, the `commit_checkpoint_verified` task
+            // can return a `JoinError::Cancelled`. We expect task cancellation on shutdown,
+            // so we don't need to panic here. The persistent state is correct even when the
+            // task is cancelled, because block data is committed inside transactions, in
+            // height order.
+            let result = if zebra_chain::shutdown::is_shutting_down() {
+                Err(VerifyCheckpointError::ShuttingDown)
+            } else {
+                result.expect("commit_checkpoint_verified should not panic")
+            };
+            if result.is_err() {
+                // If there was an error committing the block, then this verifier
+                // will be out of sync with the state. In that case, reset
+                // its progress back to the state tip.
+                let tip = match state_service
+                    .oneshot(zs::Request::Tip)
+                    .await
+                    .map_err(VerifyCheckpointError::Tip)?
+                {
+                    zs::Response::Tip(tip) => tip,
+                    _ => unreachable!("wrong response for Tip"),
+                };
+                // Ignore errors since send() can fail only when the verifier
+                // is being dropped, and then it doesn't matter anymore.
+                let _ = reset_sender.send(tip);
+            }
+            result
+        }
+        .boxed()
+    }
+
     /// During checkpoint range processing, process all the blocks at `height`.
     ///
     /// Returns the first valid block. If there is no valid block, returns None.
@@ -1100,109 +1293,11 @@ where
             return async { Err(VerifyCheckpointError::Finished) }.boxed();
         }
 
-        let mut req_block = match self.queue_block(block) {
+        let req_block = match self.queue_block(block) {
             Ok(req_block) => req_block,
             Err(e) => return async { Err(e) }.boxed(),
         };
 
-        self.process_checkpoint_range();
-
-        metrics::gauge!("checkpoint.queued_slots").set(self.queued.len() as f64);
-
-        // Because the checkpoint verifier duplicates state from the state
-        // service (it tracks which checkpoints have been verified), we must
-        // commit blocks transactionally on a per-checkpoint basis. Otherwise,
-        // the checkpoint verifier's state could desync from the underlying
-        // state service. Among other problems, this could cause the checkpoint
-        // verifier to reject blocks not already in the state as
-        // already-verified.
-        //
-        // # Dropped Receivers
-        //
-        // To commit blocks transactionally on a per-checkpoint basis, we must
-        // commit all verified blocks in a checkpoint range, regardless of
-        // whether or not the response futures for each block were dropped.
-        //
-        // We accomplish this by spawning a new task containing the
-        // commit-if-verified logic. This task will always execute, except if
-        // the program is interrupted, in which case there is no longer a
-        // checkpoint verifier to keep in sync with the state.
-        //
-        // # State Commit Failures
-        //
-        // If the state commit fails due to corrupt block data,
-        // we don't reject the entire checkpoint.
-        // Instead, we reset the verifier to the successfully committed state tip.
-        let state_service = self.state_service.clone();
-        let network = self.network.clone();
-        let commit_checkpoint_verified = tokio::spawn(async move {
-            let hash = req_block
-                .rx
-                .await
-                .map_err(Into::into)
-                .map_err(VerifyCheckpointError::CommitCheckpointVerified)
-                .expect("CheckpointVerifier does not leave dangling receivers")?;
-
-            if req_block.block.auth_data_root.is_none()
-                && NetworkUpgrade::current(&network, req_block.block.height) >= NetworkUpgrade::Nu5
-            {
-                let block = req_block.block.block.clone();
-                if let Ok(auth_data_root) =
-                    tokio::task::spawn_blocking(move || block.auth_data_root()).await
-                {
-                    req_block.block.auth_data_root = Some(auth_data_root);
-                }
-            }
-
-            // We use a `ServiceExt::oneshot`, so that every state service
-            // `poll_ready` has a corresponding `call`. See #1593.
-            match state_service
-                .oneshot(zs::Request::CommitCheckpointVerifiedBlock(req_block.block))
-                .map_err(VerifyCheckpointError::CommitCheckpointVerified)
-                .await?
-            {
-                zs::Response::Committed(committed_hash) => {
-                    assert_eq!(committed_hash, hash, "state must commit correct hash");
-                    Ok(hash)
-                }
-                _ => unreachable!("wrong response for CommitCheckpointVerifiedBlock"),
-            }
-        });
-
-        let state_service = self.state_service.clone();
-        let reset_sender = self.reset_sender.clone();
-        async move {
-            let result = commit_checkpoint_verified.await;
-            // Avoid a panic on shutdown
-            //
-            // When `zebrad` is terminated using Ctrl-C, the `commit_checkpoint_verified` task
-            // can return a `JoinError::Cancelled`. We expect task cancellation on shutdown,
-            // so we don't need to panic here. The persistent state is correct even when the
-            // task is cancelled, because block data is committed inside transactions, in
-            // height order.
-            let result = if zebra_chain::shutdown::is_shutting_down() {
-                Err(VerifyCheckpointError::ShuttingDown)
-            } else {
-                result.expect("commit_checkpoint_verified should not panic")
-            };
-            if result.is_err() {
-                // If there was an error committing the block, then this verifier
-                // will be out of sync with the state. In that case, reset
-                // its progress back to the state tip.
-                let tip = match state_service
-                    .oneshot(zs::Request::Tip)
-                    .await
-                    .map_err(VerifyCheckpointError::Tip)?
-                {
-                    zs::Response::Tip(tip) => tip,
-                    _ => unreachable!("wrong response for Tip"),
-                };
-                // Ignore errors since send() can fail only when the verifier
-                // is being dropped, and then it doesn't matter anymore.
-                let _ = reset_sender.send(tip);
-            }
-            result
-        }
-        .boxed()
+        self.verify_and_commit(req_block)
     }
 }
diff --git a/zebra-consensus/src/config.rs b/zebra-consensus/src/config.rs
index 709c73ddff2..de0b2110047 100644
--- a/zebra-consensus/src/config.rs
+++ b/zebra-consensus/src/config.rs
@@ -26,6 +26,8 @@ pub struct Config {
     ///
     /// Disabling this option makes Zebra start full validation earlier.
     /// It is slower and less secure.
+    /// To keep checkpoint sync enabled but opt out of the initial VCT fast-sync rollout, set
+    /// [`vct_fast_sync`](Self::vct_fast_sync) to `false`.
     ///
     /// Zebra requires some checkpoints to simplify validation of legacy network upgrades.
     /// Required checkpoints are always active, even when this option is `false`.
@@ -35,22 +37,52 @@ pub struct Config {
     /// For security reasons, this option might be deprecated or ignored in a future Zebra
     /// release.
     pub checkpoint_sync: bool,
+
+    /// Use the verified-commitment-trees fast sync path during its initial rollout.
+    ///
+    /// `true` by default: checkpoint sync folds in verified Sapling/Orchard roots and skips the
+    /// per-block tree recompute on networks with embedded handoff frontiers. Set to `false` to
+    /// keep [`checkpoint_sync`](Self::checkpoint_sync) enabled while forcing the legacy per-block
+    /// recompute in both Archive and Pruned storage modes.
+    pub vct_fast_sync: bool,
+}
+
+impl Config {
+    /// Validate relationships between consensus configuration options.
+    pub fn validate(&self) -> Result<(), &'static str> {
+        if !self.checkpoint_sync && self.vct_fast_sync {
+            return Err("consensus.vct_fast_sync = true requires consensus.checkpoint_sync = true");
+        }
+
+        Ok(())
+    }
 }
 
 impl From<InnerConfig> for Config {
     fn from(
         InnerConfig {
-            checkpoint_sync, ..
+            checkpoint_sync,
+            vct_fast_sync,
+            ..
         }: InnerConfig,
     ) -> Self {
-        Self { checkpoint_sync }
+        Self {
+            checkpoint_sync,
+            vct_fast_sync,
+        }
     }
 }
 
 impl From<Config> for InnerConfig {
-    fn from(Config { checkpoint_sync }: Config) -> Self {
+    fn from(
+        Config {
+            checkpoint_sync,
+            vct_fast_sync,
+        }: Config,
+    ) -> Self {
         Self {
             checkpoint_sync,
+            vct_fast_sync,
             _debug_skip_parameter_preload: false,
         }
     }
@@ -66,6 +98,9 @@ pub struct InnerConfig {
     /// See [`Config`] for more details.
     pub checkpoint_sync: bool,
 
+    /// See [`Config`] for more details.
+    pub vct_fast_sync: bool,
+
     #[serde(skip_serializing, rename = "debug_skip_parameter_preload")]
     /// Unused config field for backwards compatibility.
     pub _debug_skip_parameter_preload: bool,
@@ -78,6 +113,7 @@ impl Default for Config {
     fn default() -> Self {
         Self {
             checkpoint_sync: true,
+            vct_fast_sync: true,
         }
     }
 }
@@ -86,7 +122,60 @@ impl Default for InnerConfig {
     fn default() -> Self {
         Self {
             checkpoint_sync: Config::default().checkpoint_sync,
+            vct_fast_sync: Config::default().vct_fast_sync,
             _debug_skip_parameter_preload: false,
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn vct_fast_sync_defaults_true_and_converts_through_inner_config() {
+        assert!(Config::default().vct_fast_sync);
+
+        let force_disabled = Config::from(InnerConfig {
+            checkpoint_sync: true,
+            vct_fast_sync: false,
+            _debug_skip_parameter_preload: false,
+        });
+
+        assert!(force_disabled.checkpoint_sync);
+        assert!(!force_disabled.vct_fast_sync);
+
+        let inner = InnerConfig::from(force_disabled);
+        assert!(!inner.vct_fast_sync);
+    }
+
+    #[test]
+    fn vct_fast_sync_requires_checkpoint_sync() {
+        let valid_default = Config {
+            checkpoint_sync: true,
+            vct_fast_sync: true,
+        };
+        assert!(valid_default.validate().is_ok());
+
+        let valid_legacy_recompute = Config {
+            checkpoint_sync: true,
+            vct_fast_sync: false,
+        };
+        assert!(valid_legacy_recompute.validate().is_ok());
+
+        let valid_full_verification = Config {
+            checkpoint_sync: false,
+            vct_fast_sync: false,
+        };
+        assert!(valid_full_verification.validate().is_ok());
+
+        let invalid = Config {
+            checkpoint_sync: false,
+            vct_fast_sync: true,
+        };
+        assert_eq!(
+            invalid.validate(),
+            Err("consensus.vct_fast_sync = true requires consensus.checkpoint_sync = true")
+        );
+    }
+}
diff --git a/zebra-consensus/src/lib.rs b/zebra-consensus/src/lib.rs
index 2b0d1d55ad0..30a81414975 100644
--- a/zebra-consensus/src/lib.rs
+++ b/zebra-consensus/src/lib.rs
@@ -46,10 +46,9 @@ pub mod transaction;
 
 #[cfg(any(test, feature = "proptest-impl"))]
 pub use block::check::difficulty_is_valid;
-#[cfg(any(test, feature = "proptest-impl"))]
-pub use checkpoint::CheckpointVerifier;
 
 pub use block::{subsidy::funding_stream_address, Request, VerifyBlockError, MAX_BLOCK_SIGOPS};
+pub use checkpoint::CheckpointVerifier;
 pub use checkpoint::{VerifyCheckpointError, MAX_CHECKPOINT_BYTE_COUNT, MAX_CHECKPOINT_HEIGHT_GAP};
 pub use config::Config;
 pub use error::BlockError;
diff --git a/zebra-consensus/src/router.rs b/zebra-consensus/src/router.rs
index 91bfa46ee12..905702de21e 100644
--- a/zebra-consensus/src/router.rs
+++ b/zebra-consensus/src/router.rs
@@ -200,6 +200,17 @@ where
     }
 
     fn call(&mut self, request: Request) -> Self::Future {
+        // A precomputed checkpoint block is, by construction, below the
+        // checkpoint height; route it straight to the checkpoint verifier's
+        // fast path (which skips the now-already-done precomputation).
+        if let Request::CommitCheckpointPrecomputed(block) = request {
+            return self
+                .checkpoint
+                .call_precomputed(block)
+                .map_err(Into::into)
+                .boxed();
+        }
+
         let block = request.block();
 
         match block.coinbase_height() {
diff --git a/zebra-consensus/src/router/tests.rs b/zebra-consensus/src/router/tests.rs
index 719840e49c5..e0117c2676a 100644
--- a/zebra-consensus/src/router/tests.rs
+++ b/zebra-consensus/src/router/tests.rs
@@ -143,10 +143,12 @@ static STATE_VERIFY_TRANSCRIPT_GENESIS: Lazy<
 async fn verify_checkpoint_test() -> Result<(), Report> {
     verify_checkpoint(Config {
         checkpoint_sync: true,
+        ..Config::default()
     })
     .await?;
     verify_checkpoint(Config {
         checkpoint_sync: false,
+        ..Config::default()
     })
     .await?;
 
diff --git a/zebra-network/src/config/tests/vectors.rs b/zebra-network/src/config/tests/vectors.rs
index d2282145302..b12437077d0 100644
--- a/zebra-network/src/config/tests/vectors.rs
+++ b/zebra-network/src/config/tests/vectors.rs
@@ -268,6 +268,24 @@ fn p2p_v2_unknown_future_config_fields_are_rejected() {
     );
 }
 
+#[test]
+fn p2p_v2_block_sync_config_validation_rejects_degenerate_values() {
+    let _init_guard = zebra_test::init();
+
+    let err = toml::from_str::<Config>(
+        r#"
+        [zakura.block_sync]
+        max_inflight_block_bytes = 0
+        "#,
+    )
+    .expect_err("top-level network config must validate Zakura block-sync settings");
+
+    assert!(
+        err.to_string().contains("invalid zakura.block_sync config"),
+        "unexpected block-sync config validation error: {err}",
+    );
+}
+
 #[test]
 fn p2p_v2_config_roundtrip_keeps_dconfig_zakura_fields() {
     let _init_guard = zebra_test::init();
diff --git a/zebra-network/src/peer/connection.rs b/zebra-network/src/peer/connection.rs
index cdfe262bcd9..9a1788b80ea 100644
--- a/zebra-network/src/peer/connection.rs
+++ b/zebra-network/src/peer/connection.rs
@@ -44,6 +44,10 @@ use InventoryResponse::*;
 
 mod peer_tx;
 
+/// Consecutive non-ping outbound receive timeouts tolerated before the peer
+/// connection is closed. The first timeout still only fails the request.
+const MAX_CONSECUTIVE_RECEIVE_TIMEOUTS: usize = 4;
+
 #[cfg(test)]
 mod tests;
 
@@ -614,6 +618,9 @@ where
     /// service to a request from this connection,
     /// or None if this connection hasn't yet received an overload error.
     last_overload_time: Option<Instant>,
+
+    /// Consecutive outbound request receive timeouts, excluding pings.
+    consecutive_receive_timeouts: usize,
 }
 
 impl<S, Tx> fmt::Debug for Connection<S, Tx>
@@ -631,6 +638,10 @@ where
             .field("metrics_label", &self.metrics_label)
             .field("last_metrics_state", &self.last_metrics_state)
             .field("last_overload_time", &self.last_overload_time)
+            .field(
+                "consecutive_receive_timeouts",
+                &self.consecutive_receive_timeouts,
+            )
             .finish()
     }
 }
@@ -664,6 +675,7 @@ where
             metrics_label,
             last_metrics_state: None,
             last_overload_time: None,
+            consecutive_receive_timeouts: 0,
         }
     }
 }
@@ -815,6 +827,7 @@ where
                         } else {
                             debug!(error = ?response, "error in peer response to Zebra request");
                         }
+                        self.consecutive_receive_timeouts = 0;
 
                         let _ = tx.send(response.map_err(Into::into));
                     } else {
@@ -924,10 +937,21 @@ where
                                     self.fail_with(e).await;
                                     State::Failed
                                 }
-                                // Other request timeouts fail the request.
+                                // Other request timeouts fail the request at first, then fail
+                                // the connection if the peer keeps timing out.
                                 State::AwaitingResponse { tx, .. } => {
                                     let _ = tx.send(Err(e.into()));
-                                    State::AwaitingRequest
+                                    self.consecutive_receive_timeouts += 1;
+
+                                    if self.consecutive_receive_timeouts
+                                        >= MAX_CONSECUTIVE_RECEIVE_TIMEOUTS
+                                    {
+                                        self.fail_with(PeerError::ConnectionReceiveTimeout)
+                                            .await;
+                                        State::Failed
+                                    } else {
+                                        State::AwaitingRequest
+                                    }
                                 }
                                 _ => unreachable!(
                                     "unexpected failed connection state while AwaitingResponse: client_receiver: {:?}",
@@ -1057,7 +1081,15 @@ where
                     .map(|()| Handler::Ping { nonce, ping_sent_at })
             }
 
-            (AwaitingRequest, BlocksByHash(hashes) | BlocksByHashFrom { hashes, .. }) => {
+            // `HedgedBlocksByHash` is rewritten to `BlocksByHash` by the peer set
+            // and should not reach an individual connection, but handle it
+            // identically as a defensive fallback.
+            (
+                AwaitingRequest,
+                BlocksByHash(hashes)
+                | BlocksByHashFrom { hashes, .. }
+                | HedgedBlocksByHash { hashes, .. },
+            ) => {
                 self
                     .peer_tx
                     .send(Message::GetData(
diff --git a/zebra-network/src/peer/connection/tests/vectors.rs b/zebra-network/src/peer/connection/tests/vectors.rs
index 58ac878b63d..f54f2268633 100644
--- a/zebra-network/src/peer/connection/tests/vectors.rs
+++ b/zebra-network/src/peer/connection/tests/vectors.rs
@@ -24,7 +24,10 @@ use zebra_test::mock_service::{MockService, PanicAssertion};
 use crate::{
     constants::{MAX_OVERLOAD_DROP_PROBABILITY, MIN_OVERLOAD_DROP_PROBABILITY, REQUEST_TIMEOUT},
     peer::{
-        connection::{overload_drop_connection_probability, Connection, State},
+        connection::{
+            overload_drop_connection_probability, Connection, State,
+            MAX_CONSECUTIVE_RECEIVE_TIMEOUTS,
+        },
         ClientRequest, ErrorSlot,
     },
     protocol::external::Message,
@@ -662,6 +665,63 @@ async fn connection_run_loop_receive_timeout() {
     assert_eq!(outbound_message, None);
 }
 
+#[tokio::test]
+async fn repeated_connection_receive_timeouts_close_connection() {
+    let _init_guard = zebra_test::init();
+
+    tokio::time::pause();
+
+    let (_peer_tx, peer_rx) = mpsc::channel(1);
+    let (
+        connection,
+        mut client_tx,
+        mut inbound_service,
+        mut peer_outbound_messages,
+        shared_error_slot,
+    ) = new_test_connection();
+
+    let mut connection_join_handle = tokio::spawn(connection.run(peer_rx));
+
+    for _ in 0..MAX_CONSECUTIVE_RECEIVE_TIMEOUTS {
+        let (request_tx, mut request_rx) = oneshot::channel();
+        client_tx
+            .try_send(ClientRequest {
+                request: Request::Peers,
+                tx: request_tx,
+                inv_collector: None,
+                transient_addr: None,
+                span: Span::current(),
+            })
+            .expect("channel is valid before repeated timeout threshold");
+
+        assert_eq!(peer_outbound_messages.next().await, Some(Message::GetAddr));
+        tokio::time::sleep(REQUEST_TIMEOUT + Duration::from_secs(1)).await;
+
+        assert_eq!(
+            request_rx
+                .try_recv()
+                .expect("peer internal response channel is valid")
+                .expect("response is present")
+                .expect_err("response is an error")
+                .inner_debug(),
+            "ConnectionReceiveTimeout",
+        );
+    }
+
+    inbound_service.expect_no_requests().await;
+
+    let error = shared_error_slot
+        .try_get_error()
+        .expect("repeated receive timeouts close the connection");
+    assert_eq!(error.inner_debug(), "ConnectionReceiveTimeout");
+
+    let connection_result = futures::poll!(&mut connection_join_handle);
+    assert!(
+        matches!(connection_result, Poll::Ready(Ok(()))),
+        "expected run loop termination after repeated timeouts: {connection_result:?}",
+    );
+}
+
 /// Check basic properties of overload probabilities
 #[test]
 fn overload_probability_reduces_over_time() {
diff --git a/zebra-network/src/peer/handshake/tests.rs b/zebra-network/src/peer/handshake/tests.rs
index 0dfb890be5c..c8b81e768f8 100644
--- a/zebra-network/src/peer/handshake/tests.rs
+++ b/zebra-network/src/peer/handshake/tests.rs
@@ -14,8 +14,8 @@ use super::*;
 use crate::{
     peer_set::ActiveConnectionCounter,
     zakura::{
-        Peer as ZakuraServicePeer, Service as ZakuraService, Stream, ZakuraPeerId,
-        ZakuraUpgradeOutcome,
+        testkit::TEST_NET_TIMEOUT, Peer as ZakuraServicePeer, Service as ZakuraService, Stream,
+        ZakuraPeerId, ZakuraUpgradeOutcome,
     },
 };
 use tokio::io::duplex;
@@ -272,7 +272,7 @@ async fn mutual_p2p_v2_legacy_upgrade_forms_zakura_connection() {
     // both supervisors should register the other peer once it completes.
     let local_supervisor = local_endpoint.supervisor();
     let remote_supervisor = remote_endpoint.supervisor();
-    let registered = tokio::time::timeout(std::time::Duration::from_secs(15), async {
+    let registered = tokio::time::timeout(TEST_NET_TIMEOUT, async {
         loop {
             if !local_supervisor.registered_ids().await.is_empty()
                 && !remote_supervisor.registered_ids().await.is_empty()
diff --git a/zebra-network/src/peer_set/set.rs b/zebra-network/src/peer_set/set.rs
index d172cc679eb..28582698fe2 100644
--- a/zebra-network/src/peer_set/set.rs
+++ b/zebra-network/src/peer_set/set.rs
@@ -125,7 +125,7 @@ use tower::{
     Service,
 };
 
-use zebra_chain::{chain_tip::ChainTip, parameters::Network};
+use zebra_chain::{block, chain_tip::ChainTip, parameters::Network};
 
 use crate::{
     address_book::AddressMetrics,
@@ -1135,6 +1135,88 @@ where
         .boxed()
     }
 
+    /// Routes a single-block download to up to `fanout` random ready peers,
+    /// ignoring inventory markers, and resolves with the first peer that
+    /// delivers the block.
+    ///
+    /// # Security
+    ///
+    /// Peers are chosen randomly and load is ignored, matching the broadcast
+    /// path: this prevents a peer from biasing selection by manipulating its own
+    /// load. Inventory markers are deliberately ignored — the caller uses this
+    /// only for the head-of-line block after a registry-miss, where the markers
+    /// are stale and `route_inv` would otherwise fail the request even though
+    /// ready peers actually have the block. The fanout is small and scoped to a
+    /// single hash, bounding the extra load this places on the peer set.
+    ///
+    /// If no ready peers have the block (or there are none), returns the same
+    /// synthetic [`NotFoundRegistry`](PeerError::NotFoundRegistry) error as
+    /// [`route_inv`](Self::route_inv), so the caller's head-of-line retry and
+    /// backoff handling applies unchanged.
+    fn route_hedge(
+        &mut self,
+        hashes: HashSet<block::Hash>,
+        fanout: usize,
+    ) -> <Self as tower::Service<Request>>::Future {
+        let inv_hash = InventoryHash::from(
+            *hashes
+                .iter()
+                .next()
+                .expect("hedged block requests contain exactly one hash"),
+        );
+
+        if self.ready_services.is_empty() {
+            metrics::counter!("pool.route_hedge.no_ready.count").increment(1);
+            return async move {
+                // Let other tasks run, so a retry might find different ready peers.
+                tokio::task::yield_now().await;
+                Err::<Response, BoxError>(
+                    SharedPeerError::from(PeerError::NotFoundRegistry(vec![inv_hash])).into(),
+                )
+            }
+            .boxed();
+        }
+
+        let fanout = fanout.clamp(1, self.ready_services.len());
+        let selected_peers = self.select_random_ready_peers(fanout);
+        metrics::counter!("pool.route_hedge.dispatch.count").increment(1);
+
+        // Send a plain `BlocksByHash` to each selected peer; peers and
+        // connections never see the hedged variant.
+        let inner = Request::BlocksByHash(hashes);
+        let mut futs = FuturesUnordered::new();
+        for key in selected_peers {
+            let mut svc = self
+                .take_ready_service(&key)
+                .expect("selected peers are ready");
+            futs.push(svc.call(inner.clone()));
+            self.push_unready(key, svc);
+        }
+
+        async move {
+            // Take the first peer that actually delivers an available block.
+            // Peers that are genuinely missing it (or error) are skipped; the
+            // remaining in-flight calls are cancelled when `futs` drops on return.
+            while let Some(result) = futs.next().await {
+                if let Ok(Response::Blocks(blocks)) = result {
+                    if blocks.iter().any(|block| block.available().is_some()) {
+                        metrics::counter!("pool.route_hedge.win.count").increment(1);
+                        return Ok(Response::Blocks(blocks));
+                    }
+                }
+            }
+
+            // Every hedged peer was missing the block (or errored). Surface the
+            // same synthetic registry-miss `route_inv` would, so the sync layer's
+            // head-of-line retry/backoff handling applies.
+            metrics::counter!("pool.route_hedge.exhausted.count").increment(1);
+            Err::<Response, BoxError>(
+                SharedPeerError::from(PeerError::NotFoundRegistry(vec![inv_hash])).into(),
+            )
+        }
+        .boxed()
+    }
+
     /// Broadcasts the same request to lots of ready peers, ignoring return values.
     fn route_broadcast(&mut self, req: Request) -> <Self as tower::Service<Request>>::Future {
         // Broadcasts ignore the response
@@ -1433,6 +1515,12 @@ where
                 self.route_inv(req, hash)
             }
 
+            // Head-of-line hedge: fan a single-block download out to a few random
+            // ready peers, ignoring inventory markers, and take the first delivery.
+            Request::HedgedBlocksByHash { ref hashes, fanout } if hashes.len() == 1 => {
+                self.route_hedge(hashes.clone(), fanout)
+            }
+
             // Broadcast advertisements to lots of peers
             Request::AdvertiseTransactionIds(_, _) => self.route_broadcast(req),
             Request::AdvertiseBlock(_, _) => self.route_broadcast(req),
diff --git a/zebra-network/src/peer_set/set/tests/vectors.rs b/zebra-network/src/peer_set/set/tests/vectors.rs
index 082bfcc3910..987d40c7c9a 100644
--- a/zebra-network/src/peer_set/set/tests/vectors.rs
+++ b/zebra-network/src/peer_set/set/tests/vectors.rs
@@ -695,3 +695,81 @@ fn peer_set_route_inv_all_missing_fail() {
         );
     });
 }
+
+/// Check that a hedged block request still reaches ready peers that are all marked
+/// missing the inventory, where a plain `BlocksByHash` would fail with a synthetic
+/// `NotFoundRegistry`. This is the stale-inventory-marker bypass the head-of-line
+/// hedge relies on.
+#[test]
+fn peer_set_route_hedge_bypasses_missing_markers() {
+    let test_hash = block::Hash([0; 32]);
+    let test_inv = InventoryHash::Block(test_hash);
+
+    // Hard-coded fixed test addresses created by mock_peer_discovery.
+    let peer_addrs: [PeerSocketAddr; 2] = [
+        "127.0.0.1:1".parse().expect("valid peer address"),
+        "127.0.0.1:2".parse().expect("valid peer address"),
+    ];
+
+    // Use two peers with the same version.
+    let peer_version = Version::min_specified_for_upgrade(&Network::Mainnet, NetworkUpgrade::Nu6);
+    let peer_versions = PeerVersions {
+        peer_versions: vec![peer_version, peer_version],
+    };
+
+    let (runtime, _init_guard) = zebra_test::init_async();
+    let _guard = runtime.enter();
+
+    // CORRECTNESS: This test does not depend on external resources that could really timeout.
+    tokio::time::pause();
+
+    let (discovered_peers, mut handles) = peer_versions.mock_peer_discovery();
+    let (minimum_peer_version, _best_tip_height) =
+        MinimumPeerVersion::with_mock_chain_tip(&Network::Mainnet);
+
+    assert_eq!(handles.len(), 2);
+
+    runtime.block_on(async move {
+        let (mut peer_set, mut peer_set_guard) = PeerSetBuilder::new()
+            .with_discover(discovered_peers)
+            .with_minimum_peer_version(minimum_peer_version.clone())
+            .max_conns_per_ip(max(2, DEFAULT_MAX_CONNS_PER_IP))
+            .build();
+
+        // Mark the inventory as missing for both peers, so plain inventory routing
+        // would fail the request.
+        for addr in peer_addrs {
+            peer_set_guard
+                .inventory_sender()
+                .as_mut()
+                .expect("unexpected missing inv sender")
+                .send(InventoryStatus::new_missing(test_inv, addr))
+                .expect("unexpected dropped receiver");
+        }
+
+        let peer_ready = peer_set
+            .ready()
+            .await
+            .expect("peer set service is always ready");
+
+        assert_eq!(peer_ready.ready_services.len(), 2);
+
+        // Hedge the request to both ready peers, ignoring the missing markers.
+        let hedged_request = Request::HedgedBlocksByHash {
+            hashes: iter::once(test_hash).collect(),
+            fanout: 2,
+        };
+        let _fut = peer_ready.call(hedged_request);
+
+        // Both missing-marked peers must receive the rewritten plain `BlocksByHash`
+        // request, proving the hedge bypassed the stale markers (`route_inv` would
+        // have dispatched to neither — see `peer_set_route_inv_all_missing_fail`).
+        let expected = Request::BlocksByHash(iter::once(test_hash).collect());
+        for handle in handles.iter_mut() {
+            match handle.try_to_receive_outbound_client_request().request() {
+                Some(ClientRequest { request, .. }) => assert_eq!(request, expected),
+                None => panic!("hedged request was not routed to a ready (missing-marked) peer"),
+            }
+        }
+    });
+}
diff --git a/zebra-network/src/protocol/internal/request.rs b/zebra-network/src/protocol/internal/request.rs
index 390779e612d..bd778aeb797 100644
--- a/zebra-network/src/protocol/internal/request.rs
+++ b/zebra-network/src/protocol/internal/request.rs
@@ -103,6 +103,30 @@ pub enum Request {
         source: PeerSource,
     },
 
+    /// Hedged single-block download.
+    ///
+    /// Fans the request out to up to `fanout` random ready peers, *ignoring
+    /// inventory markers*, and returns the first peer that delivers the block.
+    ///
+    /// This is used only for the head-of-line block after a registry-miss, to
+    /// bypass stale "missing" inventory markers: the peers usually do have the
+    /// block, only the local marker is stale. The peer set rewrites this to a
+    /// per-peer [`Request::BlocksByHash`], so peers and connections see a normal
+    /// request and no wire/connection changes are needed.
+    ///
+    /// The set must contain exactly one hash. A small `fanout` keeps this
+    /// DoS-bounded; it is clamped to the number of ready peers.
+    ///
+    /// # Returns
+    ///
+    /// Returns [`Response::Blocks`](super::Response::Blocks).
+    HedgedBlocksByHash {
+        /// Requested block hashes (exactly one).
+        hashes: HashSet<block::Hash>,
+        /// Maximum number of ready peers to fan the request out to.
+        fanout: usize,
+    },
+
     /// Request transactions by their unmined transaction ID.
     ///
     /// v4 transactions use a legacy transaction ID, and
@@ -275,6 +299,9 @@ impl fmt::Display for Request {
             Request::BlocksByHashFrom { hashes, .. } => {
                 format!("BlocksByHashFrom({})", hashes.len())
             }
+            Request::HedgedBlocksByHash { hashes, fanout } => {
+                format!("HedgedBlocksByHash({}, fanout: {fanout})", hashes.len())
+            }
             Request::TransactionsById(ids) => format!("TransactionsById({})", ids.len()),
             Request::TransactionsByIdFrom { ids, .. } => {
                 format!("TransactionsByIdFrom({})", ids.len())
@@ -310,7 +337,9 @@ impl Request {
             Request::Peers => "Peers",
             Request::Ping(_) => "Ping",
 
-            Request::BlocksByHash(_) | Request::BlocksByHashFrom { .. } => "BlocksByHash",
+            Request::BlocksByHash(_)
+            | Request::BlocksByHashFrom { .. }
+            | Request::HedgedBlocksByHash { .. } => "BlocksByHash",
             Request::TransactionsById(_) | Request::TransactionsByIdFrom { .. } => {
                 "TransactionsById"
             }
@@ -332,6 +361,7 @@ impl Request {
             self,
             Request::BlocksByHash(_)
                 | Request::BlocksByHashFrom { .. }
+                | Request::HedgedBlocksByHash { .. }
                 | Request::TransactionsById(_)
                 | Request::TransactionsByIdFrom { .. }
         )
@@ -344,6 +374,10 @@ impl Request {
             | Request::BlocksByHashFrom {
                 hashes: block_hashes,
                 ..
+            }
+            | Request::HedgedBlocksByHash {
+                hashes: block_hashes,
+                ..
             } => block_hashes.clone(),
             _ => HashSet::new(),
         }
diff --git a/zebra-network/src/zakura/testkit/cluster.rs b/zebra-network/src/zakura/testkit/cluster.rs
index ffbe8c94593..249c0b5229d 100644
--- a/zebra-network/src/zakura/testkit/cluster.rs
+++ b/zebra-network/src/zakura/testkit/cluster.rs
@@ -226,19 +226,15 @@ mod tests {
 
     fn test_header_height(header: &block::Header) -> block::Height {
         let hash = block::Hash::from(header);
-        [
-            (block::Height(0), &BLOCK_MAINNET_GENESIS_BYTES[..]),
-            (block::Height(1), &BLOCK_MAINNET_1_BYTES[..]),
-            (block::Height(2), &BLOCK_MAINNET_2_BYTES[..]),
-            (block::Height(3), &BLOCK_MAINNET_3_BYTES[..]),
-            (block::Height(4), &BLOCK_MAINNET_4_BYTES[..]),
-            (block::Height(5), &BLOCK_MAINNET_5_BYTES[..]),
-        ]
-        .into_iter()
-        .find_map(|(height, bytes)| {
-            (hash == block::Hash::from(mainnet_block(bytes).header.as_ref())).then_some(height)
-        })
-        .unwrap_or(block::Height(1))
+        if hash == mainnet_genesis_hash() {
+            return block::Height(0);
+        }
+
+        (1..=5)
+            .find_map(|height| {
+                (hash == mainnet_block(block_bytes(height)).hash()).then_some(block::Height(height))
+            })
+            .unwrap_or(block::Height(1))
     }
 
     #[derive(Debug, Default)]
@@ -389,7 +385,7 @@ mod tests {
         label: &'static str,
         mut matches: impl FnMut(&TaskExitProbeEvent) -> bool,
     ) -> Result<TaskExitProbeEvent, BoxError> {
-        tokio::time::timeout(Duration::from_secs(5), async {
+        tokio::time::timeout(TEST_NET_TIMEOUT, async {
             loop {
                 let event = events.recv().await.ok_or_else(|| -> BoxError {
                     format!("task-exit probe closed before {label}").into()
@@ -795,7 +791,7 @@ mod tests {
             node: usize,
             reason: HeaderSyncMisbehavior,
         ) -> Result<(), BoxError> {
-            let deadline = tokio::time::Instant::now() + Duration::from_secs(5);
+            let deadline = tokio::time::Instant::now() + TEST_NET_TIMEOUT;
             loop {
                 if self.misbehavior_reasons(node).await.contains(&reason) {
                     tokio::time::sleep(Duration::from_millis(50)).await;
@@ -804,7 +800,7 @@ mod tests {
                 if tokio::time::Instant::now() >= deadline {
                     return Err(Box::new(WaitError::new(
                         "header-sync e2e misbehavior reason",
-                        Duration::from_secs(5),
+                        TEST_NET_TIMEOUT,
                     )));
                 }
                 tokio::time::sleep(Duration::from_millis(20)).await;
@@ -824,7 +820,7 @@ mod tests {
                 format!(
                     "header-sync e2e outbound getheaders peer={peer:?} start={start_height:?} count={count}"
                 ),
-                Duration::from_secs(5),
+                TEST_NET_TIMEOUT,
                 || {
                     sent.try_lock().is_ok_and(|sent| {
                         sent.iter().any(|(sent_peer, msg)| {
@@ -916,11 +912,12 @@ mod tests {
                         .headers_by_range(start, count);
                     let returned_count = u32::try_from(headers.len()).unwrap_or(u32::MAX);
                     if let Some(target) = peer_to_index.get(&peer) {
+                        let msg = headers_message(headers);
                         let _ = nodes[*target]
                             .handle
                             .send(HeaderSyncEvent::WireMessage {
                                 peer: local.peer_id.clone(),
-                                msg: headers_message(headers),
+                                msg,
                             })
                             .await;
                         let _ = local
@@ -1361,7 +1358,7 @@ mod tests {
     ) -> Result<(), BoxError> {
         await_until(
             "native header-sync misbehavior reason",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || {
                 misbehaviors
                     .lock()
@@ -1380,8 +1377,8 @@ mod tests {
         let mut cluster = ZakuraTestCluster::new();
         cluster.spawn_nodes([1, 2]).await?;
 
-        cluster.connect_full_mesh(Duration::from_secs(5)).await?;
-        cluster.await_all_connected(Duration::from_secs(5)).await?;
+        cluster.connect_full_mesh(TEST_NET_TIMEOUT).await?;
+        cluster.await_all_connected(TEST_NET_TIMEOUT).await?;
         cluster.shutdown().await;
 
         Ok(())
@@ -1437,7 +1434,7 @@ mod tests {
         let hostile_peer = hostile.id()?;
         let peer_set = victim.supervisor().subscribe();
 
-        await_until("block-sync peer registered", Duration::from_secs(5), || {
+        await_until("block-sync peer registered", TEST_NET_TIMEOUT, || {
             peer_set.borrow().contains(&hostile_peer)
         })
         .await?;
@@ -1452,7 +1449,7 @@ mod tests {
             )
             .await?;
 
-        await_until("stream-6 oversize trace", Duration::from_secs(5), || {
+        await_until("stream-6 oversize trace", TEST_NET_TIMEOUT, || {
             capture.reader().is_ok_and(|reader| {
                 reader
                     .node("01")
@@ -1470,7 +1467,7 @@ mod tests {
         .await?;
         await_until(
             "oversized stream-6 frame disconnects peer",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || !peer_set.borrow().contains(&hostile_peer),
         )
         .await?;
@@ -1497,7 +1494,7 @@ mod tests {
         let hostile_peer = hostile.id()?;
         let peer_set = victim.supervisor().subscribe();
 
-        await_until("block-sync peer registered", Duration::from_secs(5), || {
+        await_until("block-sync peer registered", TEST_NET_TIMEOUT, || {
             peer_set.borrow().contains(&hostile_peer)
         })
         .await?;
@@ -1519,7 +1516,7 @@ mod tests {
 
         await_until(
             "incomplete stream-6 frame disconnects peer",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || !peer_set.borrow().contains(&hostile_peer),
         )
         .await?;
@@ -1614,7 +1611,7 @@ mod tests {
                 .await?;
         let hostile_peer = hostile.id()?;
         let peer_set = victim.supervisor().subscribe();
-        await_until("block-sync peer registered", Duration::from_secs(5), || {
+        await_until("block-sync peer registered", TEST_NET_TIMEOUT, || {
             peer_set.borrow().contains(&hostile_peer)
         })
         .await?;
@@ -1634,7 +1631,7 @@ mod tests {
             )
             .await?;
 
-        let (start_height, count) = tokio::time::timeout(Duration::from_secs(5), async {
+        let (start_height, count) = tokio::time::timeout(TEST_NET_TIMEOUT, async {
             loop {
                 let frame = hostile.recv_ordered_frame(ZAKURA_STREAM_BLOCK_SYNC).await?;
                 match BlockSyncMessage::decode_frame(frame)
@@ -1698,7 +1695,7 @@ mod tests {
         let expected: Vec<_> = (start_height.0..end_height).map(block::Height).collect();
         await_until(
             "native block-sync submitted requested bodies",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || {
                 let mut actual = submitted
                     .lock()
@@ -1713,7 +1710,7 @@ mod tests {
 
         await_until(
             "native block-sync submitted trace rows",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || {
                 capture.reader().is_ok_and(|reader| {
                     let rows = reader.node("60").table("block_sync").rows();
@@ -1761,7 +1758,7 @@ mod tests {
         // Known kind 2 (gossip): must be delivered.
         hostile.send_frame(2, known_payload.clone()).await?;
 
-        await_until("known-kind frame delivered", Duration::from_secs(5), || {
+        await_until("known-kind frame delivered", TEST_NET_TIMEOUT, || {
             recorder.contains_payload(2, &known_payload)
         })
         .await?;
@@ -1804,7 +1801,7 @@ mod tests {
             .await?;
         hostile.send_frame(2, good.clone()).await?;
 
-        await_until("version-1 frame delivered", Duration::from_secs(5), || {
+        await_until("version-1 frame delivered", TEST_NET_TIMEOUT, || {
             recorder.contains_payload(2, &good)
         })
         .await?;
@@ -1850,7 +1847,7 @@ mod tests {
             .send_frame(ZAKURA_STREAM_HEADER_SYNC, bad_header_sync_payload.clone())
             .await?;
         hostile.send_frame(2, before.clone()).await?;
-        await_until("pre-error gossip delivered", Duration::from_secs(5), || {
+        await_until("pre-error gossip delivered", TEST_NET_TIMEOUT, || {
             recorder.contains_payload(2, &before)
         })
         .await?;
@@ -1859,7 +1856,7 @@ mod tests {
         hostile.send_frame(2, after.clone()).await?;
         await_until(
             "post-header-sync gossip delivered",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || recorder.contains_payload(2, &after),
         )
         .await?;
@@ -1916,7 +1913,7 @@ mod tests {
             .await?;
         await_until(
             "negotiated header-sync stream delivered",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || recorder.contains_payload(ZAKURA_STREAM_HEADER_SYNC, &admitted_payload),
         )
         .await?;
@@ -1967,7 +1964,7 @@ mod tests {
                 break;
             }
             let frame = tokio::time::timeout(
-                Duration::from_secs(5),
+                TEST_NET_TIMEOUT,
                 discovery_peer.recv_ordered_frame(ZAKURA_STREAM_DISCOVERY),
             )
             .await??;
@@ -2042,7 +2039,7 @@ mod tests {
             .await?;
         let b_id = b.node_addr().await.node_id;
 
-        a.connect_native(&b, Duration::from_secs(5)).await?;
+        a.connect_native(&b, TEST_NET_TIMEOUT).await?;
 
         let mut learned = false;
         for _ in 0..100 {
@@ -2070,7 +2067,7 @@ mod tests {
                 .await?;
         let peer_id = discovery_peer.id()?;
 
-        await_until("discovery peer registered", Duration::from_secs(5), || {
+        await_until("discovery peer registered", TEST_NET_TIMEOUT, || {
             contains_peer(&peer_set.borrow(), peer_id.as_bytes())
         })
         .await?;
@@ -2088,7 +2085,7 @@ mod tests {
 
         await_until(
             "protocol-invalid discovery peer deregistered",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || !contains_peer(&peer_set.borrow(), peer_id.as_bytes()),
         )
         .await?;
@@ -2126,25 +2123,21 @@ mod tests {
         flooding
             .flood_stream(ZAKURA_STREAM_DISCOVERY, 'd', 16)
             .await?;
-        await_until(
-            "discovery throttling traced",
-            Duration::from_secs(5),
-            || {
-                capture.reader().is_ok_and(|reader| {
-                    reader
-                        .node("29")
-                        .table("ratelimit")
-                        .rows()
-                        .iter()
-                        .any(|row| {
-                            row.get("event").and_then(serde_json::Value::as_str)
-                                == Some("message.throttled")
-                                && row.get("stream_kind").and_then(serde_json::Value::as_str)
-                                    == Some("discovery")
-                        })
-                })
-            },
-        )
+        await_until("discovery throttling traced", TEST_NET_TIMEOUT, || {
+            capture.reader().is_ok_and(|reader| {
+                reader
+                    .node("29")
+                    .table("ratelimit")
+                    .rows()
+                    .iter()
+                    .any(|row| {
+                        row.get("event").and_then(serde_json::Value::as_str)
+                            == Some("message.throttled")
+                            && row.get("stream_kind").and_then(serde_json::Value::as_str)
+                                == Some("discovery")
+                    })
+            })
+        })
         .await?;
         flooding.shutdown().await;
 
@@ -2154,7 +2147,7 @@ mod tests {
         oversized
             .oversize_frame_declared_len(ZAKURA_STREAM_DISCOVERY)
             .await?;
-        await_until("discovery oversize traced", Duration::from_secs(5), || {
+        await_until("discovery oversize traced", TEST_NET_TIMEOUT, || {
             capture.reader().is_ok_and(|reader| {
                 reader
                     .node("29")
@@ -2226,7 +2219,7 @@ mod tests {
 
         // Wait until rate limiting has clearly engaged (more frames sent than one
         // budget, so the bucket must have emptied at least once).
-        await_until("rate limiting engaged", Duration::from_secs(5), || {
+        await_until("rate limiting engaged", TEST_NET_TIMEOUT, || {
             capture.reader().is_ok_and(|reader| {
                 reader
                     .node("05")
@@ -2281,11 +2274,9 @@ mod tests {
                 .await?;
         }
 
-        await_until(
-            "ordered gossip burst delivered",
-            Duration::from_secs(5),
-            || recorder.len() >= payloads.len(),
-        )
+        await_until("ordered gossip burst delivered", TEST_NET_TIMEOUT, || {
+            recorder.len() >= payloads.len()
+        })
         .await?;
         let delivered: Vec<_> = recorder
             .drain()
@@ -2317,7 +2308,7 @@ mod tests {
         hostile
             .send_frame(ZAKURA_STREAM_GOSSIP, b"open-source-stream".to_vec())
             .await?;
-        tokio::time::timeout(Duration::from_secs(5), async {
+        tokio::time::timeout(TEST_NET_TIMEOUT, async {
             while !service.contains_peer(&peer_id).await {
                 tokio::time::sleep(Duration::from_millis(10)).await;
             }
@@ -2331,12 +2322,12 @@ mod tests {
         service.send_payload(&peer_id, second.clone()).await?;
 
         let received_first = tokio::time::timeout(
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             hostile.recv_ordered_frame(ZAKURA_STREAM_GOSSIP),
         )
         .await??;
         let received_second = tokio::time::timeout(
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             hostile.recv_ordered_frame(ZAKURA_STREAM_GOSSIP),
         )
         .await??;
@@ -2465,21 +2456,17 @@ mod tests {
         cluster.nodes.push(node1);
         cluster.nodes.push(node2);
 
-        cluster.connect_full_mesh(Duration::from_secs(5)).await?;
-        cluster.await_all_connected(Duration::from_secs(5)).await?;
-        await_until(
-            "native stream-5 status received",
-            Duration::from_secs(5),
-            || {
-                capture.reader().is_ok_and(|reader| {
-                    reader
-                        .node("02")
-                        .table("header_sync")
-                        .count(hs_trace::HEADER_STATUS_RECEIVED)
-                        >= 1
-                })
-            },
-        )
+        cluster.connect_full_mesh(TEST_NET_TIMEOUT).await?;
+        cluster.await_all_connected(TEST_NET_TIMEOUT).await?;
+        await_until("native stream-5 status received", TEST_NET_TIMEOUT, || {
+            capture.reader().is_ok_and(|reader| {
+                reader
+                    .node("02")
+                    .table("header_sync")
+                    .count(hs_trace::HEADER_STATUS_RECEIVED)
+                    >= 1
+            })
+        })
         .await?;
 
         capture.flush().await;
@@ -2556,7 +2543,7 @@ mod tests {
             .await?;
         await_until(
             "native header-sync unsolicited headers violation trace",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || {
                 capture.reader().is_ok_and(|reader| {
                     reader
@@ -2581,36 +2568,32 @@ mod tests {
                 .await?;
         let oversized_peer = oversized.id()?;
         let peer_set = victim.supervisor().subscribe();
-        await_until("oversized peer registered", Duration::from_secs(5), || {
+        await_until("oversized peer registered", TEST_NET_TIMEOUT, || {
             peer_set.borrow().contains(&oversized_peer)
         })
         .await?;
         oversized
             .oversize_frame_declared_len(ZAKURA_STREAM_HEADER_SYNC)
             .await?;
-        await_until(
-            "native stream-5 oversize trace",
-            Duration::from_secs(5),
-            || {
-                capture.reader().is_ok_and(|reader| {
-                    reader
-                        .node("11")
-                        .table("ratelimit")
-                        .rows()
-                        .iter()
-                        .any(|row| {
-                            row.get("event").and_then(serde_json::Value::as_str)
-                                == Some("frame.oversize")
-                                && row.get("stream_kind").and_then(serde_json::Value::as_str)
-                                    == Some("header_sync")
-                        })
-                })
-            },
-        )
+        await_until("native stream-5 oversize trace", TEST_NET_TIMEOUT, || {
+            capture.reader().is_ok_and(|reader| {
+                reader
+                    .node("11")
+                    .table("ratelimit")
+                    .rows()
+                    .iter()
+                    .any(|row| {
+                        row.get("event").and_then(serde_json::Value::as_str)
+                            == Some("frame.oversize")
+                            && row.get("stream_kind").and_then(serde_json::Value::as_str)
+                                == Some("header_sync")
+                    })
+            })
+        })
         .await?;
         await_until(
             "oversized persistent stream disconnects peer",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || !peer_set.borrow().contains(&oversized_peer),
         )
         .await?;
@@ -2771,7 +2754,7 @@ mod tests {
                 .commit_body(empty, mainnet_block(block_bytes(height)))
                 .await;
         }
-        await_until("missing body gap shrinks", Duration::from_secs(5), || {
+        await_until("missing body gap shrinks", TEST_NET_TIMEOUT, || {
             cluster
                 .nodes
                 .get(empty)
@@ -2835,7 +2818,7 @@ mod tests {
         cluster.wait_for_tip(checkpointed, block::Height(4)).await?;
         await_until(
             "checkpoint backfill headers committed",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || cluster.has_headers(checkpointed, 1..=3),
         )
         .await?;
@@ -3013,7 +2996,7 @@ mod tests {
             .await;
         await_until(
             "header-sync e2e unsolicited headers violation trace",
-            Duration::from_secs(5),
+            TEST_NET_TIMEOUT,
             || {
                 capture.reader().is_ok_and(|reader| {
                     reader
diff --git a/zebra-replay-bench/Cargo.toml b/zebra-replay-bench/Cargo.toml
new file mode 100644
index 00000000000..8e59ea5ca14
--- /dev/null
+++ b/zebra-replay-bench/Cargo.toml
@@ -0,0 +1,42 @@
+[package]
+name = "zebra-replay-bench"
+version = "0.1.0"
+authors.workspace = true
+description = "Offline benchmark that replays mainnet blocks through the Zebra state committer, isolated from the network"
+license.workspace = true
+repository.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+publish = false
+
+[[bin]]
+name = "zebra-replay-bench"
+path = "src/main.rs"
+
+[features]
+default = []
+# Enable the zebra-state commit-metrics histograms and render them at the end of
+# an `apply` run. Build the bench binary with this to get per-phase attribution.
+commit-metrics = ["zebra-state/commit-metrics", "dep:metrics-exporter-prometheus"]
+
+[dependencies]
+zebra-chain = { path = "../zebra-chain", version = "9.0.0" }
+zebra-state = { path = "../zebra-state", version = "8.0.0" }
+zebra-consensus = { path = "../zebra-consensus", version = "8.0.0" }
+zebra-network = { path = "../zebra-network", version = "8.0.0", features = ["internal-bench"] }
+
+clap = { workspace = true, features = ["derive"] }
+color-eyre.workspace = true
+futures.workspace = true
+tower = { workspace = true, features = ["buffer", "util"] }
+tokio = { workspace = true, features = ["sync", "rt-multi-thread", "macros", "time"] }
+tracing.workspace = true
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+
+metrics-exporter-prometheus = { workspace = true, optional = true }
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true
diff --git a/zebra-replay-bench/README.md b/zebra-replay-bench/README.md
new file mode 100644
index 00000000000..e2c351cbb44
--- /dev/null
+++ b/zebra-replay-bench/README.md
@@ -0,0 +1,164 @@
+# zebra-replay-bench
+
+Offline benchmark for the Zebra finalized-state **commit pipeline**, isolated
+from the networking stack. It replays real mainnet blocks through the exact
+production committer (`FinalizedState::commit_finalized_direct`) — no peers, no
+header/body sync, no head-of-line noise — so the write-assembler + disk-writer
+work can be measured and A/B compared on a stable baseline.
+
+It deliberately runs the **legacy recompute path** (`vct_fast_sync = false`), the
+per-block note-commitment-tree + history-tree work that dominates commit cost.
+
+## Two phases, one flat cache
+
+1. **`index`** opens a snapshot state DB **read-only**, reads a height window into
+   a flat, hash-chain-validated cache file (raw `zcash`-serialized blocks).
+2. **`apply`** opens a writable base fork whose tip is `start-1`, streams the
+   cache, and commits each block in order, timing every commit. It verifies the
+   final tip hash equals the source snapshot's, then prints throughput.
+
+Splitting into phases keeps RocksDB read noise out of the timed loop and lets the
+window warm in page cache first.
+
+## Usage
+
+```bash
+# What height is a snapshot at?
+zebra-replay-bench info --src /path/to/snapshot
+
+# Phase 1: extract a 30k window into a cache (source opened read-only)
+zebra-replay-bench index \
+  --src /path/to/high-snapshot \
+  --cache /tmp/win.zrb --start 1800001 --end 1830000
+
+# Phase 2: replay onto a fork whose tip == 1800000
+zebra-replay-bench apply --base /path/to/fork-at-1800000 --cache /tmp/win.zrb
+
+# One altitude up: replay through the real zebra-state write worker
+zebra-replay-bench apply-worker --base /path/to/fork-at-1800000 --cache /tmp/win.zrb
+
+# Two altitudes up: replay through the real zebra-consensus checkpoint verifier
+zebra-replay-bench apply-verifier --base /path/to/fork-at-1800000 --cache /tmp/win.zrb
+
+# Three altitudes up: replay through the real Zakura block-sync Sequencer (VCT-only)
+zebra-replay-bench apply-sequencer --base /path/to/fork-at-1800000 --cache /tmp/win.zrb --vct-sidecar /tmp/win.vct
+```
+
+## Third altitude: `apply-verifier`
+
+`apply-verifier` drives blocks through the real `zebra-consensus::CheckpointVerifier`,
+which internally commits to a real `zebra-state` `StateService` (→ write worker →
+committer). It adds the per-block work the lower rungs skip: proof-of-work
+(difficulty + equihash) and Merkle-root validity, plus checkpoint-range batching.
+Unlike `apply`/`apply-worker` (sync), it runs on a multi-thread tokio runtime
+because the verifier is a Tower service. Comparing its throughput to `apply-worker`
+isolates what verification adds on top of the commit pipeline.
+
+Checkpoint batching + the VCT successor boundary: the verifier only releases a
+block once its whole checkpoint range is contiguous, and the worker's VCT fast path
+can't commit a block until its successor is buffered. The final checkpoint's
+successor is in the dropped tail (its range can't complete past the window), so the
+bench **feeds** up to the last checkpoint `<= end` (to deliver the successors the
+worker needs) but **counts/gates** to the second-to-last checkpoint, checking that
+block's committed hash against the embedded checkpoint hash. As with the other
+rungs, blocks are read/parsed off-thread by the bounded prefetch and fed with a
+bounded in-flight window (`ZRB_PREFETCH_CAP`, at least one checkpoint gap so ranges
+always complete); a periodic progress log makes any stall observable.
+
+## Fourth altitude: `apply-sequencer` (VCT-only, POC)
+
+`apply-sequencer` drives blocks through the **real Zakura block-sync `Sequencer`**
+(`zebra-network`), one rung above the verifier. The sequencer is the body reorder +
+ordered-submit pipeline: bodies are fed into its reorder queue, it drains the
+contiguous prefix into `applying` and emits `SubmitBlock`s, and a thin driver here
+commits each through the same real `CheckpointVerifier` → `StateService` as
+`apply-verifier`, reporting the commit back so the sequencer frontier advances and
+releases the next blocks. Comparing to `apply-verifier` isolates the sequencer's
+reorder/ordering/backpressure overhead.
+
+It uses the real `SequencerTask` via a feature-gated helper
+(`zebra_network::zakura::spawn_bench_sequencer`, `internal-bench`). **VCT-only**
+(the Zakura fast-sync path) and, for this POC, bodies are fed **in height order**
+(random / out-of-order multi-peer arrival — the reorder buffer's stress case — is a
+future knob). Same checkpoint-batching boundary as `apply-verifier`: feed to the
+last checkpoint, commit/gate to the second-to-last.
+
+Two optional flags:
+
+- Storage mode is **Pruned by default** (the `--base` snapshot must already be pruned;
+  pruning is one-way), matching the production mainnet config. Pass `--archive` to commit
+  in Archive mode instead (full raw-tx + indexes, ~2× the bytes written; needs an archive
+  base).
+- `--trace-dir <dir>` writes the **structured Zakura JSONL trace tables** (the
+  `block_sync` body lifecycle: `block_body_accepted` / `block_body_submitted` with
+  queue-elapsed and apply tokens) — the same tables `perf-run-mainnet` emits via
+  `[network.zakura] trace_dir`, through the real `ZakuraTrace`/`JsonlTracer`. The
+  writer is flushed at end-of-run. Without it the tracer is `noop()` (zero overhead).
+  Via the harness: `REPLAY_TRACE_DIR=<dir> make perf-replay-sequencer` (add
+  `REPLAY_ARCHIVE=1` for archive mode).
+
+## Two altitudes: `apply` vs `apply-worker`
+
+`apply` calls the committer (`commit_finalized_direct`) directly in a tight loop.
+`apply-worker` drives the same blocks through the **production write worker**
+(`BlockWriteSender::spawn` / `WriteBlockWorkerTask::run`), the next rung up the
+abstraction ladder. The worker adds exactly what the node wraps around each
+commit: the in-order channel feed, the one-block VCT successor look-ahead, the
+park/poll loop, and the chain-tip channel updates. Both share the same cache,
+sidecar, config, snapshots, and correctness gate (final tip hash), so their
+throughput numbers are directly comparable.
+
+Commit-only isolation: both commands stream the window through a bounded
+[`prefetch`] producer that reads, deserializes, and builds each
+`CheckpointVerifiedBlock` (the verifier-side `prepare_block_data`) off the timed
+commit thread, into a bounded channel (`ZRB_PREFETCH_CAP`, default 64). So the
+timed window measures the committer only, memory stays flat regardless of window
+size, and `apply-worker` feeds the worker with a bounded in-flight window (no 30K
+backlog, no RocksDB write-stall).
+
+VCT (`--vct-sidecar`) termination: the worker builds its `next_checkpoint` from
+the look-ahead, so every committed height needs its successor buffered. The bench
+feeds one extra trailing block (the sidecar's `successor`, height `end+1`) so the
+last counted block commits; the worker then parks on `end+1` (whose successor is
+never fed) and cannot be drained to exit. The run verifies against a cloned DB
+handle and returns without joining — the parked worker thread is reaped at process
+exit. The legacy path has no such dependency and shuts down cleanly.
+
+`--src` / `--base` are snapshot roots that contain `state/vN/<network>`.
+
+The base fork's tip must be exactly `start-1`; the committer asserts the parent
+linkage. The simplest setup is a **forward** replay with no rollback: use a base
+snapshot whose tip is already `start-1` and a higher (near-tip) snapshot with
+block bodies through `end` as the index source.
+
+> A `rollback` subcommand exists to manufacture a base at `start-1` from a higher
+> snapshot, but rolling back a large span builds one giant in-memory delete batch
+> and will OOM. Prefer two snapshots (a near-tip source + a base already at
+> `start-1`) over rolling one back.
+
+## Per-phase metrics
+
+Build with the `commit-metrics` feature to emit and dump the `zebra_state.*`
+commit histograms (`update_trees`, `commitment_check`, `batch_prep`,
+`rocksdb.batch_commit`, `commit_finalized_total`, ...) at the end of `apply`:
+
+```bash
+cargo build --release -p zebra-replay-bench --features commit-metrics
+```
+
+## Make targets
+
+```bash
+make perf-build-replay-bench   # build the bench binary (commit-metrics)
+make perf-replay-index         # one-time: dump the window to a block cache
+make perf-replay               # legacy replay through the committer
+make perf-replay-worker        # same window, through the write worker
+make perf-replay-verifier      # same window, through the checkpoint verifier
+make perf-replay-sequencer     # same window, through the block-sync Sequencer (VCT)
+# VCT fast path:
+make perf-replay-index && deploy/runner/replay_run.sh index-roots
+make perf-replay REPLAY_VCT_SIDECAR=/path/to/win.vct
+```
+
+Window/snapshot paths come from `deploy/runner/cohort.env` (the `REPLAY_*` vars);
+the script falls back to sensible defaults when they're unset.
diff --git a/zebra-replay-bench/RESULTS.md b/zebra-replay-bench/RESULTS.md
new file mode 100644
index 00000000000..bbf02358cc9
--- /dev/null
+++ b/zebra-replay-bench/RESULTS.md
@@ -0,0 +1,283 @@
+# zebra-replay-bench — commit-pipeline results
+
+Offline A/B of the Zebra checkpoint-sync pipeline at four abstraction levels: the
+**direct committer** (`apply` → `FinalizedState::commit_finalized_direct`), the
+**write worker** one rung up (`apply-worker` → `BlockWriteSender::spawn` /
+`WriteBlockWorkerTask::run`), the **checkpoint verifier** above that
+(`apply-verifier` → `zebra-consensus::CheckpointVerifier`, committing to a real
+`StateService`), and the **block-sync Sequencer** above that (`apply-sequencer` →
+`zebra-network`'s Zakura `Sequencer`, VCT-only). Goal: isolate each layer's cost
+and find the next optimization lever.
+
+## Provenance
+
+- **Base:** branched from `feat/pre-release-main`, rebased onto `087428377`
+  (#295). Measurements were taken on the equivalent code at `c787831c0` (the #305
+  commit that introduced the bench); the only base delta since is the
+  behavior-preserving `disable_vct_fast_sync` → `vct_fast_sync` config rename, so
+  the numbers are unchanged.
+- **Changes measured:** the `apply-worker` extension (`apply_worker.rs` +
+  subcommand), the bounded `prefetch.rs` producer, the `apply.rs` commit-only
+  refactor, and the zebra-state worker-type exports (`BlockWriteSender`,
+  `QueuedCheckpointVerified`).
+
+## Environment
+
+- 8 cores (DO Premium Intel), 31 GiB RAM, Linux.
+- Snapshots under `/mnt/roman-dev-2-data`: base = `zebra-ckpt-1800000-warm`
+  (archive 27.3.0, tip 1,802,000); block + root source = `zebra-cache`
+  (tip 3,376,789).
+- Window: heights **1,802,001–1,832,000** (30,000 blocks, ~19.1 GiB of bodies);
+  VCT roots sidecar derived from the same source over the same window.
+- Forward replay, no rollback. Each run executes on a fresh hard-link fork of the
+  base; the final tip-hash gate (byte-identical to the source snapshot tip
+  1,832,000) passes on every run.
+
+## Methodology — commit-only isolation via a bounded prefetch
+
+The committer's input — a `CheckpointVerifiedBlock` — is built by `prepare_block_data`
+(`zebra-state/src/request.rs`): per-tx txid + ZIP-244 auth digest, the auth-data
+Merkle root, and the new-outputs (UTXO) map. That is **verifier-side prep** that
+runs upstream of the committer in production, so it must not be in the timed
+window of either bench.
+
+Both benches stream the window through a shared **bounded prefetch** (`prefetch.rs`):
+a producer thread reads the cache, deserializes, and builds each
+`CheckpointVerifiedBlock` ahead of the committer, into a bounded channel
+(capacity 64). The timed consumer only commits. This:
+
+- keeps block read + parse + prep **off** the timed commit thread (commit-only),
+- bounds memory to the channel depth (~0.9 GiB here) regardless of window size, so
+  the bench scales to 100K+ without holding the window in RAM, and
+- mirrors production (verifier prepares blocks upstream of the writer).
+
+`apply` (direct) keeps a one-block look-ahead for the VCT successor and times each
+`commit_finalized_direct`. `apply-worker` feeds the prefetched blocks into the
+real write worker with a **bounded in-flight window** (≤64 sent-but-not-committed),
+which also prevents dumping a 30K backlog into the worker's unbounded channel.
+
+## Results — VCT, 30K, commit-only
+
+| run | wall | throughput | p50 | p90 | p99 | max | peak RSS |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| direct (`apply --vct-sidecar`) | 235.0 s | **127.7 blk/s** (81.2 MiB/s) | 4.48 ms | 14.09 ms | 77.70 ms | 611 ms | 0.84 GiB |
+| worker (`apply-worker --vct-sidecar`) | 242.3 s | **123.8 blk/s** (78.8 MiB/s) | 4.47 ms | 15.69 ms | 85.52 ms | 504 ms | 0.95 GiB |
+
+Both committed all 30,000 blocks to the identical tip hash.
+
+**Direct and worker converge** (127.7 vs 123.8 blk/s, identical p50). Once
+`prepare_block_data` is pipelined off the commit thread on both sides, the write
+worker has **no** commit-only throughput advantage over the direct committer in
+VCT mode — it is marginally slower from the channel/oneshot plumbing; the residual
+is just coordination cost.
+
+### How the measurement converged (direct, VCT, what's in the timed wall)
+
+| what the timed wall includes | throughput | peak RSS |
+| --- | ---: | ---: |
+| block read + parse + prep + commit (original `apply`) | 99.6 blk/s | — |
+| prep + commit (window pre-loaded, CV built in the loop) | 121.2 blk/s | — |
+| commit only (all CVs pre-built up front, no contention) | 148.0 blk/s | 20.7 GiB |
+| commit only (bounded prefetch: prep concurrent, flat memory) | 127.7 blk/s | 0.84 GiB |
+
+Excluding parse and prep raised direct from 99.6 → 148.0 (a pure committer with no
+other work running). The bounded prefetch gives back some of that (148 → 127.7)
+because the producer's `prepare_block_data` (rayon, multi-core) now runs
+**concurrently** and contends for cores with the committer — but it is the
+scalable, production-like design (prep always runs alongside commit in a real
+node) and it bounds memory to ~0.84 GiB, so it is the figure used for the A/B.
+
+## Prefetch depth: contention, not lookahead
+
+Sweeping the prefetch depth (`ZRB_PREFETCH_CAP`) on VCT direct shows deeper
+buffering does **not** help — it is flat within run-to-run noise:
+
+| prefetch depth | throughput | peak RSS |
+| ---: | ---: | ---: |
+| 64 (default) | 127.7 blk/s | 0.84 GiB |
+| 2048 | 131.0 blk/s | 2.84 GiB |
+| 16384 | 120.2 blk/s | 8.2 GiB |
+| all pre-built (no concurrent producer) | 148.0 blk/s | 20.7 GiB |
+
+Depth 64 already keeps the committer fed (no buffer-starvation stalls for a bigger
+lookahead to remove). The only configuration that reaches 148 is pre-building the
+whole window so **no** producer runs during timing — i.e. the committer gets all 8
+cores. The ~15% gap is CPU contention from running `prepare_block_data` (rayon,
+multi-core) concurrently with the commit, which is inherent to a streaming
+pipeline and realistic for production. So depth 64 (flat ~0.9 GiB) is the right
+operating point; the lever to approach 148 would be capping the producer's core
+usage, not deepening the buffer.
+
+## Worker in-flight bound also removed a write-stall
+
+With the unbounded feed (all 30K pushed up front), the worker's max commit latency
+was 37,279 ms — a RocksDB L0 write-stall from the backlog. The bounded in-flight
+window (≤64) removes it: max latency is now 504 ms, in line with the direct bench.
+
+## Third rung: checkpoint verifier (`apply-verifier`)
+
+`apply-verifier` drives blocks through the real `zebra-consensus::CheckpointVerifier`,
+which internally commits to a real `StateService` (→ write worker → committer) on a
+multi-thread tokio runtime. It adds the per-block work the lower rungs skip:
+proof-of-work (difficulty + equihash) and Merkle-root validity, plus
+checkpoint-range batching.
+
+The boundary: the verifier only releases a block once its whole checkpoint range is
+contiguous, and the worker's VCT fast path can't commit a block until its successor
+is buffered (the one-block-lag root authentication). The final checkpoint's successor
+is in the dropped tail, which the verifier never releases — so the bench **feeds** up
+to the last checkpoint `<= end` (so the last range delivers the successors the worker
+needs) but **counts/gates** to the second-to-last checkpoint, whose committed hash is
+checked against the embedded checkpoint hash.
+
+| run (30K) | committed to | throughput | p50 | peak RSS |
+| --- | ---: | ---: | ---: | ---: |
+| legacy | ckpt 1,831,990 | **49.9 blk/s** | 13.99 ms | 2.35 GiB |
+| VCT | ckpt 1,831,959 | **133.0 blk/s** | 4.04 ms | ~2.4 GiB |
+
+The legacy row was measured before the second-to-last-checkpoint gate (legacy needs
+no successor, so it commits the full window and its rate is unaffected by that fix).
+
+**Verification overlaps the commit for free, in both modes.** Legacy verifier ≈ the
+legacy commit-alone rate (~50 blk/s): the rayon-parallel equihash + Merkle work
+overlaps the single-threaded note-tree recompute that bottlenecks legacy. VCT
+verifier (133 blk/s) is actually _slightly above_ the VCT worker (123.8) and direct
+(127.7) — with the recompute gone the committer is cheap, yet the concurrent
+verify→commit pipeline still hides verification behind it. So at this window,
+checkpoint verification is **not** a throughput bottleneck on top of the commit.
+
+> Diagnosis note: an earlier draft reported VCT here as "stall-bound / slower than
+> legacy." That was wrong — a one-block bench bug (the final checkpoint block had no
+> successor delivered, so it hung forever while everything else committed at ~500
+> blk/s). Adding a periodic progress log (fed/done/front-height) pinned it to exactly
+> that block; the second-to-last-checkpoint gate fixes it. Lesson: instrument before
+> concluding.
+
+## Fourth rung: block-sync Sequencer (`apply-sequencer`, VCT POC)
+
+`apply-sequencer` drives blocks through the **real Zakura block-sync `Sequencer`**
+(`zebra-network`, via a feature-gated `spawn_bench_sequencer` helper): bodies are fed
+into its reorder queue, it drains the contiguous prefix into `applying` and emits
+ordered `SubmitBlock`s, and a thin driver commits each through the same real
+`CheckpointVerifier` → `StateService`, reporting the commit back so the frontier
+advances. VCT-only; for this POC bodies are fed **in height order** (random / multi-peer
+out-of-order arrival — the reorder buffer's real stress case — is a future knob).
+
+**VCT, 30K** (committed 29,959 blocks to checkpoint 1,831,959, hash gated):
+**123.5 blk/s**, p50 4.71 ms, peak RSS 5.7 GiB. That lands right on the worker (123.8)
+and ~7% under the verifier (133.0): the sequencer adds the body-reorder + submit/apply
+control plumbing on top of verify+commit, and on an **in-order** feed the reorder does
+no real work (`reorder_len` stays 0), so the gap is the channel hops + apply-finished
+round-trips, not reordering. The higher RSS is the `applying` buffer filling under the
+bench's unbounded byte budget (it drains by end-of-window); a finite budget would cap it.
+
+The interesting measurement is still ahead: feeding bodies **out of order** (the future
+knob) is what actually exercises the ReorderBuffer and the sequencer's backpressure —
+this POC establishes the in-order baseline and that the real `SequencerTask` drives
+cleanly offline.
+
+## 100K, pruned storage, with per-phase decomposition
+
+Re-indexed to a **100,000-block** window (heights 1,802,001–1,902,000, ~72.7 GiB of
+bodies) and run through `apply-sequencer` in **Pruned** storage mode (the default; base =
+`zebra-ckpt-1800000-warm-pruned`). Committed 99,465 blocks to checkpoint 1,901,465
+(hash gated). A finite 4 GiB in-flight byte budget (`SEQUENCER_MAX_INFLIGHT_BYTES`)
+backpressures the feed so `applying` stays bounded (peak RSS 3.79 GiB, vs the unbounded
+Archive run that filled RAM).
+
+| run | committed | throughput | p50 | p90 | p99 | max | peak RSS |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: |
+| sequencer, VCT, **pruned**, 100K | 99,465 | **103.2 blk/s** (77.2 MiB/s) | 2.59 ms | 15.26 ms | 218 ms | 824 ms | 3.79 GiB |
+
+**Throughput degrades with DB size, not work per block.** 133 blk/s (verifier, 30K) →
+123.5 (sequencer, 30K) → 103.2 (sequencer, 100K). Same per-block work; the drop is
+RocksDB compaction/L0 pressure as the store grows. That is the disk-writer-bound
+signature, and the decomposition confirms it.
+
+### Per-phase commit decomposition (`--features commit-metrics`)
+
+Means are `sum/count` of the `zebra_state.*` histograms over the 100K run:
+
+| phase | calls | mean | p50 | p99 | where |
+| --- | ---: | ---: | ---: | ---: | --- |
+| `write.update_trees` | **0** | — | — | — | committer (timed) |
+| `write.commitment_check` | 0 | — | — | — | committer (timed) |
+| `rocksdb.batch_commit` | 99,467 | **1.74 ms** | 0.17 ms | 0.25 ms | committer (timed) |
+| `prepare.txid_auth_digest` | 199,732 | 1.31 ms | 0.02 ms | 0.21 ms | off-thread (prefetch) |
+| `prepare.new_ordered_outputs` | 199,732 | 0.02 ms | — | 0.19 ms | off-thread (prefetch) |
+| block size: `tx_count` / `output_count` / v5 | — | 4.14 / 22.95 / 0.96 | 2 / 6 / 0 | 12 / 541 / 2 | per block |
+
+Findings:
+
+- **VCT eliminates the note-tree recompute.** `write.update_trees` (the single-threaded
+  Pedersen/Sinsemilla recompute that bottlenecks legacy at ~50 blk/s) records **zero
+  calls** — the VCT fast path folds supplied roots instead. `commitment_check` is also
+  not on the per-block timed path. So the **only** timed committer phase that fires is
+  the RocksDB write.
+- **The committer is disk-writer bound.** `rocksdb.batch_commit` mean (1.74 ms) is far
+  above its p50/p99 (0.17/0.25 ms): the distribution is a fast common case with rare
+  multi-hundred-ms stalls (max commit 824 ms) — periodic L0 flush / compaction. The lever
+  is RocksDB write/compaction tuning (or pruning, which already roughly halves the bytes
+  written), not CPU.
+- **`prepare_*` runs ~2× per block (199,732 vs ~99,866).** In the sequencer/verifier path
+  the prefetch builds a `CheckpointVerifiedBlock` that is **discarded** (we feed the raw
+  `Arc<Block>`; the real state-commit re-runs `prepare_block_data`). It is off the timed
+  commit thread, so it does not change the committer number, but it is wasted producer CPU
+  that contends for cores — a cleanup opportunity for the sequencer rung specifically.
+- **Block size:** ~0.75 MiB/block, mean 4.1 tx / 23 outputs, with a heavy output tail
+  (p99 541 outputs) — the source of the commit-latency tail.
+
+### Structured Zakura traces (`--trace-dir`)
+
+`apply-sequencer --trace-dir <dir>` writes the **same structured JSONL trace tables** that
+`perf-run-mainnet` produces via `[network.zakura] trace_dir` — built through the real
+`ZakuraTrace`/`JsonlTracer` (production path), not a bench stub. The sequencer emits the
+`block_sync` table: one `block_body_accepted` row (with `sequencer_queue_elapsed_us`) and
+one `block_body_submitted` row (with `apply_token`) per body, e.g.:
+
+```json
+{"event":"block_body_accepted","height":1802001,"node":"01","result":"buffered","sequencer_queue_elapsed_us":28,"ts":994}
+{"apply_token":1,"event":"block_body_submitted","height":1802001,"node":"01","ts":1040}
+```
+
+The writer is flushed/drained at end-of-run (`BenchCommitter::flush_trace`) so the tables
+are complete for review. Enabled per-run via `REPLAY_TRACE_DIR=<dir> make perf-replay-sequencer`
+(and `REPLAY_ARCHIVE=1` for archive mode). With no `--trace-dir` the tracer is `noop()`
+(zero overhead), so the throughput numbers above are trace-free.
+
+### Throughput vs block size over height
+
+Joining the per-segment commit rate (from the `block_sync_state` trace / progress log)
+with mean block size per height bucket (read straight from the block cache's per-record
+lengths) shows throughput is governed by block content, in two regimes:
+
+| height region | mean block size | throughput | implied | bound by |
+| --- | ---: | ---: | ---: | --- |
+| 1.84M–1.88M (heavy) | ~1.0 MiB | ~60–80 blk/s | ~70 MiB/s | per-byte write |
+| 1.825M, 1.89M (tiny) | ~20–30 KiB | ~240–480 blk/s | ~7 MiB/s | per-block overhead |
+
+So the committer hits **two different ceilings**: heavy blocks saturate the RocksDB
+write at ~70 MiB/s, while tiny blocks can't exceed ~480 blk/s no matter how small (fixed
+per-commit cost — batch assembly, channel hops, the per-block RocksDB write). The heavy
+1.84M–1.88M region is what drags the 100K average to ~103–108 blk/s. The skill's height
+plot makes this visible; `reorder` stays 0 and there are no HoL stalls (in-order feed),
+and `applying` is held near the 4 GiB budget (peak 4,648 blocks / 2.15 GiB).
+
+> Caveat: the segment-rate vs height join is coarse (5,000-block buckets) and the
+> `verified_tip`-based rate lags the true commit by the in-flight window, so treat the
+> regime boundary as approximate. Per-block alignment (trace `ts` joined to per-block
+> cache size) would sharpen it.
+
+## Open / next
+
+- **Out-of-order / multi-peer feed for `apply-sequencer`:** the POC feeds in height
+  order, so the reorder buffer is idle. Shuffling within a window (and simulating
+  per-peer arrival) is what measures the sequencer's actual job.
+
+- **Larger windows (100K+)** are unblocked for the committer/worker/verifier rungs:
+  memory is flat (verifier peak ~2.4 GiB), so cache size, not RAM, is the limit.
+  (The sequencer rung needs a finite byte budget first — see its RSS note.)
+- **Profiling the committer floor:** with all three rungs converging in VCT
+  (~124–133 blk/s) and verification shown to overlap for free, the committer remains
+  the floor. The `prepare`/`update_trees`/`batch_prep`/`rocksdb.batch_commit`
+  histograms (`--features commit-metrics`) are the next lever.
diff --git a/zebra-replay-bench/src/apply.rs b/zebra-replay-bench/src/apply.rs
new file mode 100644
index 00000000000..2a202f34ba4
--- /dev/null
+++ b/zebra-replay-bench/src/apply.rs
@@ -0,0 +1,202 @@
+//! Phase 2: replay cached blocks through the real state committer, timed.
+//!
+//! Two modes:
+//! * **legacy** — `vct_fast_sync = false`, full per-block note-commitment
+//!   recompute; `next_checkpoint = None`.
+//! * **VCT** (`--vct-sidecar`) — `vct_fast_sync = true`, the per-height
+//!   anchor roots from the sidecar are written into the base fork's header-roots
+//!   column family so the committer folds them in and skips the recompute. Each
+//!   block is committed with its successor as `next_checkpoint`, the one-block-lag
+//!   confirmation the peer-source fast path requires.
+
+use std::{path::Path, sync::Arc, time::Instant};
+
+use color_eyre::eyre::{bail, eyre, Result};
+use zebra_chain::{block::Height, parameters::Network};
+use zebra_state::FinalizedState;
+
+use crate::{
+    cache::CacheReader, config::state_config, prefetch, roots_cache::RootsSidecar, stats::Stats,
+};
+
+/// Replays every block in `cache_path` onto the writable DB at `base`.
+///
+/// `base` must be a snapshot/fork whose finalized tip is exactly `start - 1`.
+/// When `vct_sidecar` is `Some`, the VCT fast path is exercised; otherwise the
+/// legacy recompute path runs. After the replay the resulting tip hash is checked
+/// against the hash recorded in the cache header.
+pub fn run(
+    base: &Path,
+    cache_path: &Path,
+    vct_sidecar: Option<&Path>,
+    network: Network,
+) -> Result<Stats> {
+    let reader = CacheReader::open(cache_path)?;
+    let header = reader.header();
+    let expected_net = match network {
+        Network::Mainnet => 0,
+        _ => 1,
+    };
+    if header.network != expected_net {
+        bail!(
+            "cache network byte {} does not match the requested network",
+            header.network
+        );
+    }
+    let start = header.start_height;
+    let expected_parent = start.checked_sub(1).ok_or_else(|| {
+        eyre!("cache starts at genesis (height 0); apply needs a base at start-1")
+    })?;
+
+    // Load the VCT sidecar first (if any) so we fail fast on a mismatch.
+    let sidecar = match vct_sidecar {
+        Some(path) => {
+            let s = RootsSidecar::read(path)?;
+            if s.start != start {
+                bail!("sidecar start {} != cache start {start}", s.start);
+            }
+            if s.roots.len() != header.count as usize {
+                bail!(
+                    "sidecar has {} roots but cache has {} blocks",
+                    s.roots.len(),
+                    header.count
+                );
+            }
+            Some(s)
+        }
+        None => None,
+    };
+
+    // VCT mode forces the fast path on (vct_fast_sync = true); legacy
+    // mode forces the full recompute (vct_fast_sync = false).
+    let force_legacy = sidecar.is_none();
+    let config = state_config(base.to_path_buf(), force_legacy);
+    tracing::info!(base = %base.display(), vct = sidecar.is_some(), "opening base fork writable");
+    let mut state = FinalizedState::new_writable(&config, &network);
+
+    match state.db.finalized_tip_height() {
+        Some(tip) if tip.0 == expected_parent => {}
+        Some(tip) => bail!(
+            "base tip is {} but cache window starts at {start}; base must be at height {expected_parent}",
+            tip.0
+        ),
+        None => bail!("base fork has no finalized tip; expected height {expected_parent}"),
+    }
+
+    // VCT: write the per-height roots into the base fork's header-roots column
+    // family, exactly where header sync would have placed them, so the committer's
+    // PeerSource reads and folds them per height.
+    if let Some(s) = &sidecar {
+        tracing::info!(
+            roots = s.roots.len(),
+            "injecting VCT roots into header-roots CF"
+        );
+        state
+            .db
+            .insert_zakura_header_commitment_roots(s.roots.iter().cloned())
+            .map_err(|e| eyre!("inserting VCT roots: {e}"))?;
+    }
+
+    tracing::info!(start, count = header.count, "replaying window");
+
+    // Stream the window through a bounded prefetch: a producer thread reads,
+    // deserializes, and builds each CheckpointVerifiedBlock (the verifier-side
+    // `prepare_block_data`) ahead of the committer, so the timed loop measures the
+    // committer only while memory stays bounded to the prefetch capacity. The
+    // committer keeps a one-block look-ahead for the VCT successor.
+    let (_producer, rx) = prefetch::spawn(reader, prefetch::capacity());
+
+    let mut stats = Stats::default();
+    let mut prev_trees = None;
+
+    // Pull the first prepared block before starting the clock.
+    let mut cur = match rx.recv() {
+        Ok(item) => Some(item?),
+        Err(_) => bail!("cache is empty"),
+    };
+    let wall_start = Instant::now();
+
+    while let Some(p) = cur.take() {
+        // The next prepared block is both this block's VCT successor and the next
+        // iteration's block. With a full prefetch buffer this receive does not
+        // block; if the producer lags it briefly waits (counted in the wall, not
+        // the per-commit latency).
+        let next = match rx.recv() {
+            Ok(item) => Some(item?),
+            Err(_) => None,
+        };
+
+        let next_checkpoint = if let Some(s) = &sidecar {
+            let (successor, auth) = match &next {
+                Some(n) => (n.block.clone(), n.auth),
+                None => {
+                    let successor = Arc::new(s.successor.clone());
+                    let auth = successor.auth_data_root();
+                    (successor, auth)
+                }
+            };
+            Some((successor, Some(auth)))
+        } else {
+            None
+        };
+
+        let height = p.height;
+        let commit_start = Instant::now();
+        let (_hash, trees) = state
+            .commit_finalized_direct(
+                p.cv.into(),
+                prev_trees.take(),
+                None,
+                next_checkpoint,
+                if sidecar.is_some() {
+                    "replay-bench-vct"
+                } else {
+                    "replay-bench"
+                },
+            )
+            .map_err(|e| eyre!("commit failed at height {height}: {e}"))?;
+        let latency = commit_start.elapsed();
+
+        prev_trees = Some(trees);
+        stats.record(p.len, latency);
+
+        let done = height - start + 1;
+        if done.is_multiple_of(5000) || done == header.count {
+            tracing::info!(height, done, count = header.count, "applying");
+        }
+
+        cur = next;
+    }
+
+    let wall = wall_start.elapsed();
+
+    // Correctness gate: the committer validates each block's commitments (against
+    // the recomputed trees in legacy mode, or the folded supplied roots in VCT
+    // mode), so reaching the end height already proves consensus correctness.
+    // Confirm the final tip hash equals the source tip for good measure.
+    let tip = state
+        .db
+        .tip()
+        .ok_or_else(|| eyre!("target has no tip after replay"))?;
+    if tip.1 .0 != header.tip_hash {
+        bail!(
+            "final tip hash mismatch: target tip at height {} does not match the source snapshot",
+            tip.0 .0
+        );
+    }
+    if tip.0 != Height(start + header.count - 1) {
+        bail!(
+            "final tip height {} != expected {}",
+            tip.0 .0,
+            start + header.count - 1
+        );
+    }
+    tracing::info!(
+        tip = tip.0 .0,
+        vct = sidecar.is_some(),
+        "replay verified: tip hash matches source"
+    );
+
+    println!("{}", stats.report(wall));
+    Ok(stats)
+}
diff --git a/zebra-replay-bench/src/apply_sequencer.rs b/zebra-replay-bench/src/apply_sequencer.rs
new file mode 100644
index 00000000000..9b60ea63045
--- /dev/null
+++ b/zebra-replay-bench/src/apply_sequencer.rs
@@ -0,0 +1,353 @@
+//! Phase 2, sequencer altitude: replay cached mainnet bodies through the **real**
+//! Zakura block-sync `Sequencer` (`zebra-network`), one rung above [`crate::apply_verifier`].
+//!
+//! The sequencer is the body reorder + ordered-submit pipeline: bodies are fed into
+//! its reorder queue (here in height order, sequentially — random/out-of-order arrival
+//! is a future knob), it drains the contiguous prefix into `applying` and emits
+//! `SubmitBlock`s, and a thin driver here commits each through the same real
+//! `CheckpointVerifier` → `StateService` the verifier rung uses, reporting the commit
+//! back so the sequencer frontier advances and releases the next blocks.
+//!
+//! VCT mode only. Checkpoint batching is the same as `apply_verifier`: feed up to the
+//! last checkpoint `<= end` so the last range delivers the successors the worker's VCT
+//! path needs, but count/gate to the second-to-last checkpoint.
+
+use std::{
+    path::Path,
+    sync::{
+        atomic::{AtomicU64, Ordering},
+        Arc,
+    },
+    time::Instant,
+};
+
+use color_eyre::eyre::{bail, eyre, Result};
+use futures::stream::{FuturesOrdered, StreamExt};
+use tower::{buffer::Buffer, Service, ServiceExt};
+use zebra_chain::{
+    block::{self, Height},
+    parameters::Network,
+};
+use zebra_consensus::CheckpointVerifier;
+use zebra_network::zakura::{spawn_bench_sequencer, BenchSubmit};
+use zebra_state::{FinalizedState, PruningConfig, StorageMode};
+
+use crate::{
+    cache::CacheReader, config::state_config, prefetch, roots_cache::RootsSidecar, stats::Stats,
+};
+
+/// Request-channel bound for the cloneable (buffered) state service the verifier
+/// commits through (same as `apply_verifier`).
+const STATE_BUFFER_BOUND: usize = 1024;
+
+/// Concurrency limit passed to `zebra_state::init` (same as `apply_verifier`).
+const STATE_CHECKPOINT_CONCURRENCY: usize = 1000;
+
+/// Byte budget for the sequencer's in-flight bodies (reorder + applying). Bounds
+/// memory: the sequencer backpressures the feed once this many body bytes are
+/// buffered, so the `applying` set can't grow with the whole window. 4 GiB is plenty
+/// of pipeline depth (>> one checkpoint range) while staying well within RAM.
+const SEQUENCER_MAX_INFLIGHT_BYTES: u64 = 4 * 1024 * 1024 * 1024;
+
+/// Replays the cache through the real block-sync `Sequencer` (which submits to the
+/// checkpoint verifier → state) onto the writable base fork at `base`. VCT only.
+pub fn run(
+    base: &Path,
+    cache_path: &Path,
+    vct_sidecar: Option<&Path>,
+    network: Network,
+    archive: bool,
+    trace_dir: Option<&Path>,
+) -> Result<Stats> {
+    let reader = CacheReader::open(cache_path)?;
+    let header = reader.header();
+    let expected_net = match network {
+        Network::Mainnet => 0,
+        _ => 1,
+    };
+    if header.network != expected_net {
+        bail!(
+            "cache network byte {} does not match the requested network",
+            header.network
+        );
+    }
+    let start = header.start_height;
+    let end = start + header.count - 1;
+    let expected_parent = start.checked_sub(1).ok_or_else(|| {
+        eyre!("cache starts at genesis (height 0); apply needs a base at start-1")
+    })?;
+
+    // The sequencer rung is VCT-only: it exercises the Zakura fast-sync pipeline.
+    let sidecar_path =
+        vct_sidecar.ok_or_else(|| eyre!("apply-sequencer is VCT-only; pass --vct-sidecar"))?;
+    let sidecar = {
+        let s = RootsSidecar::read(sidecar_path)?;
+        if s.start != start {
+            bail!("sidecar start {} != cache start {start}", s.start);
+        }
+        if s.roots.len() != header.count as usize {
+            bail!(
+                "sidecar has {} roots but cache has {} blocks",
+                s.roots.len(),
+                header.count
+            );
+        }
+        s
+    };
+
+    // VCT (force_legacy = false). Storage mode: Pruned by default (the base must
+    // already be a pruned snapshot — pruning is one-way), matching the production
+    // mainnet config; `--archive` opts back into full raw-tx + indexes.
+    let mut config = state_config(base.to_path_buf(), /* force_legacy */ false);
+    if !archive {
+        config.storage_mode = StorageMode::Pruned(PruningConfig::default());
+    }
+    let storage_label = if archive { "archive" } else { "pruned" };
+
+    // Optional structured Zakura JSONL traces (same tables `perf-run-mainnet` writes
+    // via `[network.zakura] trace_dir`). Created up front so a stale dir surfaces early.
+    let trace_dir = trace_dir.map(|p| p.to_path_buf());
+    if let Some(dir) = trace_dir.as_deref() {
+        std::fs::create_dir_all(dir).map_err(|e| eyre!("creating trace dir {dir:?}: {e}"))?;
+        tracing::info!(trace_dir = ?dir, "Zakura JSONL tracing enabled for the sequencer");
+    }
+
+    // Open the fork directly first: assert the tip, capture the parent hash (the
+    // sequencer/verifier initial tip), inject the per-height VCT roots. Drop before
+    // `zebra_state::init` reopens the fork.
+    let parent_hash = {
+        let state = FinalizedState::new_writable(&config, &network);
+        match state.db.finalized_tip_height() {
+            Some(tip) if tip.0 == expected_parent => {}
+            Some(tip) => bail!(
+                "base tip is {} but cache window starts at {start}; base must be at height {expected_parent}",
+                tip.0
+            ),
+            None => bail!("base fork has no finalized tip; expected height {expected_parent}"),
+        }
+        tracing::info!(
+            roots = sidecar.roots.len(),
+            "injecting VCT roots into header-roots CF"
+        );
+        state
+            .db
+            .insert_zakura_header_commitment_roots(sidecar.roots.iter().cloned())
+            .map_err(|e| eyre!("inserting VCT roots: {e}"))?;
+        state.db.finalized_tip_hash()
+    };
+
+    // Same checkpoint boundary as apply_verifier: feed to the last checkpoint <= end,
+    // commit/gate to the second-to-last (the last block's successor is in the tail).
+    let checkpoint_list = network.checkpoint_list();
+    let feed_checkpoint = checkpoint_list
+        .max_height_in_range(..=Height(end))
+        .ok_or_else(|| eyre!("no checkpoint at or below end height {end}"))?;
+    let last_checkpoint = checkpoint_list
+        .max_height_in_range(..Height(feed_checkpoint.0))
+        .ok_or_else(|| {
+            eyre!(
+                "window [{start}, {end}] spans fewer than two checkpoints; \
+                 pick a window covering at least two checkpoints"
+            )
+        })?;
+    if last_checkpoint.0 < start {
+        bail!(
+            "the second-to-last checkpoint {} is below the window start {start}; widen the window",
+            last_checkpoint.0
+        );
+    }
+    let expected_tip_hash = checkpoint_list
+        .hash(last_checkpoint)
+        .ok_or_else(|| eyre!("checkpoint list has no hash for {}", last_checkpoint.0))?;
+    let target = last_checkpoint.0 - start + 1;
+    let feed_target = feed_checkpoint.0 - start + 1;
+    tracing::info!(
+        start,
+        end,
+        feed_checkpoint = feed_checkpoint.0,
+        last_checkpoint = last_checkpoint.0,
+        committed = target,
+        "sequencer feeds to the last checkpoint <= end, commits/gates to the second-to-last"
+    );
+
+    let max_checkpoint_height = checkpoint_list.max_height();
+    // In-flight window / submit limit must exceed the largest checkpoint gap (same as
+    // apply_verifier), else a range never completes.
+    let in_flight = prefetch::capacity().max(zebra_consensus::MAX_CHECKPOINT_HEIGHT_GAP + 64);
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .map_err(|e| eyre!("building tokio runtime: {e}"))?;
+
+    let stats = runtime.block_on(async move {
+        // Real buffered StateService + checkpoint verifier on the base fork.
+        let (state, _read, _latest, _change) = zebra_state::init(
+            config,
+            &network,
+            max_checkpoint_height,
+            STATE_CHECKPOINT_CONCURRENCY,
+        )
+        .await;
+        let state = Buffer::new(state, STATE_BUFFER_BOUND);
+        let mut verifier = CheckpointVerifier::new(
+            &network,
+            Some((Height(expected_parent), parent_hash)),
+            state.clone(),
+        );
+
+        // Per-height serialized byte length, written by the feed task and read by the
+        // driver (the SubmitBlock action does not carry the size). One slot per fed
+        // block; small (8 bytes each).
+        let lens: Arc<Vec<AtomicU64>> = Arc::new(
+            (0..feed_target).map(|_| AtomicU64::new(0)).collect(),
+        );
+
+        // Spawn the real block-sync Sequencer starting from the base tip.
+        let (feeder, mut submissions, mut committer) = spawn_bench_sequencer(
+            Height(expected_parent),
+            Height(expected_parent),
+            parent_hash,
+            in_flight,
+            SEQUENCER_MAX_INFLIGHT_BYTES,
+            trace_dir.clone(),
+        )
+        .into_parts();
+
+        let (_producer, rx) = prefetch::spawn(reader, in_flight);
+
+        // Feed task: stream prepared blocks into the reorder queue, in height order,
+        // up to the last checkpoint (`feed_target`). Records each block's size in `lens`.
+        let feed_lens = lens.clone();
+        let feed = tokio::spawn(async move {
+            let mut fed = 0u32;
+            while fed < feed_target {
+                // The prefetch producer is a std thread; do the blocking recv off the
+                // async executor.
+                let item = tokio::task::block_in_place(|| rx.recv());
+                let prepared = match item {
+                    Ok(Ok(p)) => p,
+                    Ok(Err(e)) => return Err(e),
+                    Err(_) => break, // producer exhausted before feed_target
+                };
+                let height = prepared.height;
+                let hash = prepared.block.hash();
+                let len = prepared.len as u64;
+                feed_lens[(height - start) as usize].store(len, Ordering::Relaxed);
+                if !feeder
+                    .feed_body(Height(height), hash, prepared.block, len)
+                    .await
+                {
+                    break; // sequencer gone
+                }
+                fed += 1;
+            }
+            Ok::<(), color_eyre::Report>(())
+        });
+
+        let mut stats = Stats::default();
+        let mut verifies = FuturesOrdered::new();
+        let mut submitted = 0u32;
+        let mut done = 0u32;
+
+        let wall_start = Instant::now();
+        let mut last = wall_start;
+
+        // Cadence for the `block_sync_state` trace snapshots (only when tracing is on).
+        // Dense enough for a smooth throughput/applying curve; the plotter downsamples.
+        let tracing_on = trace_dir.is_some();
+        if tracing_on {
+            committer.emit_state_snapshot();
+        }
+
+        // Drive: pull ordered submissions and verify+commit them concurrently; report
+        // each commit back so the sequencer frontier advances. The sequencer's submit
+        // limit bounds the in-flight set.
+        while done < target {
+            tokio::select! {
+                biased;
+                // A verify+commit completed: report it back and record it.
+                Some(item) = verifies.next(), if !verifies.is_empty() => {
+                    let (token, height, committed_hash, len): (_, Height, block::Hash, u64) = item?;
+                    if height == last_checkpoint && committed_hash != expected_tip_hash {
+                        bail!(
+                            "committed hash at the second-to-last checkpoint {} does not match the embedded checkpoint hash",
+                            last_checkpoint.0
+                        );
+                    }
+                    committer.apply_committed(token, height, committed_hash);
+                    done += 1;
+                    let now = Instant::now();
+                    stats.record(len as usize, now - last);
+                    last = now;
+                    if tracing_on && (done.is_multiple_of(20) || done == target) {
+                        committer.emit_state_snapshot();
+                    }
+                    if done.is_multiple_of(5000) || done == target {
+                        let p = committer.progress();
+                        tracing::info!(
+                            done, submitted,
+                            verified_tip = p.verified_tip.0,
+                            reorder = p.reorder_len,
+                            applying = p.applying_len,
+                            "sequencer-progress"
+                        );
+                    }
+                }
+                // The next ordered submission from the sequencer: start its verify.
+                // The next ordered submission from the sequencer: start its verify.
+                // `None` (action channel closed) just leaves the drain arm to finish.
+                maybe = submissions.next_submit(), if submitted < feed_target => {
+                    if let Some(BenchSubmit { token, block }) = maybe {
+                        let height = block
+                            .coinbase_height()
+                            .expect("submitted checkpoint block has a coinbase height");
+                        let len = lens[(height.0 - start) as usize].load(Ordering::Relaxed);
+                        let fut = verifier
+                            .ready()
+                            .await
+                            .map_err(|e| eyre!("verifier not ready: {e}"))?
+                            .call(block);
+                        verifies.push_back(async move {
+                            let committed = fut.await.map_err(|e| {
+                                eyre!("verify/commit failed at height {}: {e}", height.0)
+                            })?;
+                            Ok::<(_, Height, block::Hash, u64), color_eyre::Report>((
+                                token, height, committed, len,
+                            ))
+                        });
+                        submitted += 1;
+                    }
+                }
+                else => break,
+            }
+        }
+        let wall = wall_start.elapsed();
+
+        if done < target {
+            // Drive couldn't reach the target: surface a feed error if there was one.
+            match feed.await {
+                Ok(Ok(())) => bail!("sequencer stalled at {done}/{target} committed (no feed error)"),
+                Ok(Err(e)) => return Err(e),
+                Err(e) => bail!("feed task panicked: {e}"),
+            }
+        }
+
+        // Drain + flush the JSONL trace writer so the tables are complete on disk.
+        committer.flush_trace().await;
+
+        tracing::info!(
+            committed = done,
+            last_checkpoint = last_checkpoint.0,
+            "replay verified (sequencer, vct): committed through the second-to-last checkpoint; hash matches"
+        );
+        println!("mode=sequencer (vct, {storage_label})");
+        if let Some(dir) = trace_dir.as_deref() {
+            println!("zakura-traces={}", dir.display());
+        }
+        println!("{}", stats.report(wall));
+        Ok::<Stats, color_eyre::Report>(stats)
+    })?;
+
+    Ok(stats)
+}
diff --git a/zebra-replay-bench/src/apply_verifier.rs b/zebra-replay-bench/src/apply_verifier.rs
new file mode 100644
index 00000000000..075cd932967
--- /dev/null
+++ b/zebra-replay-bench/src/apply_verifier.rs
@@ -0,0 +1,340 @@
+//! Phase 2, checkpoint-verifier altitude: replay cached blocks through the real
+//! `zebra-consensus::CheckpointVerifier`, which internally commits to a real
+//! `zebra-state` `StateService` — one rung above [`crate::apply_worker`], which
+//! drives the write worker directly.
+//!
+//! This is the first rung that adds genuinely new CPU above the commit pipeline:
+//! per-block proof-of-work (difficulty + equihash) and Merkle-root validity, plus
+//! checkpoint-range batching. The verifier is a Tower service, so unlike `apply`
+//! and `apply_worker` (sync) this path runs on a multi-thread tokio runtime.
+//!
+//! Checkpoint batching + the VCT successor boundary: the verifier only releases (and
+//! the worker commits) a block once its whole checkpoint range is contiguous. The
+//! worker's VCT fast path additionally can't commit a block until its successor is
+//! buffered (the one-block-lag root authentication). The final checkpoint's successor
+//! is in the dropped tail, and the verifier never releases it (its range can't
+//! complete past the window) — so the last checkpoint block would never commit. We
+//! therefore **feed** up to the last checkpoint `<= end` (so the last range delivers
+//! the successors the worker needs), but **count/gate** only up to the *second-to-last*
+//! checkpoint, whose successor that last range does deliver.
+//!
+//! Boundedness: blocks are read/parsed off-thread by the bounded [`crate::prefetch`]
+//! producer and fed to the verifier with a bounded in-flight window (>= the largest
+//! checkpoint gap, so ranges always complete), keeping memory flat. A periodic
+//! progress log (fed/done/front-height) makes any stall observable.
+
+use std::{
+    collections::VecDeque,
+    path::Path,
+    sync::{
+        atomic::{AtomicU32, Ordering},
+        Arc,
+    },
+    time::{Duration, Instant},
+};
+
+use color_eyre::eyre::{bail, eyre, Result};
+use tower::{buffer::Buffer, Service, ServiceExt};
+use zebra_chain::{block::Height, parameters::Network};
+use zebra_consensus::{CheckpointVerifier, MAX_CHECKPOINT_HEIGHT_GAP};
+use zebra_state::FinalizedState;
+
+use crate::{
+    cache::CacheReader, config::state_config, prefetch, roots_cache::RootsSidecar, stats::Stats,
+};
+
+/// Request-channel bound for the cloneable (buffered) state service the verifier
+/// commits through. Generous so concurrent per-block commit requests don't queue.
+const STATE_BUFFER_BOUND: usize = 1024;
+
+/// Concurrency limit passed to `zebra_state::init` (checkpoint raw-tx retention
+/// buffering); not throughput-critical for this bench.
+const STATE_CHECKPOINT_CONCURRENCY: usize = 1000;
+
+/// Replays the cache through the checkpoint verifier (which commits to a real
+/// `StateService`) onto the writable base fork at `base` (tip must be `start-1`).
+///
+/// Feeds up to the last checkpoint `<= end`, commits/counts to the second-to-last
+/// checkpoint (see the module docs for why), and gates that block's committed hash
+/// against the embedded checkpoint hash.
+pub fn run(
+    base: &Path,
+    cache_path: &Path,
+    vct_sidecar: Option<&Path>,
+    network: Network,
+) -> Result<Stats> {
+    let reader = CacheReader::open(cache_path)?;
+    let header = reader.header();
+    let expected_net = match network {
+        Network::Mainnet => 0,
+        _ => 1,
+    };
+    if header.network != expected_net {
+        bail!(
+            "cache network byte {} does not match the requested network",
+            header.network
+        );
+    }
+    let start = header.start_height;
+    let end = start + header.count - 1;
+    let expected_parent = start.checked_sub(1).ok_or_else(|| {
+        eyre!("cache starts at genesis (height 0); apply needs a base at start-1")
+    })?;
+
+    // Load the VCT sidecar first (if any) so we fail fast on a mismatch.
+    let sidecar = match vct_sidecar {
+        Some(path) => {
+            let s = RootsSidecar::read(path)?;
+            if s.start != start {
+                bail!("sidecar start {} != cache start {start}", s.start);
+            }
+            if s.roots.len() != header.count as usize {
+                bail!(
+                    "sidecar has {} roots but cache has {} blocks",
+                    s.roots.len(),
+                    header.count
+                );
+            }
+            Some(s)
+        }
+        None => None,
+    };
+
+    let force_legacy = sidecar.is_none();
+    let config = state_config(base.to_path_buf(), force_legacy);
+
+    // Open the fork directly first: assert the tip, capture the parent hash (the
+    // verifier's initial tip), and in VCT mode inject the per-height roots into the
+    // header-roots CF. Drop this handle before `zebra_state::init` reopens the fork.
+    let parent_hash = {
+        let state = FinalizedState::new_writable(&config, &network);
+        match state.db.finalized_tip_height() {
+            Some(tip) if tip.0 == expected_parent => {}
+            Some(tip) => bail!(
+                "base tip is {} but cache window starts at {start}; base must be at height {expected_parent}",
+                tip.0
+            ),
+            None => bail!("base fork has no finalized tip; expected height {expected_parent}"),
+        }
+        if let Some(s) = &sidecar {
+            tracing::info!(
+                roots = s.roots.len(),
+                "injecting VCT roots into header-roots CF"
+            );
+            state
+                .db
+                .insert_zakura_header_commitment_roots(s.roots.iter().cloned())
+                .map_err(|e| eyre!("inserting VCT roots: {e}"))?;
+        }
+        state.db.finalized_tip_hash()
+    };
+
+    // The verifier only releases (and the worker commits) a block once its whole
+    // checkpoint range is contiguous, so the verifier delivers blocks to the worker
+    // up to the last checkpoint <= end (`feed_checkpoint`). But the worker's VCT fast
+    // path can't commit a block until its successor is buffered, and the final
+    // checkpoint's successor is in the dropped tail (its range can't complete past
+    // the window). So we **feed** up to the last checkpoint (to deliver successors),
+    // but **count/gate** only up to the *second-to-last* checkpoint, whose successor
+    // the last range does deliver. The embedded checkpoint hash there is the gate.
+    let checkpoint_list = network.checkpoint_list();
+    let feed_checkpoint = checkpoint_list
+        .max_height_in_range(..=Height(end))
+        .ok_or_else(|| eyre!("no checkpoint at or below end height {end}"))?;
+    let last_checkpoint = checkpoint_list
+        .max_height_in_range(..Height(feed_checkpoint.0))
+        .ok_or_else(|| {
+            eyre!(
+                "window [{start}, {end}] spans fewer than two checkpoints; \
+                 the VCT fast path needs the last counted block's successor delivered, \
+                 so pick a window covering at least two checkpoints"
+            )
+        })?;
+    if last_checkpoint.0 < start {
+        bail!(
+            "the second-to-last checkpoint {} is below the window start {start}; widen the window",
+            last_checkpoint.0
+        );
+    }
+    let expected_tip_hash = checkpoint_list
+        .hash(last_checkpoint)
+        .ok_or_else(|| eyre!("checkpoint list has no hash for {}", last_checkpoint.0))?;
+    let target = last_checkpoint.0 - start + 1;
+    let feed_target = feed_checkpoint.0 - start + 1;
+    let dropped_tail = end - last_checkpoint.0;
+    tracing::info!(
+        start,
+        end,
+        feed_checkpoint = feed_checkpoint.0,
+        last_checkpoint = last_checkpoint.0,
+        committed = target,
+        dropped_tail,
+        "verifier feeds to the last checkpoint <= end, commits/gates to the second-to-last"
+    );
+
+    let max_checkpoint_height = checkpoint_list.max_height();
+
+    // The in-flight window must exceed the largest checkpoint gap, or a range never
+    // completes and its blocks' futures never resolve. `ZRB_PREFETCH_CAP` can raise it.
+    let in_flight = prefetch::capacity().max(MAX_CHECKPOINT_HEIGHT_GAP + 64);
+
+    let runtime = tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .map_err(|e| eyre!("building tokio runtime: {e}"))?;
+
+    let vct = sidecar.is_some();
+
+    let stats = runtime.block_on(async move {
+        // Real buffered StateService on the base fork (the verifier commits into it).
+        let (state, _read, _latest, _change) = zebra_state::init(
+            config,
+            &network,
+            max_checkpoint_height,
+            STATE_CHECKPOINT_CONCURRENCY,
+        )
+        .await;
+        let state = Buffer::new(state, STATE_BUFFER_BOUND);
+
+        let mut verifier = CheckpointVerifier::new(
+            &network,
+            Some((Height(expected_parent), parent_hash)),
+            state.clone(),
+        );
+
+        let (_producer, rx) = prefetch::spawn(reader, in_flight);
+
+        let mut stats = Stats::default();
+        let mut inflight = VecDeque::new();
+        let mut fed = 0u32;
+        let mut done = 0u32;
+
+        // Instrumentation: a periodic task logs these counters so a stall is
+        // observable — which height we're blocked awaiting, whether it's a
+        // checkpoint boundary, and whether feed/commit are still advancing.
+        let fed_ctr = Arc::new(AtomicU32::new(0));
+        let done_ctr = Arc::new(AtomicU32::new(0));
+        let front_ctr = Arc::new(AtomicU32::new(0));
+        let inflight_ctr = Arc::new(AtomicU32::new(0));
+        let progress = {
+            let (f, d, fr, il, cl) = (
+                fed_ctr.clone(),
+                done_ctr.clone(),
+                front_ctr.clone(),
+                inflight_ctr.clone(),
+                checkpoint_list.clone(),
+            );
+            tokio::spawn(async move {
+                let mut prev = 0u32;
+                loop {
+                    tokio::time::sleep(Duration::from_secs(5)).await;
+                    let (fed, done, front, inf) = (
+                        f.load(Ordering::Relaxed),
+                        d.load(Ordering::Relaxed),
+                        fr.load(Ordering::Relaxed),
+                        il.load(Ordering::Relaxed),
+                    );
+                    tracing::info!(
+                        fed,
+                        done,
+                        inflight = inf,
+                        front_height = front,
+                        front_is_checkpoint = cl.contains(Height(front)),
+                        committed_last_5s = done.wrapping_sub(prev),
+                        "verifier-progress"
+                    );
+                    prev = done;
+                }
+            })
+        };
+
+        let wall_start = Instant::now();
+        let mut last = wall_start;
+
+        // Pull, call (eagerly queues), and spawn one block's verify+commit future.
+        // Returns Ok(false) if the producer ended before `target`.
+        macro_rules! feed_one {
+            () => {{
+                match rx.recv() {
+                    Ok(item) => {
+                        let p = item?;
+                        let (height, len) = (p.height, p.len);
+                        let fut = verifier
+                            .ready()
+                            .await
+                            .map_err(|e| eyre!("verifier not ready: {e}"))?
+                            .call(p.block);
+                        inflight.push_back((tokio::spawn(fut), height, len));
+                        fed += 1;
+                        fed_ctr.store(fed, Ordering::Relaxed);
+                        true
+                    }
+                    Err(_) => false,
+                }
+            }};
+        }
+
+        // Prime the in-flight window (>= one checkpoint range, so ranges complete).
+        // Feed extends to `feed_target` (the last checkpoint) so the last range's
+        // successors reach the worker, even though we only count up to `target`.
+        while inflight.len() < in_flight && fed < feed_target {
+            if !feed_one!() {
+                break;
+            }
+        }
+
+        // Drain completions in commit order until the counted target (second-to-last
+        // checkpoint); refill toward `feed_target` to keep the window bounded. The
+        // remaining in-flight handles (the last range, whose final block can't commit)
+        // are left detached and reaped when the runtime drops.
+        while done < target {
+            let Some((handle, height, len)) = inflight.pop_front() else {
+                bail!("ran out of in-flight blocks before the counted target (feed/checkpoint logic bug)");
+            };
+            // Publish the block we're about to block on, so the progress task can
+            // show where a stall is (and whether `height` is a checkpoint).
+            front_ctr.store(height, Ordering::Relaxed);
+            // `inflight.len()` is bounded by `in_flight` (a few thousand), fits u32.
+            inflight_ctr.store(inflight.len() as u32, Ordering::Relaxed);
+            // The verify+commit future resolves to the block's hash *after* it is
+            // committed, so the returned hash is an authenticated, post-commit value.
+            let committed_hash = handle
+                .await
+                .map_err(|e| eyre!("verifier task join error at height {height}: {e}"))?
+                .map_err(|e| eyre!("verify/commit failed at height {height}: {e}"))?;
+            // Correctness gate: the counted final block is the second-to-last
+            // checkpoint; its committed hash must match the embedded checkpoint hash.
+            if height == last_checkpoint.0 && committed_hash != expected_tip_hash {
+                bail!(
+                    "committed hash at the second-to-last checkpoint {} does not match the embedded checkpoint hash",
+                    last_checkpoint.0
+                );
+            }
+            done += 1;
+            done_ctr.store(done, Ordering::Relaxed);
+            let now = Instant::now();
+            stats.record(len, now - last);
+            last = now;
+
+            if fed < feed_target {
+                feed_one!();
+            }
+        }
+        progress.abort();
+        let wall = wall_start.elapsed();
+
+        tracing::info!(
+            committed = done,
+            last_checkpoint = last_checkpoint.0,
+            vct,
+            "replay verified (checkpoint-verifier): committed through the second-to-last checkpoint; hash matches"
+        );
+
+        let mode = if vct { "vct" } else { "legacy" };
+        println!("mode=checkpoint-verifier ({mode})");
+        println!("{}", stats.report(wall));
+        Ok::<Stats, color_eyre::Report>(stats)
+    })?;
+
+    Ok(stats)
+}
diff --git a/zebra-replay-bench/src/apply_worker.rs b/zebra-replay-bench/src/apply_worker.rs
new file mode 100644
index 00000000000..c428a972686
--- /dev/null
+++ b/zebra-replay-bench/src/apply_worker.rs
@@ -0,0 +1,272 @@
+//! Phase 2, write-worker altitude: replay cached blocks through the real
+//! `zebra-state` write worker ([`BlockWriteSender::spawn`] /
+//! `WriteBlockWorkerTask::run`), timed — one rung above [`crate::apply`], which
+//! calls the committer directly.
+//!
+//! Driving the worker rather than the committer adds exactly the orchestration
+//! the production node wraps around each commit: the in-order channel feed, the
+//! one-block VCT successor look-ahead, the park/poll loop, and the chain-tip
+//! channel updates. Blocks are read,
+//! parsed, and prepared off the commit thread by a bounded [`crate::prefetch`]
+//! producer and fed to the worker with a bounded in-flight window, so the timed
+//! window measures the commit pipeline only while memory stays flat regardless of
+//! window size.
+//!
+//! Two modes, differing only at the window boundary:
+//! * **legacy** (`vct_fast_sync = false`, no sidecar): feed `start..=end`,
+//!   drop both worker senders so the worker drains, hits `Disconnected`, and
+//!   exits; the worker thread is joined.
+//! * **VCT** (`--vct-sidecar`): the per-height roots are injected into the base
+//!   fork's header-roots CF and the worker builds its own `next_checkpoint` from
+//!   the look-ahead. Every committed height needs its successor buffered, so we
+//!   feed one extra trailing block (the sidecar's `successor`, height `end+1`) to
+//!   give `end` its successor. The worker then parks on `end+1` (whose successor
+//!   is never fed) and cannot be drained to exit, so we verify against a cloned
+//!   DB handle and return without joining — the parked thread is reaped at exit.
+
+use std::{path::Path, sync::Arc, time::Instant};
+
+use std::collections::VecDeque;
+
+use color_eyre::eyre::{bail, eyre, Result};
+use tokio::sync::{oneshot, watch};
+use zebra_chain::{block::Height, parameters::Network};
+use zebra_state::{
+    BlockWriteSender, ChainTipSender, CheckpointVerifiedBlock, FinalizedState, NonFinalizedState,
+};
+
+use crate::{
+    cache::CacheReader, config::state_config, prefetch, roots_cache::RootsSidecar, stats::Stats,
+};
+
+/// Replays every block in `cache_path` through the write worker, onto the
+/// writable DB at `base` (whose finalized tip must be exactly `start - 1`).
+///
+/// When `vct_sidecar` is `Some`, the VCT fast path is exercised; otherwise the
+/// legacy recompute path runs. After the replay the resulting tip hash is checked
+/// against the hash recorded in the cache header.
+pub fn run(
+    base: &Path,
+    cache_path: &Path,
+    vct_sidecar: Option<&Path>,
+    network: Network,
+) -> Result<Stats> {
+    let reader = CacheReader::open(cache_path)?;
+    let header = reader.header();
+    let expected_net = match network {
+        Network::Mainnet => 0,
+        _ => 1,
+    };
+    if header.network != expected_net {
+        bail!(
+            "cache network byte {} does not match the requested network",
+            header.network
+        );
+    }
+    let start = header.start_height;
+    let expected_parent = start.checked_sub(1).ok_or_else(|| {
+        eyre!("cache starts at genesis (height 0); apply needs a base at start-1")
+    })?;
+
+    // Load the VCT sidecar first (if any) so we fail fast on a mismatch.
+    let sidecar = match vct_sidecar {
+        Some(path) => {
+            let s = RootsSidecar::read(path)?;
+            if s.start != start {
+                bail!("sidecar start {} != cache start {start}", s.start);
+            }
+            if s.roots.len() != header.count as usize {
+                bail!(
+                    "sidecar has {} roots but cache has {} blocks",
+                    s.roots.len(),
+                    header.count
+                );
+            }
+            Some(s)
+        }
+        None => None,
+    };
+
+    // VCT mode forces the fast path on (vct_fast_sync = true); legacy
+    // mode forces the full recompute (vct_fast_sync = false).
+    let force_legacy = sidecar.is_none();
+    let config = state_config(base.to_path_buf(), force_legacy);
+    tracing::info!(base = %base.display(), vct = sidecar.is_some(), "opening base fork writable (worker)");
+    let state = FinalizedState::new_writable(&config, &network);
+
+    match state.db.finalized_tip_height() {
+        Some(tip) if tip.0 == expected_parent => {}
+        Some(tip) => bail!(
+            "base tip is {} but cache window starts at {start}; base must be at height {expected_parent}",
+            tip.0
+        ),
+        None => bail!("base fork has no finalized tip; expected height {expected_parent}"),
+    }
+
+    // VCT: write the per-height roots into the base fork's header-roots column
+    // family, exactly where header sync would have placed them, so the worker's
+    // committer reads and folds them per height.
+    if let Some(s) = &sidecar {
+        tracing::info!(
+            roots = s.roots.len(),
+            "injecting VCT roots into header-roots CF"
+        );
+        state
+            .db
+            .insert_zakura_header_commitment_roots(s.roots.iter().cloned())
+            .map_err(|e| eyre!("inserting VCT roots: {e}"))?;
+    }
+
+    // Keep a DB handle for the post-run correctness gate: the worker drops its own
+    // `FinalizedState` (and calls `db.shutdown`) on exit, but this clone shares the
+    // Arc-backed RocksDB and keeps it open for the final tip read.
+    let db = state.db.clone();
+
+    // Wire the worker exactly as `StateService` does, minus the service plumbing.
+    let nf = NonFinalizedState::new(&network);
+    let (nf_tx, nf_rx) = watch::channel(nf.clone());
+    let (tip_tx, latest, change) = ChainTipSender::new(None, &network);
+    let (mut sender, invalid_rx, rejected_rx, join) =
+        BlockWriteSender::spawn(state, nf, tip_tx, nf_tx, true, None);
+
+    // These must stay alive for the whole run: dropping `invalid_rx`/`rejected_rx`
+    // closes channels the worker reads as a shutdown signal; the rest are realistic
+    // receivers the worker broadcasts to. We expect no resets on a valid forward
+    // replay, so nothing is read off them.
+    let _guards = (invalid_rx, rejected_rx, nf_rx, latest, change);
+
+    // Stream the window through a bounded prefetch (read + deserialize + build
+    // CheckpointVerifiedBlock off the commit thread) and feed it to the worker with
+    // a bounded in-flight window: never more than `in_flight` blocks sent-but-not-
+    // committed. This keeps memory flat regardless of window size and avoids dumping
+    // a 30K backlog into the worker's unbounded channel (which would trigger a
+    // RocksDB write-stall). The worker builds its own VCT next_checkpoint from the
+    // look-ahead, so it only needs the CVs fed in order.
+    let in_flight = prefetch::capacity();
+    let (_producer, rx) = prefetch::spawn(reader, in_flight);
+
+    let fin = sender
+        .finalized
+        .take()
+        .expect("finalized sender present: should_use_finalized = true");
+
+    let mut stats = Stats::default();
+    let mut completions = VecDeque::new();
+    let mut window_done = false;
+    let mut successor_fed = false;
+
+    let wall_start = Instant::now();
+
+    // Prime the in-flight window with up to `in_flight` prepared blocks.
+    while completions.len() < in_flight && !window_done {
+        match rx.recv() {
+            Ok(item) => {
+                let p = item?;
+                let (tx, c) = oneshot::channel();
+                fin.send((p.cv, tx))
+                    .map_err(|_| eyre!("worker finalized channel closed early"))?;
+                completions.push_back((c, p.len));
+            }
+            Err(_) => window_done = true,
+        }
+    }
+
+    // Drain completions in commit order, refilling to keep the in-flight window
+    // bounded. Inter-arrival deltas are the worker-side per-block latency.
+    let mut last = wall_start;
+    while let Some((c, len)) = completions.pop_front() {
+        let committed = c
+            .blocking_recv()
+            .map_err(|e| eyre!("worker dropped a commit response: {e}"))?;
+        committed.map_err(|e| eyre!("commit failed: {e}"))?;
+        let now = Instant::now();
+        stats.record(len, now - last);
+        last = now;
+
+        // Refill with the next window block; once the window is drained, feed the
+        // single VCT successor (height end+1) so the last counted block can commit.
+        // Its completion is intentionally not tracked — the worker parks on it.
+        if !window_done {
+            match rx.recv() {
+                Ok(item) => {
+                    let p = item?;
+                    let (tx, c2) = oneshot::channel();
+                    fin.send((p.cv, tx))
+                        .map_err(|_| eyre!("worker finalized channel closed early"))?;
+                    completions.push_back((c2, p.len));
+                }
+                Err(_) => window_done = true,
+            }
+        }
+        if window_done && !successor_fed {
+            if let Some(s) = &sidecar {
+                let scv = CheckpointVerifiedBlock::from(Arc::new(s.successor.clone()));
+                let (tx, _c) = oneshot::channel();
+                fin.send((scv, tx))
+                    .map_err(|_| eyre!("worker finalized channel closed early (successor)"))?;
+            }
+            successor_fed = true;
+        }
+    }
+    let wall = wall_start.elapsed();
+
+    // Legacy: drop both worker senders so the worker drains and exits. VCT keeps
+    // them alive — the worker parks on the unfed successor of end+1 regardless.
+    if sidecar.is_none() {
+        drop(fin);
+        drop(sender);
+    }
+
+    // Correctness gate (via the cloned DB handle). Reaching the end height already
+    // proves consensus correctness — the committer validates each block's
+    // commitments — so this just confirms the final tip.
+    let tip = db
+        .tip()
+        .ok_or_else(|| eyre!("target has no tip after replay"))?;
+    if tip.1 .0 != header.tip_hash {
+        bail!(
+            "final tip hash mismatch: target tip at height {} does not match the source snapshot",
+            tip.0 .0
+        );
+    }
+    if tip.0 != Height(start + header.count - 1) {
+        bail!(
+            "final tip height {} != expected {}",
+            tip.0 .0,
+            start + header.count - 1
+        );
+    }
+
+    if sidecar.is_none() {
+        // Legacy: the worker has drained and is shutting down — join it.
+        if let Some(join) = join {
+            if let Ok(handle) = Arc::try_unwrap(join) {
+                handle
+                    .join()
+                    .map_err(|_| eyre!("write worker thread panicked"))?;
+            }
+        }
+        tracing::info!(
+            tip = tip.0 .0,
+            "replay verified (worker, legacy): tip hash matches source"
+        );
+    } else {
+        // VCT: the worker is parked on the unfed successor of end+1 and cannot be
+        // drained to exit. All counted blocks committed and the tip gate passed;
+        // leave the thread parked (reaped at process exit).
+        drop(join);
+        tracing::info!(
+            tip = tip.0 .0,
+            "replay verified (worker, vct): tip hash matches source; worker left parked (reaped at exit)"
+        );
+    }
+
+    let mode = if vct_sidecar.is_some() {
+        "vct"
+    } else {
+        "legacy"
+    };
+    println!("mode=writer-worker ({mode})");
+    println!("{}", stats.report(wall));
+    Ok(stats)
+}
diff --git a/zebra-replay-bench/src/cache.rs b/zebra-replay-bench/src/cache.rs
new file mode 100644
index 00000000000..23070135799
--- /dev/null
+++ b/zebra-replay-bench/src/cache.rs
@@ -0,0 +1,186 @@
+//! Flat on-disk cache of serialized blocks shared between the `index` and
+//! `apply` phases.
+//!
+//! Layout (little-endian):
+//! ```text
+//!   magic        [u8; 4]   = b"ZRB1"
+//!   network      u8        0 = Mainnet, 1 = Testnet
+//!   start_height u32       height of the first block
+//!   count        u32       number of blocks
+//!   tip_hash     [u8; 32]  hash of the last block (for post-apply verification)
+//!   records      count × (len: u32, bytes: [u8; len])   raw zcash-serialized blocks
+//! ```
+//! Records are stored sequentially in height order, so `apply` streams them with
+//! one buffered read pass and no random seeks.
+
+use std::{
+    fs::File,
+    io::{self, BufReader, BufWriter, Read, Write},
+    path::Path,
+};
+
+use zebra_chain::{block::Height, parameters::Network};
+
+const MAGIC: [u8; 4] = *b"ZRB1";
+
+fn network_byte(network: &Network) -> u8 {
+    match network {
+        Network::Mainnet => 0,
+        _ => 1,
+    }
+}
+
+/// Streaming writer for the block cache.
+pub struct CacheWriter {
+    file: BufWriter<File>,
+    count: u32,
+}
+
+impl CacheWriter {
+    /// Creates a new cache file and writes a provisional header. The header is
+    /// rewritten with the final count and tip hash by [`CacheWriter::finish`].
+    pub fn create(path: &Path, network: &Network, start_height: Height) -> io::Result<Self> {
+        let mut file = BufWriter::new(File::create(path)?);
+        file.write_all(&MAGIC)?;
+        file.write_all(&[network_byte(network)])?;
+        file.write_all(&start_height.0.to_le_bytes())?;
+        // Provisional count + tip hash, backfilled in `finish`.
+        file.write_all(&0u32.to_le_bytes())?;
+        file.write_all(&[0u8; 32])?;
+        Ok(Self { file, count: 0 })
+    }
+
+    /// Appends one raw-serialized block.
+    pub fn append(&mut self, bytes: &[u8]) -> io::Result<()> {
+        // A block over u32::MAX bytes is impossible on any real network, but
+        // surface it as an error rather than panicking from the write path.
+        let len = u32::try_from(bytes.len())
+            .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "block exceeds u32 length"))?;
+        self.file.write_all(&len.to_le_bytes())?;
+        self.file.write_all(bytes)?;
+        self.count += 1;
+        Ok(())
+    }
+
+    /// Backfills the header count and tip hash, then flushes.
+    pub fn finish(mut self, tip_hash: [u8; 32]) -> io::Result<u32> {
+        self.file.flush()?;
+        let mut file = self.file.into_inner()?;
+        use std::io::Seek;
+        // count sits after magic(4) + network(1) + start_height(4) = offset 9.
+        file.seek(io::SeekFrom::Start(9))?;
+        file.write_all(&self.count.to_le_bytes())?;
+        file.write_all(&tip_hash)?;
+        file.flush()?;
+        Ok(self.count)
+    }
+}
+
+/// Header metadata read back from a cache file.
+#[derive(Clone, Copy, Debug)]
+pub struct CacheHeader {
+    /// 0 = Mainnet, 1 = Testnet.
+    pub network: u8,
+    /// Height of the first block in the cache.
+    pub start_height: u32,
+    /// Number of blocks in the cache.
+    pub count: u32,
+    /// Hash of the last block, for post-apply verification.
+    pub tip_hash: [u8; 32],
+}
+
+/// Streaming reader that yields raw block bytes in height order.
+pub struct CacheReader {
+    file: BufReader<File>,
+    header: CacheHeader,
+    yielded: u32,
+}
+
+impl CacheReader {
+    /// Opens a cache file and parses its header.
+    pub fn open(path: &Path) -> io::Result<Self> {
+        let mut file = BufReader::new(File::open(path)?);
+
+        let mut magic = [0u8; 4];
+        file.read_exact(&mut magic)?;
+        if magic != MAGIC {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "not a zebra-replay-bench cache file (bad magic)",
+            ));
+        }
+        let mut one = [0u8; 1];
+        file.read_exact(&mut one)?;
+        let network = one[0];
+        let mut four = [0u8; 4];
+        file.read_exact(&mut four)?;
+        let start_height = u32::from_le_bytes(four);
+        file.read_exact(&mut four)?;
+        let count = u32::from_le_bytes(four);
+        let mut tip_hash = [0u8; 32];
+        file.read_exact(&mut tip_hash)?;
+
+        Ok(Self {
+            file,
+            header: CacheHeader {
+                network,
+                start_height,
+                count,
+                tip_hash,
+            },
+            yielded: 0,
+        })
+    }
+
+    /// The parsed header.
+    pub fn header(&self) -> CacheHeader {
+        self.header
+    }
+
+    /// Reads the next block's raw bytes, or `None` at end of cache.
+    pub fn next_block(&mut self) -> io::Result<Option<Vec<u8>>> {
+        if self.yielded >= self.header.count {
+            return Ok(None);
+        }
+        let mut four = [0u8; 4];
+        self.file.read_exact(&mut four)?;
+        let len = u32::from_le_bytes(four) as usize;
+        let mut buf = vec![0u8; len];
+        self.file.read_exact(&mut buf)?;
+        self.yielded += 1;
+        Ok(Some(buf))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cache_round_trips_blocks_and_header() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("test.zrb");
+        let blocks: Vec<Vec<u8>> = vec![vec![1, 2, 3], vec![], vec![9; 1000], vec![42, 42]];
+        let tip = [7u8; 32];
+
+        let mut w = CacheWriter::create(&path, &Network::Mainnet, Height(100)).expect("create");
+        for b in &blocks {
+            w.append(b).expect("append");
+        }
+        let count = w.finish(tip).expect("finish");
+        assert_eq!(count, blocks.len() as u32);
+
+        let mut r = CacheReader::open(&path).expect("open");
+        let h = r.header();
+        assert_eq!(h.network, 0);
+        assert_eq!(h.start_height, 100);
+        assert_eq!(h.count, blocks.len() as u32);
+        assert_eq!(h.tip_hash, tip);
+
+        let mut read_back = Vec::new();
+        while let Some(b) = r.next_block().expect("next") {
+            read_back.push(b);
+        }
+        assert_eq!(read_back, blocks);
+    }
+}
diff --git a/zebra-replay-bench/src/config.rs b/zebra-replay-bench/src/config.rs
new file mode 100644
index 00000000000..3becdb2c817
--- /dev/null
+++ b/zebra-replay-bench/src/config.rs
@@ -0,0 +1,26 @@
+//! State config construction shared by the subcommands.
+
+use std::path::PathBuf;
+
+use zebra_state::{Config, StorageMode};
+
+/// Builds a [`zebra_state::Config`] pointing at `cache_dir`.
+///
+/// `cache_dir` is the snapshot/fork root that contains `state/vN/<network>`. The
+/// benchmark only ever opens archive snapshots (full block bodies + per-height
+/// trees), so storage mode is fixed to [`StorageMode::Archive`].
+///
+/// `force_legacy` clears `vct_fast_sync`, which forces the committer onto the full
+/// per-block note-commitment recompute path — the write-assembler + disk-writer
+/// work this benchmark exists to measure. Left on (the default), Mainnet would
+/// select the VCT peer-source fast path and skip the recompute.
+pub fn state_config(cache_dir: PathBuf, force_legacy: bool) -> Config {
+    Config {
+        cache_dir,
+        ephemeral: false,
+        checkpoint_sync: true,
+        vct_fast_sync: !force_legacy,
+        storage_mode: StorageMode::Archive,
+        ..Config::default()
+    }
+}
diff --git a/zebra-replay-bench/src/index.rs b/zebra-replay-bench/src/index.rs
new file mode 100644
index 00000000000..4eb1da947a0
--- /dev/null
+++ b/zebra-replay-bench/src/index.rs
@@ -0,0 +1,161 @@
+//! Phase 1: read blocks from a snapshot state DB (read-only) into a flat cache.
+
+use std::path::Path;
+
+use color_eyre::eyre::{bail, eyre, Result};
+use zebra_chain::{
+    block::Height, parallel::commitment_aux::BlockCommitmentRoots, parameters::Network,
+    serialization::ZcashSerialize,
+};
+use zebra_state::{FinalizedState, HashOrHeight};
+
+use crate::{cache::CacheWriter, config::state_config, roots_cache::RootsSidecar};
+
+/// Reads blocks `start..=end` from the snapshot at `src` into `cache_path`.
+///
+/// The fork is opened writable only so RocksDB can create column families this
+/// binary adds that older snapshots lack; point it at a disposable fork, never the
+/// pristine snapshot. Each block's hash chain is validated as it is read, so the
+/// `apply` phase can trust the cache without re-checking continuity.
+pub fn run(src: &Path, cache_path: &Path, start: u32, end: u32, network: Network) -> Result<()> {
+    if end < start {
+        bail!("end height {end} is below start height {start}");
+    }
+
+    let config = state_config(src.to_path_buf(), true);
+    // Opened writable so RocksDB can create any column families this binary adds
+    // that the (older) snapshot lacks; point this at a disposable fork, never the
+    // pristine snapshot. No format upgrade runs when the fork already matches the
+    // code version.
+    tracing::info!(src = %src.display(), "opening source fork (writable, for CF creation)");
+    let state = FinalizedState::new_writable(&config, &network);
+
+    let tip = state
+        .db
+        .finalized_tip_height()
+        .ok_or_else(|| eyre!("source snapshot has no finalized tip"))?;
+    tracing::info!(source_tip = tip.0, "source snapshot opened");
+    if end > tip.0 {
+        bail!("requested end height {end} exceeds source tip {}", tip.0);
+    }
+
+    let mut writer = CacheWriter::create(cache_path, &network, Height(start))?;
+    let mut prev_hash: Option<zebra_chain::block::Hash> = None;
+    let mut last_hash = [0u8; 32];
+    let total = end - start + 1;
+
+    for height in start..=end {
+        let block = state
+            .db
+            .block(HashOrHeight::Height(Height(height)))
+            .ok_or_else(|| eyre!("source snapshot is missing a body at height {height}"))?;
+
+        if let Some(prev) = prev_hash {
+            if block.header.previous_block_hash != prev {
+                bail!("hash chain break at height {height}: block parent != previous block hash");
+            }
+        }
+        let hash = block.hash();
+        prev_hash = Some(hash);
+        last_hash = hash.0;
+
+        let bytes = block
+            .zcash_serialize_to_vec()
+            .map_err(|e| eyre!("serializing block {height}: {e}"))?;
+        writer.append(&bytes)?;
+
+        let done = height - start + 1;
+        if done.is_multiple_of(5000) || done == total {
+            tracing::info!(height, done, total, "indexing");
+        }
+    }
+
+    let count = writer.finish(last_hash)?;
+    tracing::info!(count, cache = %cache_path.display(), "index complete");
+    Ok(())
+}
+
+/// Reads the per-height anchor roots for `start..=end`, plus the successor block
+/// at `end+1`, from the snapshot at `src` into a VCT sidecar.
+///
+/// Roots are derived from the source's per-height trees: `*_tree_by_height` does a
+/// backward search, returning the tree as-of each height (carry-forward), so the
+/// roots are gap-free on an archive node — even for heights whose block changed
+/// neither tree. This is the same derivation `produce_block_roots` uses, and unlike
+/// the `commitment_roots_by_height` index it also works on a pre-index archive
+/// (format 27.2.0), whose index is empty. `apply --vct-sidecar` writes these roots
+/// into the base fork's header-roots column family so the fast path folds them in.
+pub fn run_roots(
+    src: &Path,
+    sidecar_path: &Path,
+    start: u32,
+    end: u32,
+    network: Network,
+) -> Result<()> {
+    if end < start {
+        bail!("end height {end} is below start height {start}");
+    }
+
+    let config = state_config(src.to_path_buf(), true);
+    tracing::info!(src = %src.display(), "opening source fork (writable, for CF creation)");
+    let state = FinalizedState::new_writable(&config, &network);
+
+    let tip = state
+        .db
+        .finalized_tip_height()
+        .ok_or_else(|| eyre!("source snapshot has no finalized tip"))?;
+    // The fast path needs the successor of the last committed block (end+1) to
+    // confirm end's roots, so the window must leave one block of headroom.
+    if end + 1 > tip.0 {
+        bail!(
+            "VCT needs a successor at height {}, but source tip is {}",
+            end + 1,
+            tip.0
+        );
+    }
+
+    let total = end - start + 1;
+    let mut roots = Vec::with_capacity(total as usize);
+    for h in start..=end {
+        let height = Height(h);
+        let sapling = state
+            .db
+            .sapling_tree_by_height(&height)
+            .ok_or_else(|| eyre!("source missing sapling tree at height {h}"))?;
+        let orchard = state
+            .db
+            .orchard_tree_by_height(&height)
+            .ok_or_else(|| eyre!("source missing orchard tree at height {h}"))?;
+        roots.push(BlockCommitmentRoots {
+            height,
+            sapling_root: sapling.root(),
+            orchard_root: orchard.root(),
+            ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+            sapling_tx: 0,
+            orchard_tx: 0,
+            ironwood_tx: 0,
+            auth_data_root: state
+                .db
+                .block(height.into())
+                .map(|block| block.auth_data_root())
+                .unwrap_or_else(|| zebra_chain::block::merkle::AuthDataRoot::from([0u8; 32])),
+        });
+        let done = h - start + 1;
+        if done.is_multiple_of(5000) || done == total {
+            tracing::info!(height = h, done, total, "deriving roots");
+        }
+    }
+
+    let successor = state
+        .db
+        .block(HashOrHeight::Height(Height(end + 1)))
+        .ok_or_else(|| eyre!("source missing successor block at height {}", end + 1))?;
+
+    RootsSidecar::write(sidecar_path, start, &roots, &successor)?;
+    tracing::info!(
+        count = roots.len(),
+        sidecar = %sidecar_path.display(),
+        "roots sidecar complete"
+    );
+    Ok(())
+}
diff --git a/zebra-replay-bench/src/main.rs b/zebra-replay-bench/src/main.rs
new file mode 100644
index 00000000000..7e63d77ff00
--- /dev/null
+++ b/zebra-replay-bench/src/main.rs
@@ -0,0 +1,296 @@
+//! `zebra-replay-bench` — replay mainnet blocks through the Zebra state committer
+//! in isolation from the network, to benchmark the commit pipeline.
+//!
+//! Two phases share a flat block cache:
+//!   * `index` reads a height window from a snapshot DB (read-only) into the cache;
+//!   * `apply` replays the cache onto a writable fork at `start-1`, timing each
+//!     `commit_finalized_direct` call and verifying the final tip hash.
+//!
+//! See `README.md` for the end-to-end harness usage.
+
+// This is an operator-facing benchmark CLI: its results go to stdout/stderr.
+#![allow(clippy::print_stdout)]
+#![allow(clippy::print_stderr)]
+
+mod apply;
+mod apply_sequencer;
+mod apply_verifier;
+mod apply_worker;
+mod cache;
+mod config;
+mod index;
+mod prefetch;
+mod rollback;
+mod roots_cache;
+mod stats;
+
+use std::path::PathBuf;
+
+use clap::{Parser, Subcommand};
+use color_eyre::eyre::{eyre, Result};
+use zebra_chain::parameters::Network;
+use zebra_state::{FinalizedState, HashOrHeight};
+
+use config::state_config;
+
+#[derive(Parser)]
+#[command(
+    name = "zebra-replay-bench",
+    about = "Replay mainnet blocks through the state committer, isolated from the network"
+)]
+struct Cli {
+    #[command(subcommand)]
+    cmd: Cmd,
+}
+
+#[derive(Subcommand)]
+enum Cmd {
+    /// Print a snapshot's finalized tip height and hash (read-only).
+    Info {
+        /// Snapshot root containing `state/vN/<network>`.
+        #[arg(long)]
+        src: PathBuf,
+    },
+    /// Read blocks `start..=end` from a snapshot into a flat cache file.
+    Index {
+        /// Snapshot root to read from (opened read-only).
+        #[arg(long)]
+        src: PathBuf,
+        /// Output cache file path.
+        #[arg(long)]
+        cache: PathBuf,
+        /// First height to index (inclusive).
+        #[arg(long)]
+        start: u32,
+        /// Last height to index (inclusive).
+        #[arg(long)]
+        end: u32,
+    },
+    /// Read per-height anchor roots (+ the successor of `end`) into a VCT sidecar.
+    IndexRoots {
+        /// Snapshot root to read from (opened on a writable fork).
+        #[arg(long)]
+        src: PathBuf,
+        /// Output sidecar file path.
+        #[arg(long)]
+        sidecar: PathBuf,
+        /// First height (inclusive); must match the block cache's start.
+        #[arg(long)]
+        start: u32,
+        /// Last height (inclusive); must match the block cache's end.
+        #[arg(long)]
+        end: u32,
+    },
+    /// Roll a base fork's finalized tip back to `target` (to manufacture a base
+    /// at `start-1` from a higher snapshot).
+    Rollback {
+        /// Base fork root (opened writable, mutated in place).
+        #[arg(long)]
+        base: PathBuf,
+        /// Height to roll the finalized tip back to.
+        #[arg(long)]
+        target: u32,
+    },
+    /// Replay a cache onto a writable base fork (tip must be `start-1`).
+    Apply {
+        /// Base fork root (opened writable; must be at height start-1).
+        #[arg(long)]
+        base: PathBuf,
+        /// Cache file produced by `index`.
+        #[arg(long)]
+        cache: PathBuf,
+        /// VCT roots sidecar produced by `index-roots`. When set, the committer
+        /// runs the VCT fast path (folds supplied roots, skips the recompute);
+        /// otherwise the legacy full-recompute path runs.
+        #[arg(long)]
+        vct_sidecar: Option<PathBuf>,
+    },
+    /// Replay a cache through the real `zebra-state` write worker (tip must be
+    /// `start-1`), one altitude above `apply` (which calls the committer directly).
+    ApplyWorker {
+        /// Base fork root (opened writable; must be at height start-1).
+        #[arg(long)]
+        base: PathBuf,
+        /// Cache file produced by `index`.
+        #[arg(long)]
+        cache: PathBuf,
+        /// VCT roots sidecar produced by `index-roots`. When set, the worker
+        /// drives the VCT fast path; otherwise the legacy full-recompute path runs.
+        #[arg(long)]
+        vct_sidecar: Option<PathBuf>,
+    },
+    /// Replay a cache through the real Zakura block-sync `Sequencer` (which reorders
+    /// bodies and submits them to the checkpoint verifier → state). VCT-only; one
+    /// altitude above `apply-verifier`. Requires `--vct-sidecar`.
+    ApplySequencer {
+        /// Base fork root (opened writable; must be at height start-1).
+        #[arg(long)]
+        base: PathBuf,
+        /// Cache file produced by `index`.
+        #[arg(long)]
+        cache: PathBuf,
+        /// VCT roots sidecar produced by `index-roots` (required).
+        #[arg(long)]
+        vct_sidecar: Option<PathBuf>,
+        /// Commit in Archive storage mode (full raw-tx + indexes). The default is
+        /// Pruned (the base must already be a pruned snapshot; pruning is one-way).
+        #[arg(long)]
+        archive: bool,
+        /// Write structured Zakura JSONL trace tables to this directory (the same
+        /// tables `perf-run-mainnet` produces via `[network.zakura] trace_dir`).
+        #[arg(long)]
+        trace_dir: Option<PathBuf>,
+    },
+    /// Replay a cache through the real `zebra-consensus` checkpoint verifier, which
+    /// commits to a real `StateService` (tip must be `start-1`). One altitude above
+    /// `apply-worker`; adds PoW/equihash + Merkle verification and checkpoint
+    /// batching. Commits up to the last checkpoint `<= end`.
+    ApplyVerifier {
+        /// Base fork root (opened writable; must be at height start-1).
+        #[arg(long)]
+        base: PathBuf,
+        /// Cache file produced by `index`.
+        #[arg(long)]
+        cache: PathBuf,
+        /// VCT roots sidecar produced by `index-roots`. When set, the committer
+        /// drives the VCT fast path; otherwise the legacy full-recompute path runs.
+        #[arg(long)]
+        vct_sidecar: Option<PathBuf>,
+    },
+}
+
+fn main() -> Result<()> {
+    color_eyre::install()?;
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let cli = Cli::parse();
+    // The snapshots under test are Mainnet; widen this when a need arises.
+    let network = Network::Mainnet;
+
+    match cli.cmd {
+        Cmd::Info { src } => {
+            let config = state_config(src.clone(), true);
+            let state = FinalizedState::new_read_only(&config, &network);
+            let tip = state
+                .db
+                .tip()
+                .ok_or_else(|| eyre!("snapshot has no finalized tip"))?;
+            let has_body = state.db.block(HashOrHeight::Height(tip.0)).is_some();
+            println!(
+                "src={}\ntip_height={}\ntip_hash={}\ntip_body_present={}",
+                src.display(),
+                tip.0 .0,
+                tip.1,
+                has_body
+            );
+        }
+        Cmd::Index {
+            src,
+            cache,
+            start,
+            end,
+        } => {
+            index::run(&src, &cache, start, end, network)?;
+        }
+        Cmd::IndexRoots {
+            src,
+            sidecar,
+            start,
+            end,
+        } => {
+            index::run_roots(&src, &sidecar, start, end, network)?;
+        }
+        Cmd::Rollback { base, target } => {
+            rollback::run(&base, target, network)?;
+        }
+        Cmd::Apply {
+            base,
+            cache,
+            vct_sidecar,
+        } => {
+            #[cfg(feature = "commit-metrics")]
+            let handle = install_metrics();
+
+            apply::run(&base, &cache, vct_sidecar.as_deref(), network)?;
+
+            #[cfg(feature = "commit-metrics")]
+            render_metrics(handle);
+        }
+        Cmd::ApplyWorker {
+            base,
+            cache,
+            vct_sidecar,
+        } => {
+            #[cfg(feature = "commit-metrics")]
+            let handle = install_metrics();
+
+            apply_worker::run(&base, &cache, vct_sidecar.as_deref(), network)?;
+
+            #[cfg(feature = "commit-metrics")]
+            render_metrics(handle);
+        }
+        Cmd::ApplyVerifier {
+            base,
+            cache,
+            vct_sidecar,
+        } => {
+            #[cfg(feature = "commit-metrics")]
+            let handle = install_metrics();
+
+            apply_verifier::run(&base, &cache, vct_sidecar.as_deref(), network)?;
+
+            #[cfg(feature = "commit-metrics")]
+            render_metrics(handle);
+        }
+        Cmd::ApplySequencer {
+            base,
+            cache,
+            vct_sidecar,
+            archive,
+            trace_dir,
+        } => {
+            #[cfg(feature = "commit-metrics")]
+            let handle = install_metrics();
+
+            apply_sequencer::run(
+                &base,
+                &cache,
+                vct_sidecar.as_deref(),
+                network,
+                archive,
+                trace_dir.as_deref(),
+            )?;
+
+            #[cfg(feature = "commit-metrics")]
+            render_metrics(handle);
+        }
+    }
+
+    Ok(())
+}
+
+#[cfg(feature = "commit-metrics")]
+fn install_metrics() -> metrics_exporter_prometheus::PrometheusHandle {
+    metrics_exporter_prometheus::PrometheusBuilder::new()
+        .install_recorder()
+        .expect("installing the prometheus recorder")
+}
+
+#[cfg(feature = "commit-metrics")]
+fn render_metrics(handle: metrics_exporter_prometheus::PrometheusHandle) {
+    let rendered = handle.render();
+    println!("--- commit-metrics (zebra_state.* / state_vct.*) ---");
+    for line in rendered.lines() {
+        if line.starts_with('#') {
+            continue;
+        }
+        if line.starts_with("zebra_state_") || line.starts_with("state_vct_") {
+            println!("{line}");
+        }
+    }
+}
diff --git a/zebra-replay-bench/src/prefetch.rs b/zebra-replay-bench/src/prefetch.rs
new file mode 100644
index 00000000000..9f0504d582d
--- /dev/null
+++ b/zebra-replay-bench/src/prefetch.rs
@@ -0,0 +1,106 @@
+//! Bounded look-ahead block prefetch.
+//!
+//! A producer thread streams the block cache, deserializes each block, and builds
+//! its [`CheckpointVerifiedBlock`] (which runs the verifier-side `prepare_block_data`:
+//! per-tx txid + ZIP-244 auth digest, the auth-data root, and the new-outputs map),
+//! pushing the results into a bounded channel.
+//!
+//! This keeps block read + parse + prep **off** the timed commit thread — so both
+//! `apply` and `apply_worker` measure the committer only — while bounding memory to
+//! the channel capacity. The producer blocks when the channel is full, so the bench
+//! scales to arbitrarily large windows without holding the whole window in RAM. It
+//! mirrors production, where the verifier prepares blocks upstream of the committer.
+
+use std::{
+    sync::{
+        mpsc::{sync_channel, Receiver},
+        Arc,
+    },
+    thread::{self, JoinHandle},
+};
+
+use color_eyre::eyre::{eyre, Result};
+use zebra_chain::{
+    block::{merkle::AuthDataRoot, Block},
+    serialization::ZcashDeserialize,
+};
+use zebra_state::CheckpointVerifiedBlock;
+
+use crate::cache::CacheReader;
+
+/// Default number of prepared blocks the producer may run ahead of the committer.
+/// Big enough to keep the commit thread fed across jitter, small enough that
+/// memory stays flat regardless of window size.
+pub const DEFAULT_PREFETCH_CAPACITY: usize = 64;
+
+/// Prefetch depth, overridable with `ZRB_PREFETCH_CAP` for tuning the
+/// memory-vs-contention tradeoff: a deeper buffer lets the producer race ahead and
+/// front-load its (multi-core) prep, leaving the committer more cores later, at the
+/// cost of holding more prepared blocks in memory.
+pub fn capacity() -> usize {
+    std::env::var("ZRB_PREFETCH_CAP")
+        .ok()
+        .and_then(|v| v.parse::<usize>().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(DEFAULT_PREFETCH_CAPACITY)
+}
+
+/// One prepared block ready to commit: the verified block plus the per-block prep
+/// the committer's `next_checkpoint` needs (the block handle and its auth-data
+/// root), with its height and serialized byte length.
+pub struct Prepared {
+    pub cv: CheckpointVerifiedBlock,
+    pub block: Arc<Block>,
+    pub auth: AuthDataRoot,
+    pub len: usize,
+    pub height: u32,
+}
+
+/// Spawns the prefetch producer over `reader`, returning its join handle and a
+/// bounded receiver of prepared blocks in height order. The producer blocks once
+/// `capacity` items are buffered, so memory stays bounded. Errors are delivered
+/// in-band as `Err` items; the producer stops after the first error or when the
+/// consumer drops the receiver.
+pub fn spawn(reader: CacheReader, capacity: usize) -> (JoinHandle<()>, Receiver<Result<Prepared>>) {
+    let (tx, rx) = sync_channel(capacity);
+    let mut reader = reader;
+    let mut height = reader.header().start_height;
+
+    let handle = thread::spawn(move || loop {
+        let bytes = match reader.next_block() {
+            Ok(Some(bytes)) => bytes,
+            Ok(None) => return,
+            Err(e) => {
+                let _ = tx.send(Err(eyre!("reading block {height}: {e}")));
+                return;
+            }
+        };
+        let len = bytes.len();
+        let block = match Block::zcash_deserialize(&bytes[..]) {
+            Ok(block) => Arc::new(block),
+            Err(e) => {
+                let _ = tx.send(Err(eyre!("deserializing block {height}: {e}")));
+                return;
+            }
+        };
+        let auth = block.auth_data_root();
+        let cv = CheckpointVerifiedBlock::from(block.clone());
+
+        if tx
+            .send(Ok(Prepared {
+                cv,
+                block,
+                auth,
+                len,
+                height,
+            }))
+            .is_err()
+        {
+            // Consumer dropped the receiver: stop producing.
+            return;
+        }
+        height += 1;
+    });
+
+    (handle, rx)
+}
diff --git a/zebra-replay-bench/src/rollback.rs b/zebra-replay-bench/src/rollback.rs
new file mode 100644
index 00000000000..ba01ba3a22c
--- /dev/null
+++ b/zebra-replay-bench/src/rollback.rs
@@ -0,0 +1,37 @@
+//! Prepare a base fork by rolling its finalized tip back to `target`.
+//!
+//! Used to manufacture a base at `start-1` from a higher snapshot when no
+//! lower snapshot is available, so the `apply` window can be replayed on top.
+
+use std::path::Path;
+
+use color_eyre::eyre::{eyre, Result};
+use zebra_chain::{block::Height, parameters::Network};
+use zebra_state::{rollback_finalized_state, RollbackFinalizedStateOptions};
+
+use crate::config::state_config;
+
+/// Rolls the finalized state at `base` back to `target` height.
+pub fn run(base: &Path, target: u32, network: Network) -> Result<()> {
+    let config = state_config(base.to_path_buf(), true);
+    tracing::info!(base = %base.display(), target, "rolling back base fork");
+
+    let summary = rollback_finalized_state(
+        config,
+        &network,
+        RollbackFinalizedStateOptions {
+            target_height: Height(target),
+            keep_rolled_back_blocks: false,
+            max_checkpoint_height: None,
+        },
+    )
+    .map_err(|e| eyre!("rollback failed: {e}"))?;
+
+    tracing::info!(
+        old_tip = summary.old_tip.0 .0,
+        new_tip = summary.new_tip.0 .0,
+        removed = summary.rolled_back_count,
+        "rollback complete"
+    );
+    Ok(())
+}
diff --git a/zebra-replay-bench/src/roots_cache.rs b/zebra-replay-bench/src/roots_cache.rs
new file mode 100644
index 00000000000..a9fc27513d1
--- /dev/null
+++ b/zebra-replay-bench/src/roots_cache.rs
@@ -0,0 +1,110 @@
+//! Sidecar holding the per-height anchor roots (and the final successor block)
+//! needed to drive the VCT fast path offline.
+//!
+//! The committer's `PeerSource` reads per-height roots from the base DB's
+//! `zakura_header_commitment_roots_by_height` column family (where header sync
+//! normally writes them). This sidecar carries those roots — derived from the
+//! source snapshot's committed root index — plus the block one past the window's
+//! end, which the fast path needs as the "verified successor" of the last block.
+//!
+//! Layout (little-endian):
+//! ```text
+//!   magic     [u8; 4]  = b"ZRBV"
+//!   start     u32      height of the first root
+//!   count     u32      number of roots
+//!   roots     count × BlockCommitmentRoots (zcash-serialized, 68 bytes each)
+//!   succ_len  u32      byte length of the successor block
+//!   succ      [u8]     zcash-serialized block at height start+count (end+1)
+//! ```
+
+use std::{
+    fs::File,
+    io::{self, BufReader, BufWriter, Read, Write},
+    path::Path,
+};
+
+use zebra_chain::{
+    block::Block,
+    parallel::commitment_aux::BlockCommitmentRoots,
+    serialization::{ZcashDeserialize, ZcashSerialize},
+};
+
+const MAGIC: [u8; 4] = *b"ZRBV";
+
+/// The anchor roots for a window plus the successor block of its last height.
+pub struct RootsSidecar {
+    /// Height of the first root.
+    pub start: u32,
+    /// Per-height roots for `start..start+roots.len()`.
+    pub roots: Vec<BlockCommitmentRoots>,
+    /// The block at `start+roots.len()` (window end + 1), the verified successor
+    /// the fast path checks the last committed block against.
+    pub successor: Block,
+}
+
+impl RootsSidecar {
+    /// Writes the sidecar to `path`.
+    pub fn write(
+        path: &Path,
+        start: u32,
+        roots: &[BlockCommitmentRoots],
+        successor: &Block,
+    ) -> io::Result<()> {
+        let mut f = BufWriter::new(File::create(path)?);
+        f.write_all(&MAGIC)?;
+        f.write_all(&start.to_le_bytes())?;
+        let count = u32::try_from(roots.len())
+            .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "too many roots"))?;
+        f.write_all(&count.to_le_bytes())?;
+        for r in roots {
+            r.zcash_serialize(&mut f)?;
+        }
+        let succ = successor
+            .zcash_serialize_to_vec()
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+        let succ_len = u32::try_from(succ.len())
+            .map_err(|_| io::Error::new(io::ErrorKind::InvalidInput, "successor too large"))?;
+        f.write_all(&succ_len.to_le_bytes())?;
+        f.write_all(&succ)?;
+        f.flush()?;
+        Ok(())
+    }
+
+    /// Reads the sidecar from `path`.
+    pub fn read(path: &Path) -> io::Result<Self> {
+        let mut f = BufReader::new(File::open(path)?);
+        let mut magic = [0u8; 4];
+        f.read_exact(&mut magic)?;
+        if magic != MAGIC {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                "not a zebra-replay-bench roots sidecar (bad magic)",
+            ));
+        }
+        let mut four = [0u8; 4];
+        f.read_exact(&mut four)?;
+        let start = u32::from_le_bytes(four);
+        f.read_exact(&mut four)?;
+        let count = u32::from_le_bytes(four);
+
+        let mut roots = Vec::with_capacity(count as usize);
+        for _ in 0..count {
+            let r = BlockCommitmentRoots::zcash_deserialize(&mut f)
+                .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+            roots.push(r);
+        }
+
+        f.read_exact(&mut four)?;
+        let succ_len = u32::from_le_bytes(four) as usize;
+        let mut succ = vec![0u8; succ_len];
+        f.read_exact(&mut succ)?;
+        let successor = Block::zcash_deserialize(&succ[..])
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
+
+        Ok(Self {
+            start,
+            roots,
+            successor,
+        })
+    }
+}
diff --git a/zebra-replay-bench/src/stats.rs b/zebra-replay-bench/src/stats.rs
new file mode 100644
index 00000000000..993335f2226
--- /dev/null
+++ b/zebra-replay-bench/src/stats.rs
@@ -0,0 +1,56 @@
+//! Throughput and latency rollup for an `apply` run.
+
+use std::time::Duration;
+
+/// Accumulates per-block commit latencies and byte counts.
+#[derive(Default)]
+pub struct Stats {
+    /// Per-block commit latency in microseconds.
+    latencies_us: Vec<u64>,
+    total_bytes: u64,
+}
+
+impl Stats {
+    /// Records one committed block.
+    pub fn record(&mut self, bytes: usize, latency: Duration) {
+        self.latencies_us
+            .push(u64::try_from(latency.as_micros()).unwrap_or(u64::MAX));
+        self.total_bytes += bytes as u64;
+    }
+
+    /// Number of blocks recorded.
+    pub fn count(&self) -> usize {
+        self.latencies_us.len()
+    }
+
+    fn percentile_us(&mut self, p: f64) -> u64 {
+        if self.latencies_us.is_empty() {
+            return 0;
+        }
+        self.latencies_us.sort_unstable();
+        // Nearest-rank percentile; clamp the index into bounds.
+        let rank = ((p / 100.0) * self.latencies_us.len() as f64).ceil() as usize;
+        let idx = rank.saturating_sub(1).min(self.latencies_us.len() - 1);
+        self.latencies_us[idx]
+    }
+
+    /// Renders a human-readable multi-line report.
+    pub fn report(&mut self, wall: Duration) -> String {
+        let n = self.count();
+        let secs = wall.as_secs_f64().max(f64::MIN_POSITIVE);
+        let blk_s = n as f64 / secs;
+        let mib = self.total_bytes as f64 / (1024.0 * 1024.0);
+        let mib_s = mib / secs;
+
+        let p50 = self.percentile_us(50.0) as f64 / 1000.0;
+        let p90 = self.percentile_us(90.0) as f64 / 1000.0;
+        let p99 = self.percentile_us(99.0) as f64 / 1000.0;
+        let max = self.latencies_us.last().copied().unwrap_or(0) as f64 / 1000.0;
+
+        format!(
+            "blocks={n}  bytes={mib:.1} MiB  wall={secs:.2}s\n\
+             throughput: {blk_s:.1} blk/s  {mib_s:.2} MiB/s\n\
+             commit latency (ms): p50={p50:.2}  p90={p90:.2}  p99={p99:.2}  max={max:.2}"
+        )
+    }
+}
diff --git a/zebra-state/CHANGELOG.md b/zebra-state/CHANGELOG.md
index 318f6b23203..ee7c265832f 100644
--- a/zebra-state/CHANGELOG.md
+++ b/zebra-state/CHANGELOG.md
@@ -12,13 +12,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bumped the state database format to 28 during upgrade, backfilling empty
   Ironwood tree, value pool, and index data, then rebuilding stored history tree
   entries so they use the Ironwood-capable entry size.
-- Extended value-pool disk serialization with an Ironwood slot after the
-  deferred pool, and bumped the state database format version to `27.3.0`.
-- `tree_aux` root serving now stitches the per-height trees below the
-  verified-commitment-trees upgrade height `U` with the
-  `commitment_roots_by_height` serving index at and above `U`, so a node that
-  upgraded mid-chain serves a range crossing `U` as one gap-free batch instead
-  of a short prefix that stalled the fetch client.
+- Extended value-pool disk serialization with an Ironwood slot after the deferred pool, with the
+  verified-commitment-trees state database format changes preserved as the intermediate
+  no-migration version `27.3.0`.
+- Extended the `commitment_roots_by_height` serving index (and the `tree_aux` header-sync
+  payload it is served from) with each block's per-height ZIP-244 `auth_data_root`, so a node
+  can serve the co-input a peer needs to authenticate a block's note-commitment roots against
+  its successor's NU5+ header commitment. Consolidated under database format version `27.3.0`
+  (no version bump); serving-index rows from an earlier pre-release build (64 bytes, no
+  auth-data root) remain readable. Carrying the auth-data root bumps the Zakura header-sync
+  stream format to version 5, a breaking wire change (all peers must run the new format).
+- Extended the same serving index and `tree_aux` payload with each block's Ironwood
+  note-commitment root and its three per-pool shielded transaction counts
+  (Sapling/Orchard/Ironwood). Together with the roots and auth-data root, these are the complete
+  set of ZIP-221 history-leaf inputs a recipient needs to rebuild each leaf and verify the
+  supplied roots against its own header commitments during header sync, without downloading the
+  block body. Rows grow to 152 bytes with a backward-compatible `FromDisk`; still consolidated
+  under `27.3.0`. Carried in the (already breaking, still version 5) Zakura header-sync stream
+  format, with `auth_data_root` serialized last. This is the data-carrying half only — nothing
+  consumes the new fields yet.
+- Added the `vct_upgrade_metadata` column family, recording the upgrade height `U` (the lowest
+  height this binary committed). `tree_aux` root serving now stitches the per-height trees below
+  `U` with the serving index at and above `U`, so a node that upgraded mid-chain serves a range
+  crossing `U` as one gap-free batch instead of a short prefix that stalled the fetch client.
+  Historical note-commitment tree RPCs are unavailable only within the band `[U, H)` (where `H`
+  is the checkpoint handoff), and available below `U` and at or above `H`.
 - Added `produce_final_frontiers_bytes` for deriving serialized checkpoint
   final-frontier fixtures from a finalized database.
 
diff --git a/zebra-state/src/error.rs b/zebra-state/src/error.rs
index 6487c61907d..54adce5f644 100644
--- a/zebra-state/src/error.rs
+++ b/zebra-state/src/error.rs
@@ -86,6 +86,26 @@ impl CommitBlockError {
         }
     }
 
+    /// Returns the missing VCT supplied-root height for retryable root-fetch stalls.
+    pub fn vct_supplied_root_unavailable_height(&self) -> Option<block::Height> {
+        match self {
+            CommitBlockError::ValidateContextError(error) => {
+                error.vct_supplied_root_unavailable_height()
+            }
+            _ => None,
+        }
+    }
+
+    /// Returns the height for any retryable VCT root stall (absent/evicted root, or one
+    /// not yet verifiable for lack of a buffered successor). See
+    /// [`ValidateContextError::vct_retryable_height`].
+    pub fn vct_retryable_height(&self) -> Option<block::Height> {
+        match self {
+            CommitBlockError::ValidateContextError(error) => error.vct_retryable_height(),
+            _ => None,
+        }
+    }
+
     /// Returns a suggested misbehaviour score increment for a certain error.
     pub fn misbehavior_score(&self) -> u32 {
         0
@@ -149,6 +169,18 @@ impl CommitCheckpointVerifiedError {
     pub fn duplicate_location(&self) -> Option<&KnownBlock> {
         self.0.duplicate_location()
     }
+
+    /// Returns the missing VCT supplied-root height for retryable root-fetch stalls.
+    pub fn vct_supplied_root_unavailable_height(&self) -> Option<block::Height> {
+        self.0.vct_supplied_root_unavailable_height()
+    }
+
+    /// Returns the height for any retryable VCT root stall (absent/evicted root, or one
+    /// not yet verifiable for lack of a buffered successor). See
+    /// [`ValidateContextError::vct_retryable_height`].
+    pub fn vct_retryable_height(&self) -> Option<block::Height> {
+        self.0.vct_retryable_height()
+    }
 }
 
 impl From<ValidateContextError> for CommitCheckpointVerifiedError {
@@ -367,6 +399,23 @@ pub enum ValidateContextError {
     #[non_exhaustive]
     NotReadyToBeCommitted,
 
+    #[error(
+        "verified-commitment-trees fast path has no valid supplied root for height \
+         {height:?}: the note-commitment frontier is frozen, so this block cannot be \
+         committed until a verifiable root is fetched from a peer (retryable)"
+    )]
+    #[non_exhaustive]
+    VctSuppliedRootUnavailable { height: block::Height },
+
+    #[error(
+        "verified-commitment-trees fast path cannot yet verify the supplied root for height \
+         {height:?}: no successor block is buffered to confirm it against the header chain, and \
+         committing it unverified would persist a root that is only checked one block later \
+         (irreversibly, once on disk). Commit is deferred until the successor arrives (retryable)"
+    )]
+    #[non_exhaustive]
+    VctSuppliedRootAwaitingSuccessor { height: block::Height },
+
     #[error("block height {candidate_height:?} is lower than the current finalized height {finalized_tip_height:?}")]
     #[non_exhaustive]
     OrphanedBlock {
@@ -597,6 +646,33 @@ pub enum ValidateContextError {
     },
 }
 
+impl ValidateContextError {
+    /// Returns the missing VCT supplied-root height for retryable root-fetch stalls.
+    ///
+    /// This is the subset of [`Self::vct_retryable_height`] that warrants a peer *refetch*:
+    /// the supplied root is absent or was evicted after failing verification, so a different
+    /// peer must supply a replacement. An await-successor stall ([`Self::vct_retryable_height`]
+    /// but not this) already has its root and only waits for the next block to be downloaded.
+    pub fn vct_supplied_root_unavailable_height(&self) -> Option<block::Height> {
+        match self {
+            ValidateContextError::VctSuppliedRootUnavailable { height } => Some(*height),
+            _ => None,
+        }
+    }
+
+    /// Returns the height for any retryable VCT root stall: either an absent/evicted supplied
+    /// root ([`Self::VctSuppliedRootUnavailable`]) or one not yet verifiable because no successor
+    /// is buffered to confirm it ([`Self::VctSuppliedRootAwaitingSuccessor`]). The write loop
+    /// parks and retries the same block for both; only the former additionally requests a refetch.
+    pub fn vct_retryable_height(&self) -> Option<block::Height> {
+        match self {
+            ValidateContextError::VctSuppliedRootUnavailable { height }
+            | ValidateContextError::VctSuppliedRootAwaitingSuccessor { height } => Some(*height),
+            _ => None,
+        }
+    }
+}
+
 impl From<sprout::tree::NoteCommitmentTreeError> for ValidateContextError {
     fn from(value: sprout::tree::NoteCommitmentTreeError) -> Self {
         ValidateContextError::NoteCommitmentTreeError(value.into())
@@ -657,4 +733,65 @@ mod tests {
         };
         assert_eq!(dup_err.misbehavior_score(), 0);
     }
+
+    #[test]
+    fn checkpoint_error_exposes_retryable_vct_root_height() {
+        let height = Height(42);
+        let retryable: CommitCheckpointVerifiedError =
+            ValidateContextError::VctSuppliedRootUnavailable { height }.into();
+        assert_eq!(
+            retryable.vct_supplied_root_unavailable_height(),
+            Some(height),
+            "checkpoint commit errors expose retryable VCT root misses"
+        );
+
+        let non_retryable: CommitCheckpointVerifiedError =
+            ValidateContextError::NonSequentialBlock {
+                candidate_height: Height(5),
+                parent_height: Height(3),
+            }
+            .into();
+        assert_eq!(
+            non_retryable.vct_supplied_root_unavailable_height(),
+            None,
+            "unrelated validation errors are not treated as VCT root misses"
+        );
+        assert_eq!(
+            non_retryable.vct_retryable_height(),
+            None,
+            "unrelated validation errors are not retryable VCT stalls"
+        );
+    }
+
+    /// An await-successor stall is retryable (the write loop parks and re-commits) but is
+    /// *not* a refetch case: the root is present, only its successor is missing. So it must
+    /// surface through `vct_retryable_height` while `vct_supplied_root_unavailable_height`
+    /// (which gates the peer refetch) stays `None` — otherwise the committer would spam
+    /// pointless refetches for a root it already holds.
+    #[test]
+    fn await_successor_is_retryable_but_not_a_refetch() {
+        let height = Height(7);
+        let awaiting: CommitCheckpointVerifiedError =
+            ValidateContextError::VctSuppliedRootAwaitingSuccessor { height }.into();
+
+        assert_eq!(
+            awaiting.vct_retryable_height(),
+            Some(height),
+            "an await-successor stall is retryable",
+        );
+        assert_eq!(
+            awaiting.vct_supplied_root_unavailable_height(),
+            None,
+            "an await-successor stall must not trigger a peer refetch (the root is present)",
+        );
+
+        // The unavailable case is both retryable and a refetch trigger.
+        let unavailable: CommitCheckpointVerifiedError =
+            ValidateContextError::VctSuppliedRootUnavailable { height }.into();
+        assert_eq!(unavailable.vct_retryable_height(), Some(height));
+        assert_eq!(
+            unavailable.vct_supplied_root_unavailable_height(),
+            Some(height)
+        );
+    }
 }
diff --git a/zebra-state/src/lib.rs b/zebra-state/src/lib.rs
index 4d8b9061ee8..6c555a22b98 100644
--- a/zebra-state/src/lib.rs
+++ b/zebra-state/src/lib.rs
@@ -63,8 +63,10 @@ pub use service::{
     finalized_state::FinalizedState,
     init, init_read_only,
     non_finalized_state::NonFinalizedState,
+    queued_blocks::QueuedCheckpointVerified,
     spawn_init_read_only,
     watch_receiver::WatchReceiver,
+    write::BlockWriteSender,
     OutputLocation, ReadState, State, TransactionIndex, TransactionLocation,
 };
 
@@ -80,7 +82,10 @@ pub use service::finalized_state::{
     preview_rollback_finalized_state, rollback_finalized_state, RollbackBackupSummary,
     RollbackFinalizedStateError, RollbackFinalizedStateOptions, RollbackFinalizedStateSummary,
 };
-pub use service::finalized_state::{produce_final_frontiers_bytes, FinalFrontiersGenerationError};
+pub use service::finalized_state::{
+    produce_final_frontiers_bytes, validate_final_frontiers_bytes, FinalFrontiersGenerationError,
+    FinalFrontiersValidationError,
+};
 pub use service::{
     finalized_state::{DiskWriteBatch, FromDisk, IntoDisk, WriteDisk, ZebraDb},
     ReadStateService,
diff --git a/zebra-state/src/request.rs b/zebra-state/src/request.rs
index 709aac8b2af..852410343d0 100644
--- a/zebra-state/src/request.rs
+++ b/zebra-state/src/request.rs
@@ -2,7 +2,7 @@
 
 use std::{
     collections::{HashMap, HashSet},
-    ops::{Add, Deref, DerefMut, RangeInclusive},
+    ops::{Add, Deref, RangeInclusive},
     pin::Pin,
     sync::Arc,
 };
@@ -40,6 +40,27 @@ use crate::{
     CommitSemanticallyVerifiedError,
 };
 
+/// Times `$body` and records its duration to the named histogram when the
+/// `commit-metrics` feature is enabled; otherwise just evaluates `$body` with
+/// zero overhead. Used to profile checkpoint prepare phases.
+macro_rules! timed_prepare_phase {
+    ($name:expr, $body:expr) => {{
+        #[cfg(feature = "commit-metrics")]
+        let _start = std::time::Instant::now();
+        let result = $body;
+        #[cfg(feature = "commit-metrics")]
+        metrics::histogram!($name).record(_start.elapsed().as_secs_f64());
+        result
+    }};
+}
+
+/// Minimum transaction count before checkpoint prepare uses Rayon for
+/// per-transaction digest fanout.
+///
+/// Small blocks are faster serially because Rayon scheduling costs dominate the
+/// native ZIP-244 digest work.
+const MIN_PARALLEL_CHECKPOINT_PREPARE_TRANSACTIONS: usize = 16;
+
 /// Identify a spend by a transparent outpoint or revealed nullifier.
 ///
 /// This enum supports [`transparent::OutPoint`], [`sprout::Nullifier`],
@@ -268,10 +289,23 @@ pub struct SemanticallyVerifiedBlock {
     /// The precomputed ZIP-244 authorizing-data commitment root for this block,
     /// if it was computed during verification.
     ///
-    /// The checkpoint verifier can set this ahead of the single-threaded
-    /// finalized committer. `None` means the committer falls back to computing
-    /// it from the block's transactions.
-    pub auth_data_root: Option<AuthDataRoot>,
+    /// The checkpoint verifier sets this (it runs with high concurrency, ahead
+    /// of the single-threaded finalized committer) so the committer does not
+    /// have to recompute the per-transaction auth digests on its critical path.
+    /// `None` means "not precomputed"; the committer falls back to computing it.
+    ///
+    /// # Security
+    ///
+    /// The finalized checkpoint committer **trusts** a `Some` value as the
+    /// authorizing data for the ZIP-244 `hashBlockCommitments` header check
+    /// (`check::block_commitment_is_valid_for_chain_history`), so it must always
+    /// equal `block.auth_data_root()`. To keep that invariant unforgeable this
+    /// field is crate-private: it is only ever set by the constructors in this
+    /// module, which derive it from `block`. A caller outside the crate cannot
+    /// set it, and [`CheckpointVerifiedBlock`] (the only type whose cache the
+    /// committer trusts) cannot be mutated after construction, so the cache can
+    /// never be desynced from the block it commits.
+    pub(crate) auth_data_root: Option<AuthDataRoot>,
 }
 
 /// A block ready to be committed directly to the finalized state with
@@ -541,7 +575,7 @@ impl CheckpointVerifiedBlock {
         deferred_pool_balance_change: Option<DeferredPoolBalanceChange>,
     ) -> Self {
         let mut block = Self::with_hash(block.clone(), hash.unwrap_or(block.hash()));
-        block.deferred_pool_balance_change = deferred_pool_balance_change;
+        block.set_deferred_pool_balance_change(deferred_pool_balance_change);
         block
     }
     /// Creates a block that's ready to be committed to the finalized state,
@@ -568,14 +602,77 @@ impl CheckpointVerifiedBlock {
     }
 }
 
+fn prepare_block_data(
+    block: &Block,
+) -> (
+    Arc<[transaction::Hash]>,
+    AuthDataRoot,
+    HashMap<transparent::OutPoint, transparent::OrderedUtxo>,
+) {
+    #[cfg(feature = "commit-metrics")]
+    {
+        let transaction_count = block.transactions.len();
+        let output_count: usize = block
+            .transactions
+            .iter()
+            .map(|transaction| transaction.outputs().len())
+            .sum();
+        let v5_transaction_count = block
+            .transactions
+            .iter()
+            .filter(|transaction| transaction.version() == 5)
+            .count();
+
+        if let Some(height) = block.coinbase_height() {
+            metrics::gauge!("zebra.state.prepare.block.height").set(height.0 as f64);
+        }
+        metrics::histogram!("zebra.state.prepare.block_tx_count").record(transaction_count as f64);
+        metrics::histogram!("zebra.state.prepare.block_output_count").record(output_count as f64);
+        metrics::histogram!("zebra.state.prepare.block_v5_tx_count")
+            .record(v5_transaction_count as f64);
+    }
+
+    // Compute each transaction's txid and ZIP-244 auth digest together, for efficiency.
+    let (transaction_hashes, auth_digests): (Vec<_>, Vec<_>) =
+        timed_prepare_phase!("zebra.state.prepare.txid_auth_digest.duration_seconds", {
+            if block.transactions.len() < MIN_PARALLEL_CHECKPOINT_PREPARE_TRANSACTIONS {
+                block
+                    .transactions
+                    .iter()
+                    .map(|tx| tx.txid_and_auth_digest())
+                    .unzip()
+            } else {
+                use rayon::prelude::*;
+                block
+                    .transactions
+                    .par_iter()
+                    .map(|tx| tx.txid_and_auth_digest())
+                    .unzip()
+            }
+        });
+    let transaction_hashes: Arc<[_]> = transaction_hashes.into();
+    let auth_data_root = timed_prepare_phase!(
+        "zebra.state.prepare.auth_data_root.duration_seconds",
+        auth_digests
+            .into_iter()
+            .map(|auth_digest| auth_digest.unwrap_or(AUTH_DIGEST_PLACEHOLDER))
+            .collect::<AuthDataRoot>()
+    );
+    let new_outputs = timed_prepare_phase!(
+        "zebra.state.prepare.new_ordered_outputs.duration_seconds",
+        transparent::new_ordered_outputs(block, &transaction_hashes)
+    );
+
+    (transaction_hashes, auth_data_root, new_outputs)
+}
+
 impl SemanticallyVerifiedBlock {
     /// Creates [`SemanticallyVerifiedBlock`] from [`Block`] and [`block::Hash`].
     pub fn with_hash(block: Arc<Block>, hash: block::Hash) -> Self {
         let height = block
             .coinbase_height()
             .expect("semantically verified block should have a coinbase height");
-        let (transaction_hashes, auth_data_root) = transaction_hashes_and_auth_data_root(&block);
-        let new_outputs = transparent::new_ordered_outputs(&block, &transaction_hashes);
+        let (transaction_hashes, auth_data_root, new_outputs) = prepare_block_data(&block);
 
         Self {
             block,
@@ -588,6 +685,34 @@ impl SemanticallyVerifiedBlock {
         }
     }
 
+    /// Creates a [`SemanticallyVerifiedBlock`] from data the semantic verifier
+    /// has already prepared, leaving the authorizing-data root unset.
+    ///
+    /// The semantic verifier binds the ZIP-244 auth-data commitment during
+    /// contextual validation and the committer recomputes it on that path, so it
+    /// is not precomputed here. This constructor exists so callers outside the
+    /// crate build the block through a checked entry point rather than a struct
+    /// literal, keeping the crate-private [`auth_data_root`](Self::auth_data_root)
+    /// cache out of their reach (see its security note).
+    pub fn from_semantic_data(
+        block: Arc<Block>,
+        hash: block::Hash,
+        height: block::Height,
+        new_outputs: HashMap<transparent::OutPoint, transparent::OrderedUtxo>,
+        transaction_hashes: Arc<[transaction::Hash]>,
+        deferred_pool_balance_change: Option<DeferredPoolBalanceChange>,
+    ) -> Self {
+        Self {
+            block,
+            hash,
+            height,
+            new_outputs,
+            transaction_hashes,
+            deferred_pool_balance_change,
+            auth_data_root: None,
+        }
+    }
+
     /// Sets the deferred balance in the block.
     pub fn with_deferred_pool_balance_change(
         mut self,
@@ -610,8 +735,7 @@ impl From<Arc<Block>> for SemanticallyVerifiedBlock {
         let height = block
             .coinbase_height()
             .expect("semantically verified block should have a coinbase height");
-        let (transaction_hashes, auth_data_root) = transaction_hashes_and_auth_data_root(&block);
-        let new_outputs = transparent::new_ordered_outputs(&block, &transaction_hashes);
+        let (transaction_hashes, auth_data_root, new_outputs) = prepare_block_data(&block);
 
         Self {
             block,
@@ -625,52 +749,6 @@ impl From<Arc<Block>> for SemanticallyVerifiedBlock {
     }
 }
 
-/// Returns the transaction IDs and ZIP-244 authorizing-data root for `block`.
-fn transaction_hashes_and_auth_data_root(
-    block: &Block,
-) -> (Arc<[transaction::Hash]>, AuthDataRoot) {
-    use rayon::prelude::*;
-
-    let (transaction_hashes, auth_digests): (Vec<_>, Vec<_>) = block
-        .transactions
-        .par_iter()
-        .map(|transaction| transaction.txid_and_auth_digest())
-        .unzip();
-
-    let auth_data_root = auth_digests
-        .into_iter()
-        .map(|auth_digest| auth_digest.unwrap_or(AUTH_DIGEST_PLACEHOLDER))
-        .collect();
-
-    (transaction_hashes.into(), auth_data_root)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    use zebra_chain::serialization::ZcashDeserializeInto;
-
-    #[test]
-    fn transaction_hashes_and_auth_data_root_matches_separate_computation() {
-        let _init_guard = zebra_test::init();
-
-        let block = zebra_test::vectors::BLOCK_MAINNET_1687107_BYTES
-            .zcash_deserialize_into::<Block>()
-            .expect("NU5 mainnet block deserializes");
-
-        let (transaction_hashes, auth_data_root) = transaction_hashes_and_auth_data_root(&block);
-        let expected_transaction_hashes: Vec<_> = block
-            .transactions
-            .iter()
-            .map(|transaction| transaction.hash())
-            .collect();
-
-        assert_eq!(transaction_hashes.as_ref(), expected_transaction_hashes);
-        assert_eq!(auth_data_root, block.auth_data_root());
-    }
-}
-
 impl From<ContextuallyVerifiedBlock> for SemanticallyVerifiedBlock {
     fn from(valid: ContextuallyVerifiedBlock) -> Self {
         Self {
@@ -714,9 +792,28 @@ impl Deref for CheckpointVerifiedBlock {
         &self.0
     }
 }
-impl DerefMut for CheckpointVerifiedBlock {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.0
+
+// `DerefMut` is intentionally **not** implemented for `CheckpointVerifiedBlock`.
+// The committer trusts its precomputed `auth_data_root` for the ZIP-244 header
+// commitment check, so the block bytes and the cache must stay locked together
+// after construction. Mutable deref would let a holder swap `block` (or the
+// cache) and feed the committer a root that doesn't match the block. The only
+// field the checkpoint verifier sets after construction is the deferred pool
+// balance, exposed through the narrow setter below.
+
+impl CheckpointVerifiedBlock {
+    /// Sets the deferred pool balance change computed by the checkpoint verifier
+    /// after construction.
+    ///
+    /// This is the only post-construction mutation a caller may perform; it does
+    /// not touch the block or the precomputed authorizing-data root, so the
+    /// committer's trusted cache stays bound to the block (see
+    /// [`SemanticallyVerifiedBlock::auth_data_root`]).
+    pub fn set_deferred_pool_balance_change(
+        &mut self,
+        deferred_pool_balance_change: Option<DeferredPoolBalanceChange>,
+    ) {
+        self.0.deferred_pool_balance_change = deferred_pool_balance_change;
     }
 }
 
@@ -1417,8 +1514,8 @@ pub enum ReadRequest {
 
     /// Returns scheduling-only body-size hints for a contiguous height range.
     ///
-    /// Confirmed committed block sizes win over untrusted advertised header
-    /// hints. Unknown advertised sizes are returned as `None`.
+    /// Confirmed committed block sizes are preferred over advertised header
+    /// hints. Unknown sizes are returned as `None`.
     BlockSizeHints {
         /// First height to read.
         from: block::Height,
@@ -1759,3 +1856,92 @@ impl TimedSpan {
         .wait_for_panics()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use zebra_chain::serialization::ZcashDeserializeInto;
+
+    use super::*;
+
+    /// Loads the NU5 mainnet block 1,687,106 (its v5 transactions exercise the
+    /// ZIP-244 authorizing-data digests).
+    fn nu5_block() -> Arc<Block> {
+        Arc::new(
+            zebra_test::vectors::BLOCK_MAINNET_1687106_BYTES
+                .zcash_deserialize_into::<Block>()
+                .expect("NU5 test vector block deserializes"),
+        )
+    }
+
+    #[test]
+    fn transaction_hashes_and_auth_data_root_matches_separate_computation() {
+        let _init_guard = zebra_test::init();
+
+        let block = zebra_test::vectors::BLOCK_MAINNET_1687107_BYTES
+            .zcash_deserialize_into::<Block>()
+            .expect("NU5 mainnet block deserializes");
+
+        let (transaction_hashes, auth_data_root, _new_outputs) = prepare_block_data(&block);
+        let expected_transaction_hashes: Vec<_> = block
+            .transactions
+            .iter()
+            .map(|transaction| transaction.hash())
+            .collect();
+
+        assert_eq!(transaction_hashes.as_ref(), expected_transaction_hashes);
+        assert_eq!(auth_data_root, block.auth_data_root());
+    }
+
+    /// Every [`CheckpointVerifiedBlock`] constructor must precompute the
+    /// authorizing-data root *from its own block*, so the value the finalized
+    /// committer trusts for the ZIP-244 header commitment check always matches
+    /// the block it commits. This is the invariant that makes the crate-private,
+    /// non-`DerefMut` cache safe; a constructor that set a stale or foreign root
+    /// would reopen the trust hole this guards.
+    #[test]
+    fn checkpoint_verified_block_caches_its_own_auth_data_root() {
+        let block = nu5_block();
+        let expected = Some(block.auth_data_root());
+
+        assert_eq!(
+            CheckpointVerifiedBlock::from(block.clone()).auth_data_root,
+            expected,
+            "From<Arc<Block>> must cache the block's own auth data root",
+        );
+        assert_eq!(
+            CheckpointVerifiedBlock::with_hash(block.clone(), block.hash()).auth_data_root,
+            expected,
+            "with_hash must cache the block's own auth data root",
+        );
+        assert_eq!(
+            CheckpointVerifiedBlock::new(block.clone(), None, None).auth_data_root,
+            expected,
+            "new must cache the block's own auth data root",
+        );
+    }
+
+    /// The semantic-verifier constructor leaves the cache empty: that path binds
+    /// the auth-data commitment during contextual validation, and the committer
+    /// recomputes it, so there is no precomputed value to trust.
+    #[test]
+    fn semantic_constructor_leaves_auth_data_root_unset() {
+        let block = nu5_block();
+        let hash = block.hash();
+        let height = block.coinbase_height().expect("test block has a height");
+        let (transaction_hashes, _auth_data_root, new_outputs) = prepare_block_data(&block);
+
+        let semantic = SemanticallyVerifiedBlock::from_semantic_data(
+            block,
+            hash,
+            height,
+            new_outputs,
+            transaction_hashes,
+            None,
+        );
+
+        assert_eq!(
+            semantic.auth_data_root, None,
+            "the semantic path must not precompute an auth data root the committer would trust",
+        );
+    }
+}
diff --git a/zebra-state/src/service.rs b/zebra-state/src/service.rs
index 9756058763c..199c2d49f36 100644
--- a/zebra-state/src/service.rs
+++ b/zebra-state/src/service.rs
@@ -71,10 +71,10 @@ pub mod check;
 pub(crate) mod finalized_state;
 pub(crate) mod non_finalized_state;
 mod pending_utxos;
-mod queued_blocks;
+pub(crate) mod queued_blocks;
 pub(crate) mod read;
 mod traits;
-mod write;
+pub(crate) mod write;
 
 #[cfg(any(test, feature = "proptest-impl"))]
 pub mod arbitrary;
@@ -89,6 +89,13 @@ use self::queued_blocks::{QueuedCheckpointVerified, QueuedSemanticallyVerified,
 
 pub use self::traits::{ReadState, State};
 
+/// Error returned for historical note-commitment tree/subtree read requests on a
+/// verified-commitment-trees fast-synced database, where the per-height trees
+/// below the checkpoint handoff height were never written.
+const FAST_SYNCED_TREE_UNAVAILABLE_ERROR: &str =
+    "note commitment treestate is unavailable below the checkpoint on a fast-synced node; \
+     historical treestate queries require an archive node";
+
 /// A read-write service for Zebra's cached blockchain state.
 ///
 /// This service modifies and provides access to:
@@ -1480,6 +1487,7 @@ where
     headers
 }
 
+// Returns the block commitment roots for the given height range
 fn block_roots_by_height_range<C>(
     chain: Option<C>,
     db: &ZebraDb,
@@ -1515,6 +1523,11 @@ where
                 chain.orchard_tree(height.into()),
             ) {
                 (Some(sapling), Some(orchard)) => {
+                    // The non-finalized chain holds the full block, so derive its shielded
+                    // tx-counts and ZIP-244 auth-data root — the ZIP-221 leaf inputs the
+                    // header and roots don't provide — to serve for header-sync verification
+                    // (zero only if the block is unexpectedly absent). The Ironwood tree does
+                    // not exist below Nu7, so its root is the empty-tree root here.
                     let (sapling_tx, orchard_tx, ironwood_tx, auth_data_root) = chain
                         .block(height.into())
                         .map(|block| {
@@ -1566,6 +1579,70 @@ where
     roots
 }
 
+// Returns true if the given roots cover the given height range
+fn block_roots_cover_range(
+    start_height: block::Height,
+    count: u32,
+    roots: &[BlockCommitmentRoots],
+) -> bool {
+    if roots.len() != usize::try_from(count).unwrap_or(usize::MAX) {
+        return false;
+    }
+
+    roots.iter().enumerate().all(|(offset, roots)| {
+        let Ok(offset) = u32::try_from(offset) else {
+            return false;
+        };
+        start_height
+            .0
+            .checked_add(offset)
+            .is_some_and(|height| roots.height == block::Height(height))
+    })
+}
+
+// Return the highest known tip, but cap it to the verified block tip
+// if the header-only extension is not root-covered.
+fn root_covered_best_header_tip<C>(
+    chain: Option<C>,
+    db: &ZebraDb,
+    best_disk_header_tip: Option<(block::Height, block::Hash)>,
+    verified_block_tip: Option<(block::Height, block::Hash)>,
+) -> Option<(block::Height, block::Hash)>
+where
+    C: AsRef<Chain>,
+{
+    // Choose the best candidate between the best disk header tip and the verified block tip
+    let best_header_tip = match (best_disk_header_tip, verified_block_tip) {
+        (Some(header_tip), Some(block_tip)) if block_tip.0 > header_tip.0 => Some(block_tip),
+        (Some(header_tip), _) => Some(header_tip),
+        (None, block_tip) => block_tip,
+    }?;
+
+    // Is the chosen candidate already at or below the verified block tip?
+    // If yes, there no header-only gap.
+    let Some(verified_block_tip) = verified_block_tip else {
+        return Some(best_header_tip);
+    };
+
+    if best_header_tip.0 <= verified_block_tip.0 {
+        return Some(best_header_tip);
+    }
+
+    let Ok(start_height) = verified_block_tip.0.next() else {
+        return Some(verified_block_tip);
+    };
+    let best_header_height = best_header_tip.0;
+    let verified_block_height = verified_block_tip.0;
+    let count = best_header_height.0.checked_sub(verified_block_height.0)?;
+    let roots = block_roots_by_height_range(chain, db, start_height, count);
+
+    if block_roots_cover_range(start_height, count, &roots) {
+        Some(best_header_tip)
+    } else {
+        Some(verified_block_tip)
+    }
+}
+
 impl Service<ReadRequest> for ReadStateService {
     type Response = ReadResponse;
     type Error = BoxError;
@@ -1819,17 +1896,15 @@ impl Service<ReadRequest> for ReadStateService {
 
             ReadRequest::BestHeaderTip => {
                 let best_disk_header_tip = state.db.best_header_tip();
-                let verified_block_tip = read::tip(state.latest_best_chain(), &state.db);
-
-                Ok(ReadResponse::BestHeaderTip(
-                    match (best_disk_header_tip, verified_block_tip) {
-                        (Some(header_tip), Some(block_tip)) if block_tip.0 > header_tip.0 => {
-                            Some(block_tip)
-                        }
-                        (Some(header_tip), _) => Some(header_tip),
-                        (None, block_tip) => block_tip,
-                    },
-                ))
+                let best_chain = state.latest_best_chain();
+                let verified_block_tip = read::tip(best_chain.clone(), &state.db);
+
+                Ok(ReadResponse::BestHeaderTip(root_covered_best_header_tip(
+                    best_chain,
+                    &state.db,
+                    best_disk_header_tip,
+                    verified_block_tip,
+                )))
             }
 
             ReadRequest::MissingBlockBodies { from, limit } => {
@@ -1869,19 +1944,38 @@ impl Service<ReadRequest> for ReadStateService {
                 Ok(ReadResponse::Blocks(blocks))
             }
 
-            ReadRequest::SaplingTree(hash_or_height) => Ok(ReadResponse::SaplingTree(
-                read::sapling_tree(state.latest_best_chain(), &state.db, hash_or_height),
-            )),
+            ReadRequest::SaplingTree(hash_or_height) => {
+                if state.db.vct_historical_tree_unavailable(hash_or_height) {
+                    return Err(FAST_SYNCED_TREE_UNAVAILABLE_ERROR.into());
+                }
+                Ok(ReadResponse::SaplingTree(read::sapling_tree(
+                    state.latest_best_chain(),
+                    &state.db,
+                    hash_or_height,
+                )))
+            }
 
-            ReadRequest::OrchardTree(hash_or_height) => Ok(ReadResponse::OrchardTree(
-                read::orchard_tree(state.latest_best_chain(), &state.db, hash_or_height),
-            )),
+            ReadRequest::OrchardTree(hash_or_height) => {
+                if state.db.vct_historical_tree_unavailable(hash_or_height) {
+                    return Err(FAST_SYNCED_TREE_UNAVAILABLE_ERROR.into());
+                }
+                Ok(ReadResponse::OrchardTree(read::orchard_tree(
+                    state.latest_best_chain(),
+                    &state.db,
+                    hash_or_height,
+                )))
+            }
 
             ReadRequest::IronwoodTree(hash_or_height) => Ok(ReadResponse::IronwoodTree(
                 read::ironwood_tree(state.latest_best_chain(), &state.db, hash_or_height),
             )),
 
             ReadRequest::SaplingSubtrees { start_index, limit } => {
+                // On a fast-synced database, subtrees below the checkpoint handoff
+                // height were never written, so a below-checkpoint range returns an
+                // empty list (the existing "no subtree at the start index" contract)
+                // rather than panicking. A typed archive-mode error for subtrees
+                // unifies with the indexing watermark in a later increment.
                 let end_index = limit
                     .and_then(|limit| start_index.0.checked_add(limit.0))
                     .map(NoteCommitmentSubtreeIndex);
@@ -2120,7 +2214,7 @@ impl Service<ReadRequest> for ReadStateService {
 
 /// Initialize a state service from the provided [`Config`].
 /// Returns a boxed state service, a read-only state service,
-/// and receivers for state chain tip updates.
+/// receivers for state chain tip updates, and a `tree_aux` roots writer if peer mode is active.
 ///
 /// Each `network` has its own separate on-disk database.
 ///
@@ -2218,12 +2312,9 @@ pub fn spawn_init_read_only(
 pub async fn init_test(
     network: &Network,
 ) -> Buffer<BoxService<Request, Response, BoxError>, Request> {
-    // TODO: pass max_checkpoint_height and checkpoint_verify_concurrency limit
-    //       if we ever need to test final checkpoint sent UTXO queries
-    let (state_service, _, _, _) =
-        StateService::new(Config::ephemeral(), network, block::Height::MAX, 0).await;
+    let (state_service, _, _, _) = init_test_services_inner(network).await;
 
-    Buffer::new(BoxService::new(state_service), 1)
+    state_service
 }
 
 /// Initializes a state service with an ephemeral [`Config`] and a buffer with a single slot,
@@ -2238,6 +2329,18 @@ pub async fn init_test_services(
     ReadStateService,
     LatestChainTip,
     ChainTipChange,
+) {
+    init_test_services_inner(network).await
+}
+
+#[cfg(any(test, feature = "proptest-impl"))]
+async fn init_test_services_inner(
+    network: &Network,
+) -> (
+    Buffer<BoxService<Request, Response, BoxError>, Request>,
+    ReadStateService,
+    LatestChainTip,
+    ChainTipChange,
 ) {
     // TODO: pass max_checkpoint_height and checkpoint_verify_concurrency limit
     //       if we ever need to test final checkpoint sent UTXO queries
diff --git a/zebra-state/src/service/check.rs b/zebra-state/src/service/check.rs
index f7868eb5ef4..c8120797b05 100644
--- a/zebra-state/src/service/check.rs
+++ b/zebra-state/src/service/check.rs
@@ -235,17 +235,23 @@ pub(crate) fn block_commitment_is_valid_for_chain_history(
                     "the history tree of the previous block must exist \
                  since the current block has a ChainHistoryBlockTxAuthCommitment",
                 );
-            let auth_data_root = block.auth_data_root();
-            if let Some(precomputed_auth_data_root) = precomputed_auth_data_root {
-                if precomputed_auth_data_root != auth_data_root {
-                    return Err(ValidateContextError::InvalidBlockCommitment(
-                        CommitmentError::InvalidAuthDataRoot {
-                            actual: precomputed_auth_data_root.into(),
-                            expected: auth_data_root.into(),
-                        },
-                    ));
+            // Use the auth data root precomputed by the verifier when available
+            // after checking it is byte-identical to recomputing it from the block body.
+            let auth_data_root = match precomputed_auth_data_root {
+                Some(precomputed_auth_data_root) => {
+                    let expected_auth_data_root = block.auth_data_root();
+                    if precomputed_auth_data_root != expected_auth_data_root {
+                        return Err(ValidateContextError::InvalidBlockCommitment(
+                            CommitmentError::InvalidAuthDataRoot {
+                                actual: precomputed_auth_data_root.into(),
+                                expected: expected_auth_data_root.into(),
+                            },
+                        ));
+                    }
+                    precomputed_auth_data_root
                 }
-            }
+                None => block.auth_data_root(),
+            };
 
             let hash_block_commitments = ChainHistoryBlockTxAuthCommitmentHash::from_commitments(
                 &history_tree_root,
diff --git a/zebra-state/src/service/check/tests/nullifier.rs b/zebra-state/src/service/check/tests/nullifier.rs
index e634f485e59..420a4ee2be7 100644
--- a/zebra-state/src/service/check/tests/nullifier.rs
+++ b/zebra-state/src/service/check/tests/nullifier.rs
@@ -89,7 +89,7 @@ proptest! {
         // randomly choose to commit the block to the finalized or non-finalized state
         if use_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             // the block was committed
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
@@ -353,7 +353,7 @@ proptest! {
         // randomly choose to commit the next block to the finalized or non-finalized state
         if duplicate_in_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -452,7 +452,7 @@ proptest! {
         // randomly choose to commit the block to the finalized or non-finalized state
         if use_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(),None,  "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -632,7 +632,7 @@ proptest! {
         // randomly choose to commit the next block to the finalized or non-finalized state
         if duplicate_in_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(),None,  "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -729,7 +729,7 @@ proptest! {
         // randomly choose to commit the block to the finalized or non-finalized state
         if use_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -918,7 +918,7 @@ proptest! {
         // randomly choose to commit the next block to the finalized or non-finalized state
         if duplicate_in_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -1025,7 +1025,8 @@ proptest! {
         let block1_hash;
         if duplicate_in_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result =
+                finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
             prop_assert!(commit_result.is_ok());
@@ -1118,7 +1119,7 @@ proptest! {
         finalized_state.populate_with_anchors(&block2);
 
         let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, "test");
+        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, None, "test");
         prop_assert!(commit_result.is_ok());
 
         let block2 = Arc::new(block2).prepare();
@@ -1172,7 +1173,7 @@ proptest! {
         finalized_state.populate_with_anchors(&block2);
 
         let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, "test");
+        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, None, "test");
         prop_assert!(commit_result.is_ok());
 
         let block2 = Arc::new(block2).prepare();
@@ -1226,7 +1227,7 @@ proptest! {
         finalized_state.populate_with_anchors(&block2);
 
         let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, "test");
+        let commit_result = finalized_state.commit_finalized_direct(block1.into(), None, None, "test");
         prop_assert!(commit_result.is_ok());
 
         let block2 = Arc::new(block2).prepare();
diff --git a/zebra-state/src/service/check/tests/utxo.rs b/zebra-state/src/service/check/tests/utxo.rs
index dd9017bea20..69bfe446f69 100644
--- a/zebra-state/src/service/check/tests/utxo.rs
+++ b/zebra-state/src/service/check/tests/utxo.rs
@@ -185,7 +185,7 @@ proptest! {
         // randomly choose to commit the block to the finalized or non-finalized state
         if use_finalized_state {
             let block1 = CheckpointVerifiedBlock::from(Arc::new(block1));
-            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
             // the block was committed
             prop_assert_eq!(Some((Height(1), block1.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
@@ -273,7 +273,7 @@ proptest! {
 
         if use_finalized_state_spend {
             let block2 = CheckpointVerifiedBlock::from(Arc::new(block2));
-            let commit_result = finalized_state.commit_finalized_direct(block2.clone().into(),None,  "test");
+            let commit_result = finalized_state.commit_finalized_direct(block2.clone().into(), None, None, "test");
 
             // the block was committed
             prop_assert_eq!(Some((Height(2), block2.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
@@ -609,7 +609,7 @@ proptest! {
 
         if use_finalized_state_spend {
             let block2 = CheckpointVerifiedBlock::from(block2.clone());
-            let commit_result = finalized_state.commit_finalized_direct(block2.clone().into(), None, "test");
+            let commit_result = finalized_state.commit_finalized_direct(block2.clone().into(), None, None, "test");
 
             // the block was committed
             prop_assert_eq!(Some((Height(2), block2.hash)), read::best_tip(&non_finalized_state, &finalized_state.db));
@@ -878,7 +878,7 @@ fn new_state_with_mainnet_transparent_data(
     if use_finalized_state {
         let block1 = CheckpointVerifiedBlock::from(block1.clone());
         let commit_result =
-            finalized_state.commit_finalized_direct(block1.clone().into(), None, "test");
+            finalized_state.commit_finalized_direct(block1.clone().into(), None, None, "test");
 
         // the block was committed
         assert_eq!(
diff --git a/zebra-state/src/service/finalized_state.rs b/zebra-state/src/service/finalized_state.rs
index 4a1431eba8a..0de56a57c6d 100644
--- a/zebra-state/src/service/finalized_state.rs
+++ b/zebra-state/src/service/finalized_state.rs
@@ -22,11 +22,15 @@ use std::{
     },
 };
 
-use zebra_chain::{block, parallel::tree::NoteCommitmentTrees, parameters::Network};
+use zebra_chain::{
+    block::{self, merkle::AuthDataRoot, Block},
+    ironwood, orchard,
+    parallel::tree::NoteCommitmentTrees,
+    parameters::Network,
+    sapling,
+};
 use zebra_db::{
-    block::{
-        RetentionPlan, ZAKURA_HEADER_BODY_SIZE_BY_HEIGHT, ZAKURA_HEADER_COMMITMENT_ROOTS_BY_HEIGHT,
-    },
+    block::{RetentionPlan, ZAKURA_HEADER_BODY_SIZE_BY_HEIGHT},
     chain::BLOCK_INFO,
     transparent::{BALANCE_BY_TRANSPARENT_ADDR, TX_LOC_BY_SPENT_OUT_LOC},
 };
@@ -78,8 +82,11 @@ pub(crate) mod commitment_aux;
 pub(crate) mod commitment_aux_verify;
 mod disk_db;
 mod disk_format;
+mod vct;
 mod zebra_db;
 
+use vct::VctState;
+
 #[cfg(any(test, feature = "proptest-impl"))]
 mod arbitrary;
 
@@ -88,6 +95,8 @@ mod tests;
 
 #[allow(unused_imports)]
 pub use column_family::{TypedColumnFamily, WriteTypedBatch};
+/// The verified-commitment-trees `tree_aux` serving read path (design §9): the per-block
+/// commitment roots for a height range, derived from the per-height trees.
 pub(crate) use commitment_aux::serve_block_roots;
 pub use commitment_aux::{produce_final_frontiers_bytes, FinalFrontiersGenerationError};
 #[allow(unused_imports)]
@@ -97,6 +106,7 @@ pub use disk_format::{
     FromDisk, IntoDisk, OutputLocation, RawBytes, TransactionIndex, TransactionLocation,
     MAX_ON_DISK_HEIGHT,
 };
+pub use vct::{validate_final_frontiers_bytes, FinalFrontiersValidationError};
 pub use zebra_db::ZebraDb;
 
 #[cfg(any(test, feature = "proptest-impl"))]
@@ -178,22 +188,62 @@ pub const PRUNING_METADATA: &str = "pruning_metadata";
 /// The name of the column family that marks a verified-commitment-trees
 /// (vct) synced database.
 ///
-/// A vct-synced database skips historical per-height note-commitment tree
-/// writes below the checkpoint handoff height. This column family holds a
-/// single entry with that handoff height.
+/// A vct-synced database is built by folding verified commitment roots into the
+/// anchor set and history tree below the last checkpoint, skipping the per-height
+/// note-commitment trees entirely. This column family holds a single entry, keyed
+/// by the unit value `()`, mapping to the checkpoint handoff height: the lowest
+/// height at which a per-height note-commitment tree is present. Per-height trees
+/// are absent for every non-genesis height strictly below it.
+///
+/// The presence of this entry marks the database as vct-synced: the historical
+/// per-height trees were never written, so the database cannot answer historical
+/// tree/subtree RPCs below the handoff height (the RPC handlers return a typed
+/// archive-mode error there, §9). Vct sync is the default under checkpoint sync
+/// for both Archive and Pruned storage modes, so a vct-synced database reopens in
+/// either; the missing-history limitation is enforced at the RPC boundary, not at
+/// reopen. This is orthogonal to pruning (which drops raw transactions but keeps
+/// the trees); a database can be both.
 pub const VCT_SYNC_METADATA: &str = "vct_sync_metadata";
 
-/// The name of the column family that records the verified-commitment-trees
-/// upgrade height.
+/// The name of the column family that records the verified-commitment-trees upgrade height.
+///
+/// This holds a single entry, keyed by the unit value `()`, mapping to `U`: the lowest height
+/// this (vct-aware) binary committed, which is also the lowest height present in the
+/// [`COMMITMENT_ROOTS_BY_HEIGHT`] serving index. It is written once — on the first committed
+/// block — and never moved, so it is a stable boundary as the chain grows.
 ///
-/// This height is the first block committed by code that writes the
-/// [`COMMITMENT_ROOTS_BY_HEIGHT`] serving index.
+/// `U` is what lets the two root sources be stitched without a gap: heights below `U` predate
+/// this binary, so they carry per-height trees but no index entry and are served from the trees;
+/// heights at or above `U` carry an index entry and are served from it. Combined with the
+/// checkpoint handoff `H` in [`VCT_SYNC_METADATA`], it also bounds the band `[U, H)` in which a
+/// vct-synced node holds no per-height tree, so historical tree/subtree RPCs are unavailable
+/// there but available below `U` (pre-upgrade trees) and at/above `H` (semantic-sync trees).
 pub const VCT_UPGRADE_METADATA: &str = "vct_upgrade_metadata";
 
-/// The name of the column family holding per-height Sapling/Orchard
-/// note-commitment roots, keyed by [`block::Height`].
+/// The name of the column family holding the per-height Sapling/Orchard note-commitment
+/// roots, keyed by [`block::Height`].
+///
+/// This is the verified-commitment-trees serving index (design §4): a compact
+/// `height -> (sapling_root, orchard_root)` map (64 bytes/height) that **every** node
+/// persists for each committed block, on both the vct and legacy commit paths. Its purpose
+/// is to let a vct-synced node — which folds verified roots in but writes no per-height
+/// note-commitment trees — still answer the `tree_aux` `BlockRoots` read, so the
+/// root-serving fleet does not collapse as nodes adopt vct sync. The roots are the same
+/// values a legacy node derives from its per-height trees via `produce_block_roots`; serving
+/// reads this index first and falls back to the trees only for databases written before the
+/// index existed.
 pub const COMMITMENT_ROOTS_BY_HEIGHT: &str = "commitment_roots_by_height";
 
+/// Provisional peer-supplied per-height Sapling/Orchard roots attached to Zakura
+/// header-sync responses.
+///
+/// These roots are advisory metadata for header-ahead blocks. They are persisted
+/// with `zakura_header_*` so VCT fast sync can read them before full block bodies
+/// arrive, but they remain untrusted until block commit verifies them against the
+/// header commitments.
+pub const ZAKURA_HEADER_COMMITMENT_ROOTS_BY_HEIGHT: &str =
+    "zakura_header_commitment_roots_by_height";
+
 /// The finalized part of the chain state, stored in the db.
 ///
 /// `rocksdb` allows concurrent writes through a shared reference,
@@ -245,6 +295,39 @@ pub struct FinalizedState {
     #[cfg(feature = "elasticsearch")]
     /// A collection of blocks to be sent to elasticsearch as a bulk.
     pub elastic_blocks: Vec<String>,
+
+    /// Verified-commitment-trees state (peer/fixture/capture mode), or `None`
+    /// when legacy recompute is selected. Shared across clones.
+    vct: Option<Arc<VctState>>,
+
+    /// Verify-before-commit dedup. Holds the `(height, hash)` of the next
+    /// block whose commitment was already validated by the previous fast
+    /// commit's look-ahead (`C(next, candidate)`). When the next block to commit
+    /// matches, its own commitment check is the identical computation, so it is
+    /// skipped — making each header commitment check run once instead of twice.
+    /// Guarded by hash identity (and height monotonicity), so a stale or cloned
+    /// value can never cause an incorrect skip.
+    vct_prevalidated_next: Option<(block::Height, block::Hash)>,
+
+    /// `true` while a verified-commitment-trees (vct) fast sync has frozen the
+    /// note-commitment frontier — i.e. a verified commitment tree block has committed but the
+    /// checkpoint handoff (which replaces the frontier with the real one) has not.
+    ///
+    /// While frozen, the running frontier is no longer the real frontier for the
+    /// heights being committed, so a legacy recompute would fold a wrong root into
+    /// the history MMR and corrupt consensus state. The committer therefore refuses
+    /// to recompute for a height with no valid supplied root in this window,
+    /// returning a retryable error instead (see `commit_finalized_direct`). Reset to
+    /// `false` at the handoff, after which legacy recompute resumes from the real
+    /// frontier.
+    ///
+    /// Seeded from durable state on open (not just within a session): a vct sync
+    /// interrupted by a restart leaves the frozen frontier persisted but the tip
+    /// below the handoff, so [`FinalizedState::new`] re-derives this flag from the
+    /// vct-sync marker. Without that, the first post-restart height with no supplied
+    /// root would legacy-recompute against the stale on-disk frontier and corrupt the
+    /// MMR — the exact hazard this flag exists to prevent.
+    vct_frontier_frozen: bool,
 }
 
 impl FinalizedState {
@@ -265,6 +348,40 @@ impl FinalizedState {
         )
     }
 
+    /// Opens (or creates) the on-disk finalized state database read-write, for
+    /// offline tooling (e.g. the replay benchmark).
+    ///
+    /// Equivalent to [`FinalizedState::new`] but without the `elasticsearch`
+    /// feature's `enable_elastic_db` parameter, so callers compile unchanged
+    /// regardless of feature flags (elasticsearch is never enabled here).
+    pub fn new_writable(config: &Config, network: &Network) -> Self {
+        Self::new_with_debug(
+            config,
+            network,
+            false,
+            #[cfg(feature = "elasticsearch")]
+            false,
+            false,
+        )
+    }
+
+    /// Opens an existing on-disk finalized state database in **read-only** mode.
+    ///
+    /// Intended for offline tooling (e.g. the replay benchmark) that reads
+    /// committed blocks from a snapshot without triggering format upgrades or any
+    /// writes to the source database. Read-only opens skip format upgrades, so the
+    /// pristine snapshot is never mutated.
+    pub fn new_read_only(config: &Config, network: &Network) -> Self {
+        Self::new_with_debug(
+            config,
+            network,
+            false,
+            #[cfg(feature = "elasticsearch")]
+            false,
+            true,
+        )
+    }
+
     /// Returns an on-disk database instance with the supplied production and debug settings.
     /// If there is no existing database, creates a new database on disk.
     ///
@@ -284,6 +401,7 @@ impl FinalizedState {
             enable_elastic_db,
             read_only,
             true,
+            true,
         )
     }
 
@@ -307,6 +425,35 @@ impl FinalizedState {
             enable_elastic_db,
             read_only,
             false,
+            true,
+        )
+    }
+
+    /// Reopens an on-disk database for VCT reopen tests without enforcing the
+    /// interrupted-fast-sync resume guard.
+    ///
+    /// Production always enforces the guard: a fast sync interrupted below the
+    /// checkpoint handoff can only resume through a configured VCT root source, so
+    /// reopening one without a source (`vct.is_none()`) refuses to open. Tests model a
+    /// (Mainnet) node restart on a configured network that has no embedded frontiers,
+    /// then attach a fixture root source after construction the way a real node's
+    /// configured source would already be present at open time, so they need to skip
+    /// the constructor-time guard.
+    #[cfg(test)]
+    pub(crate) fn new_without_resume_guard(
+        config: &Config,
+        network: &Network,
+        #[cfg(feature = "elasticsearch")] enable_elastic_db: bool,
+    ) -> Self {
+        Self::new_with_debug_and_storage_validation(
+            config,
+            network,
+            false,
+            #[cfg(feature = "elasticsearch")]
+            enable_elastic_db,
+            false,
+            true,
+            false,
         )
     }
 
@@ -317,6 +464,7 @@ impl FinalizedState {
         #[cfg(feature = "elasticsearch")] enable_elastic_db: bool,
         read_only: bool,
         validate_storage_mode: bool,
+        enforce_resume_guard: bool,
     ) -> Self {
         // Fail fast on an invalid storage configuration, before opening the database.
         if validate_storage_mode {
@@ -365,6 +513,26 @@ impl FinalizedState {
             read_only,
         );
 
+        let vct = VctState::from_config(
+            config.checkpoint_sync,
+            config.vct_fast_sync,
+            network,
+            db.clone(),
+        );
+
+        // Re-derive the frozen-frontier flag from durable state: a fast sync
+        // interrupted before the checkpoint handoff leaves the stale frozen frontier
+        // on disk (fast commits never write per-height trees) with the tip still below
+        // the handoff. Reopening in that window must keep the committer frozen so a
+        // height with no supplied root refuses instead of legacy-recomputing against
+        // the stale frontier. The handoff height itself carries the real frontier, so
+        // `tip < handoff` (exclusive) is exactly the frozen region. Read from the
+        // fast-sync marker, not `vct`, so it holds even if VCT is disabled this run.
+        let vct_frontier_frozen = db
+            .vct_synced_below()
+            .zip(db.finalized_tip_height())
+            .is_some_and(|(handoff, tip)| tip < handoff);
+
         #[cfg(feature = "elasticsearch")]
         let new_state = Self {
             debug_stop_at_height: config.debug_stop_at_height.map(block::Height),
@@ -373,6 +541,9 @@ impl FinalizedState {
             db,
             elastic_db,
             elastic_blocks: vec![],
+            vct,
+            vct_prevalidated_next: None,
+            vct_frontier_frozen,
         };
 
         #[cfg(not(feature = "elasticsearch"))]
@@ -381,6 +552,9 @@ impl FinalizedState {
             checkpoint_raw_tx_retention_start: None,
             checkpoint_raw_tx_archive_backlog: Arc::new(AtomicBool::new(false)),
             db,
+            vct,
+            vct_prevalidated_next: None,
+            vct_frontier_frozen,
         };
 
         // Pruning is a one-way storage mode. Refuse to open a database that has
@@ -394,6 +568,23 @@ impl FinalizedState {
             );
         }
 
+        // An *interrupted* fast sync — frozen frontier, tip still below the handoff — can
+        // only be safely resumed by the fast path (which supplies the verified roots). The
+        // on-disk frontier is stale, so the committer fails closed on every below-handoff
+        // height with no supplied root (§8). Reopening without a VCT root source selects the
+        // legacy committer, which can never supply those roots, so the node would refuse every
+        // block forever. Refuse to open instead, with a clear recovery path, rather than
+        // stalling silently.
+        if enforce_resume_guard && new_state.vct_frontier_frozen && new_state.vct.is_none() {
+            panic!(
+                "this database was previously synced in verified commitment tree mode that was \
+                 interrupted below the checkpoint handoff height. the fast path that supplies \
+                 the verified roots needed to resume it is disabled. Set \
+                 `consensus.checkpoint_sync = true` and `consensus.vct_fast_sync = true` to \
+                 finish the fast sync, or delete the cache directory and re-sync from genesis"
+            );
+        }
+
         // TODO: move debug_stop_at_height into a task in the start command (#3442)
         if let Some(tip_height) = new_state.db.finalized_tip_height() {
             if new_state.is_at_stop_height(tip_height) {
@@ -555,11 +746,16 @@ impl FinalizedState {
         &mut self,
         ordered_block: QueuedCheckpointVerified,
         prev_note_commitment_trees: Option<NoteCommitmentTrees>,
-    ) -> Result<(CheckpointVerifiedBlock, NoteCommitmentTrees), CommitCheckpointVerifiedError> {
+        next_checkpoint: Option<(Arc<Block>, Option<AuthDataRoot>)>,
+    ) -> Result<
+        (CheckpointVerifiedBlock, NoteCommitmentTrees),
+        (QueuedCheckpointVerified, CommitCheckpointVerifiedError),
+    > {
         let (checkpoint_verified, rsp_tx) = ordered_block;
         let result = self.commit_finalized_direct(
             checkpoint_verified.clone().into(),
             prev_note_commitment_trees,
+            next_checkpoint,
             "commit checkpoint-verified request",
         );
 
@@ -580,9 +776,13 @@ impl FinalizedState {
                 .set(checkpoint_verified.height.0 as f64);
         };
 
-        let _ = rsp_tx.send(result.clone().map(|(hash, _)| hash));
-
-        result.map(|(_hash, note_commitment_trees)| (checkpoint_verified, note_commitment_trees))
+        match result {
+            Ok((hash, note_commitment_trees)) => {
+                let _ = rsp_tx.send(Ok(hash));
+                Ok((checkpoint_verified, note_commitment_trees))
+            }
+            Err(error) => Err(((checkpoint_verified, rsp_tx), error)),
+        }
     }
 
     /// Immediately commit a `finalized` block to the finalized state.
@@ -603,43 +803,241 @@ impl FinalizedState {
         &mut self,
         finalizable_block: FinalizableBlock,
         prev_note_commitment_trees: Option<NoteCommitmentTrees>,
+        // The next checkpoint block (and its precomputed
+        // auth data root), used to verify this block's fixture roots before the fast
+        // path trusts them. `None` is only valid for fast blocks at the checkpoint
+        // handoff, where the embedded final frontiers independently authenticate
+        // this height's roots, or outside the checkpoint commit path.
+        next_checkpoint: Option<(Arc<Block>, Option<AuthDataRoot>)>,
         source: &str,
     ) -> Result<(block::Hash, NoteCommitmentTrees), CommitCheckpointVerifiedError> {
-        let (height, hash, finalized, prev_note_commitment_trees, retention) =
-            match finalizable_block {
-                FinalizableBlock::Checkpoint {
-                    checkpoint_verified,
-                } => {
-                    // Checkpoint-verified blocks don't have an associated treestate, so we retrieve the
-                    // treestate of the finalized tip from the database and update it for the block
-                    // being committed, assuming the retrieved treestate is the parent block's
-                    // treestate. Later on, this function proves this assumption by asserting that the
-                    // finalized tip is the parent block of the block being committed.
-
-                    let block = checkpoint_verified.block.clone();
-                    let precomputed_auth_data_root = checkpoint_verified.auth_data_root;
-                    let mut history_tree = self.db.history_tree();
-                    let prev_note_commitment_trees = prev_note_commitment_trees
-                        .unwrap_or_else(|| self.db.note_commitment_trees_for_tip());
-
-                    let mut note_commitment_trees = prev_note_commitment_trees.clone();
-                    let network = self.network();
+        let (
+            height,
+            hash,
+            finalized,
+            prev_note_commitment_trees,
+            retention,
+            fast_anchor_roots,
+            fast_sync_below,
+        ) = match finalizable_block {
+            FinalizableBlock::Checkpoint {
+                checkpoint_verified,
+            } => {
+                // Checkpoint-verified blocks don't have an associated treestate, so we retrieve the
+                // treestate of the finalized tip from the database and update it for the block
+                // being committed, assuming the retrieved treestate is the parent block's
+                // treestate. Later on, this function proves this assumption by asserting that the
+                // finalized tip is the parent block of the block being committed.
+
+                let block = checkpoint_verified.block.clone();
+                // Auth data root precomputed by the checkpoint verifier (if any),
+                // so the commitment check below doesn't recompute it here on the
+                // single-threaded committer. `AuthDataRoot` is `Copy`.
+                let precomputed_auth_data_root = checkpoint_verified.auth_data_root;
+                let mut history_tree = self.db.history_tree();
+                let prev_note_commitment_trees = prev_note_commitment_trees
+                    .unwrap_or_else(|| self.db.note_commitment_trees_for_tip());
+
+                let mut note_commitment_trees = prev_note_commitment_trees.clone();
+                let network = self.network();
+                let height = checkpoint_verified.height;
+
+                // The last checkpoint height (boundary below which the vct
+                // path skips per-height trees), when final frontiers are loaded.
+                let vct_last_checkpoint_height = self
+                    .vct
+                    .as_ref()
+                    .and_then(|v| v.vct_sync_last_checkpoint_height());
+
+                // In vct mode, if the source has this height's roots at or below the
+                // last checkpoint height, skip the per-block note-commitment frontier recompute
+                // (`update_trees_parallel`) entirely and fold the supplied roots into the
+                // anchor set and history leaf instead. The frontier stays the (frozen)
+                // parent frontier; nothing below the checkpoint reads it for consensus.
+                // See docs/design/verified-commitment-trees.md.
+                let vct_roots = self.vct.as_ref().and_then(|v| {
+                    if vct_last_checkpoint_height
+                        .is_some_and(|last_checkpoint_height| height > last_checkpoint_height)
+                    {
+                        None
+                    } else {
+                        v.vct_roots_at_height(height)
+                    }
+                });
 
-                    // Run two independent CPU-intensive crypto operations concurrently
-                    // on the rayon pool (Part 1 of the checkpoint-commit parallelization):
-                    //
-                    // - updating the note commitment trees, and
-                    // - checking this block's commitment against the *parent* history tree.
-                    //
-                    // These are independent: the commitment check reads only the parent
-                    // history tree (not this block's note commitment trees), and the
-                    // history tree push below depends on both, so it runs after the join.
+                let mut vct_anchor_roots = None;
+                // `Some(C)` for fast blocks of a persistent fast sync; written
+                // to the fast-sync marker in the commit batch.
+                let mut vct_sync_below = None;
+
+                if let Some((sapling_root, orchard_root)) = vct_roots {
+                    // The handoff frontiers are the only non-successor authority that
+                    // can authenticate this block's own supplied roots before they are
+                    // persisted.
+                    let last_checkpoint_frontiers = self
+                        .vct
+                        .as_ref()
+                        .and_then(|v| v.final_frontiers_for_last_checkpoint(height));
+
+                    // This block's own commitment check is identical to the
+                    // previous vct block's look-ahead. When that look-ahead
+                    // already validated this exact header, skip the duplicate.
+                    let block_hash = block.hash();
+                    let is_prevalidated = self.vct_prevalidated_next == Some((height, block_hash));
+                    if is_prevalidated {
+                        if let Some(v) = &self.vct {
+                            v.record_prevalidated();
+                        }
+                        // Observability: the previous fast block's look-ahead already
+                        // validated this header, so its commitment check was skipped (the
+                        // dedup). A subset of `state.vct.fast.block.count`.
+                        metrics::counter!("state.vct.prevalidated.block.count").increment(1);
+                    }
+
+                    let mut verification_items = vec![
+                        commitment_aux_verify::CommitmentRootVerification::with_roots(
+                            block.clone(),
+                            sapling_root,
+                            orchard_root,
+                            precomputed_auth_data_root,
+                            is_prevalidated,
+                        ),
+                    ];
+                    if let Some((next_block, next_auth)) = &next_checkpoint {
+                        verification_items.push(
+                            commitment_aux_verify::CommitmentRootVerification::header_only(
+                                next_block.clone(),
+                                *next_auth,
+                            ),
+                        );
+                    }
+
+                    // Verifies this block's own header, folds its supplied roots into
+                    // the candidate tree, and when buffered checks the successor header
+                    // against that candidate (the one-block lag).
+                    let candidate = COMMIT_COMPUTE_POOL
+                        .install(|| {
+                            commitment_aux_verify::verify_commitment_roots(
+                                &network,
+                                (*history_tree).clone(),
+                                verification_items,
+                            )
+                        })
+                        .map_err(|(_fail_height, error)| {
+                            self.vct_prevalidated_next = None;
+                            self.vct_reject_supplied_root(height, error)
+                        })?;
+
+                    if let Some((next_block, _next_auth)) = &next_checkpoint {
+                        self.vct_prevalidated_next = Some((
+                            (height + 1).expect("checkpoint block heights are valid"),
+                            next_block.hash(),
+                        ));
+                    } else if self
+                        .vct
+                        .as_ref()
+                        .is_some_and(|v| v.vct_root_needs_successor(height, &network))
+                    {
+                        // Untrusted root at/above Heartwood, no successor to confirm it,
+                        // not the last checkpoint: defer rather than persist it unverified. Leaves
+                        // the database untouched; the block re-commits once the successor
+                        // is buffered.
+                        metrics::counter!("state.vct.root.await_successor.count").increment(1);
+                        return Err(ValidateContextError::VctSuppliedRootAwaitingSuccessor {
+                            height,
+                        }
+                        .into());
+                    } else {
+                        self.vct_prevalidated_next = None;
+                    }
+
+                    history_tree = Arc::new(candidate);
+                    if let Some(v) = &self.vct {
+                        v.record_fast_block();
+                    }
+                    // Observability: this block folded supplied roots and skipped the
+                    // note-commitment frontier recompute (the verified-commitment-trees
+                    // fast path). Paired with `state.vct.legacy.block.count` below, this
+                    // gives a live fast-vs-legacy ratio.
+                    metrics::counter!("state.vct.fast.block.count").increment(1);
+
+                    // When final frontiers are loaded, this is a persistent fast
+                    // sync: mark the database fast-synced (per-height trees absent
+                    // below the handoff height).
+                    vct_sync_below = vct_last_checkpoint_height;
+
+                    if let Some((sapling_frontier, orchard_frontier, sprout_frontier)) =
+                        last_checkpoint_frontiers
+                    {
+                        // Checkpoint handoff: verify the supplied frontiers against
+                        // this block's verified roots (collision resistance makes the
+                        // root a binding commitment to the frontier), then write them
+                        // as the real tip treestate via the legacy write path
+                        // (`fast_anchor_roots` left `None`), so post-checkpoint
+                        // semantic verification resumes from a correct frontier.
+                        self.vct_verify_handoff_frontier_roots(
+                            height,
+                            &sapling_frontier,
+                            &orchard_frontier,
+                            &sapling_root,
+                            &orchard_root,
+                        )?;
+
+                        // Subtree tips are left `None`: the resuming chain recomputes
+                        // them from the frontier position.
+                        note_commitment_trees = NoteCommitmentTrees {
+                            sprout: sprout_frontier,
+                            sapling: sapling_frontier,
+                            sapling_subtree: None,
+                            orchard: orchard_frontier,
+                            orchard_subtree: None,
+                            ironwood: Arc::<ironwood::tree::NoteCommitmentTree>::default(),
+                            ironwood_subtree: None,
+                        };
+
+                        // The handoff writes the real final frontier as the tip
+                        // treestate, so the frontier is no longer frozen: heights at and
+                        // above the handoff resume legacy recompute from a correct frontier.
+                        self.vct_frontier_frozen = false;
+                    } else {
+                        vct_anchor_roots = Some((sapling_root, orchard_root));
+
+                        // A non-handoff fast block leaves the note-commitment frontier
+                        // frozen (it folds roots instead of advancing the trees), so a
+                        // later height with no valid supplied root must not legacy-recompute
+                        // against this stale frontier (see the `else` branch below).
+                        self.vct_frontier_frozen = true;
+                    }
+                } else if self.vct_frontier_frozen {
+                    // Frozen-frontier safety: a fast sync has already frozen the
+                    // note-commitment frontier, but this height has no valid supplied root
+                    // (never fetched, or evicted after failing verification). Recomputing
+                    // here would fold a wrong root into the history MMR and corrupt state,
+                    // so refuse with a retryable error and leave the database untouched —
+                    // the block is committed once a verifiable root is fetched from a peer.
+                    metrics::counter!("state.vct.root.unavailable.count").increment(1);
+                    tracing::warn!(
+                        ?height,
+                        "VCT: no verifiable supplied root for a frozen-frontier height; \
+                         refusing to recompute (retryable)"
+                    );
+                    return Err(ValidateContextError::VctSuppliedRootUnavailable { height }.into());
+                } else {
+                    // Not a fast block: any cached pre-validation does not apply to
+                    // the next fast block (its parent frontier differs), so clear it.
+                    self.vct_prevalidated_next = None;
+
+                    // Observability: this block recomputed the note-commitment frontier
+                    // (the legacy path) — either VCT is off, or the fast path's roots were
+                    // unavailable for this height and it safely fell back.
+                    metrics::counter!("state.vct.legacy.block.count").increment(1);
+
+                    // Legacy / capture path: recompute the note-commitment frontier.
                     //
-                    // The commitment check is done here (and not during semantic
-                    // validation) because it needs the history tree root, and the
-                    // checkpoint verifier doesn't run contextual validation. For
-                    // Nu5-onward the block hash commits only to non-authorizing data
-                    // (ZIP-244), so this verifies the authorizing-data commitment.
+                    // Run two independent CPU-intensive crypto operations concurrently
+                    // on the rayon pool: updating the note commitment trees, and
+                    // checking this block's commitment against the *parent* history
+                    // tree. They are independent; the history push below joins them.
                     #[cfg(feature = "commit-metrics")]
                     metrics::histogram!("zebra.state.write.block_tx_count")
                         .record(block.transactions.len() as f64);
@@ -673,10 +1071,7 @@ impl FinalizedState {
                     // Surface the tree-update error first, preserving the error
                     // precedence of the previous sequential code.
                     tree_result.map_err(ValidateContextError::from)?;
-                    // `rayon::in_place_scope_fifo` guarantees all spawned tasks
-                    // complete before the scope returns, so `commitment_result` is
-                    // always `Some` here: the spawned closure wrote to it before
-                    // the scope exited.
+                    // `in_place_scope_fifo` joins all spawned tasks, so this is `Some`.
                     commitment_result.expect("scope has already finished")?;
 
                     // Update the history tree (depends on both operations above).
@@ -695,47 +1090,45 @@ impl FinalizedState {
                         .map_err(Arc::new)
                         .map_err(ValidateContextError::from)?;
 
-                    // Total serial wall time of the checkpoint compute phase (note tree
-                    // update + commitment check, then history push). Compared against the
-                    // summed phase times, this shows the overlap win.
                     #[cfg(feature = "commit-metrics")]
                     metrics::histogram!("zebra.state.write.checkpoint_compute.duration_seconds")
                         .record(_ckpt_compute.elapsed().as_secs_f64());
-
-                    let treestate = Treestate {
-                        note_commitment_trees,
-                        history_tree,
-                    };
-
-                    let height = checkpoint_verified.height;
-                    let hash = checkpoint_verified.hash;
-
-                    (
-                        height,
-                        hash,
-                        FinalizedBlock::from_checkpoint_verified(checkpoint_verified, treestate),
-                        Some(prev_note_commitment_trees),
-                        self.retention_plan(height, true),
-                    )
                 }
-                FinalizableBlock::Contextual {
-                    contextually_verified,
-                    treestate,
-                } => {
-                    let height = contextually_verified.height;
-
-                    (
-                        height,
-                        contextually_verified.hash,
-                        FinalizedBlock::from_contextually_verified(
-                            contextually_verified,
-                            *treestate,
-                        ),
-                        prev_note_commitment_trees,
-                        self.retention_plan(height, false),
-                    )
-                }
-            };
+
+                let treestate = Treestate {
+                    note_commitment_trees,
+                    history_tree,
+                };
+
+                let hash = checkpoint_verified.hash;
+
+                (
+                    height,
+                    hash,
+                    FinalizedBlock::from_checkpoint_verified(checkpoint_verified, treestate),
+                    Some(prev_note_commitment_trees),
+                    self.retention_plan(height, true),
+                    vct_anchor_roots,
+                    vct_sync_below,
+                )
+            }
+            FinalizableBlock::Contextual {
+                contextually_verified,
+                treestate,
+            } => {
+                let height = contextually_verified.height;
+
+                (
+                    height,
+                    contextually_verified.hash,
+                    FinalizedBlock::from_contextually_verified(contextually_verified, *treestate),
+                    prev_note_commitment_trees,
+                    self.retention_plan(height, false),
+                    None,
+                    None,
+                )
+            }
+        };
 
         let committed_tip_hash = self.db.finalized_tip_hash();
         let committed_tip_height = self.db.finalized_tip_height();
@@ -768,24 +1161,32 @@ impl FinalizedState {
         let finalized_inner_block = finalized.block.clone();
         let note_commitment_trees = finalized.treestate.note_commitment_trees.clone();
 
-        // Build and write the block's RocksDB batch inside the dedicated
-        // commit-compute pool. The par-iter calls inside write_block end up scheduled
-        // on a separate pool from global (which is used by download/verify pipeline).
-        // This leads to less contention and more throughput, as benchmarked over the
-        // sand-blasting region.
+        // Run `write_block` directly on the committer thread rather than entering the
+        // dedicated commit-compute pool via `install()`.
+        //
+        // The committer is not a member of `COMMIT_COMPUTE_POOL`, so `install()` is a
+        // synchronous cross-thread handoff: the committer parks until a pool worker
+        // picks up the job, runs it, and signals back. That wait can dominate the
+        // isolation it was meant to provide for `write_block`'s internal rayon
+        // (`join`/`par_iter`). Running `write_block` here removes the per-block
+        // round-trip; its internal rayon uses the global pool instead. Measured net
+        // win on the sandblast region (see PR).
         let network = self.network();
-        let result = COMMIT_COMPUTE_POOL.install(|| {
-            self.db.write_block(
-                finalized,
-                prev_note_commitment_trees,
-                &network,
-                source,
-                retention,
-                None,
-            )
-        });
+        let result = self.db.write_block(
+            finalized,
+            prev_note_commitment_trees,
+            &network,
+            source,
+            retention,
+            fast_anchor_roots,
+            fast_sync_below,
+        );
 
         if result.is_ok() {
+            if let Some(vct) = &self.vct {
+                vct.evict_committed_roots_through(height);
+            }
+
             if retention.clears_archive_backlog() {
                 self.checkpoint_raw_tx_archive_backlog
                     .store(false, Ordering::Relaxed);
@@ -804,6 +1205,9 @@ impl FinalizedState {
                     "stopping at configured height, flushing database to disk"
                 );
 
+                // POC: emit the equivalence digest + fast-path summary before exit.
+                self.vct_log_equivalence_digest();
+
                 // We're just about to do a forced exit, so it's ok to do a forced db shutdown
                 self.db.shutdown(true);
 
@@ -819,6 +1223,156 @@ impl FinalizedState {
         result.map(|hash| (hash, note_commitment_trees))
     }
 
+    /// POC: `true` when the verified-commitment-trees fast (skip-recompute) path will
+    /// apply to `height` — i.e. fast mode is active *and* the source already holds this
+    /// height's roots, so the committer will fold them in and skip the frontier recompute.
+    pub(crate) fn vct_fast_will_apply(&self, height: block::Height) -> bool {
+        self.vct
+            .as_ref()
+            .is_some_and(|v| v.is_fast() && v.vct_roots_at_height(height).is_some())
+    }
+
+    /// Clears any cached successor prevalidation.
+    ///
+    /// The finalized write loop calls this when it discards checkpoint queue state, so a
+    /// look-ahead header that no longer corresponds to the next committed block cannot
+    /// authorize a later fast-path skip.
+    pub(crate) fn clear_vct_prevalidated_next(&mut self) {
+        self.vct_prevalidated_next = None;
+    }
+
+    /// `true` when committing `height` on the fast path needs a buffered successor before
+    /// it can safely persist this block's supplied roots.
+    ///
+    /// Only untrusted peer-supplied roots at or above Heartwood require this. The
+    /// checkpoint handoff is exempt because its embedded final frontiers are verified
+    /// against this block's roots before the real tip treestate is written; trusted
+    /// local fixtures can commit their tip root on the in-arrears check.
+    pub(crate) fn vct_fast_needs_successor(&self, height: block::Height) -> bool {
+        self.vct
+            .as_ref()
+            .is_some_and(|v| v.vct_root_needs_successor(height, &self.network()))
+    }
+
+    /// Verify checkpoint handoff frontiers against this block's supplied roots.
+    fn vct_verify_handoff_frontier_roots(
+        &mut self,
+        height: block::Height,
+        sapling_frontier: &sapling::tree::NoteCommitmentTree,
+        orchard_frontier: &orchard::tree::NoteCommitmentTree,
+        sapling_root: &sapling::tree::Root,
+        orchard_root: &orchard::tree::Root,
+    ) -> Result<(), CommitCheckpointVerifiedError> {
+        if sapling_frontier.root() != *sapling_root || orchard_frontier.root() != *orchard_root {
+            self.vct_prevalidated_next = None;
+            return Err(self.vct_reject_supplied_root(
+                height,
+                ValidateContextError::VctSuppliedRootUnavailable { height },
+            ));
+        }
+
+        Ok(())
+    }
+
+    /// Reject a supplied fast-path root that failed verification for `height`.
+    ///
+    /// Evicts the bad root from the source so a re-fetch can replace it with a verifiable
+    /// one from a different peer, and returns a typed, retryable error. In fast mode the
+    /// note-commitment frontier is frozen, so the committer cannot recompute the root
+    /// locally (that would fold a wrong root into the history MMR); it must refuse and
+    /// leave the database untouched rather than persist or corrupt state. This is what
+    /// keeps a single malicious peer from halting the sync: the bad root is dropped, not
+    /// retried forever, and any honest peer's root verifies.
+    fn vct_reject_supplied_root(
+        &self,
+        height: block::Height,
+        error: ValidateContextError,
+    ) -> CommitCheckpointVerifiedError {
+        if let Some(v) = &self.vct {
+            v.invalidate_fast_root(height);
+        }
+        metrics::counter!("state.vct.root.rejected.count").increment(1);
+        tracing::warn!(
+            ?height,
+            ?error,
+            "VCT: supplied commitment root failed verification; evicted for re-fetch"
+        );
+        ValidateContextError::VctSuppliedRootUnavailable { height }.into()
+    }
+
+    /// Test-only: enable fast mode reading roots/frontiers from an arbitrary
+    /// [`commitment_aux::CommitmentRootSource`] (e.g. a payload produced from a
+    /// database via [`commitment_aux::produce_block_roots`]), so the producer→consumer
+    /// round-trip can be exercised in-process. `requires_verified_successor` marks
+    /// whether the installed source is untrusted and must defer tip roots until their
+    /// successor is buffered.
+    #[cfg(test)]
+    pub(in crate::service::finalized_state) fn enable_vct_fast_source(
+        &mut self,
+        source: Box<dyn commitment_aux::CommitmentRootSource>,
+        requires_verified_successor: bool,
+    ) {
+        self.vct = Some(VctState::test_with_source(
+            source,
+            requires_verified_successor,
+        ));
+    }
+
+    /// Test-only: the fast-sync handoff height recorded in the database marker, if any.
+    #[cfg(test)]
+    pub(crate) fn vct_fast_synced_below(&self) -> Option<block::Height> {
+        self.db.vct_synced_below()
+    }
+
+    /// Test-only: number of blocks that took the fast (skip-recompute) path so far.
+    #[cfg(test)]
+    pub(crate) fn vct_fast_count(&self) -> u64 {
+        self.vct.as_ref().map(|v| v.fast_count()).unwrap_or(0)
+    }
+
+    /// Test-only: number of fast blocks whose own commitment check was skipped by
+    /// the dedup (the previous block's look-ahead already validated them).
+    #[cfg(test)]
+    pub(crate) fn vct_prevalidated_count(&self) -> u64 {
+        self.vct
+            .as_ref()
+            .map(|v| v.prevalidated_count())
+            .unwrap_or(0)
+    }
+
+    /// POC: log the consensus-equivalence digest (anchor sets + history root) and
+    /// the fast-path block count at the stop height, so a legacy run and a fast run
+    /// can be compared. Gated by `VCT_DIGEST` so normal runs pay nothing.
+    fn vct_log_equivalence_digest(&self) {
+        if std::env::var_os("VCT_DIGEST").is_none() {
+            return;
+        }
+
+        let fast_count = if let Some(v) = &self.vct {
+            v.fast_count()
+        } else {
+            0
+        };
+
+        let (
+            sapling_anchor_count,
+            sapling_anchor_digest,
+            orchard_anchor_count,
+            orchard_anchor_digest,
+        ) = self.db.vct_anchor_digest();
+        let history_root = self.db.history_tree().hash();
+
+        tracing::info!(
+            sapling_anchor_count,
+            sapling_anchor_digest,
+            orchard_anchor_count,
+            orchard_anchor_digest,
+            ?history_root,
+            vct_fast_blocks = fast_count,
+            "VCT-DIGEST"
+        );
+    }
+
     #[cfg(feature = "elasticsearch")]
     /// Store finalized blocks into an elasticsearch database.
     ///
diff --git a/zebra-state/src/service/finalized_state/commitment_aux.rs b/zebra-state/src/service/finalized_state/commitment_aux.rs
index cbbb9319a89..f97b867a3aa 100644
--- a/zebra-state/src/service/finalized_state/commitment_aux.rs
+++ b/zebra-state/src/service/finalized_state/commitment_aux.rs
@@ -1,7 +1,23 @@
-//! Payload types and the producer/serving half of the verified-commitment-trees
-//! (`docs/design/verified-commitment-trees.md`).
-
-use std::{fmt, sync::Arc};
+//! Commitment-root source seam and payload types for the verified-commitment-trees
+//! fast path (`docs/design/verified-commitment-trees.md` §5, increment 3).
+//!
+//! The fast path consumes per-block Sapling/Orchard roots and a final frontier at the
+//! checkpoint handoff. *Where* that data comes from is abstracted behind
+//! [`CommitmentRootSource`], so the committer reads through one seam regardless of
+//! source. The production source is the transport-backed [`PeerSource`] over `tree_aux`;
+//! tests use a crate-local fixture source over the same `RootMap` shape.
+//!
+//! It also provides the **producer** half ([`produce_block_roots`] /
+//! [`produce_final_frontiers`]): deriving the same payload from an existing database's
+//! per-height trees. That is the read path a serving node runs, and tests can feed the
+//! DB-produced payload back through the fast path in-process to prove producer and
+//! consumer agreement without networking.
+
+use std::{
+    collections::HashMap,
+    fmt,
+    sync::{Arc, RwLock},
+};
 
 use thiserror::Error;
 use zebra_chain::{
@@ -11,16 +27,19 @@ use zebra_chain::{
 
 use super::{FromDisk, IntoDisk, ZebraDb};
 
-/// Per-block verified commitment roots
+/// Per-block verified commitment roots — the essential fast-path payload (design §5.1),
+/// the wire payload carried over `tree_aux` (increment 6a). Defined in `zebra-chain` so
+/// `zebra-network` and `zebra-state` share it without a dependency cycle.
 pub(super) use zebra_chain::parallel::commitment_aux::BlockCommitmentRoots;
 
-/// The verified final note-commitment frontiers at the last checkpoint height.
+/// The verified final note-commitment frontiers at the checkpoint handoff height
+/// (design §5.2).
 ///
-/// Verified-commitment-tree (VCT) mode skips the per-block frontier recompute below the checkpoint, so the
+/// Fast mode skips the per-block frontier recompute below the checkpoint, so the
 /// running Sapling/Orchard frontiers are never advanced. To let post-checkpoint
 /// semantic verification resume, the real frontiers at the checkpoint are supplied
 /// here, verified (`frontier.root() == the verified root at the checkpoint`), and
-/// written as the tip treestate at the last checkpoint. Subtree tips are not carried: the
+/// written as the tip treestate at the handoff. Subtree tips are not carried: the
 /// resuming chain recomputes them from the frontier position.
 #[derive(Clone, Debug)]
 pub(super) struct FinalFrontiers {
@@ -49,9 +68,6 @@ pub enum FinalFrontiersGenerationError {
 }
 
 /// Errors parsing [`FinalFrontiers`] from the embedded/frontier-file byte format.
-// The non-test consumer is the VCT embedded-frontier loader, which lands with the
-// committer fast path in a follow-up increment; the round-trip test exercises it here.
-#[allow(dead_code)]
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub(super) enum FinalFrontiersParseError {
     /// The input ended before the 4-byte height field.
@@ -159,9 +175,6 @@ impl FinalFrontiers {
     }
 
     /// Parse the embedded byte format written by [`Self::to_bytes`].
-    // The non-test consumer is the VCT embedded-frontier loader, which lands with the
-    // committer fast path in a follow-up increment; the round-trip test exercises it here.
-    #[allow(dead_code)]
     pub(super) fn from_bytes(bytes: &[u8]) -> Result<Self, FinalFrontiersParseError> {
         let height_bytes = bytes
             .get(0..4)
@@ -253,9 +266,252 @@ impl FinalFrontiers {
     }
 }
 
+/// Where the fast path's verified per-block roots and handoff frontiers come from.
+///
+/// One enduring seam, two enduring data paths: the standard/legacy path rebuilds
+/// trees locally and never consults a source; the fast verified path reads roots
+/// from *some* source and verifies them against the headers. The production source is
+/// [`PeerSource`]; tests may install a trusted local source to isolate committer
+/// behavior. The trait carries no trust policy by itself: the owning VCT state decides
+/// whether supplied roots must be confirmed by a buffered successor before commit.
+pub(super) trait CommitmentRootSource: std::fmt::Debug + Send + Sync {
+    /// The supplied roots for `height`, if this source has them.
+    fn vct_root(&self, height: block::Height)
+        -> Option<(sapling::tree::Root, orchard::tree::Root)>;
+
+    /// The checkpoint handoff height (below which the vct path skips per-height
+    /// trees), if this source supplies a final frontier.
+    fn vct_last_checkpoint_height(&self) -> Option<block::Height>;
+
+    /// The verified final frontiers at the handoff height, if supplied.
+    fn final_frontiers(&self) -> Option<&FinalFrontiers>;
+
+    /// Discard the supplied root for `height` so a later [`fast_root`](Self::fast_root)
+    /// returns `None` for it.
+    ///
+    /// Called by the committer when a supplied root fails verification: dropping the bad
+    /// root un-poisons the cache so a re-fetch from a different peer can replace it, rather
+    /// than the committer re-reading the same rejected root forever. The default is a no-op
+    /// for test-only local sources; the peer source overrides it.
+    fn invalidate(&self, _height: block::Height) {}
+
+    /// Discard roots for heights that have already been committed.
+    ///
+    /// Called after the database write succeeds, so retry paths still keep roots needed
+    /// for an uncommitted block. The default is a no-op for test-only local sources; the
+    /// peer source uses this to keep its live fetch-ahead cache bounded during sync.
+    fn evict_committed_through(&self, _height: block::Height) {}
+}
+
+/// The shared in-memory representation behind the concrete sources: a height→roots
+/// map plus the optional handoff frontiers.
+#[cfg(test)]
+#[derive(Debug, Default)]
+struct RootMap {
+    roots: HashMap<u32, (sapling::tree::Root, orchard::tree::Root)>,
+    frontiers: Option<FinalFrontiers>,
+}
+
+#[cfg(test)]
+impl RootMap {
+    fn fast_root(
+        &self,
+        height: block::Height,
+    ) -> Option<(sapling::tree::Root, orchard::tree::Root)> {
+        self.roots.get(&height.0).copied()
+    }
+
+    fn handoff_height(&self) -> Option<block::Height> {
+        self.frontiers.as_ref().map(|f| f.height)
+    }
+
+    fn final_frontiers(&self) -> Option<&FinalFrontiers> {
+        self.frontiers.as_ref()
+    }
+}
+
+/// Test-only local source over a height-keyed roots map.
+#[cfg(test)]
+#[derive(Debug)]
+pub(super) struct FixtureSource(RootMap);
+
+#[cfg(test)]
+impl FixtureSource {
+    pub(super) fn new(
+        roots: HashMap<u32, (sapling::tree::Root, orchard::tree::Root)>,
+        frontiers: Option<FinalFrontiers>,
+    ) -> Self {
+        FixtureSource(RootMap { roots, frontiers })
+    }
+}
+
+#[cfg(test)]
+impl CommitmentRootSource for FixtureSource {
+    fn vct_root(
+        &self,
+        height: block::Height,
+    ) -> Option<(sapling::tree::Root, orchard::tree::Root)> {
+        self.0.fast_root(height)
+    }
+    fn vct_last_checkpoint_height(&self) -> Option<block::Height> {
+        self.0.handoff_height()
+    }
+    fn final_frontiers(&self) -> Option<&FinalFrontiers> {
+        self.0.final_frontiers()
+    }
+}
+
+/// A [`CommitmentRootSource`] backed by provisional header-ahead roots in `db`.
+///
+/// Header sync persists peer-supplied roots into `db` ahead of body commit; the committer
+/// reads them per height through the [`CommitmentRootSource`] seam. The handoff frontier is
+/// embedded in the binary (design §5.2), held immutably here and never fetched over the
+/// network. The in-memory `cache` is test-only scaffolding for the non-`db` source.
+#[derive(Debug)]
+pub(super) struct PeerSource {
+    db: Option<ZebraDb>,
+    cache: Arc<RwLock<PeerRootsCache>>,
+    frontiers: Option<FinalFrontiers>,
+}
+
+/// Shared peer-source cache state.
+#[derive(Debug, Default)]
+struct PeerRootsCache {
+    roots: HashMap<u32, (sapling::tree::Root, orchard::tree::Root)>,
+    committed_through: Option<u32>,
+}
+
+impl PeerSource {
+    /// Create an empty in-memory peer source and a writer sharing its cache. `frontiers`
+    /// is the embedded handoff frontier (`None` for the bare benchmark, with no checkpoint
+    /// handoff). The writer lets a test fill roots before and after the source is moved
+    /// into the committer.
+    #[cfg(any(test, feature = "proptest-impl"))]
+    #[allow(dead_code)]
+    pub(super) fn new(frontiers: Option<FinalFrontiers>) -> (Self, PeerSourceWriter) {
+        let cache = Arc::new(RwLock::new(PeerRootsCache::default()));
+        let writer = PeerSourceWriter {
+            cache: Arc::clone(&cache),
+        };
+        (
+            PeerSource {
+                db: None,
+                cache,
+                frontiers,
+            },
+            writer,
+        )
+    }
+
+    /// Create a source backed by provisional header-ahead roots in `db`.
+    pub(super) fn new_with_db(db: ZebraDb, frontiers: Option<FinalFrontiers>) -> Self {
+        PeerSource {
+            db: Some(db),
+            cache: Arc::new(RwLock::new(PeerRootsCache::default())),
+            frontiers,
+        }
+    }
+}
+
+/// Test-only writer sharing a [`PeerSource`]'s in-memory cache, so a proptest can fill
+/// roots before and after the source is moved into the committer.
+#[cfg(any(test, feature = "proptest-impl"))]
+#[derive(Clone, Debug)]
+pub(super) struct PeerSourceWriter {
+    cache: Arc<RwLock<PeerRootsCache>>,
+}
+
+#[cfg(any(test, feature = "proptest-impl"))]
+impl PeerSourceWriter {
+    /// Insert roots into the shared in-memory cache. Last write wins per uncommitted
+    /// height; roots at already-committed heights are ignored.
+    #[allow(dead_code)]
+    pub(super) fn insert_roots(&self, roots: impl IntoIterator<Item = BlockCommitmentRoots>) {
+        let mut cache = self.cache.write().expect("peer source roots lock poisoned");
+        for r in roots {
+            if cache
+                .committed_through
+                .is_some_and(|height| r.height.0 <= height)
+            {
+                continue;
+            }
+
+            cache
+                .roots
+                .insert(r.height.0, (r.sapling_root, r.orchard_root));
+        }
+    }
+}
+
+impl CommitmentRootSource for PeerSource {
+    fn vct_root(
+        &self,
+        height: block::Height,
+    ) -> Option<(sapling::tree::Root, orchard::tree::Root)> {
+        if let Some(db) = &self.db {
+            return db
+                .zakura_header_commitment_roots_by_height_range(height..=height)
+                .into_iter()
+                .next()
+                .map(|roots| (roots.sapling_root, roots.orchard_root));
+        }
+
+        self.cache
+            .read()
+            .expect("peer source roots lock poisoned")
+            .roots
+            .get(&height.0)
+            .copied()
+    }
+    fn vct_last_checkpoint_height(&self) -> Option<block::Height> {
+        self.frontiers.as_ref().map(|f| f.height)
+    }
+    fn final_frontiers(&self) -> Option<&FinalFrontiers> {
+        self.frontiers.as_ref()
+    }
+    fn invalidate(&self, height: block::Height) {
+        // Drop the rejected root so the next read misses; header sync can then deliver a
+        // verifiable replacement for this height from another peer.
+        if let Some(db) = &self.db {
+            if let Err(error) = db.delete_zakura_header_commitment_roots([height]) {
+                tracing::debug!(?error, ?height, "failed to delete rejected VCT root");
+            }
+            return;
+        }
+
+        self.cache
+            .write()
+            .expect("peer source roots lock poisoned")
+            .roots
+            .remove(&height.0);
+    }
+
+    fn evict_committed_through(&self, height: block::Height) {
+        let mut cache = self.cache.write().expect("peer source roots lock poisoned");
+        let start = cache
+            .committed_through
+            .map_or(0, |height| height.saturating_add(1));
+
+        if start <= height.0 {
+            for cached_height in start..=height.0 {
+                cache.roots.remove(&cached_height);
+            }
+            cache.committed_through = Some(height.0);
+        }
+    }
+}
+
 /// Produce the per-block roots payload for `range` from `db`'s per-height trees.
 ///
-/// Derives each root from the per-height note commitment tree.
+/// This is the serving read path (the future `TreeAuxStatePort::read_block_roots`),
+/// minus the network: it derives each root from the stored per-height tree, exactly
+/// the value the fast path folds into the anchor set. It requires per-height trees, so
+/// the caller restricts it to a non-fast-synced (archive/pre-index) database within the
+/// tip, where the trees are present. As defense-in-depth on this peer-triggered read, a
+/// height whose tree is unexpectedly absent stops the scan and serves the contiguous
+/// prefix collected so far rather than panicking; the wire client validates contiguity
+/// and treats a short batch as partial progress.
+// The `ReadRequest::BlockRoots` serving read path; also exercised by the round-trip test.
 pub(crate) fn produce_block_roots(
     db: &ZebraDb,
     range: std::ops::RangeInclusive<block::Height>,
@@ -302,23 +558,29 @@ pub(crate) fn produce_block_roots(
     roots
 }
 
-/// Serve the per-block roots for `range`, joining tree-derived roots below the VCT upgrade height
-/// with indexed roots at and above it.
+/// Serve the per-block roots for `range`, stitching the two sources at the upgrade height `U`.
 ///
-/// Each source stops at the first missing height, so the result is always a contiguous prefix from
-/// `range.start()`. Databases without a recorded upgrade height derive the whole range from trees.
+/// The `commitment_roots_by_height` serving index only covers heights at and above `U` (the lowest
+/// height this binary committed). Heights below `U` predate the index, so they are derived from the
+/// per-height trees instead, and the two runs are concatenated. This is what lets a node that
+/// upgraded mid-chain serve a request that straddles `U` as one gap-free batch, rather than the
+/// short index-only prefix that would stall the client's minimum-progress check.
+///
+/// Both sources stop at the first absent height, so the result is always a contiguous run from
+/// `range.start()`; a tree gap below `U` is served as the prefix collected so far without reaching
+/// into the index. A database that never recorded `U` — a pre-index archive node — derives the
+/// whole range from the trees, the original archive fallback.
 pub(crate) fn serve_block_roots(
     db: &ZebraDb,
     range: std::ops::RangeInclusive<block::Height>,
 ) -> Vec<BlockCommitmentRoots> {
-    // Below the VCT upgrade height, we use the per-height trees to derive the roots.
     let Some(upgrade) = db.vct_upgrade_height() else {
         return produce_block_roots(db, range);
     };
 
     let (start, end) = (*range.start(), *range.end());
 
-    // Wholly at/above `U`: the VCT-specific index covers it. (`U == 0` for a node that fast-synced from
+    // Wholly at/above `U`: the index covers it. (`U == 0` for a node that fast-synced from
     // genesis takes this path for every request, never touching the absent per-height trees.)
     if start >= upgrade {
         return db.commitment_roots_by_height_range(range);
@@ -363,7 +625,7 @@ pub(super) fn produce_final_frontiers(
 /// Produce serialized final-frontier bytes for the checkpoint handoff at `height`.
 ///
 /// These bytes use the same format as the embedded `mainnet-frontier.bin` file consumed by
-/// the VCT frontier loader (landing with the committer fast path in a follow-up increment).
+/// [`super::vct`].
 pub fn produce_final_frontiers_bytes(
     db: &ZebraDb,
     height: block::Height,
@@ -728,4 +990,89 @@ mod tests {
             }
         );
     }
+
+    /// The test fixture source looks up produced roots by height and exposes
+    /// the handoff frontier — the consumer view of producer output.
+    #[test]
+    fn fixture_source_round_trips_payload() {
+        let roots = vec![
+            BlockCommitmentRoots {
+                height: block::Height(10),
+                sapling_root: sapling::tree::NoteCommitmentTree::default().root(),
+                orchard_root: orchard::tree::NoteCommitmentTree::default().root(),
+                ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+                sapling_tx: 0,
+                orchard_tx: 0,
+                ironwood_tx: 0,
+                auth_data_root: AuthDataRoot::from([0u8; 32]),
+            },
+            BlockCommitmentRoots {
+                height: block::Height(11),
+                sapling_root: sapling::tree::NoteCommitmentTree::default().root(),
+                orchard_root: orchard::tree::NoteCommitmentTree::default().root(),
+                ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+                sapling_tx: 0,
+                orchard_tx: 0,
+                ironwood_tx: 0,
+                auth_data_root: AuthDataRoot::from([0u8; 32]),
+            },
+        ];
+        let roots = roots
+            .into_iter()
+            .map(|root| (root.height.0, (root.sapling_root, root.orchard_root)))
+            .collect();
+        let frontiers = FinalFrontiers {
+            height: block::Height(11),
+            sapling: Arc::new(Default::default()),
+            orchard: Arc::new(Default::default()),
+            sprout: Arc::new(Default::default()),
+        };
+
+        let source = FixtureSource::new(roots, Some(frontiers));
+
+        assert!(
+            source.vct_root(block::Height(10)).is_some(),
+            "produced root is looked up by height"
+        );
+        assert!(
+            source.vct_root(block::Height(99)).is_none(),
+            "absent height has no root"
+        );
+        assert_eq!(
+            source.vct_last_checkpoint_height(),
+            Some(block::Height(11)),
+            "handoff height comes from the supplied frontiers"
+        );
+    }
+
+    /// `invalidate` drops a peer-supplied root so a later read misses it, letting the
+    /// driver re-fetch a verifiable replacement from another peer. This un-poisons the
+    /// cache after a bad root is rejected by the committer, so one malicious peer cannot
+    /// wedge the same rejected root in place forever.
+    #[test]
+    fn peer_source_invalidate_evicts_a_root() {
+        let (source, writer) = PeerSource::new(None);
+        writer.insert_roots([BlockCommitmentRoots {
+            height: block::Height(42),
+            sapling_root: sapling::tree::NoteCommitmentTree::default().root(),
+            orchard_root: orchard::tree::NoteCommitmentTree::default().root(),
+            ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+            sapling_tx: 0,
+            orchard_tx: 0,
+            ironwood_tx: 0,
+            auth_data_root: AuthDataRoot::from([0u8; 32]),
+        }]);
+
+        assert!(
+            source.vct_root(block::Height(42)).is_some(),
+            "the inserted root is present before eviction"
+        );
+
+        source.invalidate(block::Height(42));
+
+        assert!(
+            source.vct_root(block::Height(42)).is_none(),
+            "an evicted root is gone, so the next read misses and a re-fetch can replace it"
+        );
+    }
 }
diff --git a/zebra-state/src/service/finalized_state/commitment_aux_verify.rs b/zebra-state/src/service/finalized_state/commitment_aux_verify.rs
index f5cd2a57558..2247c7130ec 100644
--- a/zebra-state/src/service/finalized_state/commitment_aux_verify.rs
+++ b/zebra-state/src/service/finalized_state/commitment_aux_verify.rs
@@ -1,12 +1,16 @@
 //! Read-only verification of supplied per-block note-commitment roots against the
 //! checkpoint-committed block headers, via the ZIP-221 ChainHistory MMR.
 //!
-//! This is the "verify" component of the verified-commitment-trees design
-//! (`docs/design/verified-commitment-trees.md`). Given a sequence of per-block
+//! This is the "verify" half of the verified-commitment-trees design
+//! (`docs/design/verified-commitment-trees.md` §6): given a sequence of per-block
 //! Sapling/Orchard roots (from a fixture today, an untrusted peer later), confirm
-//! they reconstruct a history tree consistent with the header commitments.
-
-#![cfg_attr(not(test), allow(dead_code))]
+//! they reconstruct a history tree consistent with the header commitments. The
+//! commit path uses this module before persisting supplied roots.
+//!
+//! It reuses the existing consensus check
+//! ([`block_commitment_is_valid_for_chain_history`](crate::service::check::block_commitment_is_valid_for_chain_history))
+//! and [`HistoryTree::push`], which build the V1/V2 leaf from the block body and the
+//! supplied roots — so there is no new crypto here.
 
 use std::sync::Arc;
 
@@ -67,13 +71,21 @@ impl CommitmentRootVerification {
 }
 
 /// Verifies a supplied Sapling root for a *pre-Heartwood* block directly against the
-/// block header.
+/// block header (design §6.1).
 ///
-/// The ZIP-221 history MMR does not exist below Heartwood, so `block_commitment_is_valid_for_chain_history`
+/// The ZIP-221 history MMR does not exist below Heartwood, so
+/// [`block_commitment_is_valid_for_chain_history`](check::block_commitment_is_valid_for_chain_history)
 /// is a no-op there and cannot authenticate the supplied roots. This fills that gap:
+///
 /// - Sapling..Heartwood: the header's `FinalSaplingRoot` commits the Sapling root
 ///   directly, so the supplied root must equal it.
-/// - Pre-Sapling: the Sapling tree is empty, so the supplied root must be the empty-tree root.
+/// - Pre-Sapling: the Sapling tree is empty, so the supplied root must be the
+///   empty-tree root.
+///
+/// Heartwood and later (`ChainHistoryRoot` / `ChainHistoryBlockTxAuthCommitment` /
+/// the activation-reserved block) are authenticated by the MMR path and accepted
+/// here. The Orchard root below NU5 is pinned separately by
+/// [`verify_supplied_orchard_root_below_nu5`].
 pub(crate) fn verify_supplied_sapling_root_below_heartwood(
     network: &Network,
     block: &Block,
@@ -98,10 +110,20 @@ pub(crate) fn verify_supplied_sapling_root_below_heartwood(
     Ok(())
 }
 
-/// Verifies a supplied Orchard root for a pre-NU5 block.
+/// Verifies a supplied Orchard root for a *pre-NU5* block (design §6.1).
+///
+/// The Orchard tree does not activate until NU5, and no header below NU5 commits to an
+/// Orchard root: the ZIP-221 V1 history leaf (Heartwood..Canopy) *ignores* the Orchard
+/// root entirely (`zcash_history.rs`, `V1::block_to_history_node`), and below Heartwood
+/// there is no MMR at all. So the MMR path that authenticates Orchard roots from NU5
+/// onward cannot vouch for any root below NU5 — yet the fast path folds the supplied
+/// Orchard root into the anchor set for every block. Without this check an untrusted
+/// source could inject an arbitrary Orchard anchor below NU5 that the legacy recompute
+/// path never produces, breaking the §11 trust boundary and consensus equivalence.
 ///
-/// Blocks before NU5 do not commit to Orchard roots, so the MMR cannot
-/// authenticate them. The supplied root must therefore be the empty-tree root.
+/// Below NU5 the Orchard tree is always the empty default, so the supplied root must
+/// equal the empty-tree root. At and above NU5 activation the MMR path authenticates
+/// the root, so this accepts.
 pub(crate) fn verify_supplied_orchard_root_below_nu5(
     network: &Network,
     height: Height,
@@ -172,11 +194,10 @@ where
         //    * This is so that we do not commit block X before we have verified its roots.
         // 3. Verify block X + 1 against block X history tree
         //
-        // Note that, when we are processing block X + 1 step 1, we are ovrlapping
+        // Note that, when we are processing block X + 1 step 1, we are overlapping
         // with step 3 of the prior iteration so verification can be skipped in that case
         // for perf reasons.
         if !skip_parent_check {
-            // This block + history tree up to and including the previous block.
             check::block_commitment_is_valid_for_chain_history(
                 block.clone(),
                 network,
@@ -203,8 +224,6 @@ where
                 block,
                 &sapling_root,
                 &orchard_root,
-                // TODO: add ironwood root
-                // https://linear.app/zcale/issue/ZCA-746/wire-up-ironwood-into-vct
                 &Default::default(),
             )
             .map_err(Arc::new)
diff --git a/zebra-state/src/service/finalized_state/disk_format/chain.rs b/zebra-state/src/service/finalized_state/disk_format/chain.rs
index ae86b025eb5..31bd1a2a8d6 100644
--- a/zebra-state/src/service/finalized_state/disk_format/chain.rs
+++ b/zebra-state/src/service/finalized_state/disk_format/chain.rs
@@ -52,6 +52,18 @@ pub struct HistoryTreeParts {
 }
 
 impl HistoryTreeParts {
+    /// Deserializes history tree parts from raw database bytes.
+    pub(crate) fn from_bytes_result(bytes: impl AsRef<[u8]>) -> Result<Self, bincode::Error> {
+        let bytes = bytes.as_ref();
+        let options = bincode::DefaultOptions::new();
+
+        options.deserialize::<HistoryTreeParts>(bytes).or_else(|_| {
+            options
+                .deserialize::<LegacyHistoryTreeParts>(bytes)
+                .map(HistoryTreeParts::from)
+        })
+    }
+
     /// Converts [`HistoryTreeParts`] to a [`NonEmptyHistoryTree`].
     pub(crate) fn with_network(
         self,
@@ -130,23 +142,7 @@ impl From<LegacyHistoryTreeParts> for HistoryTreeParts {
 
 impl FromDisk for HistoryTreeParts {
     fn from_bytes(bytes: impl AsRef<[u8]>) -> Self {
-        let bytes = bytes.as_ref();
-        let options = bincode::DefaultOptions::new();
-
-        // Try the current entry width first. Databases written before NU6.3 widened
-        // `zcash_history::Entry` store narrower entries that fail to parse at the current width,
-        // so fall back to the legacy width and zero-pad each entry up to the current width.
-        //
-        // Legacy-width rows can fail the current-width decoder with errors other than
-        // `UnexpectedEof`, because the wider entry can read into the next legacy entry and
-        // interpret arbitrary entry bytes as bincode control bytes.
-        options
-            .deserialize::<HistoryTreeParts>(bytes)
-            .or_else(|_| {
-                options
-                    .deserialize::<LegacyHistoryTreeParts>(bytes)
-                    .map(HistoryTreeParts::from)
-            })
+        Self::from_bytes_result(bytes)
             .expect("deserialization format should match the serialization format used by IntoDisk")
     }
 }
diff --git a/zebra-state/src/service/finalized_state/disk_format/tests/snapshot.rs b/zebra-state/src/service/finalized_state/disk_format/tests/snapshot.rs
index fe1c390a76f..6b3436fc2ef 100644
--- a/zebra-state/src/service/finalized_state/disk_format/tests/snapshot.rs
+++ b/zebra-state/src/service/finalized_state/disk_format/tests/snapshot.rs
@@ -96,7 +96,7 @@ fn test_raw_rocksdb_column_families_with_network(network: Network) {
             .expect("test data deserializes");
 
         state
-            .commit_finalized_direct(block.into(), None, "snapshot tests")
+            .commit_finalized_direct(block.into(), None, None, "snapshot tests")
             .expect("test block is valid");
 
         let mut settings = insta::Settings::clone_current();
diff --git a/zebra-state/src/service/finalized_state/disk_format/upgrade/cache_genesis_roots.rs b/zebra-state/src/service/finalized_state/disk_format/upgrade/cache_genesis_roots.rs
index 0d7a41e460d..bbd8f64ef9b 100644
--- a/zebra-state/src/service/finalized_state/disk_format/upgrade/cache_genesis_roots.rs
+++ b/zebra-state/src/service/finalized_state/disk_format/upgrade/cache_genesis_roots.rs
@@ -81,11 +81,26 @@ pub fn quick_check(db: &ZebraDb) -> Result<(), String> {
         return Ok(());
     }
 
-    // A fast-sync commit can set the VCT marker after the `is_vct_synced()`
-    // check above but before these tree reads. In that case the readers return
-    // `None` for the absent per-height trees, and this genesis-root check no
-    // longer applies. Non-VCT databases still panic on genuinely missing genesis
-    // trees inside the readers.
+    // The genesis-tree reads below are not race-free against an in-progress fast
+    // sync. This validity check runs on a background thread (see
+    // `DbFormatChange::spawn_format_change`) concurrently with block commits, and
+    // the per-height tree readers (`sapling_tree_by_height` etc.) return `None`
+    // for any height in a fast-synced database's `[U, H)` absent band -- a guard
+    // that re-reads the `vct_synced_below` marker. The `is_vct_synced()` check
+    // above reads that same marker, but a fast-sync commit can set it in the
+    // window between the two reads: this function then passes the `is_vct_synced()`
+    // guard (marker still unset) and *afterwards* a genesis read returns `None`
+    // (marker now set, so height 0 is in the absent band). Before this change the
+    // `.expect("just checked for genesis block")` panicked on exactly that
+    // interleaving, surfacing under the test suite's parallelism as a flaky
+    // `vct_mode_switches_continue_from_safe_boundaries` failure.
+    //
+    // A `None` here can only mean the absent-band guard fired, i.e. the database
+    // is (now) fast-synced and the genesis-root-caching invariant does not apply
+    // to it -- a genuinely missing genesis tree on a non-fast database makes these
+    // readers panic with their own "must exist" message rather than return `None`.
+    // So treat `None` as "invariant not applicable" and return `Ok` instead of
+    // racing the marker.
     let sprout_genesis_tree = sprout::tree::NoteCommitmentTree::default();
     let Some(sprout_genesis_tree) = db.sprout_tree_by_anchor(&sprout_genesis_tree.root()) else {
         return Ok(());
diff --git a/zebra-state/src/service/finalized_state/tests/prop.rs b/zebra-state/src/service/finalized_state/tests/prop.rs
index 206657b6de2..707bc84ff28 100644
--- a/zebra-state/src/service/finalized_state/tests/prop.rs
+++ b/zebra-state/src/service/finalized_state/tests/prop.rs
@@ -1,6 +1,9 @@
 //! Randomised property tests for the finalized state.
 
-use std::{env, error::Error};
+use std::{collections::HashMap, env, error::Error, fs, sync::Arc};
+
+use tempfile::TempDir;
+use tokio::sync::oneshot;
 
 use zebra_chain::{
     block::Height,
@@ -13,16 +16,137 @@ use zebra_chain::{
 use zebra_test::prelude::*;
 
 use crate::{
-    config::Config,
-    service::{
-        arbitrary::PreparedChain,
-        finalized_state::{CheckpointVerifiedBlock, FinalizedState},
-    },
-    tests::FakeChainHelper,
+    config::Config, service::arbitrary::PreparedChain, tests::FakeChainHelper, HashOrHeight,
+};
+
+use super::super::{
+    commitment_aux, serve_block_roots, vct::validate_final_frontiers_bytes,
+    CheckpointVerifiedBlock, DiskWriteBatch, FinalizedState,
 };
 
 const DEFAULT_PARTIAL_CHAIN_PROPTEST_CASES: u32 = 1;
 
+type TestRootMap = HashMap<
+    u32,
+    (
+        zebra_chain::sapling::tree::Root,
+        zebra_chain::orchard::tree::Root,
+    ),
+>;
+type SaplingTree = Arc<zebra_chain::sapling::tree::NoteCommitmentTree>;
+type OrchardTree = Arc<zebra_chain::orchard::tree::NoteCommitmentTree>;
+type SproutTree = Arc<zebra_chain::sprout::tree::NoteCommitmentTree>;
+
+fn enable_vct_test_fixture_source(state: &mut FinalizedState, roots: TestRootMap) {
+    state.enable_vct_fast_source(
+        Box::new(commitment_aux::FixtureSource::new(roots, None)),
+        false,
+    );
+}
+
+fn enable_vct_test_fixture_source_with_handoff(
+    state: &mut FinalizedState,
+    roots: TestRootMap,
+    handoff_height: Height,
+    sapling: SaplingTree,
+    orchard: OrchardTree,
+    sprout: SproutTree,
+) {
+    state.enable_vct_fast_source(
+        Box::new(commitment_aux::FixtureSource::new(
+            roots,
+            Some(commitment_aux::FinalFrontiers {
+                height: handoff_height,
+                sapling,
+                orchard,
+                sprout,
+            }),
+        )),
+        false,
+    );
+}
+
+#[test]
+fn vct_generated_final_frontier_bytes_are_node_loader_compatible() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last, "generated chain unexpectedly short");
+            let height = Height(last as u32);
+
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            for block in blocks.iter().take(last + 1) {
+                let cv = CheckpointVerifiedBlock::from(block.block.clone());
+                legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct frontier bytes legacy")
+                    .unwrap();
+            }
+
+            let bytes = commitment_aux::produce_final_frontiers_bytes(&legacy.db, height)
+                .expect("legacy DB has final frontiers at the requested height");
+            let temp_dir = TempDir::new().expect("temp dir");
+            let path = temp_dir.path().join("frontier.bin");
+            fs::write(&path, &bytes).expect("frontier bytes write to temp file");
+
+            let bytes_from_file = fs::read(&path).expect("frontier bytes read from temp file");
+            validate_final_frontiers_bytes(&bytes_from_file, height)
+                .expect("generated frontier bytes pass node loader validation");
+
+            let parsed = commitment_aux::FinalFrontiers::from_bytes(&bytes_from_file)
+                .expect("validated bytes parse as final frontiers");
+            prop_assert_eq!(parsed.height, height, "frontier height round-trips");
+            prop_assert_eq!(
+                parsed.sapling.root(),
+                legacy.db.sapling_tree_by_height(&height).unwrap().root(),
+                "parsed Sapling frontier matches the DB tree at the requested height"
+            );
+            prop_assert_eq!(
+                parsed.orchard.root(),
+                legacy.db.orchard_tree_by_height(&height).unwrap().root(),
+                "parsed Orchard frontier matches the DB tree at the requested height"
+            );
+            prop_assert_eq!(
+                parsed.sprout.root(),
+                legacy.db.sprout_tree_for_tip().root(),
+                "parsed Sprout frontier matches the DB tip tree"
+            );
+
+            let wrong_height = Height(height.0.checked_add(1).expect("test height is in range"));
+            prop_assert!(
+                validate_final_frontiers_bytes(&bytes_from_file, wrong_height).is_err(),
+                "node loader validation rejects a frontier whose height does not match the checkpoint"
+            );
+    });
+
+    Ok(())
+}
+
 #[test]
 fn blocks_with_v5_transactions() -> Result<()> {
     let _init_guard = zebra_test::init();
@@ -39,6 +163,7 @@ fn blocks_with_v5_transactions() -> Result<()> {
                 let (hash, _) = state.commit_finalized_direct(
                     checkpoint_verified.into(),
                     None,
+                    None,
                     "blocks_with_v5_transactions test"
                 ).unwrap();
                 prop_assert_eq!(Some(height), state.finalized_tip_height());
@@ -115,6 +240,7 @@ fn all_upgrades_and_wrong_commitments_with_fake_activation_heights() -> Result<(
                             state.commit_finalized_direct(
                                 checkpoint_verified.into(),
                                 None,
+                                None,
                                 "all_upgrades test"
                             ).expect_err("Must fail commitment check");
                             failure_count += 1;
@@ -124,10 +250,11 @@ fn all_upgrades_and_wrong_commitments_with_fake_activation_heights() -> Result<(
                 if current_height == nu5_height_plus1 {
                     let mut checkpoint_verified =
                         CheckpointVerifiedBlock::from(block.block.clone());
-                    checkpoint_verified.auth_data_root = Some([0x42; 32].into());
+                    checkpoint_verified.0.auth_data_root = Some([0x42; 32].into());
                     let err = state.commit_finalized_direct(
                         checkpoint_verified.into(),
                         None,
+                        None,
                         "all_upgrades bad auth root test"
                     ).expect_err("Must fail when the supplied auth data root is incorrect");
                     let commit_error = err
@@ -151,6 +278,7 @@ fn all_upgrades_and_wrong_commitments_with_fake_activation_heights() -> Result<(
                 let (hash, _) = state.commit_finalized_direct(
                     checkpoint_verified.into(),
                     None,
+                    None,
                     "all_upgrades test"
                 ).unwrap();
                 prop_assert_eq!(Some(height), state.finalized_tip_height());
@@ -164,3 +292,1630 @@ fn all_upgrades_and_wrong_commitments_with_fake_activation_heights() -> Result<(
 
     Ok(())
 }
+
+/// Verified-commitment-trees fast path (`commit_finalized_direct` Checkpoint arm):
+/// committing with correct fixture roots produces the same consensus state (anchor
+/// sets + history root) as the legacy recompute path across all upgrade boundaries,
+/// and a wrong fixture root is rejected (verify-before-commit) rather than persisted.
+/// Exercises: a below-Heartwood seed, history-tree creation at Heartwood, the NU5
+/// V1->V2 transition, verify-ahead against the buffered successor, trusted fixture tip
+/// commits without a successor, and rejection of a corrupted root.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loops index blocks[i+1] and the fixture by height
+fn vct_fast_path_matches_legacy_and_rejects_wrong_roots() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(env::var("PROPTEST_CASES")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(DEFAULT_PARTIAL_CHAIN_PROPTEST_CASES)),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+
+            // Process a bounded prefix [0, last] spanning the Heartwood (history-tree
+            // creation) and NU5 (V1->V2) boundaries plus a couple of V2 blocks; `last` is
+            // the tip we compare at. Chains are far longer than this
+            // (MAX_PARTIAL_CHAIN_BLOCKS), so this is a plain assertion, not a discard.
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last + 1, "generated chain unexpectedly short");
+
+            // The fast path runs below the checkpoint, seeded from an already-committed
+            // tip. Seed just before Heartwood so the fast range creates the history tree
+            // (Heartwood) and crosses NU5 (V1->V2).
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy pass over [0, last]: record per-block roots for the fast range as
+            // the fixture, and the golden consensus state at the tip.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+            let golden_anchors = legacy.db.vct_anchor_digest();
+            let golden_history = legacy.db.history_tree().hash();
+
+            // Fast pass over [0, last] with the correct fixture: genesis..=seed recompute
+            // (no fixture entry); seed+1..=last verify-ahead against their buffered
+            // successor. Every fast-eligible block takes the fast path, and the result
+            // equals legacy.
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut fast, fixture.clone());
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct fast")
+                    .expect("verified fast commit succeeds");
+            }
+            prop_assert_eq!(fast.db.vct_anchor_digest(), golden_anchors, "fast anchors must match legacy");
+            prop_assert_eq!(fast.db.history_tree().hash(), golden_history, "fast history must match legacy");
+            prop_assert_eq!(fast.vct_fast_count(), (last - seed) as u64, "every fast-eligible block took the fast path");
+            // The dedup: each header commitment is checked once, not twice. Only the
+            // first fast block runs its own commitment check; every later fast block
+            // was already validated by its predecessor's look-ahead, so it is skipped.
+            prop_assert_eq!(fast.vct_prevalidated_count(), (last - seed - 1) as u64, "every fast block after the first skips its redundant own commitment check");
+
+            // A trusted local fixture may commit its tip root without a successor: it is
+            // not adversarial and the root is checked in arrears when a successor arrives.
+            let mut no_successor = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut no_successor, fixture.clone());
+            for i in 0..last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                no_successor
+                    .commit_finalized_direct(cv.into(), None, next, "vct no-successor seed")
+                    .expect("verified fast commit succeeds with successor");
+            }
+            prop_assert!(!no_successor.vct_fast_needs_successor(Height(last as u32)), "a trusted fixture tip can commit without a successor");
+            let cv = CheckpointVerifiedBlock::from(blocks[last].block.clone());
+            no_successor
+                .commit_finalized_direct(cv.into(), None, None, "vct trusted fixture no successor")
+                .expect("trusted fixture tip commits without a successor");
+            prop_assert_eq!(
+                no_successor.db.finalized_tip_height(),
+                Some(Height(last as u32)),
+                "the trusted fixture tip committed"
+            );
+
+            // Negative: corrupt the fixture Sapling root at a V2 (post-NU5) height with a
+            // distinct value (the empty root; a V2 block has a non-empty Sapling tree).
+            // Fast mode cannot recompute a bad root away (the frontier is frozen), so the
+            // wrong root must be *rejected* by the next block's commitment (verify-before-
+            // commit) — the commit at that height fails rather than persisting it.
+            let bad_height = (nu5 + 1) as usize;
+            let mut bad_fixture = fixture.clone();
+            let bad_entry = bad_fixture.get_mut(&(bad_height as u32)).unwrap();
+            prop_assert_ne!(bad_entry.0, Default::default(), "a V2 block must have a non-empty Sapling root");
+            bad_entry.0 = Default::default();
+
+            let mut bad = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut bad, bad_fixture);
+            let mut error_height = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                if bad.commit_finalized_direct(cv.into(), None, next, "vct bad").is_err() {
+                    error_height = Some(i);
+                    break;
+                }
+            }
+            prop_assert_eq!(error_height, Some(bad_height), "a wrong fixture root is rejected at its own commit");
+
+            // Negative (Orchard, below NU5): no header commits to an Orchard root below
+            // NU5 (V1 history leaves ignore it; no MMR below Heartwood), so the fast path
+            // pins it to the empty-tree root. Corrupt a below-NU5 fixture Orchard root to
+            // a non-empty value. Unlike the Sapling MMR path (one-block lag), this is a
+            // direct check, so it is rejected at the block's *own* commit — closing the
+            // hole where an untrusted source injects a spurious Orchard anchor.
+            let bad_orchard_height = (nu5 - 1) as usize;
+            prop_assert!(bad_orchard_height > seed, "the corrupted height must be in the fast range");
+            let empty_orchard = zebra_chain::orchard::tree::NoteCommitmentTree::default().root();
+            let wrong_orchard = zebra_chain::orchard::tree::Root::try_from([0u8; 32])
+                .expect("zero is a valid pallas base field element");
+            prop_assert_ne!(wrong_orchard, empty_orchard, "the wrong root must differ from the empty-tree root");
+
+            let mut bad_orchard_fixture = fixture.clone();
+            let bad_orchard_entry = bad_orchard_fixture.get_mut(&(bad_orchard_height as u32)).unwrap();
+            prop_assert_eq!(bad_orchard_entry.1, empty_orchard, "a below-NU5 block has the empty Orchard root");
+            bad_orchard_entry.1 = wrong_orchard;
+
+            let mut bad_orchard = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut bad_orchard, bad_orchard_fixture);
+            let mut orchard_error_height = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                if bad_orchard.commit_finalized_direct(cv.into(), None, next, "vct bad orchard").is_err() {
+                    orchard_error_height = Some(i);
+                    break;
+                }
+            }
+            prop_assert_eq!(orchard_error_height, Some(bad_orchard_height), "a wrong below-NU5 orchard root is rejected at its own commit");
+    });
+
+    Ok(())
+}
+
+/// A verified-commitment-trees fast sync must never legacy-recompute a height whose
+/// supplied root is missing once the note-commitment frontier is frozen: the running
+/// frontier is no longer the real one, so recomputing would fold a wrong root into the
+/// history MMR and silently corrupt consensus state (a peer that omits a height — see the
+/// driver's gap handling — could trigger this). Instead the committer must refuse with the
+/// retryable `VctSuppliedRootUnavailable` error and leave the database untouched, so the
+/// block can be committed later from a fetched root. This guards the liveness/no-corruption
+/// half of the peer-source fast path (the bad-root rejection half is covered by
+/// `vct_fast_path_matches_legacy_and_rejects_wrong_roots`).
+#[test]
+#[allow(clippy::needless_range_loop)] // the loop indexes blocks[i+1] and the fixture by height
+fn vct_frozen_frontier_hole_refuses_instead_of_recomputing() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last + 1, "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            // Record the per-block roots for the fast range as the fixture.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct hole legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+
+            // Punch a hole: drop a post-NU5 height's root from the fixture, simulating a
+            // peer that omitted it (or a root evicted after failing verification). Earlier
+            // fast blocks freeze the frontier, so this height has no real frontier to
+            // recompute against.
+            let hole = (nu5 + 1) as usize;
+            prop_assert!(hole > seed && hole < last, "the hole must be inside the fast range");
+            fixture.remove(&(hole as u32));
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut fast, fixture);
+
+            let mut error_height = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = (i < last).then(|| (blocks[i + 1].block.clone(), None));
+                match fast.commit_finalized_direct(cv.into(), None, next, "vct hole fast") {
+                    Ok(_) => {}
+                    Err(error) => {
+                        // The refusal is the typed, retryable error — not a generic
+                        // invalid-block error and not silent corruption.
+                        prop_assert!(
+                            format!("{error:?}").contains("VctSuppliedRootUnavailable"),
+                            "a frozen-frontier hole returns the retryable VctSuppliedRootUnavailable error, got: {error:?}"
+                        );
+                        error_height = Some(i);
+                        break;
+                    }
+                }
+            }
+
+            prop_assert_eq!(error_height, Some(hole), "the commit refuses at the hole height, not before or after");
+            // Nothing at or past the hole was persisted: the tip is the last block before
+            // the hole, so no corrupt MMR leaf was written.
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height((hole - 1) as u32)),
+                "the database tip stays just below the hole — the refused block left state untouched"
+            );
+    });
+
+    Ok(())
+}
+
+/// Retryable VCT root misses must stay internal to the finalized write loop: the
+/// public checkpoint commit wrapper returns the queued block and error to the caller
+/// that can retry, rather than completing the block's response channel with a
+/// transient error.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loop indexes blocks[i+1] and the fixture by height
+fn vct_retryable_root_miss_keeps_checkpoint_response_pending() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last, "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct response legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+
+            let hole = (nu5 + 1) as usize;
+            fixture.remove(&(hole as u32));
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut fast, fixture);
+
+            for i in 0..hole {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct response fast")
+                    .expect("pre-hole fast commits succeed");
+            }
+
+            let cv = CheckpointVerifiedBlock::from(blocks[hole].block.clone());
+            let (rsp_tx, mut rsp_rx) = oneshot::channel();
+            let next = Some((blocks[hole + 1].block.clone(), None));
+            let result = fast.commit_finalized((cv, rsp_tx), None, next);
+            let Err((returned_block, error)) = result else {
+                panic!("missing frozen-frontier root should return the queued block for retry");
+            };
+
+            prop_assert_eq!(returned_block.0.height, Height(hole as u32));
+            prop_assert!(
+                error.vct_supplied_root_unavailable_height().is_some(),
+                "the returned error is the typed retryable VCT root miss"
+            );
+            prop_assert!(
+                matches!(rsp_rx.try_recv(), Err(oneshot::error::TryRecvError::Empty)),
+                "the checkpoint response stays pending so the write loop can retry internally"
+            );
+    });
+
+    Ok(())
+}
+
+/// An *untrusted* (peer) source must never commit a fast block whose own supplied root has
+/// no buffered successor to confirm it against the header chain. A block's roots are only
+/// committed by the next block's header (the one-block lag), so committing at the sync tip
+/// would persist a root checked only one block later — irreversibly, once on disk. A wrong
+/// tip root would then wedge the sync with no recovery (the failure surfaces at the next
+/// block and is mis-attributed to *its* root). So the committer defers: it refuses the tip
+/// block with the retryable `VctSuppliedRootAwaitingSuccessor`, leaves the database
+/// untouched, and commits the same height once a successor is buffered. A trusted local
+/// fixture is exempt (covered by `vct_fast_path_matches_legacy_and_rejects_wrong_roots`,
+/// whose tip commits on the in-arrears check); this guards the peer path specifically.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loop indexes blocks[i+1] and inserts roots by height
+fn vct_peer_source_defers_unverifiable_tip_root_until_successor() -> Result<()> {
+    use crate::service::finalized_state::commitment_aux::PeerSource;
+    use zebra_chain::parallel::commitment_aux::BlockCommitmentRoots;
+
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            // The deferral target: a post-NU5 (real MMR root) height, so it sits above
+            // Heartwood where the root needs a successor to be confirmed.
+            let tip_target = (nu5 + 1) as usize;
+            prop_assert!(blocks.len() > tip_target + 1, "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy golden pass to source the correct per-block roots for the fast range.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut peer_roots = Vec::new();
+            for i in 0..=tip_target {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct defer legacy")
+                    .unwrap();
+                if i > seed {
+                    peer_roots.push(BlockCommitmentRoots {
+                        height: Height(i as u32),
+                        sapling_root: trees.sapling.root(),
+                        orchard_root: trees.orchard.root(),
+                        ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+                        sapling_tx: 0,
+                        orchard_tx: 0,
+                        ironwood_tx: 0,
+                        auth_data_root: blocks[i].block.auth_data_root(),
+                    });
+                }
+            }
+
+            // An untrusted peer source pre-filled with the *correct* roots: the deferral is
+            // about the missing successor, not a bad root.
+            let (source, writer) = PeerSource::new(None);
+            writer.insert_roots(peer_roots);
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            fast.enable_vct_fast_source(Box::new(source), true);
+
+            // Commit up to (but not including) the tip target, each with its successor.
+            for i in 0..tip_target {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct defer pre-tip")
+                    .expect("pre-tip fast commits succeed");
+            }
+            prop_assert_eq!(fast.db.finalized_tip_height(), Some(Height((tip_target - 1) as u32)));
+
+            // The tip target with no buffered successor must defer, not commit: its own
+            // (correct) root is not yet confirmed, and the peer source is untrusted.
+            prop_assert!(
+                fast.vct_fast_needs_successor(Height(tip_target as u32)),
+                "an untrusted peer tip root needs successor verification"
+            );
+            let pre_deferral_prevalidated = fast.vct_prevalidated_count();
+            let cv = CheckpointVerifiedBlock::from(blocks[tip_target].block.clone());
+            let error = fast
+                .commit_finalized_direct(cv.into(), None, None, "vct defer tip no successor")
+                .expect_err("an untrusted tip root with no successor must defer, not commit");
+            prop_assert!(
+                error.vct_supplied_root_unavailable_height().is_none(),
+                "deferral is not a refetch case (the root is present): {error:?}"
+            );
+            prop_assert!(
+                format!("{error:?}").contains("VctSuppliedRootAwaitingSuccessor"),
+                "the tip defers with the await-successor error, got: {error:?}"
+            );
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height((tip_target - 1) as u32)),
+                "the deferred block left the database untouched"
+            );
+            let after_deferral_prevalidated = fast.vct_prevalidated_count();
+            prop_assert_eq!(
+                after_deferral_prevalidated,
+                pre_deferral_prevalidated + 1,
+                "the deferred attempt uses the predecessor look-ahead"
+            );
+
+            // Once a successor is buffered, the very same height commits and the tip advances:
+            // the deferral was a wait, not a permanent stall.
+            let cv = CheckpointVerifiedBlock::from(blocks[tip_target].block.clone());
+            let next = Some((blocks[tip_target + 1].block.clone(), None));
+            fast.commit_finalized_direct(cv.into(), None, next, "vct defer tip with successor")
+                .expect("the deferred height commits once its successor is buffered");
+            prop_assert_eq!(
+                fast.vct_prevalidated_count(),
+                after_deferral_prevalidated + 1,
+                "the retry reuses the preserved predecessor look-ahead"
+            );
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height(tip_target as u32)),
+                "the tip advances once the successor confirms the root"
+            );
+    });
+
+    Ok(())
+}
+
+/// A wrong peer-supplied root must be recoverable at the same height: the committer rejects and
+/// evicts the bad cached value, leaves the database parked below the height, then commits the
+/// same block once the `tree_aux` driver refills that height with a verifiable root.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loop indexes blocks[i+1] and inserts roots by height
+fn vct_peer_source_bad_root_refill_commits_same_height() -> Result<()> {
+    use crate::service::finalized_state::commitment_aux::PeerSource;
+    use zebra_chain::parallel::commitment_aux::BlockCommitmentRoots;
+
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let target = (nu5 + 1) as usize;
+            prop_assert!(blocks.len() > target + 1, "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            // Source the true roots from a legacy pass, then poison the target height exactly
+            // as a malicious peer would. Earlier roots are correct so the frontier freezes
+            // before the bad root is encountered.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut peer_roots = Vec::new();
+            let mut correct_target_root = None;
+            for i in 0..=target {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct refill legacy")
+                    .unwrap();
+                if i > seed {
+                    let root = BlockCommitmentRoots {
+                        height: Height(i as u32),
+                        sapling_root: trees.sapling.root(),
+                        orchard_root: trees.orchard.root(),
+                        ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+                        sapling_tx: 0,
+                        orchard_tx: 0,
+                        ironwood_tx: 0,
+                        auth_data_root: blocks[i].block.auth_data_root(),
+                    };
+                    if i == target {
+                        correct_target_root = Some(root.clone());
+                        let mut poisoned = root;
+                        prop_assert_ne!(
+                            poisoned.sapling_root,
+                            Default::default(),
+                            "a V2 target block must have a non-empty Sapling root"
+                        );
+                        poisoned.sapling_root = Default::default();
+                        peer_roots.push(poisoned);
+                    } else {
+                        peer_roots.push(root);
+                    }
+                }
+            }
+            let correct_target_root = correct_target_root.expect("target root was produced");
+
+            let (source, writer) = PeerSource::new(None);
+            writer.insert_roots(peer_roots);
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            fast.enable_vct_fast_source(Box::new(source), true);
+
+            for i in 0..target {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct refill pre-target")
+                    .expect("pre-target fast commits succeed");
+            }
+            prop_assert_eq!(fast.db.finalized_tip_height(), Some(Height((target - 1) as u32)));
+
+            let cv = CheckpointVerifiedBlock::from(blocks[target].block.clone());
+            let next = Some((blocks[target + 1].block.clone(), None));
+            let error = fast
+                .commit_finalized_direct(cv.into(), None, next.clone(), "vct poisoned target")
+                .expect_err("the poisoned peer root must be rejected before commit");
+            prop_assert_eq!(
+                error.vct_supplied_root_unavailable_height(),
+                Some(Height(target as u32)),
+                "the bad root is exposed as a retryable refetch for its own height"
+            );
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height((target - 1) as u32)),
+                "the rejected root left the database parked below the target"
+            );
+
+            // Simulate the `tree_aux` driver refilling the evicted height from another peer.
+            writer.insert_roots([correct_target_root]);
+
+            let cv = CheckpointVerifiedBlock::from(blocks[target].block.clone());
+            fast.commit_finalized_direct(cv.into(), None, next, "vct refilled target")
+                .expect("the same height commits once the peer cache is refilled");
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height(target as u32)),
+                "the refilled root unblocks the parked height"
+            );
+    });
+
+    Ok(())
+}
+
+/// The frozen-frontier guard must survive a restart. A fast sync interrupted before the
+/// checkpoint handoff leaves the stale frozen frontier persisted (fast commits never write
+/// per-height trees) with the tip still below the handoff, but the in-memory `frozen` flag
+/// is rebuilt from scratch on open. If it came back `false`, the first post-restart height
+/// with no supplied root would legacy-recompute against the stale on-disk frontier and
+/// corrupt the history MMR — the exact hazard the in-session guard prevents
+/// (`vct_frozen_frontier_hole_refuses_instead_of_recomputing`). So `FinalizedState::new`
+/// re-derives the flag from the durable fast-sync marker. This reopens the database between
+/// freezing and the hole, and asserts that the very first commit of the new session (no
+/// prior fast block to re-arm the flag in-session) still refuses with the retryable
+/// `VctSuppliedRootUnavailable`, leaves state untouched, and commits once the root arrives.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loop indexes blocks[i+1] and the fixture by height
+fn vct_frozen_frontier_survives_reopen() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let handoff_height = nu5 + 3;
+            let last = handoff_height as usize;
+            prop_assert!(blocks.len() > last, "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            // Stop the fast sync two blocks below the handoff, so the tip is inside the
+            // frozen region and there is room for the hole at `stop + 1` (still below the
+            // handoff, where the real frontier would have been written).
+            let stop = (handoff_height - 2) as usize;
+            let hole = stop + 1;
+            prop_assert!(seed < stop && hole < last, "the hole must sit inside the frozen fast range");
+
+            // Legacy golden pass over [0, last]: the per-block fixture for the fast range
+            // and the real final frontiers at the handoff (needed to configure fast mode).
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            let mut handoff_trees = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct reopen legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+                if i == last {
+                    handoff_trees = Some(trees);
+                }
+            }
+            let handoff_trees = handoff_trees.expect("committed the handoff block");
+
+            // A persistent database so the syncing handle can be dropped and reopened by
+            // path, modelling a node restart. Archive storage mode (the default): fast sync
+            // is the default under checkpoint sync, and a fast-synced database reopens fine
+            // in archive mode, exactly as in production.
+            let dir = TempDir::new().expect("temp dir");
+            let config = Config {
+                cache_dir: dir.path().to_path_buf(),
+                ephemeral: false,
+                ..Config::default()
+            };
+
+            // Session 1: a genesis-start fast sync interrupted at `stop`, two blocks below
+            // the handoff. The fast commits write the fast-sync marker but no per-height
+            // trees, so the on-disk frontier is frozen and the tip is below the handoff.
+            {
+                let mut fast = FinalizedState::new(&config, &network, #[cfg(feature = "elasticsearch")] false);
+                enable_vct_test_fixture_source_with_handoff(
+                    &mut fast,
+                    fixture.clone(),
+                    Height(handoff_height),
+                    handoff_trees.sapling.clone(),
+                    handoff_trees.orchard.clone(),
+                    handoff_trees.sprout.clone(),
+                );
+                for i in 0..=stop {
+                    let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                    let next = Some((blocks[i + 1].block.clone(), None));
+                    fast.commit_finalized_direct(cv.into(), None, next, "vct reopen fast")
+                        .expect("verified fast commit succeeds");
+                }
+                prop_assert_eq!(fast.vct_fast_synced_below(), Some(Height(handoff_height)), "the interrupted sync left the fast-sync marker");
+                prop_assert_eq!(fast.db.finalized_tip_height(), Some(Height(stop as u32)), "the tip is parked below the handoff");
+                // Drop releases the database lock for the reopen below.
+            }
+
+            // Session 2 (restart): reopen the same database, then punch a hole at the next
+            // height (a peer that omitted it, or a root evicted after failing verification).
+            // Skip the constructor-time interrupted-fast-sync resume guard: this configured
+            // network has no embedded frontiers, so `from_config` yields no source, but the
+            // test attaches a fixture source below the way a real (Mainnet) node's configured
+            // source is already present at open time.
+            let mut reopened = FinalizedState::new_without_resume_guard(&config, &network, #[cfg(feature = "elasticsearch")] false);
+            prop_assert_eq!(reopened.vct_fast_synced_below(), Some(Height(handoff_height)), "the marker is still durable after reopen");
+
+            let mut holed = fixture.clone();
+            holed.remove(&(hole as u32));
+            enable_vct_test_fixture_source_with_handoff(
+                &mut reopened,
+                holed,
+                Height(handoff_height),
+                handoff_trees.sapling.clone(),
+                handoff_trees.orchard.clone(),
+                handoff_trees.sprout.clone(),
+            );
+
+            // The very first commit of the new session is the hole. No fast block has run
+            // since the reopen, so the only thing that can arm the guard is the flag seeded
+            // from the durable marker. Before the fix it came back `false` and this would
+            // legacy-recompute against the stale frontier; now it refuses.
+            let cv = CheckpointVerifiedBlock::from(blocks[hole].block.clone());
+            let next = Some((blocks[hole + 1].block.clone(), None));
+            let error = reopened
+                .commit_finalized_direct(cv.into(), None, next, "vct reopen hole")
+                .expect_err("a frozen-frontier hole must refuse after reopen, not recompute");
+            prop_assert!(
+                format!("{error:?}").contains("VctSuppliedRootUnavailable"),
+                "the reopened committer returns the retryable VctSuppliedRootUnavailable, got: {error:?}"
+            );
+            prop_assert_eq!(reopened.db.finalized_tip_height(), Some(Height(stop as u32)), "the refused block left the reopened state untouched");
+
+            // Retryable: once a verifiable root for the hole is supplied, the same height
+            // commits and the tip advances — the refusal was a stall, not a permanent wedge.
+            enable_vct_test_fixture_source_with_handoff(
+                &mut reopened,
+                fixture.clone(),
+                Height(handoff_height),
+                handoff_trees.sapling.clone(),
+                handoff_trees.orchard.clone(),
+                handoff_trees.sprout.clone(),
+            );
+            let cv = CheckpointVerifiedBlock::from(blocks[hole].block.clone());
+            let next = Some((blocks[hole + 1].block.clone(), None));
+            reopened
+                .commit_finalized_direct(cv.into(), None, next, "vct reopen refill")
+                .expect("the height commits once its root is fetched");
+            prop_assert_eq!(reopened.db.finalized_tip_height(), Some(Height(hole as u32)), "the tip advances past the former hole once the root arrives");
+    });
+
+    Ok(())
+}
+
+/// Verified-commitment-trees checkpoint handoff (merged increments 4+5): a
+/// genesis-start fast sync writes the verified final frontier at the handoff
+/// height, marks the database fast-synced, guards historical per-height tree reads
+/// below the handoff, and leaves the tip treestate (which post-checkpoint semantic
+/// verification resumes from) byte-identical to the legacy recompute.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loops index blocks[i+1] and the fixture by height
+fn vct_fast_sync_handoff_marks_database_and_resumes() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(env::var("PROPTEST_CASES")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(DEFAULT_PARTIAL_CHAIN_PROPTEST_CASES)),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last, "generated chain unexpectedly short");
+            let handoff = Height(last as u32);
+
+            // The fast range is seeded just below Heartwood, so it is authenticated by
+            // the ZIP-221 MMR (the synthetic chain's pre-Heartwood `FinalSaplingRoot`
+            // headers are not consistent with the computed trees, so the Sapling-era
+            // direct-header path can't be exercised here — that rides with the real
+            // synced node). The handoff is at the tip.
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy pass over [0, last]: the per-block fixture for the fast range, the
+            // golden consensus state, and the real final frontiers at the handoff.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            let mut handoff_trees = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+                if i == last {
+                    handoff_trees = Some(trees);
+                }
+            }
+            let golden_anchors = legacy.db.vct_anchor_digest();
+            let golden_history = legacy.db.history_tree().hash();
+            let golden_tip = legacy.db.note_commitment_trees_for_tip();
+            let handoff_trees = handoff_trees.expect("committed the handoff block");
+
+            // Fast genesis-start pass over [0, last], supplying the verified frontiers
+            // for the handoff at `last`.
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source_with_handoff(
+                &mut fast,
+                fixture.clone(),
+                handoff,
+                handoff_trees.sapling.clone(),
+                handoff_trees.orchard.clone(),
+                handoff_trees.sprout.clone(),
+            );
+            prop_assert!(!fast.vct_fast_needs_successor(handoff), "the trusted handoff frontier authenticates the handoff root without a successor");
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = (i < last).then(|| (blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct fast handoff")
+                    .expect("verified fast commit succeeds");
+            }
+
+            // The database is marked fast-synced at the handoff height, and the upgrade height is
+            // genesis: a node that fast-syncs from genesis records `U = 0`, so its whole `[0, H)`
+            // range is the absent band and every request is served from the index.
+            prop_assert_eq!(fast.vct_fast_synced_below(), Some(handoff), "fast-sync marker is set to the handoff height");
+            prop_assert_eq!(fast.db.vct_upgrade_height(), Some(Height(0)), "genesis fast sync records the upgrade height at genesis");
+
+            // Consensus state (anchor sets + history root) matches the legacy recompute.
+            prop_assert_eq!(fast.db.vct_anchor_digest(), golden_anchors, "fast anchors must match legacy");
+            prop_assert_eq!(fast.db.history_tree().hash(), golden_history, "fast history must match legacy");
+
+            // The handoff wrote the real frontier at the checkpoint, so the tip
+            // treestate that semantic verification resumes from matches legacy.
+            let fast_tip = fast.db.note_commitment_trees_for_tip();
+            prop_assert_eq!(fast_tip.sapling.root(), golden_tip.sapling.root(), "tip sapling frontier must match legacy");
+            prop_assert_eq!(fast_tip.orchard.root(), golden_tip.orchard.root(), "tip orchard frontier must match legacy");
+            prop_assert_eq!(fast_tip.sprout.root(), golden_tip.sprout.root(), "tip sprout frontier must match legacy");
+
+            // Historical per-height tree reads below the handoff are unavailable
+            // (guarded, no panic), while the handoff height itself is present.
+            prop_assert!(fast.db.sapling_tree_by_height(&Height(last as u32 - 1)).is_none(), "below-handoff sapling tree read is guarded");
+            prop_assert!(fast.db.orchard_tree_by_height(&Height(last as u32 - 1)).is_none(), "below-handoff orchard tree read is guarded");
+            prop_assert!(fast.db.sapling_tree_by_height(&handoff).is_some(), "handoff sapling tree is present");
+            prop_assert!(fast.db.orchard_tree_by_height(&handoff).is_some(), "handoff orchard tree is present");
+
+            // Root-serving index (design §4): the fast-synced node holds no per-height trees
+            // below the handoff (asserted just above), yet it must still serve `tree_aux`
+            // roots for that range so the root-serving fleet does not collapse as nodes
+            // fast-sync. Those roots come from the compact `commitment_roots_by_height` index
+            // the fast path persists per block, and they match exactly the roots the
+            // legacy/archive node derives from its per-height trees.
+            let below_handoff = Height((seed + 1) as u32)..=Height(last as u32 - 1);
+            let served = fast.db.commitment_roots_by_height_range(below_handoff.clone());
+            let expected = commitment_aux::produce_block_roots(&legacy.db, below_handoff.clone());
+            prop_assert!(!served.is_empty(), "a fast-synced node serves below-handoff roots from the index");
+            prop_assert_eq!(served, expected.clone(), "index-served roots match the legacy per-height-tree roots");
+
+            // The same range goes through `serve_block_roots`: with `U = 0` the request starts at
+            // or above the upgrade height, so it is served entirely from the index — no per-height
+            // trees (which the fast-synced node lacks below the handoff) are consulted.
+            prop_assert_eq!(serve_block_roots(&fast.db, below_handoff), expected, "serve_block_roots serves the fast-synced range from the index");
+
+            // The `z_gettreestate` RPC gate predicate matches the read guard: a
+            // below-handoff height is unavailable (typed archive-mode error), while the
+            // handoff height itself is available.
+            prop_assert!(fast.db.vct_historical_tree_unavailable(HashOrHeight::Height(Height(last as u32 - 1))), "RPC gate: below-handoff treestate is unavailable");
+            prop_assert!(!fast.db.vct_historical_tree_unavailable(HashOrHeight::Height(handoff)), "RPC gate: handoff treestate is available");
+
+            // Negative: a peer can supply a wrong root exactly at the handoff height,
+            // where there is no buffered checkpoint successor to authenticate it. The
+            // final embedded frontier still binds the expected root, so the committer
+            // must reject and retry instead of panicking or writing a bad handoff.
+            let mut bad_handoff_fixture = fixture.clone();
+            let bad_handoff_entry = bad_handoff_fixture
+                .get_mut(&(last as u32))
+                .expect("fixture contains the handoff root");
+            prop_assert_ne!(bad_handoff_entry.0, Default::default(), "a post-NU5 handoff block must have a non-empty Sapling root");
+            bad_handoff_entry.0 = Default::default();
+
+            let mut bad_handoff = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source_with_handoff(
+                &mut bad_handoff,
+                bad_handoff_fixture,
+                handoff,
+                handoff_trees.sapling.clone(),
+                handoff_trees.orchard.clone(),
+                handoff_trees.sprout.clone(),
+            );
+
+            let mut error_height = None;
+            let mut handoff_error = None;
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = (i < last).then(|| (blocks[i + 1].block.clone(), None));
+                match bad_handoff.commit_finalized_direct(cv.into(), None, next, "vct bad handoff") {
+                    Ok(_) => {}
+                    Err(error) => {
+                        error_height = Some(i);
+                        handoff_error = Some(error);
+                        break;
+                    }
+                }
+            }
+            prop_assert_eq!(error_height, Some(last), "the bad handoff root is rejected at the handoff height");
+            let handoff_error = handoff_error.expect("the bad handoff root failed");
+            prop_assert!(
+                format!("{handoff_error:?}").contains("VctSuppliedRootUnavailable"),
+                "a bad handoff root returns the retryable VctSuppliedRootUnavailable error, got: {handoff_error:?}"
+            );
+            prop_assert_eq!(
+                bad_handoff.db.finalized_tip_height(),
+                Some(Height(last as u32 - 1)),
+                "the refused handoff block left state untouched"
+            );
+    });
+
+    Ok(())
+}
+
+/// Switching between the rollout fast path and the manual recompute path is safe at the
+/// committed-state boundaries: after the handoff writes the real frontier, legacy recompute can
+/// resume from that frontier; before any fast commit has frozen the frontier, a later fast sync
+/// can consume verified roots for future heights.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loops index blocks[i+1] and the fixture by height
+fn vct_mode_switches_continue_from_safe_boundaries() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let handoff_index = (nu5 + 3) as usize;
+            let post_handoff_tip = handoff_index + 2;
+            prop_assert!(blocks.len() > post_handoff_tip, "generated chain unexpectedly short");
+            let handoff = Height(handoff_index as u32);
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy golden pass over the full range: source fast roots and final frontiers, then
+            // compare both switching scenarios against this byte-identical manual recompute.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            let mut handoff_trees = None;
+            let mut post_handoff_roots = None;
+            for i in 0..=post_handoff_tip {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct switch legacy")
+                    .unwrap();
+                if i > seed && i <= handoff_index {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+                if i == handoff_index {
+                    handoff_trees = Some(trees);
+                } else if i == handoff_index + 1 {
+                    post_handoff_roots = Some((trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+            let golden_anchors = legacy.db.vct_anchor_digest();
+            let golden_history = legacy.db.history_tree().hash();
+            let golden_tip = legacy.db.note_commitment_trees_for_tip();
+            let handoff_trees = handoff_trees.expect("committed the handoff block");
+            let post_handoff_roots = post_handoff_roots.expect("committed a post-handoff block");
+
+            // Fast -> manual: complete the fast handoff, reopen with the force-disable knob, and
+            // keep checkpoint sync enabled while post-handoff blocks recompute from the real
+            // frontier written at the handoff.
+            let fast_to_manual_dir = TempDir::new().expect("temp dir");
+            let fast_config = Config {
+                cache_dir: fast_to_manual_dir.path().to_path_buf(),
+                ephemeral: false,
+                ..Config::default()
+            };
+            {
+                let mut fast = FinalizedState::new(&fast_config, &network, #[cfg(feature = "elasticsearch")] false);
+                enable_vct_test_fixture_source_with_handoff(
+                    &mut fast,
+                    fixture.clone(),
+                    handoff,
+                    handoff_trees.sapling.clone(),
+                    handoff_trees.orchard.clone(),
+                    handoff_trees.sprout.clone(),
+                );
+                for i in 0..=handoff_index {
+                    let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                    let next = (i < handoff_index).then(|| (blocks[i + 1].block.clone(), None));
+                    fast.commit_finalized_direct(cv.into(), None, next, "vct switch fast prefix")
+                        .expect("verified fast prefix commits");
+                }
+                prop_assert_eq!(fast.vct_fast_synced_below(), Some(handoff), "fast sync reached the handoff before the switch");
+            }
+
+            let manual_config = Config {
+                vct_fast_sync: false,
+                ..fast_config
+            };
+            let mut manual = FinalizedState::new(&manual_config, &network, #[cfg(feature = "elasticsearch")] false);
+            for i in (handoff_index + 1)..=post_handoff_tip {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                manual
+                    .commit_finalized_direct(cv.into(), None, None, "vct switch manual suffix")
+                    .expect("manual suffix commits after fast handoff");
+            }
+            let manual_tip = manual.db.note_commitment_trees_for_tip();
+            prop_assert_eq!(manual.db.vct_anchor_digest(), golden_anchors, "fast-to-manual anchors match legacy");
+            prop_assert_eq!(manual.db.history_tree().hash(), golden_history, "fast-to-manual history matches legacy");
+            prop_assert_eq!(manual_tip.sapling.root(), golden_tip.sapling.root(), "fast-to-manual sapling tip matches legacy");
+            prop_assert_eq!(manual_tip.orchard.root(), golden_tip.orchard.root(), "fast-to-manual orchard tip matches legacy");
+            prop_assert_eq!(manual_tip.sprout.root(), golden_tip.sprout.root(), "fast-to-manual sprout tip matches legacy");
+
+            // Manual -> fast: commit a prefix with the force-disable knob before any fast block
+            // can freeze the frontier, then reopen and consume verified roots through the handoff.
+            let manual_to_fast_dir = TempDir::new().expect("temp dir");
+            let manual_prefix_config = Config {
+                cache_dir: manual_to_fast_dir.path().to_path_buf(),
+                ephemeral: false,
+                vct_fast_sync: false,
+                ..Config::default()
+            };
+            {
+                let mut manual_prefix = FinalizedState::new(&manual_prefix_config, &network, #[cfg(feature = "elasticsearch")] false);
+                for i in 0..=seed {
+                    let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                    manual_prefix
+                        .commit_finalized_direct(cv.into(), None, None, "vct switch manual prefix")
+                        .expect("manual prefix commits");
+                }
+            }
+
+            let fast_suffix_config = Config {
+                vct_fast_sync: true,
+                ..manual_prefix_config
+            };
+            let mut fast_suffix = FinalizedState::new(&fast_suffix_config, &network, #[cfg(feature = "elasticsearch")] false);
+            let mut guarded_fixture = fixture;
+            // A stale or over-eager peer cache entry above the handoff must be ignored so
+            // the committer resumes legacy recompute from the real handoff frontier.
+            prop_assert_ne!(
+                post_handoff_roots.0,
+                Default::default(),
+                "a post-NU5 post-handoff block must have a non-empty Sapling root",
+            );
+            guarded_fixture.insert(
+                (handoff_index + 1) as u32,
+                (Default::default(), post_handoff_roots.1),
+            );
+            enable_vct_test_fixture_source_with_handoff(
+                &mut fast_suffix,
+                guarded_fixture,
+                handoff,
+                handoff_trees.sapling.clone(),
+                handoff_trees.orchard.clone(),
+                handoff_trees.sprout.clone(),
+            );
+            for i in (seed + 1)..=post_handoff_tip {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = (i < post_handoff_tip).then(|| (blocks[i + 1].block.clone(), None));
+                fast_suffix
+                    .commit_finalized_direct(cv.into(), None, next, "vct switch fast suffix")
+                    .expect("fast suffix commits after manual prefix");
+            }
+            prop_assert_eq!(
+                fast_suffix.vct_fast_count(),
+                (handoff_index - seed) as u64,
+                "an above-handoff cached root must not keep the committer on the fast path",
+            );
+            let fast_suffix_tip = fast_suffix.db.note_commitment_trees_for_tip();
+            prop_assert_eq!(fast_suffix.db.vct_anchor_digest(), golden_anchors, "manual-to-fast anchors match legacy");
+            prop_assert_eq!(fast_suffix.db.history_tree().hash(), golden_history, "manual-to-fast history matches legacy");
+            prop_assert_eq!(fast_suffix_tip.sapling.root(), golden_tip.sapling.root(), "manual-to-fast sapling tip matches legacy");
+            prop_assert_eq!(fast_suffix_tip.orchard.root(), golden_tip.orchard.root(), "manual-to-fast orchard tip matches legacy");
+            prop_assert_eq!(fast_suffix_tip.sprout.root(), golden_tip.sprout.root(), "manual-to-fast sprout tip matches legacy");
+    });
+
+    Ok(())
+}
+
+/// Standalone test isolating the verify-before-commit **dedup**: each header
+/// commitment is checked once, not twice.
+///
+/// - **Skip:** the first fast block runs its own commitment check; the next one
+///   is skipped, because the first block's look-ahead already validated it.
+/// - **Stale-cache guard:** a cache entry with the right height but the *wrong*
+///   hash must not trigger a skip — the guard forces the own check to run, so a
+///   stale or mismatched entry can never let an unverified block through.
+/// - **Wrapper-hash guard:** a public `CheckpointVerifiedBlock::with_hash` caller
+///   cannot replay a stale cached successor hash onto a different block.
+#[test]
+fn vct_dedup_skips_redundant_check_and_guards_stale_cache() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0 as usize;
+
+            // Seed just before NU5, then operate on four consecutive fast blocks so
+            // the forged-wrapper regression exercises `hashBlockCommitments`.
+            let seed = nu5 - 2;
+            let last = seed + 4;
+            prop_assert!(blocks.len() > last + 1, "generated chain unexpectedly short");
+
+            // Legacy pass to record the correct per-block roots as the fixture.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            for (i, prepared) in blocks.iter().take(last + 1).enumerate() {
+                let cv = CheckpointVerifiedBlock::from(prepared.block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct dedup legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut fast, fixture);
+
+            // Commit block `i` with its real successor as the one-block look-ahead.
+            let commit = |fast: &mut FinalizedState, i: usize| {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct dedup fast")
+                    .expect("verified fast commit succeeds");
+            };
+
+            // genesis..=seed take the recompute path (no fixture entries), so the dedup
+            // never engages here.
+            for i in 0..=seed {
+                commit(&mut fast, i);
+            }
+            prop_assert_eq!(fast.vct_prevalidated_count(), 0, "no fast blocks committed yet");
+
+            // First fast block: no cached predecessor, so it runs its own check.
+            commit(&mut fast, seed + 1);
+            prop_assert_eq!(fast.vct_prevalidated_count(), 0, "the first fast block runs its own commitment check");
+
+            // Second fast block: its predecessor's look-ahead already validated it,
+            // so the own check is skipped — the dedup engages.
+            commit(&mut fast, seed + 2);
+            prop_assert_eq!(fast.vct_prevalidated_count(), 1, "the second fast block skips its redundant own commitment check");
+
+            // Stale-cache guard: overwrite the cache with the correct height but the
+            // hash of a *different* block. The next commit must NOT skip.
+            let stale_hash = blocks[seed + 1].hash;
+            prop_assert_ne!(stale_hash, blocks[seed + 3].hash, "stale hash must differ from the real block");
+            fast.vct_prevalidated_next = Some((Height((seed + 3) as u32), stale_hash));
+            commit(&mut fast, seed + 3);
+            prop_assert_eq!(fast.vct_prevalidated_count(), 1, "a stale cache entry (wrong hash) must not cause a false skip");
+
+            // Public wrapper-hash guard: the stale cache records a real look-ahead
+            // hash, but a caller-controlled checkpoint wrapper tries to replay that
+            // hash onto a different block whose own NU5 header commitment is invalid.
+            // The skip must compare the cache against the wrapped block's real hash,
+            // not the wrapper hash, so the bad commitment is checked and rejected.
+            let forged_wrapper_hash = blocks[seed + 2].hash;
+            let bad_block = blocks[seed + 4].block.clone().set_block_commitment([0x42; 32]);
+            let bad_block_hash = bad_block.hash();
+            prop_assert_ne!(
+                forged_wrapper_hash,
+                bad_block_hash,
+                "the forged wrapper hash must differ from the bad block's real hash",
+            );
+            fast.vct_prevalidated_next =
+                Some((Height((seed + 4) as u32), forged_wrapper_hash));
+            let forged = CheckpointVerifiedBlock::with_hash(bad_block, forged_wrapper_hash);
+            let error = fast
+                .commit_finalized_direct(forged.into(), None, None, "vct forged wrapper hash")
+                .expect_err("a forged wrapper hash must not skip the bad block's own commitment check");
+            prop_assert!(
+                format!("{error:?}").contains("VctSuppliedRootUnavailable"),
+                "the forged wrapper hash path must reject the bad commitment, got: {error:?}",
+            );
+            prop_assert_eq!(
+                fast.vct_prevalidated_count(),
+                1,
+                "the forged wrapper hash must not increment the prevalidated count",
+            );
+            prop_assert_eq!(
+                fast.db.finalized_tip_height(),
+                Some(Height((seed + 3) as u32)),
+                "the rejected forged block must leave finalized state untouched",
+            );
+    });
+
+    Ok(())
+}
+
+/// Clearing a cached VCT successor prevalidation must disarm exactly one possible
+/// skip without disabling the normal dedup optimization for future contiguous fast
+/// blocks. This covers the write-loop reset/drop behavior indirectly: those paths
+/// call `clear_vct_prevalidated_next()` when buffered checkpoint state is discarded.
+#[test]
+fn vct_clear_prevalidation_cache_disarms_skip_then_dedup_resumes() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0 as usize;
+            let seed = nu5 - 2;
+            let last = seed + 5;
+            prop_assert!(blocks.len() > last + 1, "generated chain unexpectedly short");
+
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let mut fixture = std::collections::HashMap::new();
+            for (i, prepared) in blocks.iter().take(last + 1).enumerate() {
+                let cv = CheckpointVerifiedBlock::from(prepared.block.clone());
+                let (_h, trees) = legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct clear legacy")
+                    .unwrap();
+                if i > seed {
+                    fixture.insert(i as u32, (trees.sapling.root(), trees.orchard.root()));
+                }
+            }
+
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            enable_vct_test_fixture_source(&mut fast, fixture);
+
+            let commit = |fast: &mut FinalizedState, i: usize| {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct clear fast")
+                    .expect("verified fast commit succeeds");
+            };
+
+            for i in 0..=seed {
+                commit(&mut fast, i);
+            }
+            commit(&mut fast, seed + 1);
+            prop_assert_eq!(fast.vct_prevalidated_count(), 0, "first fast block runs its own check");
+
+            commit(&mut fast, seed + 2);
+            prop_assert_eq!(fast.vct_prevalidated_count(), 1, "second fast block uses predecessor look-ahead");
+
+            fast.clear_vct_prevalidated_next();
+            commit(&mut fast, seed + 3);
+            prop_assert_eq!(
+                fast.vct_prevalidated_count(),
+                1,
+                "clearing the cache forces the next fast block to run its own check",
+            );
+
+            commit(&mut fast, seed + 4);
+            prop_assert_eq!(
+                fast.vct_prevalidated_count(),
+                2,
+                "normal successor dedup resumes after the cleared block commits",
+            );
+    });
+
+    Ok(())
+}
+
+/// Increment-3 contract proof: a roots/frontier payload **produced from a database**
+/// (the serving read path) can replace the fixture and drives the fast path to
+/// byte-identical consensus state.
+///
+/// Builds an archive/legacy state over a generated valid-commitment chain (crossing
+/// Heartwood and NU5), produces the per-block roots and final frontier from that DB
+/// via [`commitment_aux::produce_block_roots`] / [`commitment_aux::produce_final_frontiers`],
+/// then drives a fresh fast-sync state that consumes the produced payload through the
+/// test-only [`commitment_aux::FixtureSource`]. Asserts the fast anchors + history-tree hash are
+/// byte-identical to the legacy build, and that the produced final frontier agrees with
+/// the legacy tip frontier and the produced root at the handoff height.
+///
+/// This is coverage the existing equivalence test lacks: there the roots are captured
+/// from the committer's inline-returned trees, here they come from the **DB read path**
+/// a serving node runs. No networking and no DB-format change.
+#[test]
+#[allow(clippy::needless_range_loop)] // the loops index blocks[i+1] (the look-ahead) and by height
+fn vct_db_produced_payload_round_trips_to_byte_identical_state() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            let last = (nu5 + 3) as usize;
+            prop_assert!(blocks.len() > last + 1, "generated chain unexpectedly short");
+            // Seed below Heartwood so the fast range creates the history tree and
+            // crosses the NU5 V1->V2 boundary, matching the equivalence test.
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy/archive pass: a real DB with per-height trees, plus the golden state.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            for block in blocks.iter().take(last + 1) {
+                let cv = CheckpointVerifiedBlock::from(block.block.clone());
+                legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct round-trip legacy")
+                    .unwrap();
+            }
+            let golden_anchors = legacy.db.vct_anchor_digest();
+            let golden_history = legacy.db.history_tree().hash();
+
+            // Produce the payload from the legacy DB's per-height trees (the serving read path).
+            let last_height = Height(last as u32);
+            let produced_roots = commitment_aux::produce_block_roots(
+                &legacy.db,
+                Height((seed + 1) as u32)..=last_height,
+            );
+            let produced_frontiers = commitment_aux::produce_final_frontiers(&legacy.db, last_height)
+                .expect("legacy DB has the tip frontier");
+
+            // The produced final frontier agrees with the legacy tip frontier and with the
+            // produced root at the handoff height (the two producer outputs are consistent).
+            let handoff = produced_roots.last().expect("produced a non-empty range");
+            prop_assert_eq!(produced_frontiers.sapling.root(), handoff.sapling_root, "produced sapling frontier matches the produced root at handoff");
+            prop_assert_eq!(produced_frontiers.orchard.root(), handoff.orchard_root, "produced orchard frontier matches the produced root at handoff");
+            prop_assert_eq!(produced_frontiers.sapling.root(), legacy.db.sapling_tree_by_height(&last_height).unwrap().root(), "produced sapling frontier matches legacy tip");
+            prop_assert_eq!(produced_frontiers.sprout.root(), legacy.db.sprout_tree_for_tip().root(), "produced sprout frontier matches legacy tip");
+
+            // Consume the DB-produced roots in a fresh fast-sync state.
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            let produced_roots = produced_roots
+                .into_iter()
+                .map(|root| (root.height.0, (root.sapling_root, root.orchard_root)))
+                .collect();
+            fast.enable_vct_fast_source(
+                Box::new(commitment_aux::FixtureSource::new(produced_roots, None)),
+                false,
+            );
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct round-trip fast")
+                    .expect("verified fast commit from DB-produced roots succeeds");
+            }
+
+            prop_assert_eq!(fast.db.vct_anchor_digest(), golden_anchors, "fast anchors from DB-produced roots match legacy");
+            prop_assert_eq!(fast.db.history_tree().hash(), golden_history, "fast history from DB-produced roots match legacy");
+
+            // Serving stitch across the upgrade height `U`. Simulate a node that upgraded
+            // mid-chain: it keeps the full per-height trees (written before the upgrade) but only
+            // has the serving index from `U` upward. `serve_block_roots` must still return the
+            // whole requested range as one contiguous run — trees fill `[start, U)`, the index
+            // fills `[U, end]` — matching the all-trees reference, with no short batch at the
+            // boundary that would stall the client's minimum-progress check.
+            let serve_range = Height((seed + 1) as u32)..=last_height;
+            let all_trees_reference =
+                commitment_aux::produce_block_roots(&legacy.db, serve_range.clone());
+            let upgrade = Height(((seed + 1 + last) / 2) as u32);
+            prop_assert!(
+                serve_range.start() < &upgrade && upgrade <= last_height,
+                "the chosen upgrade height splits the served range"
+            );
+            let mut batch = DiskWriteBatch::new();
+            batch.delete_range_commitment_roots_by_height(&legacy.db, &Height(0), &upgrade);
+            batch.update_vct_upgrade_marker(&legacy.db, upgrade);
+            legacy
+                .db
+                .write_batch(batch)
+                .expect("simulating a mid-chain upgrade succeeds");
+            prop_assert!(
+                legacy
+                    .db
+                    .commitment_roots_by_height_range(Height(0)..=Height(upgrade.0 - 1))
+                    .is_empty(),
+                "the serving index is dropped below the upgrade height"
+            );
+            let stitched = serve_block_roots(&legacy.db, serve_range);
+            prop_assert_eq!(
+                stitched,
+                all_trees_reference,
+                "serve_block_roots stitches the trees below U with the index at/above U into one gap-free run"
+            );
+    });
+
+    Ok(())
+}
+
+/// Verified-commitment-trees consumer half of the `tree_aux` peer source (increment 6a):
+/// a [`commitment_aux::PeerSource`] **filled incrementally** by its writer handle (as the
+/// driver fills it when root ranges arrive from peers) drives the fast path to
+/// byte-identical consensus state. Same harness as the DB-produced round-trip, but the
+/// produced roots are inserted into the shared cache in two chunks via
+/// [`commitment_aux::PeerSourceWriter`] — proving the fillable, driver-facing source is a
+/// drop-in for the fixture. (The network transport that fills it is the rest of 6a.)
+#[test]
+#[allow(clippy::needless_range_loop)] // the loops index blocks[i+1] (the look-ahead) and by height
+fn vct_peer_source_filled_incrementally_drives_byte_identical_state() -> Result<()> {
+    let _init_guard = zebra_test::init();
+
+    let network = ParametersBuilder::default()
+        .with_activation_heights(ConfiguredActivationHeights {
+            before_overwinter: Some(1),
+            overwinter: Some(10),
+            sapling: Some(15),
+            blossom: Some(20),
+            heartwood: Some(25),
+            canopy: Some(30),
+            nu5: Some(35),
+            nu6: Some(40),
+            nu6_1: Some(45),
+            nu6_2: Some(47),
+            nu6_3: Some(48),
+            nu7: Some(50),
+        })
+        .expect("failed to set activation heights")
+        .extend_funding_streams()
+        .to_network()
+        .expect("failed to build configured network");
+    let ledger_strategy =
+        LedgerState::genesis_strategy(Some(network), None::<NetworkUpgrade>, None, false);
+
+    proptest!(ProptestConfig::with_cases(1),
+        |((chain, _count, network, _history_tree) in PreparedChain::default().with_ledger_strategy(ledger_strategy.clone()).with_valid_commitments().no_shrink())| {
+
+            let blocks: Vec<_> = chain.iter().collect();
+            let nu5 = NetworkUpgrade::Nu5.activation_height(&network).unwrap().0;
+            let heartwood = NetworkUpgrade::Heartwood.activation_height(&network).unwrap().0;
+            // The untrusted peer source defers any fast block whose own root has no buffered
+            // successor, so every committed fast block needs `blocks[i + 1]`. Keep `last` one
+            // below the chain tip so the deepest commit still has a successor witness.
+            let last = ((nu5 + 3) as usize).min(blocks.len().saturating_sub(2));
+            prop_assert!(last > (nu5 as usize), "generated chain unexpectedly short");
+            let seed = (heartwood - 1) as usize;
+
+            // Legacy/archive pass: a real DB with per-height trees, plus the golden state.
+            let mut legacy = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            for block in blocks.iter().take(last + 1) {
+                let cv = CheckpointVerifiedBlock::from(block.block.clone());
+                legacy
+                    .commit_finalized_direct(cv.into(), None, None, "vct peer-source legacy")
+                    .unwrap();
+            }
+            let golden_anchors = legacy.db.vct_anchor_digest();
+            let golden_history = legacy.db.history_tree().hash();
+
+            // Produce the payload from the legacy DB (the serving read path).
+            let produced_roots = commitment_aux::produce_block_roots(
+                &legacy.db,
+                Height((seed + 1) as u32)..=Height(last as u32),
+            );
+
+            // Fill the peer source incrementally via its writer, in two chunks, as the
+            // driver would when successive root ranges arrive from a peer.
+            let (peer_source, writer) = commitment_aux::PeerSource::new(None);
+            let split = produced_roots.len() / 2;
+            writer.insert_roots(produced_roots[..split].iter().cloned());
+            writer.insert_roots(produced_roots[split..].iter().cloned());
+
+            // Consume the peer-source-supplied roots in a fresh fast-sync state. Each fast
+            // block is committed with its successor buffered, as the write loop does — the
+            // untrusted source defers a tip commit with no successor (covered by
+            // `vct_peer_source_defers_unverifiable_tip_root_until_successor`).
+            let mut fast = FinalizedState::new(&Config::ephemeral(), &network, #[cfg(feature = "elasticsearch")] false);
+            fast.enable_vct_fast_source(Box::new(peer_source), true);
+            for i in 0..=last {
+                let cv = CheckpointVerifiedBlock::from(blocks[i].block.clone());
+                let next = Some((blocks[i + 1].block.clone(), None));
+                fast.commit_finalized_direct(cv.into(), None, next, "vct peer-source fast")
+                    .expect("verified fast commit from peer-source roots succeeds");
+            }
+
+            prop_assert_eq!(fast.db.vct_anchor_digest(), golden_anchors, "fast anchors from peer-source roots match legacy");
+            prop_assert_eq!(fast.db.history_tree().hash(), golden_history, "fast history from peer-source roots match legacy");
+    });
+
+    Ok(())
+}
diff --git a/zebra-state/src/service/finalized_state/tests/rollback.rs b/zebra-state/src/service/finalized_state/tests/rollback.rs
index 73740a32698..336f05b1d6c 100644
--- a/zebra-state/src/service/finalized_state/tests/rollback.rs
+++ b/zebra-state/src/service/finalized_state/tests/rollback.rs
@@ -80,7 +80,7 @@ fn sync_to(config: &Config, network: &Network, blocks: &[SemanticallyVerifiedBlo
     for block in blocks {
         let checkpoint_verified = CheckpointVerifiedBlock::from(block.block.clone());
         state
-            .commit_finalized_direct(checkpoint_verified.into(), None, "rollback test")
+            .commit_finalized_direct(checkpoint_verified.into(), None, None, "rollback test")
             .expect("committing a generated block to a fresh state succeeds");
     }
 }
diff --git a/zebra-state/src/service/finalized_state/vct.rs b/zebra-state/src/service/finalized_state/vct.rs
new file mode 100644
index 00000000000..a143e67eb3d
--- /dev/null
+++ b/zebra-state/src/service/finalized_state/vct.rs
@@ -0,0 +1,675 @@
+//! Verified-commitment-trees fast-sync experiment state (POC harness).
+//!
+//! This module holds the embedded-frontier plumbing and run counters for the
+//! verified-commitment-trees fast path. On networks with an embedded handoff frontier,
+//! the default source is the peer `tree_aux` source. `checkpoint_sync = false` or
+//! `consensus.vct_fast_sync = false` selects legacy recompute.
+//!
+//! [`super`] (`finalized_state.rs`) holds only the commit-path hook (the checkpoint
+//! handoff write and the fast-sync marker); everything about *where the data comes
+//! from* lives here, behind a small method API so the commit path never touches the
+//! experiment's internals.
+
+use std::sync::{
+    atomic::{AtomicU64, Ordering},
+    Arc,
+};
+
+use thiserror::Error;
+#[cfg(test)]
+use zebra_chain::parallel::tree::NoteCommitmentTrees;
+use zebra_chain::{
+    block, orchard,
+    parameters::{Network, NetworkUpgrade},
+    sapling, sprout,
+};
+
+use super::{
+    commitment_aux::{CommitmentRootSource, FinalFrontiers, PeerSource},
+    ZebraDb,
+};
+
+/// Embedded verified final note-commitment frontiers for Mainnet.
+const MAINNET_FINAL_FRONTIERS: &[u8] = include_bytes!("vct/mainnet-frontier.bin");
+
+/// Errors validating serialized VCT final-frontier bytes.
+#[derive(Clone, Debug, Eq, Error, PartialEq)]
+pub enum FinalFrontiersValidationError {
+    /// The bytes could not be parsed as [`FinalFrontiers`].
+    #[error("invalid VCT final frontier bytes: {error}")]
+    InvalidBytes {
+        /// The parser error message.
+        error: String,
+    },
+
+    /// The serialized frontier height does not match the expected checkpoint handoff height.
+    #[error("embedded VCT final frontier height must match the network's max checkpoint height")]
+    HeightMismatch {
+        /// Height encoded in the serialized frontier.
+        actual: block::Height,
+        /// Expected checkpoint handoff height.
+        expected: block::Height,
+    },
+}
+
+/// POC state for the verified-commitment-trees experiment
+/// (`docs/design/verified-commitment-trees.md`). Shared across
+/// [`super::FinalizedState`] clones via `Arc` so the counters are shared.
+///
+/// A checkpoint-trusting sync (`checkpoint_sync = true`) uses the peer `tree_aux` source by
+/// default on networks with embedded final frontiers; `checkpoint_sync = false` or
+/// `vct_fast_sync = false` opts out to the legacy per-block recompute (no VCT state).
+#[derive(Debug)]
+pub(crate) struct VctState {
+    /// Fast mode: skip the per-block frontier recompute and fold the source's roots
+    /// into the anchor set + history tree.
+    fast: bool,
+    /// Where the verified per-block roots and handoff frontiers come from. The
+    /// committer reads roots/handoff/frontiers through this seam only.
+    source: Box<dyn CommitmentRootSource>,
+    /// Whether roots from this VCT state must be confirmed against a buffered successor
+    /// before they are committed.
+    requires_verified_successor: bool,
+    /// Count of blocks that took the fast (skip-recompute) path, for the run summary.
+    fast_count: AtomicU64,
+    /// Count of fast blocks whose own commitment check was skipped because the
+    /// previous block's look-ahead already validated it (the dedup). Lets tests
+    /// assert the dedup actually engages, so it can't be silently regressed.
+    prevalidated_count: AtomicU64,
+}
+
+/// Which commitment-root source the committer uses, resolved from the (already read)
+/// configuration signals.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SourceMode {
+    /// Legacy recompute committer (no VCT state).
+    Legacy,
+    /// Fetch per-block roots from peers — the default where embedded frontiers exist.
+    Peer,
+}
+
+/// Resolve the source mode as a pure function, so the peer-source default is
+/// unit-testable without touching embedded-frontier files. The fast verified path
+/// (peer source) is the default whenever the node syncs under checkpoint trust and
+/// the network has an embedded handoff frontier. `checkpoint_sync = false` or
+/// `vct_fast_sync = false` selects the legacy recompute; a network with no embedded
+/// frontier also falls back to legacy. Storage mode (Archive vs. Pruned) is orthogonal and not
+/// an input here.
+fn select_source_mode(
+    checkpoint_sync: bool,
+    vct_fast_sync: bool,
+    has_embedded_frontiers: bool,
+) -> SourceMode {
+    if !checkpoint_sync || !vct_fast_sync || !has_embedded_frontiers {
+        SourceMode::Legacy
+    } else {
+        SourceMode::Peer
+    }
+}
+
+impl VctState {
+    /// Build the committer state from `checkpoint_sync` (the mirror of
+    /// `consensus.checkpoint_sync`) and the `vct_fast_sync` knob.
+    /// On networks with an embedded handoff frontier (Mainnet) a checkpoint-trusting sync
+    /// defaults to the peer (`tree_aux`) fast source; disabling checkpoint sync, setting
+    /// `vct_fast_sync = false`, or using a network without an embedded frontier returns `None` for
+    /// a zero-overhead legacy committer that recomputes the trees per block.
+    pub(super) fn from_config(
+        checkpoint_sync: bool,
+        vct_fast_sync: bool,
+        network: &Network,
+        db: ZebraDb,
+    ) -> Option<Arc<Self>> {
+        // Parse the embedded handoff frontier once (None on networks without one, e.g.
+        // Testnet). The decision below only needs its presence; the peer arm reuses the
+        // parsed value.
+        let embedded = embedded_final_frontiers(network);
+
+        match select_source_mode(checkpoint_sync, vct_fast_sync, embedded.is_some()) {
+            // Default: the peer (`tree_aux`) source on any network with embedded final
+            // frontiers (Mainnet). Per-block roots arrive from peers into a shared cache
+            // filled by the driver; the committer reads them per height and folds them in,
+            // skipping the recompute. A height the peer cannot supply — or any node with no
+            // serving peers — stays in legacy mode, bit-identical to a legacy committer by
+            // construction.
+            SourceMode::Peer => {
+                let parsed = embedded?;
+                tracing::info!(
+                    handoff_height = parsed.height.0,
+                    "VCT: peer (tree_aux) source enabled by default — roots fetched from peers"
+                );
+                let source = PeerSource::new_with_db(db, Some(parsed));
+                Some(Arc::new(VctState {
+                    fast: true,
+                    source: Box::new(source),
+                    requires_verified_successor: true,
+                    fast_count: AtomicU64::new(0),
+                    prevalidated_count: AtomicU64::new(0),
+                }))
+            }
+
+            // Legacy committer: full per-block recompute when checkpoint sync is disabled, the
+            // force-disable knob is set, or the network has no embedded frontiers. No VCT state,
+            // zero overhead.
+            SourceMode::Legacy => None,
+        }
+    }
+
+    /// `true` when the fast (skip-recompute) path is active.
+    pub(super) fn is_fast(&self) -> bool {
+        self.fast
+    }
+
+    /// The supplied roots for `height`, when vct mode has a source entry for it
+    /// (the signal that this block takes the fast path).
+    pub(super) fn vct_roots_at_height(
+        &self,
+        height: block::Height,
+    ) -> Option<(sapling::tree::Root, orchard::tree::Root)> {
+        if !self.fast {
+            return None;
+        }
+
+        if self
+            .source
+            .vct_last_checkpoint_height()
+            .is_some_and(|handoff| height > handoff)
+        {
+            return None;
+        }
+
+        self.source.vct_root(height)
+    }
+
+    /// `true` when committing `height` on the vct path needs a buffered successor before
+    /// it can safely persist this block's supplied roots.
+    ///
+    /// Only untrusted peer-supplied roots at or above Heartwood require this. The
+    /// checkpoint handoff is exempt because its embedded final frontiers are verified
+    /// against this block's roots before the real tip treestate is written; trusted
+    /// local fixtures can commit their tip root on the in-arrears check.
+    pub(super) fn vct_root_needs_successor(
+        &self,
+        height: block::Height,
+        network: &Network,
+    ) -> bool {
+        self.fast
+            && self.vct_roots_at_height(height).is_some()
+            && self.requires_verified_successor
+            && self
+                .source
+                .final_frontiers()
+                .is_none_or(|frontiers| frontiers.height != height)
+            && Some(height) >= NetworkUpgrade::Heartwood.activation_height(network)
+    }
+
+    /// Discard the supplied root for `height` after it failed verification, so a re-fetch
+    /// can replace it. See
+    /// [`CommitmentRootSource::invalidate`](super::commitment_aux::CommitmentRootSource::invalidate).
+    pub(super) fn invalidate_fast_root(&self, height: block::Height) {
+        self.source.invalidate(height);
+    }
+
+    /// Discard peer-supplied roots that are no longer needed after `height` has committed.
+    pub(super) fn evict_committed_roots_through(&self, height: block::Height) {
+        self.source.evict_committed_through(height);
+    }
+
+    /// The checkpoint handoff height: the boundary below which the fast path skips
+    /// per-height note-commitment trees. `None` unless final frontiers are loaded.
+    pub(super) fn vct_sync_last_checkpoint_height(&self) -> Option<block::Height> {
+        self.source.vct_last_checkpoint_height()
+    }
+
+    /// The verified `(sapling, orchard, sprout)` frontiers to write as the tip
+    /// treestate, when `height` is the checkpoint handoff height.
+    #[allow(clippy::type_complexity)]
+    pub(super) fn final_frontiers_for_last_checkpoint(
+        &self,
+        height: block::Height,
+    ) -> Option<(
+        Arc<sapling::tree::NoteCommitmentTree>,
+        Arc<orchard::tree::NoteCommitmentTree>,
+        Arc<sprout::tree::NoteCommitmentTree>,
+    )> {
+        self.source
+            .final_frontiers()
+            .filter(|f| f.height == height)
+            .map(|f| (f.sapling.clone(), f.orchard.clone(), f.sprout.clone()))
+    }
+
+    /// Record that a block took the fast (skip-recompute) path.
+    pub(super) fn record_fast_block(&self) {
+        self.fast_count.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a fast block whose own commitment check was skipped by the dedup.
+    pub(super) fn record_prevalidated(&self) {
+        self.prevalidated_count.fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Number of blocks that took the fast path so far.
+    pub(super) fn fast_count(&self) -> u64 {
+        self.fast_count.load(Ordering::Relaxed)
+    }
+
+    /// Number of fast blocks whose own commitment check the dedup skipped.
+    #[cfg(test)]
+    pub(super) fn prevalidated_count(&self) -> u64 {
+        self.prevalidated_count.load(Ordering::Relaxed)
+    }
+
+    /// Test-only: build fast-mode state from an arbitrary commitment-root source
+    /// (e.g. a payload produced from a database), so the producer→consumer round-trip
+    /// can be exercised without networking.
+    #[cfg(test)]
+    pub(super) fn test_with_source(
+        source: Box<dyn CommitmentRootSource>,
+        requires_verified_successor: bool,
+    ) -> Arc<Self> {
+        Arc::new(VctState {
+            fast: true,
+            source,
+            requires_verified_successor,
+            fast_count: AtomicU64::new(0),
+            prevalidated_count: AtomicU64::new(0),
+        })
+    }
+}
+
+/// The verified final frontiers embedded for `network`, if supported.
+///
+/// Mainnet uses the constant embedded in the binary. Regtest has no fixed checkpoint —
+/// its checkpoint list is derived at runtime from the mined chain — so there is no
+/// committed frontier to embed; for deterministic e2e/integration testing of the fast
+/// path on Regtest, the frontier is instead loaded from the file named by the
+/// `VCT_REGTEST_FRONTIER` env var. This is scoped to **Regtest only** and validated
+/// against the configured Regtest checkpoint height, so Mainnet always uses the
+/// embedded constant and never reads the env. Other testnets have no frontier.
+fn embedded_final_frontiers(network: &Network) -> Option<FinalFrontiers> {
+    match network {
+        Network::Mainnet => Some(parse_embedded_final_frontiers(
+            MAINNET_FINAL_FRONTIERS,
+            network.checkpoint_list().max_height(),
+        )),
+        Network::Testnet(params) if params.is_regtest() => {
+            let path = std::env::var_os("VCT_REGTEST_FRONTIER")?;
+            Some(load_frontier_file(
+                path.as_ref(),
+                network.checkpoint_list().max_height(),
+            ))
+        }
+        Network::Testnet(_) => None,
+    }
+}
+
+/// Load and validate a final-frontier fixture file (the Regtest path; see
+/// [`embedded_final_frontiers`]). Separated from the env read so it is unit-testable
+/// without mutating process environment variables.
+fn load_frontier_file(path: &std::ffi::OsStr, expected_height: block::Height) -> FinalFrontiers {
+    let bytes =
+        std::fs::read(path).expect("VCT_REGTEST_FRONTIER must name a readable final-frontier file");
+    parse_embedded_final_frontiers(&bytes, expected_height)
+}
+
+/// Parse embedded final frontiers and verify they match the checkpoint list.
+fn parse_embedded_final_frontiers(bytes: &[u8], expected_height: block::Height) -> FinalFrontiers {
+    parse_final_frontiers_bytes(bytes, expected_height).unwrap_or_else(|error| panic!("{error}"))
+}
+
+fn parse_final_frontiers_bytes(
+    bytes: &[u8],
+    expected_height: block::Height,
+) -> Result<FinalFrontiers, FinalFrontiersValidationError> {
+    let parsed = FinalFrontiers::from_bytes(bytes).map_err(|error| {
+        FinalFrontiersValidationError::InvalidBytes {
+            error: error.to_string(),
+        }
+    })?;
+
+    if parsed.height != expected_height {
+        return Err(FinalFrontiersValidationError::HeightMismatch {
+            actual: parsed.height,
+            expected: expected_height,
+        });
+    }
+
+    Ok(parsed)
+}
+
+/// Validate serialized VCT final-frontier bytes against an expected checkpoint handoff height.
+pub fn validate_final_frontiers_bytes(
+    bytes: &[u8],
+    expected_height: block::Height,
+) -> Result<(), FinalFrontiersValidationError> {
+    parse_final_frontiers_bytes(bytes, expected_height).map(|_| ())
+}
+
+/// Test/developer helper for producing embedded final-frontier bytes from a
+/// legacy-computed tip treestate.
+#[cfg(test)]
+fn final_frontiers_bytes(height: block::Height, trees: &NoteCommitmentTrees) -> Vec<u8> {
+    FinalFrontiers {
+        height,
+        sapling: trees.sapling.clone(),
+        orchard: trees.orchard.clone(),
+        sprout: trees.sprout.clone(),
+    }
+    .to_bytes()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const EXPECTED_MAINNET_FINAL_SAPLING_ROOT: [u8; 32] = [
+        5, 88, 219, 64, 134, 21, 57, 124, 234, 59, 83, 8, 7, 143, 19, 29, 247, 58, 105, 80, 119,
+        139, 242, 243, 206, 137, 211, 94, 151, 126, 154, 13,
+    ];
+    const EXPECTED_MAINNET_FINAL_ORCHARD_ROOT: [u8; 32] = [
+        177, 173, 139, 203, 63, 186, 47, 172, 148, 107, 150, 204, 211, 212, 33, 155, 172, 108, 132,
+        148, 70, 210, 120, 97, 219, 160, 58, 242, 198, 124, 44, 3,
+    ];
+    const EXPECTED_MAINNET_FINAL_SPROUT_ROOT: [u8; 32] = [
+        77, 239, 224, 205, 90, 67, 51, 216, 15, 139, 120, 78, 55, 17, 177, 22, 246, 34, 206, 184,
+        49, 7, 97, 172, 28, 178, 69, 208, 13, 101, 55, 169,
+    ];
+
+    #[test]
+    fn source_mode_precedence() {
+        use SourceMode::*;
+        // Args are (checkpoint_sync, vct_fast_sync, has_embedded_frontiers).
+
+        // The default: a checkpoint-trusting sync with VCT fast sync on uses the peer source
+        // wherever embedded frontiers exist (Mainnet). Storage mode (Archive/Pruned) is not an
+        // input, so this covers both Archive and Pruned.
+        assert_eq!(select_source_mode(true, true, true), Peer);
+        // `vct_fast_sync = false` keeps checkpoint sync on but forces the legacy recompute,
+        // regardless of embedded frontiers.
+        assert_eq!(select_source_mode(true, false, true), Legacy);
+        assert_eq!(select_source_mode(true, false, false), Legacy);
+        // `checkpoint_sync = false` also fully recomputes the trees: legacy, never peer,
+        // regardless of the fast-sync knob or embedded frontiers.
+        assert_eq!(select_source_mode(false, true, true), Legacy);
+        assert_eq!(select_source_mode(false, true, false), Legacy);
+        assert_eq!(select_source_mode(false, false, true), Legacy);
+        assert_eq!(select_source_mode(false, false, false), Legacy);
+        // No embedded frontiers (e.g. Testnet): legacy, never peer, even under checkpoint sync.
+        assert_eq!(select_source_mode(true, true, false), Legacy);
+    }
+
+    #[test]
+    fn successor_policy_is_vct_state_data() {
+        let network = Network::Mainnet;
+        let height = NetworkUpgrade::Heartwood
+            .activation_height(&network)
+            .expect("mainnet has a Heartwood activation height");
+        let root_map =
+            || std::iter::once((height.0, (Default::default(), Default::default()))).collect();
+
+        let trusted = VctState::test_with_source(
+            Box::new(super::super::commitment_aux::FixtureSource::new(
+                root_map(),
+                None,
+            )),
+            false,
+        );
+        assert!(
+            !trusted.vct_root_needs_successor(height, &network),
+            "trusted fixture roots can commit without a buffered successor"
+        );
+
+        let untrusted = VctState::test_with_source(
+            Box::new(super::super::commitment_aux::FixtureSource::new(
+                root_map(),
+                None,
+            )),
+            true,
+        );
+        assert!(
+            untrusted.vct_root_needs_successor(height, &network),
+            "untrusted roots defer until a buffered successor verifies them"
+        );
+    }
+
+    #[test]
+    fn vct_root_is_bounded_by_handoff_height() {
+        let handoff = block::Height(10);
+        let after_handoff = (handoff + 1).expect("test height is valid");
+        let roots = std::collections::HashMap::from([
+            (handoff.0, (Default::default(), Default::default())),
+            (after_handoff.0, (Default::default(), Default::default())),
+        ]);
+        let frontiers = FinalFrontiers {
+            height: handoff,
+            sapling: Arc::new(sapling::tree::NoteCommitmentTree::default()),
+            orchard: Arc::new(orchard::tree::NoteCommitmentTree::default()),
+            sprout: Arc::new(sprout::tree::NoteCommitmentTree::default()),
+        };
+
+        let bounded = VctState::test_with_source(
+            Box::new(super::super::commitment_aux::FixtureSource::new(
+                roots.clone(),
+                Some(frontiers),
+            )),
+            false,
+        );
+        assert!(
+            bounded.vct_roots_at_height(handoff).is_some(),
+            "the handoff root remains fast-path eligible"
+        );
+        assert!(
+            bounded.vct_roots_at_height(after_handoff).is_none(),
+            "roots above the handoff are ignored"
+        );
+
+        let unbounded = VctState::test_with_source(
+            Box::new(super::super::commitment_aux::FixtureSource::new(
+                roots, None,
+            )),
+            false,
+        );
+        assert!(
+            unbounded.vct_roots_at_height(after_handoff).is_some(),
+            "sources without a handoff keep the existing fixture behavior"
+        );
+    }
+
+    #[test]
+    fn embedded_mainnet_final_frontiers_parse() {
+        let frontiers = embedded_final_frontiers(&Network::Mainnet)
+            .expect("mainnet has embedded final frontiers");
+
+        assert_eq!(
+            frontiers.height,
+            Network::Mainnet.checkpoint_list().max_height(),
+            "embedded frontier is tied to the last mainnet checkpoint"
+        );
+        assert_eq!(
+            <[u8; 32]>::from(frontiers.sapling.root()),
+            EXPECTED_MAINNET_FINAL_SAPLING_ROOT,
+            "embedded mainnet final Sapling frontier root is pinned"
+        );
+        assert_eq!(
+            <[u8; 32]>::from(frontiers.orchard.root()),
+            EXPECTED_MAINNET_FINAL_ORCHARD_ROOT,
+            "embedded mainnet final Orchard frontier root is pinned"
+        );
+        assert_eq!(
+            <[u8; 32]>::from(frontiers.sprout.root()),
+            EXPECTED_MAINNET_FINAL_SPROUT_ROOT,
+            "embedded mainnet final Sprout frontier root is pinned"
+        );
+    }
+
+    #[test]
+    fn final_frontiers_capture_helper_serializes_tip_trees() {
+        let height = block::Height(3_358_006);
+        let trees = NoteCommitmentTrees::default();
+
+        let parsed = FinalFrontiers::from_bytes(&final_frontiers_bytes(height, &trees))
+            .expect("captured final frontiers should parse");
+
+        assert_eq!(parsed.height, height, "captured height round-trips");
+        assert_eq!(
+            parsed.sapling.root(),
+            trees.sapling.root(),
+            "captured sapling frontier round-trips"
+        );
+        assert_eq!(
+            parsed.orchard.root(),
+            trees.orchard.root(),
+            "captured orchard frontier round-trips"
+        );
+        assert_eq!(
+            parsed.sprout.root(),
+            trees.sprout.root(),
+            "captured sprout frontier round-trips"
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "embedded VCT final frontier height must match")]
+    fn embedded_final_frontiers_reject_checkpoint_height_mismatch() {
+        let frontiers = FinalFrontiers {
+            height: block::Height(1),
+            sapling: Arc::new(Default::default()),
+            orchard: Arc::new(Default::default()),
+            sprout: Arc::new(Default::default()),
+        };
+
+        let _ = parse_embedded_final_frontiers(&frontiers.to_bytes(), block::Height(2));
+    }
+
+    #[test]
+    fn final_frontiers_parser_rejects_short_height() {
+        let error =
+            FinalFrontiers::from_bytes(&[0, 1, 2]).expect_err("short height should be rejected");
+
+        assert_eq!(
+            error.to_string(),
+            "missing final frontier height: expected 4 bytes, got 3"
+        );
+    }
+
+    #[test]
+    fn final_frontiers_parser_rejects_missing_tree_length() {
+        let bytes = block::Height(1).0.to_le_bytes();
+
+        let error =
+            FinalFrontiers::from_bytes(&bytes).expect_err("missing length should be rejected");
+
+        assert_eq!(
+            error.to_string(),
+            "missing sapling frontier length prefix at byte 4: expected 4 bytes, got 0"
+        );
+    }
+
+    #[test]
+    fn final_frontiers_parser_rejects_truncated_tree_blob() {
+        let mut bytes = block::Height(1).0.to_le_bytes().to_vec();
+        bytes.extend_from_slice(&3u32.to_le_bytes());
+        bytes.extend_from_slice(&[0, 1]);
+
+        let error =
+            FinalFrontiers::from_bytes(&bytes).expect_err("truncated blob should be rejected");
+
+        assert_eq!(
+            error.to_string(),
+            "truncated sapling frontier blob at byte 8: length prefix says 3 bytes, but only 2 remain"
+        );
+    }
+
+    #[test]
+    fn final_frontiers_parser_rejects_trailing_bytes() {
+        let bytes = FinalFrontiers {
+            height: block::Height(1),
+            sapling: Arc::new(Default::default()),
+            orchard: Arc::new(Default::default()),
+            sprout: Arc::new(Default::default()),
+        }
+        .to_bytes()
+        .into_iter()
+        .chain([0])
+        .collect::<Vec<_>>();
+
+        let error =
+            FinalFrontiers::from_bytes(&bytes).expect_err("trailing bytes should be rejected");
+
+        assert_eq!(
+            error.to_string(),
+            format!(
+                "unexpected trailing final frontier bytes at byte {}: 1 bytes",
+                bytes.len() - 1
+            )
+        );
+    }
+
+    #[test]
+    #[should_panic(expected = "invalid VCT final frontier bytes: truncated sapling frontier blob")]
+    fn embedded_final_frontiers_reject_malformed_bytes_with_context() {
+        let mut bytes = block::Height(1).0.to_le_bytes().to_vec();
+        bytes.extend_from_slice(&3u32.to_le_bytes());
+        bytes.extend_from_slice(&[0, 1]);
+
+        let _ = parse_embedded_final_frontiers(&bytes, block::Height(1));
+    }
+
+    #[test]
+    fn embedded_final_frontiers_are_network_specific() {
+        assert!(
+            embedded_final_frontiers(&Network::new_default_testnet()).is_none(),
+            "testnet has no embedded final frontier until VCT fast sync supports it"
+        );
+    }
+
+    /// The Regtest frontier-file loader (the `VCT_REGTEST_FRONTIER` path) round-trips a
+    /// captured frontier and ties it to the expected checkpoint height — exercising the
+    /// producer (`to_bytes`) → loader (`load_frontier_file`) seam without env vars.
+    #[test]
+    fn load_frontier_file_round_trips_a_captured_frontier() {
+        let height = block::Height(123);
+        let bytes = FinalFrontiers {
+            height,
+            sapling: Arc::new(Default::default()),
+            orchard: Arc::new(Default::default()),
+            sprout: Arc::new(Default::default()),
+        }
+        .to_bytes();
+
+        let path =
+            std::env::temp_dir().join(format!("vct-frontier-load-test-{}.bin", std::process::id()));
+        std::fs::write(&path, &bytes).expect("write temp frontier file");
+
+        let loaded = load_frontier_file(path.as_os_str(), height);
+        assert_eq!(loaded.height, height, "loaded frontier height matches");
+        assert_eq!(
+            loaded.sapling.root(),
+            sapling::tree::NoteCommitmentTree::default().root(),
+            "loaded sapling frontier round-trips"
+        );
+
+        let _ = std::fs::remove_file(&path);
+    }
+
+    /// A frontier whose height does not match the checkpoint height is rejected, so a
+    /// stale/wrong Regtest fixture cannot silently mis-seed the handoff.
+    #[test]
+    #[should_panic(expected = "embedded VCT final frontier height must match")]
+    fn load_frontier_file_rejects_height_mismatch() {
+        let bytes = FinalFrontiers {
+            height: block::Height(5),
+            sapling: Arc::new(Default::default()),
+            orchard: Arc::new(Default::default()),
+            sprout: Arc::new(Default::default()),
+        }
+        .to_bytes();
+        let path = std::env::temp_dir().join(format!(
+            "vct-frontier-mismatch-test-{}.bin",
+            std::process::id()
+        ));
+        std::fs::write(&path, &bytes).expect("write temp frontier file");
+
+        let _ = load_frontier_file(path.as_os_str(), block::Height(6));
+    }
+}
diff --git a/zebra-state/src/service/finalized_state/vct/mainnet-frontier.bin b/zebra-state/src/service/finalized_state/vct/mainnet-frontier.bin
new file mode 100644
index 0000000000000000000000000000000000000000..eec96324fe99e7d2c4117b9c71fb51943c9904b5
GIT binary patch
literal 1675
zcmV;626Xv0Ju?6a0ssI3{EFFU1OO{nD(Zq{hdh0Ei>q~z6lgGV=rW(&iz~dl<{wf)
zJuwa$OK-1NGupI;GHrGpCo>?;*U-OmPXn5=h|2Dm6W?+eew25$$oM#BrEKlAYU(#l
zHPy#2kS}QWFlUha+K)no;Q=0t!UJN7#VF7@Dd7B#6IkN_cKTM8=`04P?%{8FlfCHl
z#LDG*@+Ds%c1ecnbHE1^vR2>;frT>V-n0)oG^IZ+sm85-=l$=;<vT}M69_<?xG~bx
zG<Jhr=l4(u<pb47Na*^Mx#C4Bx<fQZ@L!y@%2Lk+WM#5Vt&~2H<0JOuT@ZatT)r$!
zw84r-ZE?guw6tM8HW%$h*z{H%g|HRrHkchchMX4dE(5OXBt#%-Gpxh+vxKg>V<l#i
zpAAF=Tv$Sj*xJfIES#mFHXBuQq!ofu+v)Z?gy~6>97yU=XpXL4RKiUS_olE6<e2#`
zwc*d!qS$?oy;Ed;9OCeUo7?fa*RD7CMd$t@7U01dbvD1c)k*V*Y&=;$C7Aa^a$p9y
z-a<!i)oN9zRw<{rE<+4Xd=MIG>98sm8TpVSrkl1$>ax<R8gs*EJaoGQJUmG->dm2^
zZ`nIwCo2<7q?EP-6Mc#0D92I2Z9ep<dPVa(^FzT<V9Xu?1z6iah7~z{>N`^i2agjS
z_d01%cZ>4#&WY1rmwuWJi2?us0sMKL`vL)AAB!t%v)(<S|3p;2?SxRo(tOt+^&Q+o
zai0#me!mK^J~`3Q`7~9+hnyPn@+UEBIcnS4N>?CCZ-h^a!s;*)3l({95SALEqd!t#
zV&*HLLt%T#qemiIuhu}29P{iZf^d}OzuMR`7?Pny82fG(u#K)}dqh9jzg?vXMj+@W
z6^?^eeL-qSaJB~cw^rk%pJk&T7XjA>zQtA|wX~@_K5vYzGNy!6cLx7Jl6I=zE9?XE
zFC21P6gyZcHXHB)_Y!k|kUTFl8f&fmmf^k?2viQaY%(~s?7Y*?9L6UsTYDfGiSu$`
z=h$~*6{}Ux^!B|gkpuUY2iIko=(DaIb7MVu#$+=disvX;;Zrz)YIP(?XkrE`o5oQf
z(&kVG1}d2|LX<yx%Q$4H6r?XcgQ2mNh6|vsrQ;25^4ahp)g-i{!qd!2Ktc@E$W+@`
zPRo+6Bv;jko!(q2Wnoh`AXx1%gj-}LB=zZhIbEq4M=!+BGcgXFY*mu`Bm#yy<hxrd
zefjjm^$6M}jgci&ncrsUO89wGceiP4xP9~^C@JWw&GAqhs_R^~;fd7e7$PX+)VZwn
zM-y36LFs=Xe2&g5DzY_QfSXu=n<2-g>0JD2Jl2Uge|0nLhe;+L%q_~JII|KFEwD>N
zT5xS+Bu&&cBaaH9>ET(8HAe^#EzCl5$e`^bH|+O^lYpRpeL{SHor2{!04vc%DR@9E
z+V(x`^|TH70@~?~t-vYrfk#al4BhPS8xUnONTM_q;=HD)*@xC>-utMXz=9cSk|s3m
zh~Q<$Y2_xnh!yS|0kN%%%Rjm=tdwh(%+u5%o2+bvlt$8cVcVcO^2U5D1L*+(00I1C
zn->592%oiW)oun@S=3i!3h2L?Sj54KOf!f{O<*-+hp{nQLSnM}qfGmhm>F}w+AHt$
z7A}>d@UHM|YuT#awOG3K480KANk_C*fMC8M@ZCm*MgVPm{n00JrR9!lAfRA3iTt{~
zL9e(sjdb)<4E1V;=d|NThOkH<Fe_@^Ej+qvTqDr9kmvL@Df{3w!WcXT8{b=~?+hv7
zmn1_rMHt5Re}uM2d+zF(TlsU$F6DTF3u`(Tp*@@u4)M*)i_?9+XFEd!j@@r6DYmzI
z4Ie78*`3UA!GjsMHZLL3cUK%!=yVR=;;7sB<EKj5>%-;SvO8{@IH^P4++M(X%EOML
ztClHR9*qHv99i&~=95szq6WB7$S83Sy6cA1?{eBZwt!+1|5q0eX#~__(o4nPVG<^q
z3uWH_`_#9O`KN`Oor9n`6~$(&61rKjFuJgcCAl)rAWQLgPs!;feo-*-kw#s+f0*8X
z8R9QD#W!XSlt=t0;e(Pm+;voo1bji!zQIj<9s23QTqr^q*GxlV8+lSjrTaW1j4Y|w
z`5juQU>hI9Bo~v|cvKNy#~BWwY-G1@s+Syh%*HWp#}@eycL7cB;LTb?GuRJ{cuqGF
Vu@?3s&bToLVXPdoMbHgpH>u=*EEWI&

literal 0
HcmV?d00001

diff --git a/zebra-state/src/service/finalized_state/zebra_db.rs b/zebra-state/src/service/finalized_state/zebra_db.rs
index e7ba5325b2f..be72207dfca 100644
--- a/zebra-state/src/service/finalized_state/zebra_db.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db.rs
@@ -175,11 +175,25 @@ impl ZebraDb {
             )
         }
 
+        db.run_blocking_format_repairs(network);
         db.spawn_format_change(format_change);
 
         db
     }
 
+    /// Run synchronous compatibility repairs before background format checks can read the DB.
+    pub fn run_blocking_format_repairs(&self, network: &Network) {
+        if self.debug_skip_format_upgrades {
+            return;
+        }
+
+        // Repair incompatible stored history-tree bytes before the background
+        // format-validity check can read and panic on them. Healthy databases are
+        // a no-op, and read-only/offline-tool opens keep their existing
+        // skip-upgrade behavior.
+        rollback::repair_tip_history_tree_if_incompatible(self, network);
+    }
+
     /// Launch any required format changes or format checks, and store their thread handle.
     pub fn spawn_format_change(&mut self, format_change: DbFormatChange) {
         if self.debug_skip_format_upgrades {
diff --git a/zebra-state/src/service/finalized_state/zebra_db/block.rs b/zebra-state/src/service/finalized_state/zebra_db/block.rs
index 3177bee75ae..a551fcd9481 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/block.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/block.rs
@@ -68,20 +68,6 @@ pub const ZAKURA_HEADER_COMMITMENT_ROOTS_BY_HEIGHT: &str =
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
 struct AdvertisedBodySize(u32);
 
-/// Verified-commitment-trees data used only while checkpoint fast-sync skips
-/// per-height Sapling and Orchard tree writes.
-///
-/// Live semantic sync must pass `None` for this data so it keeps writing the
-/// full per-height trees.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub struct VctData {
-    /// Roots to insert into the anchor set instead of writing per-height trees.
-    pub(in super::super) anchor_roots: (sapling::tree::Root, orchard::tree::Root),
-
-    /// Height below which per-height trees are absent in a VCT-synced database.
-    pub(in super::super) sync_below: Height,
-}
-
 impl AdvertisedBodySize {
     fn new(size: u32) -> Option<Self> {
         (size != 0).then_some(Self(size))
@@ -1033,6 +1019,7 @@ impl ZebraDb {
     /// - Propagates any errors from computing the block's chain value balance change or
     ///   from applying the change to the chain value balance
     #[allow(clippy::unwrap_in_result)]
+    #[allow(clippy::too_many_arguments)]
     pub(in super::super) fn write_block(
         &mut self,
         finalized: FinalizedBlock,
@@ -1040,7 +1027,11 @@ impl ZebraDb {
         network: &Network,
         source: &str,
         retention: RetentionPlan,
-        vct_data: Option<VctData>,
+        // When `Some`, skip per-height tree writes and fold these roots into
+        // the anchor set.
+        vct_anchor_roots: Option<(sapling::tree::Root, orchard::tree::Root)>,
+        // When `Some(height)`, mark the database as vct-synced.
+        vct_sync_below: Option<Height>,
     ) -> Result<block::Hash, CommitCheckpointVerifiedError> {
         let tx_hash_indexes: HashMap<transaction::Hash, usize> = finalized
             .transaction_hashes
@@ -1224,7 +1215,8 @@ impl ZebraDb {
             prev_note_commitment_trees,
             store_raw_txs,
             precomputed_raw_txs,
-            vct_data,
+            vct_anchor_roots,
+            vct_sync_below,
         )?;
 
         // In pruned storage mode, delete raw transaction history that has fallen
@@ -1582,7 +1574,8 @@ impl DiskWriteBatch {
         prev_note_commitment_trees: Option<NoteCommitmentTrees>,
         store_raw_transactions: bool,
         precomputed_raw_txs: Option<Vec<RawBytes>>,
-        vct_data: Option<VctData>,
+        vct_anchor_roots: Option<(sapling::tree::Root, orchard::tree::Root)>,
+        vct_sync_below: Option<Height>,
     ) -> Result<(), CommitCheckpointVerifiedError> {
         // Commit block, transaction, and note commitment tree data.
         self.prepare_block_header_and_transaction_data_batch(
@@ -1604,7 +1597,13 @@ impl DiskWriteBatch {
         //
         // In Zebra we include the nullifiers and note commitments in the genesis block because it simplifies our code.
         self.prepare_shielded_transaction_batch(zebra_db, finalized);
-        self.prepare_trees_batch(zebra_db, finalized, prev_note_commitment_trees, vct_data);
+        self.prepare_trees_batch(
+            zebra_db,
+            finalized,
+            prev_note_commitment_trees,
+            vct_anchor_roots,
+            vct_sync_below,
+        );
 
         // # Consensus
         //
diff --git a/zebra-state/src/service/finalized_state/zebra_db/block/tests/prune.rs b/zebra-state/src/service/finalized_state/zebra_db/block/tests/prune.rs
index 6c24d19b301..536b8dd52eb 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/block/tests/prune.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/block/tests/prune.rs
@@ -49,7 +49,7 @@ fn new_state_with_blocks(config: &Config, network: &Network) -> FinalizedState {
             .expect("test data deserializes");
 
         state
-            .commit_finalized_direct(block.into(), None, "prune tests")
+            .commit_finalized_direct(block.into(), None, None, "prune tests")
             .expect("test block is valid");
     }
 
@@ -80,7 +80,7 @@ fn new_state_with_checkpoint_retention(
             .expect("test data deserializes");
 
         state
-            .commit_finalized_direct(block.into(), None, "checkpoint retention tests")
+            .commit_finalized_direct(block.into(), None, None, "checkpoint retention tests")
             .expect("test block is valid");
     }
 
@@ -351,7 +351,7 @@ fn checkpoint_retention_hands_off_to_online_pruning_at_start() {
             .expect("test data deserializes");
 
         state
-            .commit_finalized_direct(block.into(), None, "checkpoint handoff tests")
+            .commit_finalized_direct(block.into(), None, None, "checkpoint handoff tests")
             .expect("test block is valid");
     }
 
@@ -386,7 +386,7 @@ fn checkpoint_retention_hands_off_to_online_pruning_at_start() {
         .expect("test data deserializes");
 
     state
-        .commit_finalized_direct(block.into(), None, "checkpoint handoff tests")
+        .commit_finalized_direct(block.into(), None, None, "checkpoint handoff tests")
         .expect("handoff block is valid");
 
     let online_prune_until =
@@ -630,7 +630,7 @@ fn archive_to_pruned_checkpoint_sync_drains_archive_raw_transactions_before_skip
             .expect("test data deserializes");
 
         archive_state
-            .commit_finalized_direct(block.into(), None, "archive phase")
+            .commit_finalized_direct(block.into(), None, None, "archive phase")
             .expect("archive block is valid");
     }
 
@@ -670,7 +670,7 @@ fn archive_to_pruned_checkpoint_sync_drains_archive_raw_transactions_before_skip
         .expect("test data deserializes");
 
     pruned_state
-        .commit_finalized_direct(block.into(), None, "archive to pruned checkpoint")
+        .commit_finalized_direct(block.into(), None, None, "archive to pruned checkpoint")
         .expect("checkpoint block is valid");
 
     assert_eq!(
@@ -728,7 +728,7 @@ fn archive_backlog_flag_is_recomputed_when_reopening_a_pruned_database() {
             .expect("test data deserializes");
 
         archive_state
-            .commit_finalized_direct(block.into(), None, "archive phase")
+            .commit_finalized_direct(block.into(), None, None, "archive phase")
             .expect("archive block is valid");
     }
     std::mem::drop(archive_state);
@@ -761,7 +761,7 @@ fn archive_backlog_flag_is_recomputed_when_reopening_a_pruned_database() {
         .zcash_deserialize_into()
         .expect("test data deserializes");
     pruned_state
-        .commit_finalized_direct(block.into(), None, "archive to pruned checkpoint")
+        .commit_finalized_direct(block.into(), None, None, "archive to pruned checkpoint")
         .expect("checkpoint block is valid");
     assert_eq!(
         pruned_state.db.lowest_retained_height(),
@@ -842,7 +842,7 @@ fn contextual_commits_keep_raw_transactions_before_checkpoint_retention_start()
         .zcash_deserialize_into()
         .expect("genesis test data deserializes");
     state
-        .commit_finalized_direct(genesis.into(), None, "contextual retention tests")
+        .commit_finalized_direct(genesis.into(), None, None, "contextual retention tests")
         .expect("genesis block is valid");
 
     let block: Arc<Block> = blocks
@@ -858,7 +858,7 @@ fn contextual_commits_keep_raw_transactions_before_checkpoint_retention_start()
     let finalizable = FinalizableBlock::new(contextually_verified, Treestate::default());
 
     state
-        .commit_finalized_direct(finalizable, None, "contextual retention tests")
+        .commit_finalized_direct(finalizable, None, None, "contextual retention tests")
         .expect("contextual block is valid");
 
     assert!(
@@ -1197,7 +1197,8 @@ fn reopening_fast_synced_database_in_pruned_mode_with_vct_disabled_succeeds() {
 }
 
 #[test]
-fn reopening_interrupted_fast_sync_without_a_root_source_succeeds() {
+#[should_panic(expected = "interrupted below the checkpoint handoff")]
+fn reopening_interrupted_fast_sync_without_a_root_source_panics() {
     let _init_guard = zebra_test::init();
     let network = Mainnet;
 
@@ -1220,23 +1221,19 @@ fn reopening_interrupted_fast_sync_without_a_root_source_succeeds() {
         state.db.write_batch(batch).expect("marker batch writes");
     }
 
-    // This storage-only PR does not enable the fast path or its resume policy. Reopening preserves
-    // the marker so later fast-sync wiring can decide how to resume or repair.
-    let reopened = FinalizedState::new(
+    // Reopening with the fast path disabled must refuse: the on-disk frontier is stale and no
+    // root source exists, so the committer would otherwise stall on every below-handoff block.
+    let _state = FinalizedState::new(
         &config,
         &network,
         #[cfg(feature = "elasticsearch")]
         false,
     );
-    assert_eq!(
-        reopened.db.vct_synced_below(),
-        Some(Height(100)),
-        "the interrupted fast-sync marker is preserved across reopen"
-    );
 }
 
 #[test]
-fn reopening_interrupted_fast_sync_with_vct_disabled_succeeds() {
+#[should_panic(expected = "interrupted below the checkpoint handoff")]
+fn reopening_interrupted_fast_sync_with_vct_disabled_panics() {
     let _init_guard = zebra_test::init();
     let network = Mainnet;
 
@@ -1259,19 +1256,14 @@ fn reopening_interrupted_fast_sync_with_vct_disabled_succeeds() {
         state.db.write_batch(batch).expect("marker batch writes");
     }
 
-    // The force-disable knob only affects the future fast-sync source selection. The database still
-    // opens and keeps the marker available for follow-up resume or repair logic.
-    let reopened = FinalizedState::new(
+    // Reopening with the VCT force-disable knob must refuse: the on-disk frontier is stale and
+    // no root source exists, so the committer would otherwise stall on every below-handoff block.
+    let _state = FinalizedState::new(
         &config,
         &network,
         #[cfg(feature = "elasticsearch")]
         false,
     );
-    assert_eq!(
-        reopened.db.vct_synced_below(),
-        Some(Height(100)),
-        "the interrupted fast-sync marker is preserved across reopen"
-    );
 }
 
 #[test]
diff --git a/zebra-state/src/service/finalized_state/zebra_db/block/tests/snapshot.rs b/zebra-state/src/service/finalized_state/zebra_db/block/tests/snapshot.rs
index 82a214099c6..b875ed9903d 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/block/tests/snapshot.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/block/tests/snapshot.rs
@@ -195,7 +195,7 @@ fn test_block_and_transaction_data_with_network(network: Network) {
             .expect("test data deserializes");
 
         state
-            .commit_finalized_direct(block.into(), None, "snapshot tests")
+            .commit_finalized_direct(block.into(), None, None, "snapshot tests")
             .expect("test block is valid");
 
         let mut settings = insta::Settings::clone_current();
diff --git a/zebra-state/src/service/finalized_state/zebra_db/block/tests/vectors.rs b/zebra-state/src/service/finalized_state/zebra_db/block/tests/vectors.rs
index e72f7bb74c5..c0ecaec18cf 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/block/tests/vectors.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/block/tests/vectors.rs
@@ -1311,6 +1311,7 @@ fn write_full_block(state: &mut ZebraDb, block: Arc<Block>) {
             "test",
             RetentionPlan::Store,
             None,
+            None,
         )
         .expect("block commit succeeds");
 }
diff --git a/zebra-state/src/service/finalized_state/zebra_db/chain.rs b/zebra-state/src/service/finalized_state/zebra_db/chain.rs
index e7cadb8bc04..ff225f04257 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/chain.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/chain.rs
@@ -29,7 +29,7 @@ use zebra_chain::{
 use crate::{
     request::FinalizedBlock,
     service::finalized_state::{
-        disk_db::DiskWriteBatch,
+        disk_db::{DiskWriteBatch, ReadDisk},
         disk_format::{chain::HistoryTreeParts, RawBytes},
         zebra_db::{metrics::value_pool_metrics, ZebraDb},
         TypedColumnFamily,
@@ -157,6 +157,40 @@ impl ZebraDb {
         Arc::new(HistoryTree::from(history_tree))
     }
 
+    /// Returns `Ok(())` if the stored tip history tree decodes with the current
+    /// `HistoryTreeParts` format.
+    ///
+    /// This is a non-panicking compatibility probe used during DB open before
+    /// background format checks can call [`Self::history_tree`]. It reads raw
+    /// bytes and performs the same current-key then legacy-key fallback as
+    /// [`Self::history_tree`].
+    pub(crate) fn check_tip_history_tree_decodes(&self) -> Result<(), String> {
+        let history_tree_cf = self
+            .db
+            .cf_handle(HISTORY_TREE)
+            .expect("column family was created when database was created");
+
+        let raw_parts: Option<RawBytes> = self.db.zs_get(&history_tree_cf, &());
+        let raw_parts = raw_parts.or_else(|| {
+            self.db
+                .zs_last_key_value::<_, RawBytes, RawBytes>(&history_tree_cf)
+                .map(|(_height_key, tree_value)| tree_value)
+        });
+
+        let Some(raw_parts) = raw_parts else {
+            return Ok(());
+        };
+
+        let parts = HistoryTreeParts::from_bytes_result(raw_parts.raw_bytes())
+            .map_err(|error| format!("stored history tree does not deserialize: {error}"))?;
+
+        parts
+            .with_network(&self.db.network())
+            .map_err(|error| format!("stored history tree is invalid for this network: {error}"))?;
+
+        Ok(())
+    }
+
     /// Returns all the history tip trees.
     /// We only store the history tree for the tip, so this method is only used in tests and
     /// upgrades.
diff --git a/zebra-state/src/service/finalized_state/zebra_db/prune.rs b/zebra-state/src/service/finalized_state/zebra_db/prune.rs
index 42813e35378..e32c54f7988 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/prune.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/prune.rs
@@ -355,7 +355,7 @@ mod tests {
                 .expect("test data deserializes");
 
             state
-                .commit_finalized_direct(block.into(), None, "offline prune tests")
+                .commit_finalized_direct(block.into(), None, None, "offline prune tests")
                 .expect("test block is valid");
         }
 
diff --git a/zebra-state/src/service/finalized_state/zebra_db/rollback.rs b/zebra-state/src/service/finalized_state/zebra_db/rollback.rs
index 5cce82d505f..f92e1126cc8 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/rollback.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/rollback.rs
@@ -511,6 +511,43 @@ fn prepare_rollback(
     })
 }
 
+pub(super) fn repair_tip_history_tree_if_incompatible(db: &ZebraDb, network: &Network) {
+    if db.check_tip_history_tree_decodes().is_ok() {
+        return;
+    }
+
+    let Some(tip_height) = db.finalized_tip_height() else {
+        return;
+    };
+
+    match rebuild_history_tree_from_upgrade_activation(db, network, tip_height) {
+        Ok(history_tree) => {
+            let mut batch = DiskWriteBatch::new();
+            batch.update_history_tree(db, &history_tree);
+
+            if let Err(error) = db.write_batch(batch) {
+                warn!(
+                    ?tip_height,
+                    ?error,
+                    "failed to repair incompatible tip history tree"
+                );
+            } else {
+                info!(
+                    ?tip_height,
+                    "repaired incompatible tip history tree before format check"
+                );
+            }
+        }
+        Err(error) => {
+            warn!(
+                ?tip_height,
+                ?error,
+                "failed to rebuild incompatible tip history tree"
+            );
+        }
+    }
+}
+
 struct RebuiltTreestate {
     sprout_tree: Arc<zebra_chain::sprout::tree::NoteCommitmentTree>,
     history_tree: HistoryTree,
@@ -1368,6 +1405,43 @@ mod tests {
         }
     }
 
+    /// `serve_block_roots` reads a request that starts at or above the upgrade height `U` straight
+    /// from the serving index, without touching the per-height trees.
+    #[test]
+    fn serve_block_roots_serves_at_or_above_upgrade_from_index() {
+        let _init_guard = zebra_test::init();
+        let db = ephemeral_mainnet_db();
+
+        // Index covers [4, 6]; the upgrade height is U = 4.
+        let mut batch = DiskWriteBatch::new();
+        batch.update_vct_upgrade_marker(&db, Height(4));
+        for height in 4u32..=6 {
+            batch.insert_commitment_roots_by_height(
+                &db,
+                Height(height),
+                &sapling_root(height.into()),
+                &orchard_root(height.into()),
+                &zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+                0,
+                0,
+                0,
+                &zebra_chain::block::merkle::AuthDataRoot::from([0u8; 32]),
+            );
+        }
+        db.write_batch(batch)
+            .expect("seeding the serving index succeeds");
+
+        let served = crate::service::finalized_state::serve_block_roots(&db, Height(4)..=Height(6));
+        assert_eq!(
+            served
+                .into_iter()
+                .map(|root| root.height)
+                .collect::<Vec<_>>(),
+            vec![Height(4), Height(5), Height(6)],
+            "a request at or above U is served from the index"
+        );
+    }
+
     /// `delete_zakura_headers_above` must truncate every Zakura header CF above the target,
     /// including the hash→height index, while leaving rows at or below the target intact. This
     /// is the consistency guarantee that lets a rolled-back snapshot re-sync bodies from its tip
diff --git a/zebra-state/src/service/finalized_state/zebra_db/shielded.rs b/zebra-state/src/service/finalized_state/zebra_db/shielded.rs
index 8422c7ac935..3d10f163360 100644
--- a/zebra-state/src/service/finalized_state/zebra_db/shielded.rs
+++ b/zebra-state/src/service/finalized_state/zebra_db/shielded.rs
@@ -33,7 +33,7 @@ use crate::{
     service::finalized_state::{
         disk_db::{DiskWriteBatch, ReadDisk, WriteDisk},
         disk_format::{shielded::CommitmentRootsByHeight, RawBytes},
-        zebra_db::{block::VctData, ZebraDb},
+        zebra_db::ZebraDb,
         COMMITMENT_ROOTS_BY_HEIGHT,
     },
     TransactionLocation,
@@ -775,7 +775,8 @@ impl DiskWriteBatch {
         zebra_db: &ZebraDb,
         finalized: &FinalizedBlock,
         prev_note_commitment_trees: Option<NoteCommitmentTrees>,
-        vct_data: Option<VctData>,
+        vct_anchor_roots: Option<(sapling::tree::Root, orchard::tree::Root)>,
+        vct_sync_below: Option<Height>,
     ) {
         let FinalizedBlock {
             height,
@@ -818,8 +819,8 @@ impl DiskWriteBatch {
         // below the checkpoint handoff height). Written in the same atomic batch as
         // every vct commit, so a vct-synced database always carries the marker and
         // the read/validity guards never see absent trees without it.
-        if let Some(VctData { sync_below, .. }) = vct_data {
-            self.update_vct_sync_marker(zebra_db, sync_below);
+        if let Some(handoff) = vct_sync_below {
+            self.update_vct_sync_marker(zebra_db, handoff);
         }
 
         // POC (verified-commitment-trees) vct path: the committer skipped the
@@ -829,15 +830,7 @@ impl DiskWriteBatch {
         // tree CFs and subtrees entirely. The Sprout tree is unchanged below any
         // modern checkpoint, so it is correctly left untouched here.
         // See docs/design/verified-commitment-trees.md.
-        if let Some(VctData {
-            anchor_roots: (sapling_root, orchard_root),
-            sync_below,
-        }) = vct_data
-        {
-            // Mark the database as vct-synced in the same atomic batch as every
-            // fast commit, so the read/validity guards never see absent trees
-            // without the handoff marker.
-            self.update_vct_sync_marker(zebra_db, sync_below);
+        if let Some((sapling_root, orchard_root)) = vct_anchor_roots {
             self.insert_sapling_anchor(zebra_db, &sapling_root);
             self.insert_orchard_anchor(zebra_db, &orchard_root);
             // Persist the per-height roots into the serving index even though no per-height
diff --git a/zebra-state/src/service/non_finalized_state.rs b/zebra-state/src/service/non_finalized_state.rs
index 337cf01ff1c..1207d3e40d1 100644
--- a/zebra-state/src/service/non_finalized_state.rs
+++ b/zebra-state/src/service/non_finalized_state.rs
@@ -637,6 +637,7 @@ impl NonFinalizedState {
                     block,
                     &network,
                     &history_tree,
+                    // The non-finalized path doesn't precompute the auth data root.
                     None,
                 ));
             });
diff --git a/zebra-state/src/service/read/block.rs b/zebra-state/src/service/read/block.rs
index 11b4fe5defe..4d7f9bd91a8 100644
--- a/zebra-state/src/service/read/block.rs
+++ b/zebra-state/src/service/read/block.rs
@@ -387,14 +387,14 @@ where
         let Some(height) = from.0.checked_add(offset).map(Height) else {
             break;
         };
-        let confirmed_size = chain
+        let size_hint = chain
             .as_ref()
             .and_then(|chain| chain.as_ref().block_info(height.into()))
             .or_else(|| db.block_info(height.into()))
-            .map(|info| info.size());
-        let size = confirmed_size.or_else(|| db.advertised_body_size(height));
+            .map(|info| info.size())
+            .or_else(|| db.advertised_body_size(height));
 
-        hints.push((height, size));
+        hints.push((height, size_hint));
     }
 
     hints
diff --git a/zebra-state/src/service/tests.rs b/zebra-state/src/service/tests.rs
index 39f75203c36..f598174bbaf 100644
--- a/zebra-state/src/service/tests.rs
+++ b/zebra-state/src/service/tests.rs
@@ -28,8 +28,9 @@ use crate::{
     arbitrary::Prepare,
     init_test,
     service::{
-        arbitrary::populated_state, chain_tip::TipAction, headers_by_height_range,
-        non_finalized_state::Chain, StateService,
+        arbitrary::populated_state, block_roots_by_height_range, chain_tip::TipAction,
+        headers_by_height_range, non_finalized_state::Chain, root_covered_best_header_tip,
+        StateService,
     },
     tests::{
         setup::{partial_nu5_chain_strategy, transaction_v4_from_coinbase},
@@ -41,17 +42,24 @@ use crate::{
 
 const LAST_BLOCK_HEIGHT: u32 = 10;
 
-fn roots_from_height(start: Height, count: u32) -> Vec<BlockCommitmentRoots> {
+fn root_at(height: Height) -> BlockCommitmentRoots {
+    BlockCommitmentRoots {
+        height,
+        sapling_root: sapling::tree::NoteCommitmentTree::default().root(),
+        orchard_root: orchard::tree::NoteCommitmentTree::default().root(),
+        ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
+        sapling_tx: 0,
+        orchard_tx: 0,
+        ironwood_tx: 0,
+        auth_data_root: zebra_chain::block::merkle::AuthDataRoot::from([0u8; 32]),
+    }
+}
+
+fn roots_from_height(start_height: Height, count: usize) -> Vec<BlockCommitmentRoots> {
     (0..count)
-        .map(|offset| BlockCommitmentRoots {
-            height: Height(start.0 + offset),
-            sapling_root: sapling::tree::NoteCommitmentTree::default().root(),
-            orchard_root: orchard::tree::NoteCommitmentTree::default().root(),
-            ironwood_root: zebra_chain::ironwood::tree::NoteCommitmentTree::default().root(),
-            sapling_tx: 0,
-            orchard_tx: 0,
-            ironwood_tx: 0,
-            auth_data_root: zebra_chain::block::merkle::AuthDataRoot::from([0u8; 32]),
+        .map(|offset| {
+            let offset = u32::try_from(offset).expect("test root count fits in u32");
+            root_at(Height(start_height.0 + offset))
         })
         .collect()
 }
@@ -663,6 +671,49 @@ async fn header_only_service_requests_preserve_body_boundary() -> std::result::R
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread")]
+async fn commit_header_range_rejects_missing_tree_aux_roots() -> std::result::Result<(), BoxError> {
+    let _init_guard = zebra_test::init();
+    let network = Network::Mainnet;
+    let (state_service, _read_state, _, _) =
+        StateService::new(Config::ephemeral(), &network, Height::MAX, 0).await;
+    let genesis =
+        zebra_test::vectors::BLOCK_MAINNET_GENESIS_BYTES.zcash_deserialize_into::<Arc<Block>>()?;
+    let block1 =
+        zebra_test::vectors::BLOCK_MAINNET_1_BYTES.zcash_deserialize_into::<Arc<Block>>()?;
+
+    let state = Buffer::new(BoxService::new(state_service), 1);
+    assert_eq!(
+        state
+            .clone()
+            .oneshot(Request::CommitCheckpointVerifiedBlock(
+                CheckpointVerifiedBlock::from(genesis.clone()),
+            ))
+            .await?,
+        Response::Committed(genesis.hash()),
+    );
+
+    let error = state
+        .oneshot(Request::CommitHeaderRange {
+            anchor: genesis.hash(),
+            headers: vec![block1.header.clone()],
+            body_sizes: vec![0],
+            tree_aux_roots: Vec::new(),
+        })
+        .await
+        .expect_err("missing roots must reject a non-empty header range");
+
+    assert!(matches!(
+        error.downcast_ref::<crate::CommitHeaderRangeError>(),
+        Some(crate::CommitHeaderRangeError::TreeAuxRootCountMismatch {
+            headers: 1,
+            roots: 0,
+        })
+    ));
+
+    Ok(())
+}
+
 /// A node still in the finalized (checkpoint) write phase must be able to commit
 /// a Zakura header range.
 ///
@@ -776,9 +827,11 @@ async fn header_range_reads_include_non_finalized_best_chain_blocks() -> Result<
     chain = chain.push(block1.clone().prepare().test_with_zero_spent_utxos())?;
     chain = chain.push(block2.clone().prepare().test_with_zero_spent_utxos())?;
 
+    let chain = Arc::new(chain);
+
     assert_eq!(
         headers_by_height_range(
-            Some(Arc::new(chain)),
+            Some(chain.clone()),
             &state_service.read_service.db,
             start,
             2,
@@ -788,6 +841,45 @@ async fn header_range_reads_include_non_finalized_best_chain_blocks() -> Result<
             (start.next().unwrap(), block2_hash, block2.header.clone()),
         ],
     );
+    let roots = block_roots_by_height_range(Some(chain), &state_service.read_service.db, start, 2);
+    assert_eq!(roots.len(), 2);
+    assert_eq!(roots[0].height, start);
+    assert_eq!(roots[1].height, start.next().unwrap());
+    let verified_tip = ((start - 1).unwrap(), block::Hash([0; 32]));
+    let best_header_tip = (start.next().unwrap(), block2_hash);
+    assert_eq!(
+        root_covered_best_header_tip(
+            None::<Arc<Chain>>,
+            &state_service.read_service.db,
+            Some(best_header_tip),
+            Some(verified_tip),
+        ),
+        Some(verified_tip),
+        "rootless durable header tips are capped to the verified block tip"
+    );
+    assert_eq!(
+        root_covered_best_header_tip(
+            Some(Arc::new(
+                Chain::new(
+                    &network,
+                    (start - 1).unwrap(),
+                    Default::default(),
+                    Default::default(),
+                    Default::default(),
+                    Default::default(),
+                    Default::default(),
+                    ValueBalance::fake_populated_pool(),
+                )
+                .push(block1.prepare().test_with_zero_spent_utxos())?
+                .push(block2.prepare().test_with_zero_spent_utxos())?,
+            )),
+            &state_service.read_service.db,
+            Some(best_header_tip),
+            Some(verified_tip),
+        ),
+        Some(best_header_tip),
+        "verified non-finalized roots allow the header tip to stay ahead"
+    );
     assert_eq!(
         headers_by_height_range(None::<Arc<Chain>>, &state_service.read_service.db, start, 2),
         Vec::new(),
diff --git a/zebra-state/src/service/write.rs b/zebra-state/src/service/write.rs
index fceafbf42d7..cd746c6442e 100644
--- a/zebra-state/src/service/write.rs
+++ b/zebra-state/src/service/write.rs
@@ -4,7 +4,7 @@ use std::{
     collections::VecDeque,
     path::{Path, PathBuf},
     sync::Arc,
-    time::Duration,
+    time::{Duration, Instant},
 };
 
 use indexmap::IndexMap;
@@ -16,7 +16,7 @@ use tokio::sync::{
 use tracing::Span;
 use zebra_chain::{
     block::{self, Height},
-    parallel::commitment_aux::BlockCommitmentRoots,
+    parallel::{commitment_aux::BlockCommitmentRoots, tree::NoteCommitmentTrees},
 };
 
 use crate::{
@@ -39,6 +39,22 @@ use crate::service::{
     non_finalized_state::Chain,
 };
 
+/// Delay between retryable VCT root-miss commit attempts while the peer cache refills.
+const VCT_ROOT_RETRY_WAIT: Duration = Duration::from_millis(500);
+
+/// Delay between retryable VCT await-successor commit attempts. Shorter than
+/// [`VCT_ROOT_RETRY_WAIT`]: the root is already cached and only the next block needs to be
+/// downloaded into the look-ahead, so a tighter poll keeps the one-block commit lag small.
+const VCT_AWAIT_SUCCESSOR_WAIT: Duration = Duration::from_millis(20);
+
+/// How long a single checkpoint height may stay stuck on a retryable VCT root stall before
+/// the committer escalates to an error-level log and a `state.vct.root.stalled.height` gauge.
+/// Transient waits (a successor still downloading, a root still in flight) clear well within
+/// this; staying stuck past it means no peer can serve a root the frozen frontier requires,
+/// and — by design — the committer will not recompute against the stale frontier, so the node
+/// cannot advance until a peer supplies it. Surfacing that loudly is the operator's only signal.
+const VCT_ROOT_STALL_WARN_AFTER: Duration = Duration::from_secs(30);
+
 /// The maximum size of the parent error map.
 ///
 /// We allow enough space for multiple concurrent chain forks with errors.
@@ -220,7 +236,7 @@ impl From<QueuedSemanticallyVerified> for NonFinalizedWriteMessage {
 /// `finalized_state` or `non_finalized_state` and channels for sending
 /// it blocks.
 #[derive(Clone, Debug)]
-pub(super) struct BlockWriteSender {
+pub struct BlockWriteSender {
     /// A channel to send blocks to the `block_write_task`,
     /// so they can be written to the [`NonFinalizedState`].
     pub non_finalized: Option<tokio::sync::mpsc::UnboundedSender<NonFinalizedWriteMessage>>,
@@ -328,9 +344,21 @@ impl WriteBlockWorkerTask {
             backup_dir_path,
         } = &mut self;
 
-        let mut prev_finalized_note_commitment_trees = None;
+        let mut prev_finalized_note_commitment_trees: Option<NoteCommitmentTrees> = None;
         let mut deferred_non_finalized_messages = VecDeque::new();
 
+        // One-block look-ahead for VCT fast sync: the current block's supplied
+        // roots are authenticated by the successor's header commitment, so the
+        // writer buffers one checkpoint block ahead when possible.
+        let mut finalized_lookahead: VecDeque<QueuedCheckpointVerified> = VecDeque::new();
+        let mut retry_finalized_block: Option<QueuedCheckpointVerified> = None;
+
+        // Tracks how long the committer has been stuck retrying a single VCT root stall, so a
+        // genuine stall (no peer can serve a frozen-frontier height) escalates to a loud,
+        // observable signal while a transient wait stays quiet. `(height, first-seen)`.
+        let mut vct_root_stall: Option<(Height, Instant)> = None;
+        let mut vct_root_stall_logged = false;
+
         // Write all the finalized blocks sent by the state,
         // until the state closes the finalized block channel's sender.
         loop {
@@ -357,13 +385,19 @@ impl WriteBlockWorkerTask {
                 Err(TryRecvError::Disconnected) => {}
             }
 
-            let ordered_block = match finalized_block_write_receiver.try_recv() {
-                Ok(block) => block,
-                Err(TryRecvError::Empty) => {
-                    std::thread::park_timeout(Duration::from_millis(10));
-                    continue;
-                }
-                Err(TryRecvError::Disconnected) => break,
+            let ordered_block = match retry_finalized_block
+                .take()
+                .or_else(|| finalized_lookahead.pop_front())
+            {
+                Some(block) => block,
+                None => match finalized_block_write_receiver.try_recv() {
+                    Ok(block) => block,
+                    Err(TryRecvError::Empty) => {
+                        std::thread::park_timeout(Duration::from_millis(10));
+                        continue;
+                    }
+                    Err(TryRecvError::Disconnected) => break,
+                },
             };
 
             // TODO: split these checks into separate functions
@@ -394,22 +428,152 @@ impl WriteBlockWorkerTask {
                      Assuming a parent block failed, and dropping this block",
                 );
 
+                // The pipeline is broken; drop any look-ahead so commit resumes
+                // from the real finalized tip.
+                finalized_lookahead.clear();
+                finalized_state.clear_vct_prevalidated_next();
+
                 // We don't want to send a reset here, because it could overwrite a valid sent hash
                 std::mem::drop(ordered_block);
                 continue;
             }
 
-            // Try committing the block
-            match finalized_state
-                .commit_finalized(ordered_block, prev_finalized_note_commitment_trees.take())
+            // Peek the next block so VCT fast commits can verify the current
+            // block's supplied roots against the successor's header.
+            if finalized_lookahead.is_empty() {
+                if let Ok(next) = finalized_block_write_receiver.try_recv() {
+                    finalized_lookahead.push_back(next);
+                }
+            }
+
+            // A non-handoff VCT fast block's supplied roots are authenticated by
+            // its successor's header. If the successor is not buffered yet, keep
+            // this block local and wait instead of surfacing a checkpoint commit
+            // error through the invalid-block reset path.
+            if finalized_lookahead.is_empty()
+                && finalized_state.vct_fast_needs_successor(ordered_block.0.height)
             {
+                tracing::trace!(
+                    height = ?ordered_block.0.height,
+                    hash = ?ordered_block.0.hash,
+                    "VCT: deferring fast checkpoint commit until successor is buffered"
+                );
+                retry_finalized_block = Some(ordered_block);
+                std::thread::park_timeout(Duration::from_millis(10));
+                continue;
+            }
+
+            // The buffered successor (if any) lets the committer verify this block's
+            // verified-commitment-trees fixture roots before trusting them: a block's
+            // roots are only committed by the next block's header. Its auth data root
+            // is already precomputed by the checkpoint verifier.
+            let next_checkpoint = finalized_lookahead
+                .front()
+                .map(|next| (next.0.block.clone(), next.0.auth_data_root));
+            let prev_note_commitment_trees = prev_finalized_note_commitment_trees.take();
+            let prev_note_commitment_trees_for_retry = prev_note_commitment_trees.clone();
+
+            let next_block_took_vct_path =
+                finalized_state.vct_fast_will_apply(ordered_block.0.height);
+
+            // Try committing the block
+            match finalized_state.commit_finalized(
+                ordered_block,
+                prev_note_commitment_trees,
+                next_checkpoint,
+            ) {
                 Ok((finalized, note_commitment_trees)) => {
+                    // Whether this successful commit consumed header-carried
+                    // tree-aux roots to skip the note-commitment frontier rebuild.
+                    if next_block_took_vct_path {
+                        metrics::counter!("state.vct.fast_path.hit").increment(1);
+                    } else {
+                        metrics::counter!("state.vct.fast_path.miss").increment(1);
+                    }
+
+                    // A successful commit clears any VCT root stall: log recovery and reset
+                    // the stalled-height gauge if it had been raised.
+                    if vct_root_stall.is_some() {
+                        if vct_root_stall_logged {
+                            info!(
+                                stalled_height = ?vct_root_stall.map(|(h, _)| h),
+                                "VCT: checkpoint commit recovered; the stalled height now has a verifiable supplied root"
+                            );
+                            metrics::gauge!("state.vct.root.stalled.height").set(0.0);
+                        }
+                        vct_root_stall = None;
+                        vct_root_stall_logged = false;
+                    }
+
                     let tip_block = ChainTipBlock::from(finalized);
                     prev_finalized_note_commitment_trees = Some(note_commitment_trees);
                     chain_tip_sender.set_finalized_tip(tip_block);
                 }
-                Err(error) => {
+                Err((ordered_block, error)) => {
+                    // Retryable VCT root stalls (an absent/evicted root, or one not yet
+                    // verifiable for lack of a buffered successor) park-and-retry the same
+                    // block in place rather than resetting the queue. An absent root waits
+                    // for header sync to deliver it; an await-successor stall just waits for
+                    // the next block to be downloaded into the look-ahead, so it polls faster.
+                    if let Some(height) = error.vct_retryable_height() {
+                        metrics::counter!("state.vct.root.retry.count").increment(1);
+                        let needs_refetch = error.vct_supplied_root_unavailable_height();
+
+                        // Escalate a stall that persists on the same height past the warn
+                        // threshold: a transient wait resolves in a few polls and stays
+                        // quiet, but a height stuck longer means no peer can serve a root the
+                        // frozen frontier requires — the node will not advance (it will not,
+                        // by design, recompute against the stale frontier). Surface it loudly.
+                        match vct_root_stall {
+                            Some((stuck, _)) if stuck == height => {}
+                            _ => {
+                                vct_root_stall = Some((height, Instant::now()));
+                                vct_root_stall_logged = false;
+                            }
+                        }
+                        if !vct_root_stall_logged
+                            && vct_root_stall.is_some_and(|(_, since)| {
+                                since.elapsed() >= VCT_ROOT_STALL_WARN_AFTER
+                            })
+                        {
+                            tracing::error!(
+                                ?height,
+                                awaiting_refetch = needs_refetch.is_some(),
+                                stalled_for = ?VCT_ROOT_STALL_WARN_AFTER,
+                                "VCT: checkpoint commit stalled with no verifiable supplied root; \
+                                 the node cannot advance until a peer serves this height (it will \
+                                 not recompute against the frozen frontier)"
+                            );
+                            metrics::gauge!("state.vct.root.stalled.height")
+                                .set(f64::from(height.0));
+                            vct_root_stall_logged = true;
+                        } else {
+                            tracing::warn!(
+                                ?height,
+                                block_height = ?ordered_block.0.height,
+                                block_hash = ?ordered_block.0.hash,
+                                awaiting_refetch = needs_refetch.is_some(),
+                                "VCT: supplied root not yet verifiable; retrying checkpoint commit in place"
+                            );
+                        }
+
+                        prev_finalized_note_commitment_trees = prev_note_commitment_trees_for_retry;
+                        retry_finalized_block = Some(ordered_block);
+                        std::thread::park_timeout(if needs_refetch.is_some() {
+                            VCT_ROOT_RETRY_WAIT
+                        } else {
+                            VCT_AWAIT_SUCCESSOR_WAIT
+                        });
+                        continue;
+                    }
+
                     let finalized_tip = finalized_state.db.tip();
+                    let _ = ordered_block.1.send(Err(error.clone()));
+
+                    // The commit failed and the queue is being reset, so clear
+                    // any buffered look-ahead block.
+                    finalized_lookahead.clear();
+                    finalized_state.clear_vct_prevalidated_next();
 
                     // The last block in the queue failed, so we can't commit the next block.
                     // Instead, we need to reset the state queue,
@@ -581,10 +745,17 @@ impl WriteBlockWorkerTask {
                 tracing::trace!("finalizing block past the reorg limit");
                 let contextually_verified_with_trees = non_finalized_state.finalize();
                 prev_finalized_note_commitment_trees = finalized_state
-                            .commit_finalized_direct(contextually_verified_with_trees, prev_finalized_note_commitment_trees.take(), "commit contextually-verified request")
-                            .expect(
-                                "unexpected finalized block commit error: note commitment and history trees were already checked by the non-finalized state",
-                            ).1.into();
+                    .commit_finalized_direct(
+                        contextually_verified_with_trees,
+                        prev_finalized_note_commitment_trees.take(),
+                        None,
+                        "commit contextually-verified request",
+                    )
+                    .expect(
+                        "unexpected finalized block commit error: note commitment and history trees were already checked by the non-finalized state",
+                    )
+                    .1
+                    .into();
             }
 
             // Update the metrics if semantic and contextual validation passes
diff --git a/zebra-state/src/tests/setup.rs b/zebra-state/src/tests/setup.rs
index 7c4c4a0bd6c..34b1785a84d 100644
--- a/zebra-state/src/tests/setup.rs
+++ b/zebra-state/src/tests/setup.rs
@@ -113,7 +113,7 @@ pub(crate) fn new_state_with_mainnet_genesis(
 
     let genesis = CheckpointVerifiedBlock::from(genesis);
     finalized_state
-        .commit_finalized_direct(genesis.clone().into(), None, "test")
+        .commit_finalized_direct(genesis.clone().into(), None, None, "test")
         .expect("unexpected invalid genesis block test vector");
 
     assert_eq!(
diff --git a/zebra-utils/Cargo.toml b/zebra-utils/Cargo.toml
index 5d6891c08ff..1f7147edd73 100644
--- a/zebra-utils/Cargo.toml
+++ b/zebra-utils/Cargo.toml
@@ -41,7 +41,8 @@ zebra-checkpoints = [
     "itertools",
     "tokio",
     "zebra-chain/json-conversion",
-    "zebra-node-services/rpc-client"
+    "zebra-node-services/rpc-client",
+    "zebra-state",
 ]
 
 search-issue-refs = [
@@ -62,6 +63,7 @@ thiserror = { workspace = true }
 
 zebra-node-services = { path = "../zebra-node-services", version = "7.0.0" }
 zebra-chain = { path = "../zebra-chain", version = "9.0.0" }
+zebra-state = { path = "../zebra-state", version = "8.0.0", optional = true }
 
 # These crates are needed for the block-template-to-proposal binary
 zebra-rpc = { path = "../zebra-rpc", version = "9.0.0" }
diff --git a/zebra-utils/src/bin/zebra-checkpoints/args.rs b/zebra-utils/src/bin/zebra-checkpoints/args.rs
index dfc0ee29401..b685786e05d 100644
--- a/zebra-utils/src/bin/zebra-checkpoints/args.rs
+++ b/zebra-utils/src/bin/zebra-checkpoints/args.rs
@@ -2,7 +2,7 @@
 //!
 //! For usage please refer to the program help: `zebra-checkpoints --help`
 
-use std::{net::SocketAddr, str::FromStr};
+use std::{net::SocketAddr, path::PathBuf, str::FromStr};
 
 use structopt::StructOpt;
 use thiserror::Error;
@@ -91,6 +91,37 @@ impl FromStr for Transport {
 #[error("Invalid transport: {0}")]
 pub struct InvalidTransportError(String);
 
+/// The checkpoint height whose final frontier should be emitted.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum FrontierHeight {
+    /// Use the highest checkpoint height selected by this run.
+    Auto,
+    /// Use an explicit checkpoint height.
+    Explicit(Height),
+}
+
+impl FromStr for FrontierHeight {
+    type Err = InvalidFrontierHeightError;
+
+    fn from_str(string: &str) -> Result<Self, Self::Err> {
+        if string.eq_ignore_ascii_case("auto") {
+            return Ok(FrontierHeight::Auto);
+        }
+
+        let height = string
+            .parse::<u32>()
+            .map(Height)
+            .map_err(|_| InvalidFrontierHeightError(string.to_owned()))?;
+
+        Ok(FrontierHeight::Explicit(height))
+    }
+}
+
+/// An error indicating that the supplied string is not a valid frontier height.
+#[derive(Clone, Debug, Error, PartialEq, Eq)]
+#[error("Invalid frontier height: {0}")]
+pub struct InvalidFrontierHeightError(String);
+
 /// zebra-checkpoints arguments
 #[derive(Clone, Debug, Eq, PartialEq, StructOpt)]
 pub struct Args {
@@ -117,8 +148,41 @@ pub struct Args {
     #[structopt(short, long)]
     pub last_checkpoint: Option<Height>,
 
+    /// Write Mainnet VCT final-frontier bytes to this path.
+    ///
+    /// This is an explicit side artifact for checkpoint maintenance; checkpoint lines are still
+    /// printed unchanged on stdout.
+    #[structopt(long)]
+    pub mainnet_frontier_output: Option<PathBuf>,
+
+    /// Zebra state cache directory used to read the final-frontier trees.
+    ///
+    /// Required when `--mainnet-frontier-output` is supplied.
+    #[structopt(long)]
+    pub state_cache_dir: Option<PathBuf>,
+
+    /// Frontier height to write, or `auto` to use the highest checkpoint emitted by this run.
+    #[structopt(long, default_value = "auto")]
+    pub frontier_height: FrontierHeight,
+
     /// Passthrough args for `zcash-cli`.
     /// Only used if the transport is [`Cli`](Transport::Cli).
     #[structopt(last = true)]
     pub zcli_args: Vec<String>,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn frontier_height_parses_auto_or_explicit_height() {
+        assert_eq!("auto".parse(), Ok(FrontierHeight::Auto));
+        assert_eq!("AUTO".parse(), Ok(FrontierHeight::Auto));
+        assert_eq!(
+            "12345".parse(),
+            Ok(FrontierHeight::Explicit(Height(12_345)))
+        );
+        assert!("not-a-height".parse::<FrontierHeight>().is_err());
+    }
+}
diff --git a/zebra-utils/src/bin/zebra-checkpoints/main.rs b/zebra-utils/src/bin/zebra-checkpoints/main.rs
index e4cd5a58f2d..dd694f78627 100644
--- a/zebra-utils/src/bin/zebra-checkpoints/main.rs
+++ b/zebra-utils/src/bin/zebra-checkpoints/main.rs
@@ -8,7 +8,7 @@
 //! zebra-consensus accepts an ordered list of checkpoints, starting with the
 //! genesis block. Checkpoint heights can be chosen arbitrarily.
 
-use std::{ffi::OsString, process::Stdio};
+use std::{ffi::OsString, path::Path, process::Stdio};
 
 #[cfg(unix)]
 use std::os::unix::process::ExitStatusExt;
@@ -23,6 +23,7 @@ use structopt::StructOpt;
 
 use zebra_chain::{
     block::{self, Block, Height, HeightDiff, TryIntoHeight},
+    parameters::Network,
     serialization::ZcashDeserializeInto,
     transparent::MIN_TRANSPARENT_COINBASE_MATURITY,
 };
@@ -34,7 +35,7 @@ use zebra_utils::init_tracing;
 
 pub mod args;
 
-use args::{Args, Backend, Transport};
+use args::{Args, Backend, FrontierHeight, Transport};
 
 /// Make an RPC call based on `our_args` and `rpc_command`, and return the response as a [`Value`].
 async fn rpc_output<M, I>(our_args: &Args, method: M, params: I) -> Result<Value>
@@ -135,6 +136,47 @@ where
     Ok(response)
 }
 
+/// Write the Mainnet VCT final-frontier artifact for `frontier_height`.
+#[allow(clippy::print_stderr)]
+fn write_mainnet_frontier(
+    frontier_output: &Path,
+    state_cache_dir: &Path,
+    frontier_height: Height,
+) -> Result<()> {
+    let config = zebra_state::Config {
+        cache_dir: state_cache_dir.to_path_buf(),
+        ephemeral: false,
+        ..zebra_state::Config::default()
+    };
+
+    let (_read_state, db, _non_finalized_state_sender) =
+        zebra_state::init_read_only(config, &Network::Mainnet);
+    let bytes = zebra_state::produce_final_frontiers_bytes(&db, frontier_height)?;
+    zebra_state::validate_final_frontiers_bytes(&bytes, frontier_height)?;
+    std::fs::write(frontier_output, &bytes)?;
+
+    eprintln!(
+        "Wrote Mainnet VCT final frontier for height {:?} to {}",
+        frontier_height,
+        frontier_output.display()
+    );
+
+    Ok(())
+}
+
+fn resolve_frontier_height(
+    selection: &FrontierHeight,
+    last_checkpoint_height: Height,
+) -> Result<Height> {
+    match selection {
+        FrontierHeight::Auto if last_checkpoint_height == Height::MIN => Err(eyre!(
+            "--frontier-height auto requires at least one generated checkpoint above genesis"
+        )),
+        FrontierHeight::Auto => Ok(last_checkpoint_height),
+        FrontierHeight::Explicit(height) => Ok(*height),
+    }
+}
+
 /// Process entry point for `zebra-checkpoints`
 #[tokio::main]
 #[allow(clippy::print_stdout, clippy::print_stderr, clippy::unwrap_in_result)]
@@ -281,5 +323,34 @@ async fn main() -> Result<()> {
         }
     }
 
+    if let Some(frontier_output) = &args.mainnet_frontier_output {
+        let state_cache_dir = args.state_cache_dir.as_deref().ok_or_else(|| {
+            eyre!("--state-cache-dir is required when --mainnet-frontier-output is supplied")
+        })?;
+        let frontier_height =
+            resolve_frontier_height(&args.frontier_height, last_checkpoint_height)?;
+
+        write_mainnet_frontier(frontier_output, state_cache_dir, frontier_height)
+            .with_suggestion(|| "Hint: run this against a synced Mainnet Zebra state")?;
+    }
+
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn frontier_height_auto_requires_a_generated_checkpoint() {
+        assert!(resolve_frontier_height(&FrontierHeight::Auto, Height::MIN).is_err());
+        assert_eq!(
+            resolve_frontier_height(&FrontierHeight::Auto, Height(100)).unwrap(),
+            Height(100)
+        );
+        assert_eq!(
+            resolve_frontier_height(&FrontierHeight::Explicit(Height(42)), Height::MIN).unwrap(),
+            Height(42)
+        );
+    }
+}
diff --git a/zebrad/src/commands/start.rs b/zebrad/src/commands/start.rs
index 3543edc9c5e..87d1d22297c 100644
--- a/zebrad/src/commands/start.rs
+++ b/zebrad/src/commands/start.rs
@@ -206,6 +206,13 @@ impl StartCmd {
     const ZCASHD_COMPAT_SHUTDOWN_TIMEOUT_MARGIN: std::time::Duration =
         std::time::Duration::from_secs(30);
 
+    fn validate_consensus_config(config: &ZebradConfig) -> Result<(), Report> {
+        config
+            .consensus
+            .validate()
+            .map_err(|error| eyre!("invalid consensus configuration: {error}"))
+    }
+
     fn validate_debug_blocksync_throughput_config(config: &ZebradConfig) -> Result<(), Report> {
         let Some(target_height) = config.sync.debug_blocksync_throughput_target_height else {
             return Ok(());
@@ -500,6 +507,7 @@ impl StartCmd {
             config
         };
 
+        Self::validate_consensus_config(&config)?;
         Self::validate_debug_blocksync_throughput_config(&config)?;
 
         if config.zcashd_compat.enabled {
@@ -543,6 +551,10 @@ impl StartCmd {
 
         let mut state_config = config.state.clone();
         state_config.enable_zakura_header_seed_from_committed_blocks = config.network.v2_p2p;
+        // State owns the VCT commit path, but users configure its checkpoint-sync controls
+        // together under `[consensus]`.
+        state_config.checkpoint_sync = config.consensus.checkpoint_sync;
+        state_config.vct_fast_sync = config.consensus.vct_fast_sync;
 
         let (state_service, read_only_state_service, latest_chain_tip, chain_tip_change) =
             zebra_state::init(
@@ -1354,6 +1366,8 @@ impl config::Override<ZebradConfig> for StartCmd {
             }
         }
 
+        Self::validate_consensus_config(&config)
+            .map_err(|err| std::io::Error::other(err.to_string()))?;
         Self::validate_debug_blocksync_throughput_config(&config)
             .map_err(|err| std::io::Error::other(err.to_string()))?;
 
@@ -1463,6 +1477,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn vct_fast_sync_requires_checkpoint_sync_at_startup() {
+        let cmd = StartCmd {
+            filters: Vec::new(),
+            zcashd_compat: false,
+            unsafe_low_specs: false,
+        };
+        let mut config = ZebradConfig::default();
+        config.consensus.checkpoint_sync = false;
+        config.consensus.vct_fast_sync = true;
+
+        let error = cmd
+            .override_config(config)
+            .expect_err("startup should reject VCT fast sync without checkpoint sync");
+
+        assert!(
+            error.to_string().contains(
+                "invalid consensus configuration: consensus.vct_fast_sync = true requires consensus.checkpoint_sync = true"
+            ),
+            "unexpected error: {error}"
+        );
+    }
+
     #[test]
     fn zcashd_compat_config_rejects_conflicting_rpc_listen_addr() {
         let cmd = StartCmd {
diff --git a/zebrad/src/components/sync/tests/vectors.rs b/zebrad/src/components/sync/tests/vectors.rs
index 62b9d0804cd..9c284375160 100644
--- a/zebrad/src/components/sync/tests/vectors.rs
+++ b/zebrad/src/components/sync/tests/vectors.rs
@@ -19,6 +19,7 @@ use tower::timeout::Timeout;
 use zebra_chain::{
     block::{self, Block, Height},
     chain_tip::mock::{MockChainTip, MockChainTipSender},
+    parameters::Network,
     serialization::ZcashDeserializeInto,
 };
 use zebra_consensus::{
@@ -116,7 +117,7 @@ async fn sync_blocks_ok() -> Result<(), crate::BoxError> {
         ))]));
 
     block_verifier_router
-        .expect_request(zebra_consensus::Request::Commit(block0))
+        .expect_request_that(|req| req.block().hash() == block0_hash)
         .await
         .respond(block0_hash);
 
@@ -358,7 +359,7 @@ async fn sync_blocks_duplicate_hashes_ok() -> Result<(), crate::BoxError> {
         ))]));
 
     block_verifier_router
-        .expect_request(zebra_consensus::Request::Commit(block0))
+        .expect_request_that(|req| req.block().hash() == block0_hash)
         .await
         .respond(block0_hash);
 
@@ -658,7 +659,7 @@ async fn sync_block_too_high_obtain_tips() -> Result<(), crate::BoxError> {
         ))]));
 
     block_verifier_router
-        .expect_request(zebra_consensus::Request::Commit(block0))
+        .expect_request_that(|req| req.block().hash() == block0_hash)
         .await
         .respond(block0_hash);
 
@@ -831,7 +832,7 @@ async fn sync_block_too_high_extend_tips() -> Result<(), crate::BoxError> {
         ))]));
 
     block_verifier_router
-        .expect_request(zebra_consensus::Request::Commit(block0))
+        .expect_request_that(|req| req.block().hash() == block0_hash)
         .await
         .respond(block0_hash);
 
@@ -1079,12 +1080,10 @@ async fn request_genesis_accepts_duplicate_finalized_genesis() -> Result<(), cra
 
     let verifier_requests = Arc::new(AtomicUsize::new(0));
     let verifier_requests_in_service = Arc::clone(&verifier_requests);
-    let verifier_service = tower::service_fn(move |request| {
+    let verifier_service = tower::service_fn(move |request: zebra_consensus::Request| {
         verifier_requests_in_service.fetch_add(1, Ordering::SeqCst);
         async move {
-            let zebra_consensus::Request::Commit(block) = request else {
-                unreachable!("no other verifier request is allowed")
-            };
+            let block = request.block();
             assert_eq!(block.hash(), block0_hash);
 
             let duplicate = zs::CommitBlockError::Duplicate {
@@ -1951,6 +1950,7 @@ async fn empty_block_response_is_retryable_download_failure() {
         verifier,
         chain_tip,
         past_lookahead_limit_sender,
+        Network::Mainnet,
         sync::MIN_CONCURRENCY_LIMIT,
         Height(0),
     );
diff --git a/zebrad/tests/common/cached_state.rs b/zebrad/tests/common/cached_state.rs
index 572aa8caa51..7c3b3278474 100644
--- a/zebrad/tests/common/cached_state.rs
+++ b/zebrad/tests/common/cached_state.rs
@@ -146,7 +146,9 @@ pub async fn start_state_service_with_cache_dir(
     };
 
     // These tests don't need UTXOs to be verified efficiently, because they use cached states.
-    Ok(zebra_state::init(config, network, Height::MAX, 0).await)
+    let (state, read_state, latest_chain_tip, chain_tip_change) =
+        zebra_state::init(config, network, Height::MAX, 0).await;
+    Ok((state, read_state, latest_chain_tip, chain_tip_change))
 }
 
 /// Loads the finalized tip height from the state stored in a specified directory.
diff --git a/zebrad/tests/common/checkpoints.rs b/zebrad/tests/common/checkpoints.rs
index f21603901cd..b0a9821c90e 100644
--- a/zebrad/tests/common/checkpoints.rs
+++ b/zebrad/tests/common/checkpoints.rs
@@ -160,6 +160,7 @@ pub async fn run(network: Network) -> Result<()> {
         test_type,
         zebra_rpc_address,
         last_checkpoint,
+        &zebrad_state_path,
     )?;
 
     let show_zebrad_logs = env::var(LOG_ZEBRAD_CHECKPOINTS).is_ok();
@@ -208,13 +209,19 @@ pub fn spawn_zebra_checkpoints_direct(
     test_type: TestType,
     zebrad_rpc_address: SocketAddr,
     last_checkpoint: &str,
+    zebrad_state_path: &Path,
 ) -> Result<TestChild<TempDir>> {
     let zebrad_rpc_address = zebrad_rpc_address.to_string();
 
-    let arguments = args![
+    let mut arguments = args![
         "--addr": zebrad_rpc_address,
         "--last-checkpoint": last_checkpoint,
     ];
+    if network == Network::Mainnet {
+        arguments.set_parameter("--mainnet-frontier-output", "/tmp/mainnet-frontier.bin");
+        arguments.set_parameter("--state-cache-dir", zebrad_state_path.display().to_string());
+        arguments.set_parameter("--frontier-height", "auto");
+    }
 
     // TODO: add logs for different kinds of zebra_checkpoints failures
     let zebra_checkpoints_failure_messages = PROCESS_FAILURE_MESSAGES