@aztec/pxe 0.0.1-commit.42ee6df9b → 0.0.1-commit.431c48d

package/src/storage/tagging_store/sender_tagging_store.ts

@@ -1,12 +1,16 @@
+import { allToCompletion } from '@aztec/foundation/promise';
 import type { AztecAsyncKVStore, AztecAsyncMap } from '@aztec/kv-store';
-import { ExtendedDirectionalAppTaggingSecret, SiloedTag, type TaggingIndexRange } from '@aztec/stdlib/logs';
+import { AppTaggingSecret, SiloedTag, type TaggingIndexRange } from '@aztec/stdlib/logs';
 import { TxEffect, TxHash } from '@aztec/stdlib/tx';
 
 import type { StagedStore } from '../../job_coordinator/job_coordinator.js';
-import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../../tagging/constants.js';
+import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, unfinalizedTaggingIndexesWindowEnd } from '../../tagging/constants.js';
+
+/** A tx still awaiting finalization, and the highest tagging index it used for one secret. */
+export type PendingTx = { txHash: string; highestIndex: number };
 
 /** Internal representation of a pending index range entry. */
-type PendingIndexesEntry = { lowestIndex: number; highestIndex: number; txHash: string };
+type PendingIndexesEntry = PendingTx & { lowestIndex: number };
 
 /**
  * Data provider of tagging data used when syncing the sender tagging indexes. The recipient counterpart of this class
@@ -128,10 +132,11 @@ export class SenderTaggingStore implements StagedStore {
   }
 
   /**
-   * Stores pending index ranges.
+   * Stores pending index ranges, rejecting any range that disagrees with an already-stored one.
    * @remarks If the same (secret, txHash) pair already exists in the db with an equal range, it's a no-op. This is
    * expected to happen because whenever we start sync we start from the last finalized index and we can have pending
-   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug.
+   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug in
+   * callers that record indexes at prove time. Discovery from onchain logs must use `mergePendingIndexes` instead.
    * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
    * to be stored in the db.
    * @param txHash - The tx in which the tagging indexes were used in private logs.
@@ -141,6 +146,33 @@ export class SenderTaggingStore implements StagedStore {
    * @throws If a different range already exists for the same (secret, txHash) pair.
    */
   storePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, jobId, false);
+  }
+
+  /**
+   * Stores pending index ranges, widening an existing entry for the same (secret, txHash) pair to the union of the
+   * stored and incoming ranges instead of throwing on a mismatch. Discovery from onchain logs needs this: it may see
+   * only the surviving (non-revertible phase) sub-range of a partially reverted tx recorded at prove time (the
+   * finalized receipt step of the sync resolves that difference), or indexes beyond a partially discovered entry
+   * when a tx from another PXE straddles a sync window boundary. Callers that record indexes at prove time must use
+   * `storePendingIndexes` instead, so that a range disagreement surfaces as a bug rather than being absorbed.
+   * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+   * to be stored in the db.
+   * @param txHash - The tx in which the tagging indexes were used in private logs.
+   * @param jobId - job context for staged writes to this store. See `JobCoordinator` for more details.
+   * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+   * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+   */
+  mergePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, jobId, true);
+  }
+
+  #storePendingIndexes(
+    ranges: TaggingIndexRange[],
+    txHash: TxHash,
+    jobId: string,
+    mergeExisting: boolean,
+  ): Promise<void> {
     if (ranges.length === 0) {
       return Promise.resolve();
     }
@@ -157,7 +189,7 @@ export class SenderTaggingStore implements StagedStore {
       }));
 
       // Await all reads together
-      const rangeData = await Promise.all(
+      const rangeData = await allToCompletion(
         rangeReadPromises.map(async item => ({
           ...item,
           pendingData: await item.pending,
@@ -167,13 +199,9 @@ export class SenderTaggingStore implements StagedStore {
 
       // Process in memory and validate
       for (const { range, secretStr, pendingData, finalizedIndex } of rangeData) {
-        // Check that the highest index is not further than window length from the highest finalized index.
-        if (range.highestIndex > (finalizedIndex ?? 0) + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) {
-          throw new Error(
-            `Highest used index ${range.highestIndex} is further than window length from the highest finalized index ${finalizedIndex ?? 0}.
-            Tagging window length ${UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN} is configured too low. Contact the Aztec team
-            to increase it!`,
-          );
+        const windowEnd = unfinalizedTaggingIndexesWindowEnd(finalizedIndex);
+        if (range.highestIndex >= windowEnd) {
+          throw windowExceededError(range.highestIndex, windowEnd, finalizedIndex);
         }
 
         // Throw if the lowest index is lower than or equal to the last finalized index
@@ -187,48 +215,60 @@ export class SenderTaggingStore implements StagedStore {
         // Check if an entry with the same txHash already exists
         const existingEntry = pendingData.find(entry => entry.txHash === txHashStr);
 
-        if (existingEntry) {
-          // Assert that the ranges are equal — different ranges for the same (secret, txHash) indicates a bug
-          if (existingEntry.lowestIndex !== range.lowestIndex || existingEntry.highestIndex !== range.highestIndex) {
-            throw new Error(
-              `Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` +
-                `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` +
-                `new [${range.lowestIndex}, ${range.highestIndex}]`,
-            );
-          }
-          // Exact duplicate — skip
-        } else {
-          this.#writePendingIndexes(jobId, secretStr, [
+        let updatedPending: PendingIndexesEntry[] | undefined;
+        if (!existingEntry) {
+          updatedPending = [
             ...pendingData,
             { lowestIndex: range.lowestIndex, highestIndex: range.highestIndex, txHash: txHashStr },
-          ]);
+          ];
+        } else if (mergeExisting) {
+          // Widen the entry to the union of both ranges, never shrink it: replacing would drop prove-time
+          // indexes the chain doesn't show (partially reverted tx), and skipping would drop onchain indexes
+          // discovered in a later sync window (tx straddling the window boundary).
+          const lowestIndex = Math.min(existingEntry.lowestIndex, range.lowestIndex);
+          const highestIndex = Math.max(existingEntry.highestIndex, range.highestIndex);
+          if (lowestIndex !== existingEntry.lowestIndex || highestIndex !== existingEntry.highestIndex) {
+            updatedPending = pendingData.map(entry =>
+              entry === existingEntry ? { lowestIndex, highestIndex, txHash: entry.txHash } : entry,
+            );
+          }
+        } else if (
+          existingEntry.lowestIndex !== range.lowestIndex ||
+          existingEntry.highestIndex !== range.highestIndex
+        ) {
+          // Different ranges for the same (secret, txHash) indicate a bug in callers that record indexes at prove
+          // time.
+          throw new Error(
+            `Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` +
+              `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` +
+              `new [${range.lowestIndex}, ${range.highestIndex}]`,
+          );
+        }
+        // Remaining cases (a merge whose union equals the stored range, or an identical range without
+        // mergeExisting): duplicate evidence, nothing to write.
+
+        if (updatedPending) {
+          this.#writePendingIndexes(jobId, secretStr, updatedPending);
         }
       }
     });
   }
 
   /**
-   * Returns the transaction hashes of all pending transactions that contain highest indexes within a specified range
-   * for a given directional app tagging secret. We check based on the highest indexes only as that is the relevant
-   * information for the caller of this function.
+   * Returns the pending txs whose highest index falls within [startIndex, endIndex) for a given directional app
+   * tagging secret. The highest index is what decides whether a tx belongs to the window, so it alone is matched
+   * against the bounds, and it is also the only index a caller needs: a tx whose highest index is onchain has every
+   * lower one onchain too. A secret holds at most one entry per tx hash, so no tx hash appears twice in the result.
    * @param secret - The directional app tagging secret to query pending indexes for.
    * @param startIndex - The lower bound of the index range (inclusive).
    * @param endIndex - The upper bound of the index range (exclusive).
-   * @returns An array of unique transaction hashes for pending transactions that contain indexes in the range
-   * [startIndex, endIndex). Returns an empty array if no pending indexes exist in the range.
    */
-  getTxHashesOfPendingIndexes(
-    secret: ExtendedDirectionalAppTaggingSecret,
-    startIndex: number,
-    endIndex: number,
-    jobId: string,
-  ): Promise<TxHash[]> {
+  getPendingTxs(secret: AppTaggingSecret, startIndex: number, endIndex: number, jobId: string): Promise<PendingTx[]> {
     return this.#store.transactionAsync(async () => {
       const existing = await this.#readPendingIndexes(jobId, secret.toString());
-      const txHashes = existing
+      return existing
         .filter(entry => entry.highestIndex >= startIndex && entry.highestIndex < endIndex)
-        .map(entry => entry.txHash);
-      return Array.from(new Set(txHashes)).map(TxHash.fromString);
+        .map(entry => ({ txHash: entry.txHash, highestIndex: entry.highestIndex }));
     });
   }
 
@@ -237,7 +277,7 @@ export class SenderTaggingStore implements StagedStore {
    * @param secret - The secret to get the last finalized index for.
    * @returns The last (highest) finalized index for the given secret.
    */
-  getLastFinalizedIndex(secret: ExtendedDirectionalAppTaggingSecret, jobId: string): Promise<number | undefined> {
+  getLastFinalizedIndex(secret: AppTaggingSecret, jobId: string): Promise<number | undefined> {
     return this.#store.transactionAsync(() => this.#readLastFinalizedIndex(jobId, secret.toString()));
   }
 
@@ -247,14 +287,14 @@ export class SenderTaggingStore implements StagedStore {
    * @param secret - The directional app tagging secret to query the last used index for.
    * @returns The last used index.
    */
-  getLastUsedIndex(secret: ExtendedDirectionalAppTaggingSecret, jobId: string): Promise<number | undefined> {
+  getLastUsedIndex(secret: AppTaggingSecret, jobId: string): Promise<number | undefined> {
     const secretStr = secret.toString();
 
     return this.#store.transactionAsync(async () => {
       const pendingPromise = this.#readPendingIndexes(jobId, secretStr);
       const finalizedPromise = this.#readLastFinalizedIndex(jobId, secretStr);
 
-      const [pendingEntries, lastFinalized] = await Promise.all([pendingPromise, finalizedPromise]);
+      const [pendingEntries, lastFinalized] = await allToCompletion([pendingPromise, finalizedPromise]);
 
       if (pendingEntries.length === 0) {
         return lastFinalized;
@@ -293,7 +333,7 @@ export class SenderTaggingStore implements StagedStore {
 
       // Await all reads together
       const secrets = [...secretReadPromises.keys()];
-      const pendingDataResults = await Promise.all(secretReadPromises.values());
+      const pendingDataResults = await allToCompletion([...secretReadPromises.values()]);
 
       // Process in memory
       for (let i = 0; i < secrets.length; i++) {
@@ -344,7 +384,7 @@ export class SenderTaggingStore implements StagedStore {
 
       // Await all reads together
       const secrets = [...secretDataPromises.keys()];
-      const dataResults = await Promise.all(
+      const dataResults = await allToCompletion(
         secrets.map(async secret => ({
           secret,
           pendingData: await secretDataPromises.get(secret)!.pending,
@@ -358,15 +398,33 @@ export class SenderTaggingStore implements StagedStore {
 
   /**
    * Updates pending indexes corresponding to the given transaction hashes to be finalized and prunes any lower pending
-   * indexes.
+   * indexes. Applies to every secret the txs used, so the caller must hold tx-level evidence that the whole tx
+   * finalized. Callers holding evidence about a single secret must use {@link finalizePendingIndexesOfSecret} instead.
+   */
+  finalizePendingIndexes(txHashes: TxHash[], jobId: string): Promise<void> {
+    return this.#finalizePendingIndexes(txHashes, jobId);
+  }
+
+  /**
+   * Same as {@link finalizePendingIndexes}, but restricted to the pending indexes of a single secret.
+   *
+   * Finalizing every secret off single-secret evidence would be unsound: a tx whose execution partially reverted can
+   * have all of one secret's tags onchain and none of another's, and the second secret's indexes must not be recorded
+   * as finalized when they never reached the chain.
    */
-  async finalizePendingIndexes(txHashes: TxHash[], jobId: string): Promise<void> {
+  finalizePendingIndexesOfSecret(secret: AppTaggingSecret, txHashes: TxHash[], jobId: string): Promise<void> {
+    return this.#finalizePendingIndexes(txHashes, jobId, secret.toString());
+  }
+
+  async #finalizePendingIndexes(txHashes: TxHash[], jobId: string, onlySecret?: string): Promise<void> {
     if (txHashes.length === 0) {
       return;
     }
 
     const txHashStrings = new Set(txHashes.map(tx => tx.toString()));
-    const secretsWithData = await this.#getSecretsWithPendingData(jobId);
+    const secretsWithData = (await this.#getSecretsWithPendingData(jobId)).filter(
+      ({ secret }) => onlySecret === undefined || secret === onlySecret,
+    );
 
     for (const { secret, pendingData, lastFinalized } of secretsWithData) {
       let currentPending = pendingData;
@@ -449,11 +507,11 @@ export class SenderTaggingStore implements StagedStore {
       const pendingEntry = matchingEntries[0];
 
       // Expand each matching entry's range and recompute siloed tags for each index.
-      const extendedSecret = ExtendedDirectionalAppTaggingSecret.fromString(secret);
+      const appTaggingSecret = AppTaggingSecret.fromString(secret);
       let highestSurvivingIndex: number | undefined;
 
       for (let index = pendingEntry.lowestIndex; index <= pendingEntry.highestIndex; index++) {
-        const siloedTag = await SiloedTag.compute({ extendedSecret, index });
+        const siloedTag = await SiloedTag.compute({ extendedSecret: appTaggingSecret, index });
         if (onChainTags.has(siloedTag.value.toString())) {
           highestSurvivingIndex = highestSurvivingIndex !== undefined ? Math.max(highestSurvivingIndex, index) : index;
         }
@@ -474,3 +532,18 @@ export class SenderTaggingStore implements StagedStore {
     }
   }
 }
+
+/** Builds the error thrown when a pending tag index is at or past the unfinalized tagging window end. */
+export function windowExceededError(
+  highestIndex: number,
+  windowEnd: number,
+  finalizedIndex: number | undefined,
+): Error {
+  const finalizedDescription =
+    finalizedIndex === undefined ? 'no index finalized yet' : `highest finalized index ${finalizedIndex}`;
+  return new Error(
+    `Highest used index ${highestIndex} is at or past the window end ${windowEnd} (${finalizedDescription}). ` +
+      `Tagging window length ${UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN} is configured too low. ` +
+      `Contact the Aztec team to increase it!`,
+  );
+}

package/src/storage/tagging_store/tagging_secret_sources_store.ts

@@ -0,0 +1,138 @@
+import { Point } from '@aztec/foundation/curves/grumpkin';
+import { toArray } from '@aztec/foundation/iterable';
+import type { AztecAsyncKVStore, AztecAsyncMap, AztecAsyncMultiMap } from '@aztec/kv-store';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+/**
+ * The kinds of shared secret an entry can hold.
+ */
+export type SharedSecretKind = 'arbitrary-secret' | 'handshake';
+
+/** A shared secret registered for a recipient, with the kind that determines which tag streams it backs. */
+export type SharedSecret = { kind: SharedSecretKind; secret: Point };
+
+/**
+ * Stores the sources from which directional app tagging secrets are derived during recipient log synchronization.
+ *
+ * Two kinds of source are held:
+ * - Sender addresses: combined with a recipient to derive a shared tagging secret via ECDH. These are global (not
+ *   scoped to a recipient) because the per-recipient binding comes from re-mixing the recipient's keys during
+ *   derivation, so each account only ever derives secrets meant for it.
+ * - Pre-shared tagging secrets: shared secret points registered directly, bypassing ECDH. These are scoped to a
+ *   specific recipient, since the derivation of the directional app tagging secret does not require any secret
+ *   recipient data: given the original secret anyone can derive a recipient's app-siloed directional tagging secret,
+ *   and so these must not be reused across recipients to preserve privacy. Each carries the {@link SharedSecretKind}
+ *   it was registered through, which determines the tag streams it is scanned under.
+ */
+export class TaggingSecretSourcesStore {
+  #store: AztecAsyncKVStore;
+  #senders: AztecAsyncMap<string, true>;
+  #sharedSecretsByRecipient: AztecAsyncMultiMap<string, StoredSharedSecret>;
+
+  constructor(store: AztecAsyncKVStore) {
+    this.#store = store;
+
+    this.#senders = this.#store.openMap('senders');
+    this.#sharedSecretsByRecipient = this.#store.openMultiMap('recipient_shared_secrets');
+  }
+
+  addSender(address: AztecAddress): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      if (await this.#senders.hasAsync(address.toString())) {
+        return false;
+      }
+
+      await this.#senders.set(address.toString(), true);
+
+      return true;
+    });
+  }
+
+  getSenders(): Promise<AztecAddress[]> {
+    return this.#store.transactionAsync(async () => {
+      return (await toArray(this.#senders.keysAsync())).map(AztecAddress.fromStringUnsafe);
+    });
+  }
+
+  removeSender(address: AztecAddress): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      if (!(await this.#senders.hasAsync(address.toString()))) {
+        return false;
+      }
+
+      await this.#senders.delete(address.toString());
+
+      return true;
+    });
+  }
+
+  /**
+   * Registers a pre-shared tagging secret scoped to a recipient.
+   * @returns true if the secret was newly added, false if it was already registered for that recipient.
+   */
+  addSharedSecret(recipient: AztecAddress, kind: SharedSecretKind, secret: Point): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      const secretStr = secret.toString();
+      // MultiMap.set silently ignores an identical (key, value), so we scan to report whether this is a new secret.
+      for await (const existing of this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString())) {
+        if (existing.secret === secretStr) {
+          if (existing.kind !== kind) {
+            throw new Error(
+              `Secret already registered for recipient with kind '${existing.kind}', cannot re-register it as '${kind}'.`,
+            );
+          }
+          return false;
+        }
+      }
+
+      await this.#sharedSecretsByRecipient.set(recipient.toString(), { kind, secret: secretStr });
+
+      return true;
+    });
+  }
+
+  /** Returns the pre-shared tagging secrets registered for a given recipient. */
+  getSharedSecretsForRecipient(recipient: AztecAddress): Promise<SharedSecret[]> {
+    return this.#store.transactionAsync(async () => {
+      return (await toArray(this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString()))).map(
+        deserializeSharedSecret,
+      );
+    });
+  }
+
+  /** Returns every registered pre-shared tagging secret, each paired with the recipient it is scoped to. */
+  getAllSharedSecrets(): Promise<{ recipient: AztecAddress; kind: SharedSecretKind; secret: Point }[]> {
+    return this.#store.transactionAsync(async () => {
+      const entries = await toArray(this.#sharedSecretsByRecipient.entriesAsync());
+      return entries.map(([recipient, entry]) => ({
+        recipient: AztecAddress.fromStringUnsafe(recipient),
+        ...deserializeSharedSecret(entry),
+      }));
+    });
+  }
+
+  /**
+   * Removes a pre-shared tagging secret scoped to a recipient. Both the secret and its kind must match.
+   * @returns true if the secret was registered and removed, false if it was not registered for that recipient.
+   */
+  removeSharedSecret(recipient: AztecAddress, kind: SharedSecretKind, secret: Point): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      const secretStr = secret.toString();
+      for await (const existing of this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString())) {
+        if (existing.kind === kind && existing.secret === secretStr) {
+          await this.#sharedSecretsByRecipient.deleteValue(recipient.toString(), existing);
+          return true;
+        }
+      }
+
+      return false;
+    });
+  }
+}
+
+/** The wire form a shared secret entry is persisted as. */
+type StoredSharedSecret = { kind: SharedSecretKind; secret: string };
+
+function deserializeSharedSecret(entry: StoredSharedSecret): SharedSecret {
+  return { kind: entry.kind, secret: Point.fromString(entry.secret) };
+}

package/src/tagging/constants.ts

@@ -1,10 +1,42 @@
-// This window has to be as large as the largest expected number of logs emitted in a tx for a given directional app
-// tagging secret. If we get more tag indexes consumed than this window, an error is thrown in `PXE::proveTx` function.
-// This is set to a larger value than MAX_PRIVATE_LOGS_PER_TX (currently 64) because there could be more than
-// MAX_PRIVATE_LOGS_PER_TX indexes consumed in case the logs are squashed. This happens when the log contains a note
-// and the note is nullified in the same tx.
-//
-// Having a large window significantly slowed down `e2e_l1_with_wall_time` test as there we perform sync for more than
-// 1000 secrets. For this reason we set it to a relatively low value of 20. 20 should be sufficient for all the use
-// cases.
-export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = 20;
+import { MAX_PRIVATE_LOGS_PER_TX } from '@aztec/constants';
+
+// This window bounds how far a sender's next tag index for a directional app tagging secret can run ahead of that
+// secret's highest finalized index before `PXE::proveTx` throws.
+//
+// MAX_PRIVATE_LOGS_PER_TX is a floor for ordinary transaction patterns: the private kernel accumulates every
+// surviving private log into a single tx-wide array of exactly this size, so a fresh secret's very first
+// ordinary tx can consume that many indexes before anything is finalized.
+//
+// The +20 on top is headroom for multiple pending ordinary txs to the same counterparty stacking up
+// before the first one is observed as mined. Only a run of near-MAX_PRIVATE_LOGS_PER_TX txs back-to-back would
+// exhaust this; ordinary transfers use far fewer logs per tx, so the same margin covers many more of those. Keep the
+// margin additive rather than another multiple of the floor. A larger window also makes recipient-side sync more
+// expensive, since discovery has to probe ahead of the last finalized index for every active secret.
+//
+// TODO(F-783): MAX_PRIVATE_LOGS_PER_TX is not a hard ceiling in general — a tx that creates and nullifies (squashes)
+// many notes/logs to the same secret can drive that secret's raw tag index arbitrarily higher, since indexes are
+// reserved at log emission time, before squashing is decided, and the kernel's reset/squash loop is not bounded by
+// MAX_PRIVATE_LOGS_PER_TX. No fixed window value closes that gap.
+export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = MAX_PRIVATE_LOGS_PER_TX + 20;
+
+/**
+ * Exclusive upper bound of the tag indexes that can exist for a secret whose highest finalized index is
+ * `finalizedIndex` (undefined when nothing is finalized yet). The sender store refuses pending indexes at or past it,
+ * and both sender and recipient sync scan exactly up to it. Every absolute window bound must come from this helper:
+ * a site with a wider or narrower bound lets a tx land at an index the syncs never scan, so two stores sharing the
+ * secret could later pick a colliding index.
+ */
+export function unfinalizedTaggingIndexesWindowEnd(finalizedIndex: number | undefined): number {
+  const windowStart = finalizedIndex === undefined ? 0 : finalizedIndex + 1;
+  return windowStart + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN;
+}
+
+// The number of tags probed per constrained secret in the first round.
+//
+// The probe doubles each round (2, 4, 8, ..., capped at UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) while every probed
+// index is a hit, stopping at the first missing tag. Constrained delivery is gapless, so a single missing tag proves
+// the stream has ended: at steady state this turns a full WINDOW_LEN probe into two tags. A secret K logs behind
+// catches up in ~log2(K) round-trips while the probe is still doubling (2, 4, 8, 16, 32), but once it saturates the cap
+// and advances WINDOW_LEN tags per round, deeper catch-up is linear at ~K/WINDOW_LEN rounds. Either way it beats both
+// the full window every round and one round per log.
+export const INITIAL_CONSTRAINED_PROBE_LEN = 2;