@aztec/pxe 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/src/storage/tagging_store/tagging_secret_sources_store.ts

@@ -0,0 +1,138 @@
+import { Point } from '@aztec/foundation/curves/grumpkin';
+import { toArray } from '@aztec/foundation/iterable';
+import type { AztecAsyncKVStore, AztecAsyncMap, AztecAsyncMultiMap } from '@aztec/kv-store';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+/**
+ * The kinds of shared secret an entry can hold.
+ */
+export type SharedSecretKind = 'arbitrary-secret' | 'handshake';
+
+/** A shared secret registered for a recipient, with the kind that determines which tag streams it backs. */
+export type SharedSecret = { kind: SharedSecretKind; secret: Point };
+
+/**
+ * Stores the sources from which directional app tagging secrets are derived during recipient log synchronization.
+ *
+ * Two kinds of source are held:
+ * - Sender addresses: combined with a recipient to derive a shared tagging secret via ECDH. These are global (not
+ *   scoped to a recipient) because the per-recipient binding comes from re-mixing the recipient's keys during
+ *   derivation, so each account only ever derives secrets meant for it.
+ * - Pre-shared tagging secrets: shared secret points registered directly, bypassing ECDH. These are scoped to a
+ *   specific recipient, since the derivation of the directional app tagging secret does not require any secret
+ *   recipient data: given the original secret anyone can derive a recipient's app-siloed directional tagging secret,
+ *   and so these must not be reused across recipients to preserve privacy. Each carries the {@link SharedSecretKind}
+ *   it was registered through, which determines the tag streams it is scanned under.
+ */
+export class TaggingSecretSourcesStore {
+  #store: AztecAsyncKVStore;
+  #senders: AztecAsyncMap<string, true>;
+  #sharedSecretsByRecipient: AztecAsyncMultiMap<string, StoredSharedSecret>;
+
+  constructor(store: AztecAsyncKVStore) {
+    this.#store = store;
+
+    this.#senders = this.#store.openMap('senders');
+    this.#sharedSecretsByRecipient = this.#store.openMultiMap('recipient_shared_secrets');
+  }
+
+  addSender(address: AztecAddress): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      if (await this.#senders.hasAsync(address.toString())) {
+        return false;
+      }
+
+      await this.#senders.set(address.toString(), true);
+
+      return true;
+    });
+  }
+
+  getSenders(): Promise<AztecAddress[]> {
+    return this.#store.transactionAsync(async () => {
+      return (await toArray(this.#senders.keysAsync())).map(AztecAddress.fromStringUnsafe);
+    });
+  }
+
+  removeSender(address: AztecAddress): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      if (!(await this.#senders.hasAsync(address.toString()))) {
+        return false;
+      }
+
+      await this.#senders.delete(address.toString());
+
+      return true;
+    });
+  }
+
+  /**
+   * Registers a pre-shared tagging secret scoped to a recipient.
+   * @returns true if the secret was newly added, false if it was already registered for that recipient.
+   */
+  addSharedSecret(recipient: AztecAddress, kind: SharedSecretKind, secret: Point): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      const secretStr = secret.toString();
+      // MultiMap.set silently ignores an identical (key, value), so we scan to report whether this is a new secret.
+      for await (const existing of this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString())) {
+        if (existing.secret === secretStr) {
+          if (existing.kind !== kind) {
+            throw new Error(
+              `Secret already registered for recipient with kind '${existing.kind}', cannot re-register it as '${kind}'.`,
+            );
+          }
+          return false;
+        }
+      }
+
+      await this.#sharedSecretsByRecipient.set(recipient.toString(), { kind, secret: secretStr });
+
+      return true;
+    });
+  }
+
+  /** Returns the pre-shared tagging secrets registered for a given recipient. */
+  getSharedSecretsForRecipient(recipient: AztecAddress): Promise<SharedSecret[]> {
+    return this.#store.transactionAsync(async () => {
+      return (await toArray(this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString()))).map(
+        deserializeSharedSecret,
+      );
+    });
+  }
+
+  /** Returns every registered pre-shared tagging secret, each paired with the recipient it is scoped to. */
+  getAllSharedSecrets(): Promise<{ recipient: AztecAddress; kind: SharedSecretKind; secret: Point }[]> {
+    return this.#store.transactionAsync(async () => {
+      const entries = await toArray(this.#sharedSecretsByRecipient.entriesAsync());
+      return entries.map(([recipient, entry]) => ({
+        recipient: AztecAddress.fromStringUnsafe(recipient),
+        ...deserializeSharedSecret(entry),
+      }));
+    });
+  }
+
+  /**
+   * Removes a pre-shared tagging secret scoped to a recipient. Both the secret and its kind must match.
+   * @returns true if the secret was registered and removed, false if it was not registered for that recipient.
+   */
+  removeSharedSecret(recipient: AztecAddress, kind: SharedSecretKind, secret: Point): Promise<boolean> {
+    return this.#store.transactionAsync(async () => {
+      const secretStr = secret.toString();
+      for await (const existing of this.#sharedSecretsByRecipient.getValuesAsync(recipient.toString())) {
+        if (existing.kind === kind && existing.secret === secretStr) {
+          await this.#sharedSecretsByRecipient.deleteValue(recipient.toString(), existing);
+          return true;
+        }
+      }
+
+      return false;
+    });
+  }
+}
+
+/** The wire form a shared secret entry is persisted as. */
+type StoredSharedSecret = { kind: SharedSecretKind; secret: string };
+
+function deserializeSharedSecret(entry: StoredSharedSecret): SharedSecret {
+  return { kind: entry.kind, secret: Point.fromString(entry.secret) };
+}

package/src/tagging/constants.ts

@@ -1,10 +1,42 @@
-// This window has to be as large as the largest expected number of logs emitted in a tx for a given directional app
-// tagging secret. If we get more tag indexes consumed than this window, an error is thrown in `PXE::proveTx` function.
-// This is set to a larger value than MAX_PRIVATE_LOGS_PER_TX (currently 64) because there could be more than
-// MAX_PRIVATE_LOGS_PER_TX indexes consumed in case the logs are squashed. This happens when the log contains a note
-// and the note is nullified in the same tx.
-//
-// Having a large window significantly slowed down `e2e_l1_with_wall_time` test as there we perform sync for more than
-// 1000 secrets. For this reason we set it to a relatively low value of 20. 20 should be sufficient for all the use
-// cases.
-export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = 20;
+import { MAX_PRIVATE_LOGS_PER_TX } from '@aztec/constants';
+
+// This window bounds how far a sender's next tag index for a directional app tagging secret can run ahead of that
+// secret's highest finalized index before `PXE::proveTx` throws.
+//
+// MAX_PRIVATE_LOGS_PER_TX is a floor for ordinary transaction patterns: the private kernel accumulates every
+// surviving private log into a single tx-wide array of exactly this size, so a fresh secret's very first
+// ordinary tx can consume that many indexes before anything is finalized.
+//
+// The +20 on top is headroom for multiple pending ordinary txs to the same counterparty stacking up
+// before the first one is observed as mined. Only a run of near-MAX_PRIVATE_LOGS_PER_TX txs back-to-back would
+// exhaust this; ordinary transfers use far fewer logs per tx, so the same margin covers many more of those. Keep the
+// margin additive rather than another multiple of the floor. A larger window also makes recipient-side sync more
+// expensive, since discovery has to probe ahead of the last finalized index for every active secret.
+//
+// TODO(F-783): MAX_PRIVATE_LOGS_PER_TX is not a hard ceiling in general — a tx that creates and nullifies (squashes)
+// many notes/logs to the same secret can drive that secret's raw tag index arbitrarily higher, since indexes are
+// reserved at log emission time, before squashing is decided, and the kernel's reset/squash loop is not bounded by
+// MAX_PRIVATE_LOGS_PER_TX. No fixed window value closes that gap.
+export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = MAX_PRIVATE_LOGS_PER_TX + 20;
+
+/**
+ * Exclusive upper bound of the tag indexes that can exist for a secret whose highest finalized index is
+ * `finalizedIndex` (undefined when nothing is finalized yet). The sender store refuses pending indexes at or past it,
+ * and both sender and recipient sync scan exactly up to it. Every absolute window bound must come from this helper:
+ * a site with a wider or narrower bound lets a tx land at an index the syncs never scan, so two stores sharing the
+ * secret could later pick a colliding index.
+ */
+export function unfinalizedTaggingIndexesWindowEnd(finalizedIndex: number | undefined): number {
+  const windowStart = finalizedIndex === undefined ? 0 : finalizedIndex + 1;
+  return windowStart + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN;
+}
+
+// The number of tags probed per constrained secret in the first round.
+//
+// The probe doubles each round (2, 4, 8, ..., capped at UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) while every probed
+// index is a hit, stopping at the first missing tag. Constrained delivery is gapless, so a single missing tag proves
+// the stream has ended: at steady state this turns a full WINDOW_LEN probe into two tags. A secret K logs behind
+// catches up in ~log2(K) round-trips while the probe is still doubling (2, 4, 8, 16, 32), but once it saturates the cap
+// and advances WINDOW_LEN tags per round, deeper catch-up is linear at ~K/WINDOW_LEN rounds. Either way it beats both
+// the full window every round and one round per log.
+export const INITIAL_CONSTRAINED_PROBE_LEN = 2;

package/src/tagging/get_all_logs_by_tags.ts

@@ -1,4 +1,4 @@
-import type { BlockNumber } from '@aztec/foundation/branded-types';
+import { BlockNumber } from '@aztec/foundation/branded-types';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import type { BlockHash } from '@aztec/stdlib/block';
 import { MAX_RPC_LEN } from '@aztec/stdlib/interfaces/api-limit';
@@ -11,6 +11,31 @@ import {
   queryAllPrivateLogsByTags,
   queryAllPublicLogsByTags,
 } from '@aztec/stdlib/logs';
+import type { BlockHeader } from '@aztec/stdlib/tx';
+
+/**
+ * The block a tag query is anchored to.
+ *
+ * Both fields come from one header (see {@link logQueryAnchorOf}), which is what keeps the bound and the reorg check
+ * talking about the same block.
+ */
+export type LogQueryAnchor = {
+  /**
+   * Hash of the anchor block, naming the chain the query must be answered on: the node throws if that block is gone,
+   * which is how a reorg surfaces.
+   */
+  hash: BlockHash;
+  /** Height of the anchor block, bounding the query to blocks at or below it. */
+  number: BlockNumber;
+};
+
+/**
+ * The {@link LogQueryAnchor} naming `anchorBlockHeader`: its hash and its height. Callers build it once and reuse
+ * it across every query anchored to that block, so the header is hashed only once.
+ */
+export async function logQueryAnchorOf(anchorBlockHeader: BlockHeader): Promise<LogQueryAnchor> {
+  return { hash: await anchorBlockHeader.hash(), number: anchorBlockHeader.getBlockNumber() };
+}
 
 /** Optional block-range, effects opt-in, and pagination cap shared by both wrappers. */
 export type GetAllLogsByTagsOptions = {
@@ -61,15 +86,15 @@ async function getAllPagesInBatches<T extends Tag | SiloedTag, Opts extends LogI
  *
  * @param aztecNode - The Aztec node to query.
  * @param tags - The siloed tags to search for.
- * @param anchorBlockHash - Reference block for the Aztec node query, throws if block is not found there (typically
- *   because of reorgs).
+ * @param anchor - Block the query is anchored to: results stop there, and the call throws if that block is not found
+ *   (typically because of reorgs).
  * @param options - Optional `fromBlock`/`toBlock` range and `includeEffects` opt-in.
  * @returns An array of log arrays, one per tag, containing all logs across all pages.
  */
 export function getAllPrivateLogsByTags<Opts extends GetAllLogsByTagsOptions = GetAllLogsByTagsOptions>(
   aztecNode: AztecNode,
   tags: SiloedTag[],
-  anchorBlockHash: BlockHash,
+  anchor: LogQueryAnchor,
   options: Opts = {} as Opts,
 ): Promise<LogResult<Opts>[][]> {
   return getAllPagesInBatches<SiloedTag, Opts>(
@@ -77,9 +102,9 @@ export function getAllPrivateLogsByTags<Opts extends GetAllLogsByTagsOptions = G
     batch =>
       queryAllPrivateLogsByTags(aztecNode, {
         tags: batch,
-        referenceBlock: anchorBlockHash,
+        referenceBlock: anchor.hash,
         fromBlock: options.fromBlock,
-        toBlock: options.toBlock,
+        toBlock: exclusiveUpperBound(anchor, options.toBlock),
         includeEffects: options.includeEffects ?? false,
         limitPerTag: options.limitPerTag,
       }) as Promise<LogResult<Opts>[][]>,
@@ -92,8 +117,8 @@ export function getAllPrivateLogsByTags<Opts extends GetAllLogsByTagsOptions = G
  * @param aztecNode - The Aztec node to query.
  * @param contractAddress - The contract address to search logs for.
  * @param tags - The tags to search for.
- * @param anchorBlockHash - Reference block for the Aztec node query, throws if block is not found there (typically
- *   because of reorgs).
+ * @param anchor - Block the query is anchored to: results stop there, and the call throws if that block is not found
+ *   (typically because of reorgs).
  * @param options - Optional `fromBlock`/`toBlock` range and `includeEffects` opt-in.
  * @returns An array of log arrays, one per tag, containing all logs across all pages.
  */
@@ -101,7 +126,7 @@ export function getAllPublicLogsByTagsFromContract<Opts extends GetAllLogsByTags
   aztecNode: AztecNode,
   contractAddress: AztecAddress,
   tags: Tag[],
-  anchorBlockHash: BlockHash,
+  anchor: LogQueryAnchor,
   options: Opts = {} as Opts,
 ): Promise<LogResult<Opts>[][]> {
   return getAllPagesInBatches<Tag, Opts>(
@@ -110,11 +135,22 @@ export function getAllPublicLogsByTagsFromContract<Opts extends GetAllLogsByTags
       queryAllPublicLogsByTags(aztecNode, {
         contractAddress,
         tags: batch,
-        referenceBlock: anchorBlockHash,
+        referenceBlock: anchor.hash,
         fromBlock: options.fromBlock,
-        toBlock: options.toBlock,
+        toBlock: exclusiveUpperBound(anchor, options.toBlock),
         includeEffects: options.includeEffects ?? false,
         limitPerTag: options.limitPerTag,
       }) as Promise<LogResult<Opts>[][]>,
   );
 }
+
+/**
+ * Exclusive upper block bound for a query anchored at `anchor`: one past the anchor block, or the caller's own
+ * `toBlock` when that is tighter.
+ *
+ * The bound is spelled out in the request rather than left implicit in `referenceBlock`, so the request itself
+ * names a fixed block range that no later block can widen.
+ */
+function exclusiveUpperBound(anchor: LogQueryAnchor, toBlock: BlockNumber | undefined): BlockNumber {
+  return BlockNumber(Math.min(toBlock ?? Infinity, anchor.number + 1));
+}

package/src/tagging/index.ts

@@ -12,8 +12,13 @@
 export { syncTaggedPrivateLogs } from './recipient_sync/sync_tagged_private_logs.js';
 export { syncSenderTaggingIndexes } from './sender_sync/sync_sender_tagging_indexes.js';
 export { persistSenderTaggingIndexRangesForTx } from './persist_sender_tagging_index_ranges.js';
-export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from './constants.js';
-export { getAllPrivateLogsByTags, getAllPublicLogsByTagsFromContract } from './get_all_logs_by_tags.js';
+export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, INITIAL_CONSTRAINED_PROBE_LEN } from './constants.js';
+export {
+  type LogQueryAnchor,
+  getAllPrivateLogsByTags,
+  getAllPublicLogsByTagsFromContract,
+  logQueryAnchorOf,
+} from './get_all_logs_by_tags.js';
 
 // Re-export tagging-related types from stdlib
 export { AppTaggingSecret, Tag, SiloedTag } from '@aztec/stdlib/logs';

package/src/tagging/recipient_sync/sync_tagged_private_logs.ts

@@ -1,23 +1,27 @@
-import { BlockNumber } from '@aztec/foundation/branded-types';
+import type { BlockNumber } from '@aztec/foundation/branded-types';
 import { isDefined } from '@aztec/foundation/types';
-import type { BlockHash } from '@aztec/stdlib/block';
 import type { AztecNode } from '@aztec/stdlib/interfaces/client';
 import type { AppTaggingSecret, LogResult } from '@aztec/stdlib/logs';
-import { SiloedTag } from '@aztec/stdlib/logs';
+import { AppTaggingSecretKind, SiloedTag } from '@aztec/stdlib/logs';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
 import type { RecipientTaggingStore } from '../../storage/tagging_store/recipient_tagging_store.js';
-import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../constants.js';
-import { getAllPrivateLogsByTags } from '../get_all_logs_by_tags.js';
+import {
+  INITIAL_CONSTRAINED_PROBE_LEN,
+  UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN,
+  unfinalizedTaggingIndexesWindowEnd,
+} from '../constants.js';
+import { type LogQueryAnchor, getAllPrivateLogsByTags, logQueryAnchorOf } from '../get_all_logs_by_tags.js';
 import { findHighestIndexes } from './utils/find_highest_indexes.js';
 
 /**
  * Fetches and syncs tagged private logs for multiple sender-recipient pairs, batching tag queries across all secrets
- * into shared RPC calls.
+ * into shared RPC calls. Handles both constrained and unconstrained secrets, which differ in their scan strategy
+ * but share the same batching infrastructure.
  *
- * # Explanation of how the algorithm works
+ * # Unconstrained secrets
  *
- * For each secret we sync logs that correspond to the tagging index range
+ * For each unconstrained secret we sync logs that correspond to the tagging index range
  * (highestAgedIndex, highestFinalizedIndex + WINDOW_LEN]
  *
  * highestAgedIndex is the highest index that was used in a tx that is included in a block at least
@@ -54,11 +58,28 @@ import { findHighestIndexes } from './utils/find_highest_indexes.js';
  * the highest finalized index. If that index was already used, they will throw an error. For this reason we
  * don't have to look further than `highestFinalizedIndex + WINDOW_LEN`.
  *
- * ## Batching across secrets
+ * # Constrained secrets
  *
- * Instead of running one RPC call per secret, we merge tags from all pending secrets into a single flat array,
- * make one batched `getAllPrivateLogsByTags` call (which internally chunks at MAX_RPC_LEN), then split results
- * back per secret using tracked offsets. Only secrets whose window advanced are kept for the next iteration.
+ * Constrained delivery enforces a contiguous index sequence (each send proves the predecessor's nullifier,
+ * chaining back to the handshake), so there is only one sender and indexes are sequential. This means:
+ * - The lower bound is `highestFinalizedIndex + 1`. The `highestAgedIndex` mechanism is unnecessary because
+ *   the nullifier chain prevents out-of-order index usage: no device can fill in a lower index after a higher
+ *   one is already on-chain.
+ * - Because the sequence is gapless, the scan stops at the first missing index: that gap proves the sequence has
+ *   ended and no further logs exist. We exploit this with a doubling first-miss probe (see
+ *   `INITIAL_CONSTRAINED_PROBE_LEN` in ../constants.ts), so a
+ *   steady-state sync with no new logs costs two tags instead of the whole window. The probe length is in-memory
+ *   state scoped to one sync call, so every sync restarts at the initial probe.
+ * - The upper bound is the same as unconstrained: `highestFinalizedIndex + WINDOW_LEN`. Advancing the probe is
+ *   decoupled from persisting the finalized index, so unfinalized logs at the top of the run are still fetched
+ *   while only the finalized prefix is persisted.
+ *
+ * # Batching across secrets
+ *
+ * Instead of running one RPC call per secret, we merge tags from all pending secrets (both constrained and
+ * unconstrained) into a single flat array, make one batched `getAllPrivateLogsByTags` call (which internally
+ * chunks at MAX_RPC_LEN), then split results back per secret using tracked offsets. Only secrets whose window
+ * advanced are kept for the next iteration.
  */
 export async function syncTaggedPrivateLogs(
   secrets: AppTaggingSecret[],
@@ -72,8 +93,7 @@ export async function syncTaggedPrivateLogs(
     return [];
   }
 
-  const anchorBlockNumber = anchorBlockHeader.getBlockNumber();
-  const anchorBlockHash = await anchorBlockHeader.hash();
+  const anchor = await logQueryAnchorOf(anchorBlockHeader);
   const currentTimestamp = anchorBlockHeader.globalVariables.timestamp;
 
   // Read stored indexes from the db and compute the initial [start, end) range for each secret
@@ -82,7 +102,7 @@ export async function syncTaggedPrivateLogs(
 
   while (pending.length > 0) {
     // Compute tags for all pending secrets and fetch logs in batched RPC calls
-    const logsPerSecret = await fetchLogsForSecrets(pending, aztecNode, anchorBlockNumber, anchorBlockHash);
+    const logsPerSecret = await fetchLogsForSecrets(pending, aztecNode, anchor);
 
     const nextRound = await Promise.all(
       pending.map(async (pendingSecret, i) => {
@@ -96,14 +116,23 @@ export async function syncTaggedPrivateLogs(
 
         // Persist new indexes. If the finalized index moved forward, the window advances
         // and we need another round for this secret.
-        return await updateIndexesAndAdvanceWindow(
-          pendingSecret,
-          logsFoundWithSecret,
-          taggingStore,
-          currentTimestamp,
-          finalizedBlockNumber,
-          jobId,
-        );
+        return pendingSecret.kind === AppTaggingSecretKind.CONSTRAINED
+          ? await processConstrainedResults(
+              pendingSecret,
+              logsFoundWithSecret,
+              taggingStore,
+              currentTimestamp,
+              finalizedBlockNumber,
+              jobId,
+            )
+          : await processUnconstrainedResults(
+              pendingSecret,
+              logsFoundWithSecret,
+              taggingStore,
+              currentTimestamp,
+              finalizedBlockNumber,
+              jobId,
+            );
       }),
     );
 
@@ -120,16 +149,29 @@ function getIndexRangesForSecrets(
   jobId: string,
 ): Promise<PendingSecret[]> {
   return Promise.all(
-    secrets.map(async secret => {
-      const [currentHighestAgedIndex, currentHighestFinalizedIndex] = await Promise.all([
-        taggingStore.getHighestAgedIndex(secret, jobId),
-        taggingStore.getHighestFinalizedIndex(secret, jobId),
-      ]);
+    secrets.map(async (secret): Promise<PendingSecret> => {
+      const currentHighestFinalizedIndex = await taggingStore.getHighestFinalizedIndex(secret, jobId);
+      const boundEnd = unfinalizedTaggingIndexesWindowEnd(currentHighestFinalizedIndex);
 
-      const start = currentHighestAgedIndex === undefined ? 0 : currentHighestAgedIndex + 1;
-      const end = (currentHighestFinalizedIndex ?? 0) + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1;
+      if (secret.kind === AppTaggingSecretKind.CONSTRAINED) {
+        // Constrained streams are gapless and resume at the finalized index, so probe a small initial window and stop
+        // at the first missing tag instead of always fetching the full window. The probe grows each round up to the
+        // window cap.
+        const start = currentHighestFinalizedIndex === undefined ? 0 : currentHighestFinalizedIndex + 1;
+        return {
+          kind: AppTaggingSecretKind.CONSTRAINED,
+          secret,
+          start,
+          end: Math.min(boundEnd, start + INITIAL_CONSTRAINED_PROBE_LEN),
+          boundEnd,
+          probeLen: INITIAL_CONSTRAINED_PROBE_LEN,
+        };
+      }
 
-      return { secret, start, end };
+      // Unconstrained secrets can have gaps, so they scan the whole window starting past the highest aged index.
+      const highestAgedIndex = await taggingStore.getHighestAgedIndex(secret, jobId);
+      const start = highestAgedIndex === undefined ? 0 : highestAgedIndex + 1;
+      return { kind: AppTaggingSecretKind.UNCONSTRAINED, secret, start, end: boundEnd };
     }),
   );
 }
@@ -141,8 +183,7 @@ function getIndexRangesForSecrets(
 async function fetchLogsForSecrets(
   pending: PendingSecret[],
   aztecNode: AztecNode,
-  anchorBlockNumber: BlockNumber,
-  anchorBlockHash: BlockHash,
+  anchor: LogQueryAnchor,
 ): Promise<LogWithIndex[][]> {
   // Determine the index range for each secret
   const indexesPerSecret = pending.map(({ start, end }) => Array.from({ length: end - start }, (_, i) => start + i));
@@ -156,14 +197,10 @@ async function fetchLogsForSecrets(
 
   const allTags = tagsPerSecret.flat();
 
-  // getAllPrivateLogsByTags handles MAX_RPC_LEN chunking internally. Recipient sync builds `PendingTaggedLog` from
-  // each log's note hashes and first nullifier, so we opt into effects. The `toBlock` cap (anchor block + 1,
-  // exclusive) tells the node to skip any logs in blocks past the anchor — the same guard previously enforced
-  // by an in-memory filter on the response.
-  const allResults = await getAllPrivateLogsByTags(aztecNode, allTags, anchorBlockHash, {
-    includeEffects: true,
-    toBlock: BlockNumber(anchorBlockNumber + 1),
-  });
+  // getAllPrivateLogsByTags handles MAX_RPC_LEN chunking internally, and bounds the query at the anchor block so
+  // logs from later blocks are never returned. Recipient sync builds `PendingTaggedLog` from each log's note hashes
+  // and first nullifier, so we opt into effects.
+  const allResults = await getAllPrivateLogsByTags(aztecNode, allTags, anchor, { includeEffects: true });
 
   // Split flat results back per secret using the known lengths
   const logsPerSecret: LogWithIndex[][] = [];
@@ -183,11 +220,69 @@ async function fetchLogsForSecrets(
 }
 
 /**
- * Processes a single secret's fetched logs: updates stored indexes and returns a new PendingSecret
+ * Processes fetched logs for a constrained secret: persists the finalized index and advances the probe. See the
+ * "# Constrained secrets" section above for why the scan stops at the first missing index. Only `highestFinalizedIndex`
+ * is tracked (no aged index).
+ */
+async function processConstrainedResults(
+  pending: PendingConstrained,
+  logsWithIndexes: LogWithIndex[],
+  taggingStore: RecipientTaggingStore,
+  currentTimestamp: bigint,
+  finalizedBlockNumber: BlockNumber,
+  jobId: string,
+): Promise<PendingSecret | undefined> {
+  // Find where the contiguous run of indexes ends; all logs in the batch fall within this prefix.
+  const indexesWithLogs = new Set(logsWithIndexes.map(l => l.taggingIndex));
+  let firstMissingIndex = pending.start;
+  while (firstMissingIndex < pending.end && indexesWithLogs.has(firstMissingIndex)) {
+    firstMissingIndex++;
+  }
+
+  // Persist the highest finalized index found. The nullifier for a constrained-delivery log is emitted in the same
+  // transaction, guaranteeing the log cannot disappear once included, so we persist even when a gap stops the scan.
+  // This lets the next sync round skip already-finalized indexes.
+  const { highestFinalizedIndex } = findHighestIndexes(logsWithIndexes, currentTimestamp, finalizedBlockNumber);
+  if (highestFinalizedIndex !== undefined) {
+    await taggingStore.updateHighestFinalizedIndex(pending.secret, highestFinalizedIndex, jobId);
+  }
+
+  // Advancing the probe is decoupled from persisting the finalized index: keep scanning as long as the probe was
+  // entirely hits (no gap) and there is room before the protocol bound, even if none of those hits is finalized yet.
+  // Gating this on finalization would drop logs in unfinalized blocks, which sit at the top of the contiguous run.
+  // The bound re-anchors to any finalized index found this round.
+  const probeFullyConsumed = firstMissingIndex >= pending.end;
+  const boundEnd =
+    highestFinalizedIndex !== undefined
+      ? Math.max(pending.boundEnd, unfinalizedTaggingIndexesWindowEnd(highestFinalizedIndex))
+      : pending.boundEnd;
+
+  // Double the probe each round, capped at the window (see INITIAL_CONSTRAINED_PROBE_LEN in ../constants.ts).
+  // The queried range is already bounded by boundEnd (a probe can never reach
+  // more than WINDOW_LEN past the finalized frontier); this cap just keeps the stored length from growing unbounded
+  // once the probe saturates the window.
+  const nextProbeLen = Math.min(pending.probeLen * 2, UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN);
+
+  if (probeFullyConsumed && pending.end < boundEnd) {
+    return {
+      kind: AppTaggingSecretKind.CONSTRAINED,
+      secret: pending.secret,
+      start: pending.end,
+      end: Math.min(boundEnd, pending.end + nextProbeLen),
+      boundEnd,
+      probeLen: nextProbeLen,
+    };
+  }
+
+  return undefined;
+}
+
+/**
+ * Processes a single unconstrained secret's fetched logs: updates stored indexes and returns a new PendingSecret
  * if the window needs to advance, or undefined if this secret is done.
  */
-async function updateIndexesAndAdvanceWindow(
-  pending: PendingSecret,
+async function processUnconstrainedResults(
+  pending: PendingUnconstrained,
   logsWithIndexes: LogWithIndex[],
   taggingStore: RecipientTaggingStore,
   currentTimestamp: bigint,
@@ -221,19 +316,39 @@ async function updateIndexesAndAdvanceWindow(
 
   // For the next iteration we want to look only at indexes for which we have not yet fetched logs while
   // ensuring that we do not look further than WINDOW_LEN ahead of the highest finalized index.
+  const end = unfinalizedTaggingIndexesWindowEnd(highestFinalizedIndex);
   return {
+    kind: AppTaggingSecretKind.UNCONSTRAINED,
     secret: pending.secret,
     start: pending.end,
-    end: highestFinalizedIndex + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1,
+    end,
   };
 }
 
-type PendingSecret = {
+/** Working scan state common to both secret kinds: the half-open [start, end) tag-index range to query this round. */
+type PendingSecretBase = {
   secret: AppTaggingSecret;
   start: number;
   end: number;
 };
 
+/** Constrained scan state, carrying the doubling-probe bookkeeping that only the gapless constrained scan uses. */
+type PendingConstrained = PendingSecretBase & {
+  kind: typeof AppTaggingSecretKind.CONSTRAINED;
+  // Exclusive upper bound on the indexes this secret may probe this sync, from `unfinalizedTaggingIndexesWindowEnd`:
+  // the protocol bound on how far ahead of finalized a log can sit. `end` grows toward it each round.
+  boundEnd: number;
+  // Intended probe length for the round that produced `end`. The queried span can be smaller when boundEnd caps it.
+  probeLen: number;
+};
+
+/** Unconstrained scan state: a plain window with no probe bookkeeping, since the scan always covers the full window. */
+type PendingUnconstrained = PendingSecretBase & {
+  kind: typeof AppTaggingSecretKind.UNCONSTRAINED;
+};
+
+type PendingSecret = PendingConstrained | PendingUnconstrained;
+
 type LogWithIndex = {
   log: LogResult;
   taggingIndex: number;