@aztec/pxe 0.0.1-commit.a5db02d → 0.0.1-commit.aa0c64f

package/src/contract_function_simulator/oracle/private_execution_oracle.ts

@@ -36,6 +36,7 @@ import {
   type TaggingSecretStrategy,
 } from '../../hooks/resolve_tagging_secret_strategy.js';
 import { NoteService } from '../../notes/note_service.js';
+import { assertAllowedScope } from '../../storage/allowed_scopes.js';
 import type { SenderTaggingStore } from '../../storage/tagging_store/sender_tagging_store.js';
 import { syncSenderTaggingIndexes } from '../../tagging/index.js';
 import type { ExecutionNoteCache } from '../execution_note_cache.js';
@@ -321,7 +322,17 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
    * @returns The app tagging secret, or `None` if the recipient is invalid.
    */
   public async getAppTaggingSecret(sender: AztecAddress, recipient: AztecAddress): Promise<Option<Fr>> {
-    const extendedSecret = await this.#calculateAppTaggingSecret(this.contractAddress, sender, recipient);
+    assertAllowedScope(sender, this.scopes);
+
+    const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
+    const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
+    const extendedSecret = await AppTaggingSecret.computeViaEcdh(
+      senderCompleteAddress,
+      senderIvsk,
+      recipient,
+      this.contractAddress,
+      recipient,
+    );
 
     if (!extendedSecret) {
       this.logger.warn(`Computing a tagging secret for invalid recipient ${recipient} - returning no secret`, {
@@ -354,12 +365,6 @@ export class PrivateExecutionOracle extends UtilityExecutionOracle implements IP
     return index;
   }
 
-  async #calculateAppTaggingSecret(contractAddress: AztecAddress, sender: AztecAddress, recipient: AztecAddress) {
-    const senderCompleteAddress = await this.getCompleteAddressOrFail(sender);
-    const senderIvsk = await this.keyStore.getMasterIncomingViewingSecretKey(sender);
-    return AppTaggingSecret.computeViaEcdh(senderCompleteAddress, senderIvsk, recipient, contractAddress, recipient);
-  }
-
   async #getIndexToUseForSecret(secret: AppTaggingSecret): Promise<number> {
     // If we have the tagging index in the cache, we use it. If not we obtain it from the execution data provider.
     const lastUsedIndexInTx = this.taggingIndexCache.getLastUsedIndex(secret);

package/src/contract_function_simulator/oracle/utility_execution_oracle.ts

@@ -859,13 +859,17 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
   // TODO(#11849): consider replacing this oracle with a pure Noir implementation of aes decryption.
   public async decryptAes128(
     ciphertext: BoundedVec<number>,
-    iv: Buffer,
-    symKey: Buffer,
+    iv: number[],
+    symKey: number[],
   ): Promise<Option<BoundedVec<number>>> {
     const capacity = ciphertext.maxLength;
     try {
       const aes128 = new Aes128();
-      const plaintext = await aes128.decryptBufferCBC(Buffer.from(ciphertext.data), iv, symKey);
+      const plaintext = await aes128.decryptBufferCBC(
+        Buffer.from(ciphertext.data),
+        Buffer.from(iv),
+        Buffer.from(symKey),
+      );
       return Option.some(BoundedVec.from<number>({ data: [...plaintext], maxLength: capacity }));
     } catch {
       return Option.none({ maxLength: capacity });
@@ -1143,6 +1147,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
   #toTxEffectData(txEffect: TxEffect): TxEffectData {
     return {
       ...txEffect,
+      revertCode: txEffect.revertCode.getCode(),
       publicLogs: FlatPublicLogs.fromLogs(txEffect.publicLogs),
       contractClassLogs: txEffect.contractClassLogs.map(log => ({
         contractAddress: log.contractAddress,

package/src/entrypoints/client/store.ts

@@ -1,6 +1,11 @@
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { type Logger, createLogger } from '@aztec/foundation/log';
-import { AztecSQLiteOPFSStore, storePoolDirectory } from '@aztec/kv-store/sqlite-opfs';
+import {
+  AztecSQLiteOPFSStore,
+  SqliteCorruptionError,
+  deleteStore,
+  storePoolDirectory,
+} from '@aztec/kv-store/sqlite-opfs';
 
 import { assertStoreIdentity, effectiveStoreName } from '../../storage/store_identity.js';
 
@@ -21,12 +26,23 @@ export async function openBrowserStore(
     storeName,
     dataStoreMapSizeKb: config.dataStoreMapSizeKb,
   });
-  const store = await AztecSQLiteOPFSStore.open(
-    createLogger('kv-store:sqlite-opfs'),
-    storeName,
-    false,
-    storePoolDirectory(storeName),
-  );
+  const openStore = () =>
+    AztecSQLiteOPFSStore.open(createLogger('kv-store:sqlite-opfs'), storeName, false, storePoolDirectory(storeName));
+
+  let store: AztecSQLiteOPFSStore;
+  try {
+    store = await openStore();
+  } catch (err) {
+    if (!(err instanceof SqliteCorruptionError)) {
+      throw err;
+    }
+    // A corrupt image is unrecoverable — no retry against the same bytes helps. Wipe the store's OPFS directory
+    // (safe: the failed open left no SAH-pool lock behind) and reopen a fresh, empty one, so the browser self-heals
+    // into a normal first-run rather than dead-ending on "database disk image is malformed" every load.
+    log.warn(`${storeName} store is corrupt (${err.message}); wiping and reopening fresh`);
+    await deleteStore(storeName);
+    store = await openStore();
+  }
   try {
     await assertStoreIdentity(store, storeName, identity);
   } catch (err) {

package/src/logs/log_service.ts

@@ -22,7 +22,6 @@ import {
 } from '../contract_function_simulator/noir-structs/log_retrieval_request.js';
 import type { LogRetrievalResponse } from '../contract_function_simulator/noir-structs/log_retrieval_response.js';
 import type { PendingTaggedLog } from '../contract_function_simulator/noir-structs/pending_tagged_log.js';
-import { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
 import { AddressStore } from '../storage/address_store/address_store.js';
 import { assertAllowedScope } from '../storage/allowed_scopes.js';
 import type { RecipientTaggingStore } from '../storage/tagging_store/recipient_tagging_store.js';
@@ -225,7 +224,13 @@ export class LogService {
       }
       return {
         log: log.logData,
-        context: new ResolvedTx(log.txHash, noteHashes, nullifiers[0], log.blockNumber, log.blockHash.toFr()),
+        context: {
+          txHash: log.txHash,
+          uniqueNoteHashesInTx: noteHashes,
+          firstNullifierInTx: nullifiers[0],
+          blockNumber: log.blockNumber,
+          blockHash: log.blockHash.toFr(),
+        },
       };
     });
   }

package/src/messages/tx_resolver_service.ts

@@ -3,7 +3,7 @@ import { Fr } from '@aztec/foundation/curves/bn254';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
 import { type IndexedTxEffect, TxHash } from '@aztec/stdlib/tx';
 
-import { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
+import type { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
 
 /** Resolves transaction hashes into their on-chain context (note hashes, first nullifier, and mined block). */
 export class TxResolverService {
@@ -57,13 +57,13 @@ export class TxResolverService {
         throw new Error(`Tx effect for ${txHash} has no nullifiers`);
       }
 
-      return new ResolvedTx(
-        data.txHash,
-        data.noteHashes,
-        data.nullifiers[0],
-        txEffect.l2BlockNumber,
-        txEffect.l2BlockHash.toFr(),
-      );
+      return {
+        txHash: data.txHash,
+        uniqueNoteHashesInTx: data.noteHashes,
+        firstNullifierInTx: data.nullifiers[0],
+        blockNumber: txEffect.l2BlockNumber,
+        blockHash: txEffect.l2BlockHash.toFr(),
+      };
     });
   }
 }

package/src/oracle_version.ts

@@ -13,10 +13,10 @@
 export const ORACLE_VERSION_MAJOR = 30;
 export const ORACLE_VERSION_MINOR = 8;
 
-/// This hash is computed from the `ORACLE_REGISTRY` declaration (each oracle's name, ordered parameter names and
+/// This hash is computed from `ORACLE_REGISTRY` (each oracle's name, ordered parameter names and
 /// types, and return type) and is used to detect when the oracle interface changes. When it does, you need to either:
 /// - increment `ORACLE_VERSION_MAJOR` and reset `ORACLE_VERSION_MINOR` to zero if the change is breaking, or
 /// - increment only `ORACLE_VERSION_MINOR` if the change is additive (a new oracle was added).
 ///
 /// These constants must be kept in sync between this file and `noir-projects/aztec-nr/aztec/src/oracle/version.nr`.
-export const ORACLE_INTERFACE_HASH = 'b302a8e65d37043c0a0dc08a39895603122dce334843f0442462edb3f56e32e2';
+export const ORACLE_INTERFACE_HASH = 'fec4d3a95fc57a62a20bfeb659bb3bfd91b31cd93e07f8cf97b368f9f55cc67b';

package/src/private_kernel/batch_planner.ts

@@ -150,7 +150,6 @@ export function appendApp(
     acc.feePayer,
     acc.expirationTimestamp,
     acc.isPrivateOnly,
-    acc.claimedFirstNullifier,
     acc.claimedRevertibleCounter,
   );
 }

package/src/private_kernel/private_kernel_execution_prover.ts

@@ -1,6 +1,7 @@
+import { CircuitKind } from '@aztec/bb.js';
 import { MAX_APPS_PER_KERNEL } from '@aztec/constants';
 import { uniqueBy } from '@aztec/foundation/collection';
-import { vkAsFieldsMegaHonk } from '@aztec/foundation/crypto/keys';
+import { vkAsFields } from '@aztec/foundation/crypto/keys';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { type Logger, type LoggerBindings, createLogger } from '@aztec/foundation/log';
 import { pushTestData } from '@aztec/foundation/testing';
@@ -20,9 +21,13 @@ import {
   type PrivateKernelExecutionProofOutput,
   PrivateKernelInit2CircuitPrivateInputs,
   PrivateKernelInit3CircuitPrivateInputs,
+  PrivateKernelInit4CircuitPrivateInputs,
+  PrivateKernelInit5CircuitPrivateInputs,
   PrivateKernelInitCircuitPrivateInputs,
   PrivateKernelInner2CircuitPrivateInputs,
   PrivateKernelInner3CircuitPrivateInputs,
+  PrivateKernelInner4CircuitPrivateInputs,
+  PrivateKernelInner5CircuitPrivateInputs,
   PrivateKernelInnerCircuitPrivateInputs,
   PrivateKernelResetTailCircuitPrivateInputs,
   type PrivateKernelSimulateOutput,
@@ -145,6 +150,7 @@ export class PrivateKernelExecutionProver {
             bytecode: output.bytecode,
             witness: output.outputWitness,
             vk: output.verificationKey.keyAsBytes,
+            kind: CircuitKind.Kernel,
             timings: {
               witgen: witgenTimer.ms(),
             },
@@ -230,6 +236,7 @@ export class PrivateKernelExecutionProver {
       bytecode: tailOutput.bytecode,
       witness: tailOutput.outputWitness,
       vk: tailOutput.verificationKey.keyAsBytes,
+      kind: CircuitKind.Kernel,
       timings: {
         witgen: witgenTimer.ms(),
       },
@@ -261,6 +268,7 @@ export class PrivateKernelExecutionProver {
         bytecode: hidingOutput.bytecode,
         witness: hidingOutput.outputWitness,
         vk: hidingOutput.verificationKey.keyAsBytes,
+        kind: CircuitKind.HidingKernel,
         timings: {
           witgen: witgenTimer.ms(),
         },
@@ -270,7 +278,11 @@ export class PrivateKernelExecutionProver {
     if (profileMode == 'gates' || profileMode == 'full') {
       for (const entry of executionSteps) {
         const gateCountTimer = new Timer();
-        const gateCount = await this.proofCreator.computeGateCountForCircuit(entry.bytecode, entry.functionName);
+        const gateCount = await this.proofCreator.computeGateCountForCircuit(
+          entry.bytecode,
+          entry.functionName,
+          entry.kind,
+        );
         entry.gateCount = gateCount;
         entry.timings.gateCount = gateCountTimer.ms();
       }
@@ -366,6 +378,7 @@ export class PrivateKernelExecutionProver {
       bytecode: next.acir,
       witness: next.partialWitness,
       vk: next.vk,
+      kind: CircuitKind.App,
       timings: {
         witgen: next.profileResult?.timings.witgen ?? 0,
         oracles: next.profileResult?.timings.oracles,
@@ -399,8 +412,8 @@ export class PrivateKernelExecutionProver {
   ) {
     const { contractAddress, functionSelector } = publicInputs.callContext;
 
-    const vkAsFields = await vkAsFieldsMegaHonk(vkAsBuffer);
-    const vk = await VerificationKeyAsFields.fromKey(vkAsFields);
+    const vkFields = await vkAsFields(vkAsBuffer, CircuitKind.App);
+    const vk = await VerificationKeyAsFields.fromKey(vkFields);
 
     const { currentContractClassId, publicKeys, saltedInitializationHash } =
       await this.oracle.getContractAddressPreimage(contractAddress);
@@ -514,6 +527,47 @@ export class PrivateKernelExecutionProver {
           functionName = 'private_kernel_init_3';
           break;
         }
+        case 4: {
+          const proofInput = new PrivateKernelInit4CircuitPrivateInputs(
+            txRequest,
+            vkTreeRoot,
+            ProtocolContractsList,
+            apps[0],
+            apps[1],
+            apps[2],
+            apps[3],
+            isPrivateOnlyTx,
+            minRevertibleSideEffectCounter,
+          );
+          this.log.debug(`Calling private kernel init_4 with isPrivateOnly ${isPrivateOnlyTx}`);
+          pushTestData('private-kernel-inputs-init-4', proofInput);
+          output = generateWitnesses
+            ? await this.proofCreator.generateInit4Output(proofInput)
+            : await this.proofCreator.simulateInit4(proofInput);
+          functionName = 'private_kernel_init_4';
+          break;
+        }
+        case 5: {
+          const proofInput = new PrivateKernelInit5CircuitPrivateInputs(
+            txRequest,
+            vkTreeRoot,
+            ProtocolContractsList,
+            apps[0],
+            apps[1],
+            apps[2],
+            apps[3],
+            apps[4],
+            isPrivateOnlyTx,
+            minRevertibleSideEffectCounter,
+          );
+          this.log.debug(`Calling private kernel init_5 with isPrivateOnly ${isPrivateOnlyTx}`);
+          pushTestData('private-kernel-inputs-init-5', proofInput);
+          output = generateWitnesses
+            ? await this.proofCreator.generateInit5Output(proofInput)
+            : await this.proofCreator.simulateInit5(proofInput);
+          functionName = 'private_kernel_init_5';
+          break;
+        }
         default:
           throw new Error(`Unsupported init kernel batch size: ${apps.length}`);
       }
@@ -548,6 +602,37 @@ export class PrivateKernelExecutionProver {
           functionName = 'private_kernel_inner_3';
           break;
         }
+        case 4: {
+          const proofInput = new PrivateKernelInner4CircuitPrivateInputs(
+            previousKernelData,
+            apps[0],
+            apps[1],
+            apps[2],
+            apps[3],
+          );
+          pushTestData('private-kernel-inputs-inner-4', proofInput);
+          output = generateWitnesses
+            ? await this.proofCreator.generateInner4Output(proofInput)
+            : await this.proofCreator.simulateInner4(proofInput);
+          functionName = 'private_kernel_inner_4';
+          break;
+        }
+        case 5: {
+          const proofInput = new PrivateKernelInner5CircuitPrivateInputs(
+            previousKernelData,
+            apps[0],
+            apps[1],
+            apps[2],
+            apps[3],
+            apps[4],
+          );
+          pushTestData('private-kernel-inputs-inner-5', proofInput);
+          output = generateWitnesses
+            ? await this.proofCreator.generateInner5Output(proofInput)
+            : await this.proofCreator.simulateInner5(proofInput);
+          functionName = 'private_kernel_inner_5';
+          break;
+        }
         default:
           throw new Error(`Unsupported inner kernel batch size: ${apps.length}`);
       }
@@ -558,6 +643,7 @@ export class PrivateKernelExecutionProver {
       bytecode: output.bytecode,
       witness: output.outputWitness,
       vk: output.verificationKey.keyAsBytes,
+      kind: CircuitKind.Kernel,
       timings: {
         witgen: witgenTimer.ms(),
       },

package/src/storage/fact_store/fact_store.ts

@@ -82,7 +82,7 @@ export class FactStore implements StagedStore {
   }
 
   /**
-   * Records a fact in a collection, visible under the given scope.
+   * Records a fact in a collection.
    *
    * The collection is created implicitly on the first fact recorded for its key: recording into an existing collection
    * just adds to it.

package/src/storage/fact_store/index.ts

@@ -5,6 +5,7 @@ export type { Fact } from './stored_fact.js';
 export {
   OriginBlockState,
   classifyOriginBlockState,
+  originBlockStateFromNumber,
   anchoredTipBlockNumbers,
   toFactWithOriginState,
   type TipBlockNumbers,

package/src/storage/fact_store/origin_state.ts

@@ -21,6 +21,15 @@ export enum OriginBlockState {
   Finalized = 3,
 }
 
+/** Parses a numeric origin-block-state discriminant, rejecting unknown values. */
+export function originBlockStateFromNumber(value: number): OriginBlockState {
+  if (!(value in OriginBlockState)) {
+    const validNames = Object.keys(OriginBlockState).filter(k => isNaN(Number(k)));
+    throw new Error(`Invalid OriginBlockState value ${value}, expected one of ${validNames.join(', ')}`);
+  }
+  return value as OriginBlockState;
+}
+
 /** The two chain-tip block numbers needed to classify an origin block (`finalized <= proven` always holds). */
 export type TipBlockNumbers = { provenBlockNumber: number; finalizedBlockNumber: number };
 

package/src/tagging/constants.ts

@@ -18,3 +18,13 @@ import { MAX_PRIVATE_LOGS_PER_TX } from '@aztec/constants';
 // reserved at log emission time, before squashing is decided, and the kernel's reset/squash loop is not bounded by
 // MAX_PRIVATE_LOGS_PER_TX. No fixed window value closes that gap.
 export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = MAX_PRIVATE_LOGS_PER_TX + 20;
+
+// The number of tags probed per constrained secret in the first round.
+//
+// The probe doubles each round (2, 4, 8, ..., capped at UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) while every probed
+// index is a hit, stopping at the first missing tag. Constrained delivery is gapless, so a single missing tag proves
+// the stream has ended: at steady state this turns a full WINDOW_LEN probe into two tags. A secret K logs behind
+// catches up in ~log2(K) round-trips while the probe is still doubling (2, 4, 8, 16, 32), but once it saturates the cap
+// and advances WINDOW_LEN tags per round, deeper catch-up is linear at ~K/WINDOW_LEN rounds. Either way it beats both
+// the full window every round and one round per log.
+export const INITIAL_CONSTRAINED_PROBE_LEN = 2;

package/src/tagging/index.ts

@@ -12,7 +12,7 @@
 export { syncTaggedPrivateLogs } from './recipient_sync/sync_tagged_private_logs.js';
 export { syncSenderTaggingIndexes } from './sender_sync/sync_sender_tagging_indexes.js';
 export { persistSenderTaggingIndexRangesForTx } from './persist_sender_tagging_index_ranges.js';
-export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from './constants.js';
+export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, INITIAL_CONSTRAINED_PROBE_LEN } from './constants.js';
 export { getAllPrivateLogsByTags, getAllPublicLogsByTagsFromContract } from './get_all_logs_by_tags.js';
 
 // Re-export tagging-related types from stdlib

package/src/tagging/recipient_sync/sync_tagged_private_logs.ts

@@ -7,7 +7,7 @@ import { AppTaggingSecretKind, SiloedTag } from '@aztec/stdlib/logs';
 import type { BlockHeader } from '@aztec/stdlib/tx';
 
 import type { RecipientTaggingStore } from '../../storage/tagging_store/recipient_tagging_store.js';
-import { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../constants.js';
+import { INITIAL_CONSTRAINED_PROBE_LEN, UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from '../constants.js';
 import { getAllPrivateLogsByTags } from '../get_all_logs_by_tags.js';
 import { findHighestIndexes } from './utils/find_highest_indexes.js';
 
@@ -62,9 +62,14 @@ import { findHighestIndexes } from './utils/find_highest_indexes.js';
  * - The lower bound is `highestFinalizedIndex + 1`. The `highestAgedIndex` mechanism is unnecessary because
  *   the nullifier chain prevents out-of-order index usage: no device can fill in a lower index after a higher
  *   one is already on-chain.
- * - The scan stops at the first gap in the index sequence. If all indexes in the batch have logs, the window
- *   advances. If a gap is found, the sequence has ended and no further logs exist.
- * - The upper bound is the same as unconstrained: `highestFinalizedIndex + WINDOW_LEN`.
+ * - Because the sequence is gapless, the scan stops at the first missing index: that gap proves the sequence has
+ *   ended and no further logs exist. We exploit this with a doubling first-miss probe (see
+ *   `INITIAL_CONSTRAINED_PROBE_LEN` in ../constants.ts), so a
+ *   steady-state sync with no new logs costs two tags instead of the whole window. The probe length is in-memory
+ *   state scoped to one sync call, so every sync restarts at the initial probe.
+ * - The upper bound is the same as unconstrained: `highestFinalizedIndex + WINDOW_LEN`. Advancing the probe is
+ *   decoupled from persisting the finalized index, so unfinalized logs at the top of the run are still fetched
+ *   while only the finalized prefix is persisted.
  *
  * # Batching across secrets
  *
@@ -109,19 +114,23 @@ export async function syncTaggedPrivateLogs(
 
         // Persist new indexes. If the finalized index moved forward, the window advances
         // and we need another round for this secret.
-        const processForKind =
-          pendingSecret.secret.kind === AppTaggingSecretKind.CONSTRAINED
-            ? processConstrainedResults
-            : processUnconstrainedResults;
-
-        return await processForKind(
-          pendingSecret,
-          logsFoundWithSecret,
-          taggingStore,
-          currentTimestamp,
-          finalizedBlockNumber,
-          jobId,
-        );
+        return pendingSecret.kind === AppTaggingSecretKind.CONSTRAINED
+          ? await processConstrainedResults(
+              pendingSecret,
+              logsFoundWithSecret,
+              taggingStore,
+              currentTimestamp,
+              finalizedBlockNumber,
+              jobId,
+            )
+          : await processUnconstrainedResults(
+              pendingSecret,
+              logsFoundWithSecret,
+              taggingStore,
+              currentTimestamp,
+              finalizedBlockNumber,
+              jobId,
+            );
       }),
     );
 
@@ -138,18 +147,29 @@ function getIndexRangesForSecrets(
   jobId: string,
 ): Promise<PendingSecret[]> {
   return Promise.all(
-    secrets.map(async secret => {
+    secrets.map(async (secret): Promise<PendingSecret> => {
       const currentHighestFinalizedIndex = await taggingStore.getHighestFinalizedIndex(secret, jobId);
+      const boundEnd = (currentHighestFinalizedIndex ?? 0) + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1;
+
+      if (secret.kind === AppTaggingSecretKind.CONSTRAINED) {
+        // Constrained streams are gapless and resume at the finalized index, so probe a small initial window and stop
+        // at the first missing tag instead of always fetching the full window. The probe grows each round up to the
+        // window cap.
+        const start = currentHighestFinalizedIndex === undefined ? 0 : currentHighestFinalizedIndex + 1;
+        return {
+          kind: AppTaggingSecretKind.CONSTRAINED,
+          secret,
+          start,
+          end: Math.min(boundEnd, start + INITIAL_CONSTRAINED_PROBE_LEN),
+          boundEnd,
+          probeLen: INITIAL_CONSTRAINED_PROBE_LEN,
+        };
+      }
 
-      const highestIndexBeforeStart =
-        secret.kind === AppTaggingSecretKind.CONSTRAINED
-          ? currentHighestFinalizedIndex
-          : await taggingStore.getHighestAgedIndex(secret, jobId);
-      const start = highestIndexBeforeStart === undefined ? 0 : highestIndexBeforeStart + 1;
-
-      const end = (currentHighestFinalizedIndex ?? 0) + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1;
-
-      return { secret, start, end };
+      // Unconstrained secrets can have gaps, so they scan the whole window starting past the highest aged index.
+      const highestAgedIndex = await taggingStore.getHighestAgedIndex(secret, jobId);
+      const start = highestAgedIndex === undefined ? 0 : highestAgedIndex + 1;
+      return { kind: AppTaggingSecretKind.UNCONSTRAINED, secret, start, end: boundEnd };
     }),
   );
 }
@@ -203,41 +223,58 @@ async function fetchLogsForSecrets(
 }
 
 /**
- * Processes fetched logs for a constrained secret. Constrained delivery guarantees contiguous index sequences,
- * so we scan from the start of the queried range and stop at the first missing index. Only `highestFinalizedIndex`
+ * Processes fetched logs for a constrained secret: persists the finalized index and advances the probe. See the
+ * "# Constrained secrets" section above for why the scan stops at the first missing index. Only `highestFinalizedIndex`
  * is tracked (no aged index).
  */
 async function processConstrainedResults(
-  pending: PendingSecret,
+  pending: PendingConstrained,
   logsWithIndexes: LogWithIndex[],
   taggingStore: RecipientTaggingStore,
   currentTimestamp: bigint,
   finalizedBlockNumber: BlockNumber,
   jobId: string,
 ): Promise<PendingSecret | undefined> {
-  // Find where the contiguous run of indexes ends. Constrained delivery guarantees there are no logs after the
-  // first gap, so all logs in the batch are within this prefix.
+  // Find where the contiguous run of indexes ends; all logs in the batch fall within this prefix.
   const indexesWithLogs = new Set(logsWithIndexes.map(l => l.taggingIndex));
   let firstMissingIndex = pending.start;
   while (firstMissingIndex < pending.end && indexesWithLogs.has(firstMissingIndex)) {
     firstMissingIndex++;
   }
 
-  // Finalize any logs before the gap. The nullifier for a constrained-delivery log is emitted in the same
-  // transaction, guaranteeing the log cannot disappear once included, so we persist the highest finalized
-  // index even when a gap stops the scan. This lets the next sync round skip already-finalized indexes.
+  // Persist the highest finalized index found. The nullifier for a constrained-delivery log is emitted in the same
+  // transaction, guaranteeing the log cannot disappear once included, so we persist even when a gap stops the scan.
+  // This lets the next sync round skip already-finalized indexes.
   const { highestFinalizedIndex } = findHighestIndexes(logsWithIndexes, currentTimestamp, finalizedBlockNumber);
-
   if (highestFinalizedIndex !== undefined) {
     await taggingStore.updateHighestFinalizedIndex(pending.secret, highestFinalizedIndex, jobId);
+  }
 
-    if (firstMissingIndex >= pending.end) {
-      return {
-        secret: pending.secret,
-        start: pending.end,
-        end: highestFinalizedIndex + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1,
-      };
-    }
+  // Advancing the probe is decoupled from persisting the finalized index: keep scanning as long as the probe was
+  // entirely hits (no gap) and there is room before the protocol bound, even if none of those hits is finalized yet.
+  // Gating this on finalization would drop logs in unfinalized blocks, which sit at the top of the contiguous run.
+  // The bound re-anchors to any finalized index found this round.
+  const probeFullyConsumed = firstMissingIndex >= pending.end;
+  const boundEnd =
+    highestFinalizedIndex !== undefined
+      ? Math.max(pending.boundEnd, highestFinalizedIndex + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1)
+      : pending.boundEnd;
+
+  // Double the probe each round, capped at the window (see INITIAL_CONSTRAINED_PROBE_LEN in ../constants.ts).
+  // The queried range is already bounded by boundEnd (a probe can never reach
+  // more than WINDOW_LEN past the finalized frontier); this cap just keeps the stored length from growing unbounded
+  // once the probe saturates the window.
+  const nextProbeLen = Math.min(pending.probeLen * 2, UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN);
+
+  if (probeFullyConsumed && pending.end < boundEnd) {
+    return {
+      kind: AppTaggingSecretKind.CONSTRAINED,
+      secret: pending.secret,
+      start: pending.end,
+      end: Math.min(boundEnd, pending.end + nextProbeLen),
+      boundEnd,
+      probeLen: nextProbeLen,
+    };
   }
 
   return undefined;
@@ -248,7 +285,7 @@ async function processConstrainedResults(
  * if the window needs to advance, or undefined if this secret is done.
  */
 async function processUnconstrainedResults(
-  pending: PendingSecret,
+  pending: PendingUnconstrained,
   logsWithIndexes: LogWithIndex[],
   taggingStore: RecipientTaggingStore,
   currentTimestamp: bigint,
@@ -282,19 +319,39 @@ async function processUnconstrainedResults(
 
   // For the next iteration we want to look only at indexes for which we have not yet fetched logs while
   // ensuring that we do not look further than WINDOW_LEN ahead of the highest finalized index.
+  const end = highestFinalizedIndex + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1;
   return {
+    kind: AppTaggingSecretKind.UNCONSTRAINED,
     secret: pending.secret,
     start: pending.end,
-    end: highestFinalizedIndex + UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN + 1,
+    end,
   };
 }
 
-type PendingSecret = {
+/** Working scan state common to both secret kinds: the half-open [start, end) tag-index range to query this round. */
+type PendingSecretBase = {
   secret: AppTaggingSecret;
   start: number;
   end: number;
 };
 
+/** Constrained scan state, carrying the doubling-probe bookkeeping that only the gapless constrained scan uses. */
+type PendingConstrained = PendingSecretBase & {
+  kind: typeof AppTaggingSecretKind.CONSTRAINED;
+  // Exclusive upper bound on the indexes this secret may probe this sync (highest finalized index + WINDOW_LEN + 1, the
+  // protocol bound on how far ahead of finalized a log can sit). `end` grows toward it each round.
+  boundEnd: number;
+  // Intended probe length for the round that produced `end`. The queried span can be smaller when boundEnd caps it.
+  probeLen: number;
+};
+
+/** Unconstrained scan state: a plain window with no probe bookkeeping, since the scan always covers the full window. */
+type PendingUnconstrained = PendingSecretBase & {
+  kind: typeof AppTaggingSecretKind.UNCONSTRAINED;
+};
+
+type PendingSecret = PendingConstrained | PendingUnconstrained;
+
 type LogWithIndex = {
   log: LogResult;
   taggingIndex: number;