@aztec/pxe 0.0.1-commit.b8a057fa → 0.0.1-commit.be03c316

package/src/messages/tx_resolver_service.ts

@@ -3,7 +3,7 @@ import { Fr } from '@aztec/foundation/curves/bn254';
 import type { AztecNode } from '@aztec/stdlib/interfaces/server';
 import { type IndexedTxEffect, TxHash } from '@aztec/stdlib/tx';
 
-import { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
+import type { ResolvedTx } from '../contract_function_simulator/noir-structs/resolved_tx.js';
 
 /** Resolves transaction hashes into their on-chain context (note hashes, first nullifier, and mined block). */
 export class TxResolverService {
@@ -57,13 +57,13 @@ export class TxResolverService {
         throw new Error(`Tx effect for ${txHash} has no nullifiers`);
       }
 
-      return new ResolvedTx(
-        data.txHash,
-        data.noteHashes,
-        data.nullifiers[0],
-        txEffect.l2BlockNumber,
-        txEffect.l2BlockHash.toFr(),
-      );
+      return {
+        txHash: data.txHash,
+        uniqueNoteHashesInTx: data.noteHashes,
+        firstNullifierInTx: data.nullifiers[0],
+        blockNumber: txEffect.l2BlockNumber,
+        blockHash: txEffect.l2BlockHash.toFr(),
+      };
     });
   }
 }

package/src/notes/note_service.ts

@@ -26,7 +26,7 @@ export class NoteService {
    *
    * @param owner - The owner of the notes. If undefined, returns notes for all known owners.
    * @param status - The status of notes to fetch.
-   * @param scopes - The accounts whose notes we can access in this call. Currently optional and will default to all.
+   * @param scopes - The accounts whose notes we can access in this call. An empty list matches no notes.
    */
   public async getNotes(
     contractAddress: AztecAddress,

package/src/oracle_version.ts

@@ -11,12 +11,12 @@
 /// if AZTEC_NR_MINOR > PXE_MINOR because if a contract is updated to use a newer Aztec.nr dependency without actually
 /// using any of the new oracles then there is no reason to throw.
 export const ORACLE_VERSION_MAJOR = 30;
-export const ORACLE_VERSION_MINOR = 5;
+export const ORACLE_VERSION_MINOR = 8;
 
-/// This hash is computed from the `ORACLE_REGISTRY` declaration (each oracle's name, ordered parameter names and
+/// This hash is computed from `ORACLE_REGISTRY` (each oracle's name, ordered parameter names and
 /// types, and return type) and is used to detect when the oracle interface changes. When it does, you need to either:
 /// - increment `ORACLE_VERSION_MAJOR` and reset `ORACLE_VERSION_MINOR` to zero if the change is breaking, or
 /// - increment only `ORACLE_VERSION_MINOR` if the change is additive (a new oracle was added).
 ///
 /// These constants must be kept in sync between this file and `noir-projects/aztec-nr/aztec/src/oracle/version.nr`.
-export const ORACLE_INTERFACE_HASH = 'f71b9662ec851e74593764a87792b0a91c181e1410aac49a4507f0bba949f6be';
+export const ORACLE_INTERFACE_HASH = 'fec4d3a95fc57a62a20bfeb659bb3bfd91b31cd93e07f8cf97b368f9f55cc67b';

package/src/pxe.ts

@@ -37,7 +37,7 @@ import type {
   PrivateKernelTailCircuitPublicInputs,
 } from '@aztec/stdlib/kernel';
 import { computeAddressSecret } from '@aztec/stdlib/keys';
-import { deriveEcdhSharedSecretPoint } from '@aztec/stdlib/logs';
+import { deriveEcdhSharedSecretPoint, protectFromForgery } from '@aztec/stdlib/logs';
 import {
   BlockHeader,
   type ContractOverrides,
@@ -890,9 +890,11 @@ export class PXE {
   }
 
   /**
-   * Derives the shared secret of a handshake from its ephemeral public key: `S = addressSecret(recipient) * ephPk`,
-   * the same derivation the recipient-side scan uses for handshakes discovered onchain. The ephemeral key is
-   * reconstructed from its x-coordinate with a positive y, matching how the protocol generates it.
+   * Derives the shared secret of a handshake from its ephemeral public key: the raw ECDH secret
+   * `S = addressSecret(recipient) * ephPk` with the forgery protection applied,
+   * matching the protected secret the registry stores and the derivation the recipient-side scan uses for
+   * handshakes discovered onchain. The ephemeral key is reconstructed from its x-coordinate with a positive y,
+   * matching how the protocol generates it.
    *
    * @throws If `ephPk` is not the x-coordinate of a Grumpkin curve point, or if `recipient` is not an account of
    * this PXE, since the derivation needs its keys.
@@ -914,7 +916,8 @@ export class PXE {
 
     const ivskM = await this.keyStore.getMasterIncomingViewingSecretKey(recipient);
     const addressSecret = await computeAddressSecret(await completeAddress.getPreaddress(), ivskM);
-    return deriveEcdhSharedSecretPoint(addressSecret, ephPkPoint);
+    const rawSecret = await deriveEcdhSharedSecretPoint(addressSecret, ephPkPoint);
+    return protectFromForgery(rawSecret, ephPkPoint, await recipient.toAddressPoint());
   }
 
   /** Registers a resolved shared secret scoped to a recipient. Returns whether it was newly added. */

package/src/storage/backwards_compatibility_tests/__snapshots__/RecipientTaggingStore.json

@@ -1,17 +1,25 @@
 {
   "highest_aged_index": [
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
+      "key": "utf8:constrained:0x0000000000000000000000000000000000000000000000000000000000000013:0x0000000000000000000000000000000000000000000000000000000000000017",
+      "value": "num:13"
+    },
+    {
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
       "value": "num:13"
     }
   ],
   "highest_finalized_index": [
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
+      "key": "utf8:constrained:0x0000000000000000000000000000000000000000000000000000000000000013:0x0000000000000000000000000000000000000000000000000000000000000017",
+      "value": "num:11"
+    },
+    {
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
       "value": "num:11"
     },
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000005:0x0000000000000000000000000000000000000000000000000000000000000007",
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000005:0x0000000000000000000000000000000000000000000000000000000000000007",
       "value": "num:17"
     }
   ]

package/src/storage/backwards_compatibility_tests/__snapshots__/SenderTaggingStore.json

@@ -1,21 +1,29 @@
 {
   "pending_indexes": [
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
+      "key": "utf8:constrained:0x0000000000000000000000000000000000000000000000000000000000000013:0x0000000000000000000000000000000000000000000000000000000000000017",
+      "value": "[{\"lowestIndex\":4,\"highestIndex\":7,\"txHash\":\"0x0000000000000000000000000000000000000000000000000000000000000025\"}]"
+    },
+    {
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
       "value": "[{\"lowestIndex\":4,\"highestIndex\":7,\"txHash\":\"0x0000000000000000000000000000000000000000000000000000000000000013\"},{\"lowestIndex\":8,\"highestIndex\":11,\"txHash\":\"0x0000000000000000000000000000000000000000000000000000000000000017\"}]"
     },
     {
-      "key": "utf8:0x000000000000000000000000000000000000000000000000000000000000000b:0x000000000000000000000000000000000000000000000000000000000000000d",
+      "key": "utf8:unconstrained:0x000000000000000000000000000000000000000000000000000000000000000b:0x000000000000000000000000000000000000000000000000000000000000000d",
       "value": "[{\"lowestIndex\":1,\"highestIndex\":9,\"txHash\":\"0x000000000000000000000000000000000000000000000000000000000000001d\"}]"
     }
   ],
   "last_finalized_indexes": [
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
+      "key": "utf8:constrained:0x0000000000000000000000000000000000000000000000000000000000000013:0x0000000000000000000000000000000000000000000000000000000000000017",
+      "value": "num:3"
+    },
+    {
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000002:0x0000000000000000000000000000000000000000000000000000000000000003",
       "value": "num:3"
     },
     {
-      "key": "utf8:0x0000000000000000000000000000000000000000000000000000000000000005:0x0000000000000000000000000000000000000000000000000000000000000007",
+      "key": "utf8:unconstrained:0x0000000000000000000000000000000000000000000000000000000000000005:0x0000000000000000000000000000000000000000000000000000000000000007",
       "value": "num:5"
     }
   ]

package/src/storage/backwards_compatibility_tests/__snapshots__/opened_stores.json

@@ -1,5 +1,5 @@
 {
-  "schemaVersion": 12,
+  "schemaVersion": 13,
   "stores": [
     {
       "name": "capsules",

package/src/storage/backwards_compatibility_tests/schema_tests.ts

@@ -18,6 +18,7 @@ import { GasFees } from '@aztec/stdlib/gas';
 import { PublicKey, PublicKeys, deriveKeys } from '@aztec/stdlib/keys';
 import {
   AppTaggingSecret,
+  AppTaggingSecretKind,
   ContractClassLog,
   ContractClassLogFields,
   PrivateLog,
@@ -530,10 +531,18 @@ export const SCHEMA_TESTS: readonly SchemaTest[] = [
       const jobId = 'fixture-job';
       const secretA = new AppTaggingSecret(new Fr(2n), AztecAddress.fromBigIntUnsafe(3n));
       const secretB = new AppTaggingSecret(new Fr(5n), AztecAddress.fromBigIntUnsafe(7n));
+      // A constrained secret keys under the `constrained:` prefix, so the snapshot pins both kinds side by side.
+      const secretConstrained = new AppTaggingSecret(
+        new Fr(19n),
+        AztecAddress.fromBigIntUnsafe(23n),
+        AppTaggingSecretKind.CONSTRAINED,
+      );
 
       await recipientTaggingStore.updateHighestFinalizedIndex(secretA, 11, jobId);
       await recipientTaggingStore.updateHighestAgedIndex(secretA, 13, jobId);
       await recipientTaggingStore.updateHighestFinalizedIndex(secretB, 17, jobId);
+      await recipientTaggingStore.updateHighestFinalizedIndex(secretConstrained, 11, jobId);
+      await recipientTaggingStore.updateHighestAgedIndex(secretConstrained, 13, jobId);
       await kvStore.transactionAsync(() => recipientTaggingStore.commit(jobId));
     },
     snapshotStore: async kvStore => ({
@@ -584,10 +593,17 @@ export const SCHEMA_TESTS: readonly SchemaTest[] = [
       const secretA = new AppTaggingSecret(new Fr(2n), AztecAddress.fromBigIntUnsafe(3n));
       const secretB = new AppTaggingSecret(new Fr(5n), AztecAddress.fromBigIntUnsafe(7n));
       const secretC = new AppTaggingSecret(new Fr(11n), AztecAddress.fromBigIntUnsafe(13n));
+      const secretConstrained = new AppTaggingSecret(
+        new Fr(19n),
+        AztecAddress.fromBigIntUnsafe(23n),
+        AppTaggingSecretKind.CONSTRAINED,
+      );
       const txHashA = TxHash.fromBigInt(17n);
       const txHashB = TxHash.fromBigInt(19n);
       const txHashC = TxHash.fromBigInt(23n);
       const txHashD = TxHash.fromBigInt(29n);
+      const txHashE = TxHash.fromBigInt(31n);
+      const txHashF = TxHash.fromBigInt(37n);
 
       // secretA receives three pending ranges (one per tx); secretB receives one. After finalizing txHashA below,
       // secretA's array shrinks to two elements (the txHashB and txHashC ranges, both with highestIndex > 3) which
@@ -626,7 +642,20 @@ export const SCHEMA_TESTS: readonly SchemaTest[] = [
         jobId,
       );
 
-      await senderTaggingStore.finalizePendingIndexes([txHashA], jobId);
+      // secretConstrained gets a finalized range (txHashE) plus a surviving higher pending range (txHashF), so the
+      // `constrained:` key lands in both pending_indexes and last_finalized_indexes.
+      await senderTaggingStore.storePendingIndexes(
+        [{ extendedSecret: secretConstrained, lowestIndex: 1, highestIndex: 3 }],
+        txHashE,
+        jobId,
+      );
+      await senderTaggingStore.storePendingIndexes(
+        [{ extendedSecret: secretConstrained, lowestIndex: 4, highestIndex: 7 }],
+        txHashF,
+        jobId,
+      );
+
+      await senderTaggingStore.finalizePendingIndexes([txHashA, txHashE], jobId);
 
       await kvStore.transactionAsync(() => senderTaggingStore.commit(jobId));
     },

package/src/storage/fact_store/index.ts

@@ -5,6 +5,7 @@ export type { Fact } from './stored_fact.js';
 export {
   OriginBlockState,
   classifyOriginBlockState,
+  originBlockStateFromNumber,
   anchoredTipBlockNumbers,
   toFactWithOriginState,
   type TipBlockNumbers,

package/src/storage/fact_store/origin_state.ts

@@ -21,6 +21,15 @@ export enum OriginBlockState {
   Finalized = 3,
 }
 
+/** Parses a numeric origin-block-state discriminant, rejecting unknown values. */
+export function originBlockStateFromNumber(value: number): OriginBlockState {
+  if (!(value in OriginBlockState)) {
+    const validNames = Object.keys(OriginBlockState).filter(k => isNaN(Number(k)));
+    throw new Error(`Invalid OriginBlockState value ${value}, expected one of ${validNames.join(', ')}`);
+  }
+  return value as OriginBlockState;
+}
+
 /** The two chain-tip block numbers needed to classify an origin block (`finalized <= proven` always holds). */
 export type TipBlockNumbers = { provenBlockNumber: number; finalizedBlockNumber: number };
 

package/src/storage/metadata.ts

@@ -1 +1 @@
-export const PXE_DATA_SCHEMA_VERSION = 12;
+export const PXE_DATA_SCHEMA_VERSION = 13;

package/src/storage/store_identity.ts

@@ -0,0 +1,72 @@
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
+import { DatabaseVersion } from '@aztec/stdlib/database-version/version';
+
+/** The triple that determine which physical store a logical store name maps to. */
+export type StoreIdentity = {
+  /** Chain ID of the L1 the rollup is deployed to. */
+  l1ChainId: number;
+  /** Address of the rollup contract the store's data pertains to. */
+  rollupAddress: EthAddress;
+  /** Schema version of the data held in the store. */
+  schemaVersion: number;
+};
+
+/**
+ * Composes the store-name discriminator for a store identity. Two identities map to the same physical store iff
+ * their slugs are equal, so the format must stay stable: `<l1ChainId>-<rollupAddress>-v<schemaVersion>` — changing
+ * it orphans every existing store.
+ */
+export function storeIdentitySlug({ l1ChainId, rollupAddress, schemaVersion }: StoreIdentity): string {
+  return `${l1ChainId}-${rollupAddress.toString()}-v${schemaVersion}`;
+}
+
+/** Composes the physical store name for a logical store name and identity. */
+export function effectiveStoreName(name: string, identity: StoreIdentity): string {
+  return `${name}_${storeIdentitySlug(identity)}`;
+}
+
+/**
+ * Invariant check for stores whose physical name carries their identity: the recorded version can
+ * only disagree with the expected one if there is a store-naming bug.
+ */
+export async function assertStoreIdentity(
+  store: AztecAsyncKVStore,
+  storeName: string,
+  identity: StoreIdentity,
+): Promise<void> {
+  const expected = new DatabaseVersion(identity.schemaVersion, identity.rollupAddress);
+  const singleton = store.openSingleton<string>('dbVersion');
+  const stored = await singleton.getAsync();
+  if (stored === undefined) {
+    await singleton.set(expected.toBuffer().toString('utf-8'));
+    return;
+  }
+  let storedVersion: DatabaseVersion;
+  try {
+    storedVersion = DatabaseVersion.fromBuffer(Buffer.from(stored, 'utf-8'));
+  } catch {
+    throw new StoreIdentityMismatchError(storeName, expected.toString(), stored);
+  }
+  if (!storedVersion.equals(expected)) {
+    throw new StoreIdentityMismatchError(storeName, expected.toString(), storedVersion.toString());
+  }
+}
+
+/**
+ * Thrown when a store's recorded identity does not match the identity it was opened under. Since the identity is
+ * part of the physical store name, this can only indicate a store-naming bug; the store is left untouched.
+ */
+export class StoreIdentityMismatchError extends Error {
+  constructor(
+    public readonly storeName: string,
+    public readonly expected: string,
+    public readonly actual: string,
+  ) {
+    super(
+      `Store '${storeName}' records identity ${actual} but was opened as ${expected}. ` +
+        `Refusing to open; data was NOT modified.`,
+    );
+    this.name = 'StoreIdentityMismatchError';
+  }
+}

package/src/storage/tagging_store/sender_tagging_store.ts

@@ -128,10 +128,11 @@ export class SenderTaggingStore implements StagedStore {
   }
 
   /**
-   * Stores pending index ranges.
+   * Stores pending index ranges, rejecting any range that disagrees with an already-stored one.
    * @remarks If the same (secret, txHash) pair already exists in the db with an equal range, it's a no-op. This is
    * expected to happen because whenever we start sync we start from the last finalized index and we can have pending
-   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug.
+   * ranges already stored from previous syncs. If the ranges differ, it throws an error as that indicates a bug in
+   * callers that record indexes at prove time. Discovery from onchain logs must use `mergePendingIndexes` instead.
    * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
    * to be stored in the db.
    * @param txHash - The tx in which the tagging indexes were used in private logs.
@@ -141,6 +142,33 @@ export class SenderTaggingStore implements StagedStore {
    * @throws If a different range already exists for the same (secret, txHash) pair.
    */
   storePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, jobId, false);
+  }
+
+  /**
+   * Stores pending index ranges, widening an existing entry for the same (secret, txHash) pair to the union of the
+   * stored and incoming ranges instead of throwing on a mismatch. Discovery from onchain logs needs this: it may see
+   * only the surviving (non-revertible phase) sub-range of a partially reverted tx recorded at prove time (the
+   * finalized receipt step of the sync resolves that difference), or indexes beyond a partially discovered entry
+   * when a tx from another PXE straddles a sync window boundary. Callers that record indexes at prove time must use
+   * `storePendingIndexes` instead, so that a range disagreement surfaces as a bug rather than being absorbed.
+   * @param ranges - The tagging index ranges containing the directional app tagging secrets and the index ranges that are
+   * to be stored in the db.
+   * @param txHash - The tx in which the tagging indexes were used in private logs.
+   * @param jobId - job context for staged writes to this store. See `JobCoordinator` for more details.
+   * @throws If the highestIndex is further than window length from the highest finalized index for the same secret.
+   * @throws If the lowestIndex is lower than or equal to the last finalized index for the same secret.
+   */
+  mergePendingIndexes(ranges: TaggingIndexRange[], txHash: TxHash, jobId: string): Promise<void> {
+    return this.#storePendingIndexes(ranges, txHash, jobId, true);
+  }
+
+  #storePendingIndexes(
+    ranges: TaggingIndexRange[],
+    txHash: TxHash,
+    jobId: string,
+    mergeExisting: boolean,
+  ): Promise<void> {
     if (ranges.length === 0) {
       return Promise.resolve();
     }
@@ -187,21 +215,40 @@ export class SenderTaggingStore implements StagedStore {
         // Check if an entry with the same txHash already exists
         const existingEntry = pendingData.find(entry => entry.txHash === txHashStr);
 
-        if (existingEntry) {
-          // Assert that the ranges are equal — different ranges for the same (secret, txHash) indicates a bug
-          if (existingEntry.lowestIndex !== range.lowestIndex || existingEntry.highestIndex !== range.highestIndex) {
-            throw new Error(
-              `Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` +
-                `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` +
-                `new [${range.lowestIndex}, ${range.highestIndex}]`,
-            );
-          }
-          // Exact duplicate — skip
-        } else {
-          this.#writePendingIndexes(jobId, secretStr, [
+        let updatedPending: PendingIndexesEntry[] | undefined;
+        if (!existingEntry) {
+          updatedPending = [
             ...pendingData,
             { lowestIndex: range.lowestIndex, highestIndex: range.highestIndex, txHash: txHashStr },
-          ]);
+          ];
+        } else if (mergeExisting) {
+          // Widen the entry to the union of both ranges, never shrink it: replacing would drop prove-time
+          // indexes the chain doesn't show (partially reverted tx), and skipping would drop onchain indexes
+          // discovered in a later sync window (tx straddling the window boundary).
+          const lowestIndex = Math.min(existingEntry.lowestIndex, range.lowestIndex);
+          const highestIndex = Math.max(existingEntry.highestIndex, range.highestIndex);
+          if (lowestIndex !== existingEntry.lowestIndex || highestIndex !== existingEntry.highestIndex) {
+            updatedPending = pendingData.map(entry =>
+              entry === existingEntry ? { lowestIndex, highestIndex, txHash: entry.txHash } : entry,
+            );
+          }
+        } else if (
+          existingEntry.lowestIndex !== range.lowestIndex ||
+          existingEntry.highestIndex !== range.highestIndex
+        ) {
+          // Different ranges for the same (secret, txHash) indicate a bug in callers that record indexes at prove
+          // time.
+          throw new Error(
+            `Conflicting range for secret ${secretStr} and txHash ${txHashStr}: ` +
+              `existing [${existingEntry.lowestIndex}, ${existingEntry.highestIndex}] vs ` +
+              `new [${range.lowestIndex}, ${range.highestIndex}]`,
+          );
+        }
+        // Remaining cases (a merge whose union equals the stored range, or an identical range without
+        // mergeExisting): duplicate evidence, nothing to write.
+
+        if (updatedPending) {
+          this.#writePendingIndexes(jobId, secretStr, updatedPending);
         }
       }
     });

package/src/tagging/constants.ts

@@ -1,8 +1,30 @@
 import { MAX_PRIVATE_LOGS_PER_TX } from '@aztec/constants';
 
-// This window has to cover the largest expected number of unfinalized logs emitted for a given directional app tagging
-// secret. If more tag indexes are consumed than this window, an error is thrown in `PXE::proveTx`.
+// This window bounds how far a sender's next tag index for a directional app tagging secret can run ahead of that
+// secret's highest finalized index before `PXE::proveTx` throws.
 //
-// Having a large window significantly slowed down `e2e_l1_with_wall_time` test as there we perform sync for more than
-// 1000 secrets, so keep this bounded to the per-tx private log limit.
-export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = MAX_PRIVATE_LOGS_PER_TX;
+// MAX_PRIVATE_LOGS_PER_TX is a floor for ordinary transaction patterns: the private kernel accumulates every
+// surviving private log into a single tx-wide array of exactly this size, so a fresh secret's very first
+// ordinary tx can consume that many indexes before anything is finalized.
+//
+// The +20 on top is headroom for multiple pending ordinary txs to the same counterparty stacking up
+// before the first one is observed as mined. Only a run of near-MAX_PRIVATE_LOGS_PER_TX txs back-to-back would
+// exhaust this; ordinary transfers use far fewer logs per tx, so the same margin covers many more of those. Keep the
+// margin additive rather than another multiple of the floor. A larger window also makes recipient-side sync more
+// expensive, since discovery has to probe ahead of the last finalized index for every active secret.
+//
+// TODO(F-783): MAX_PRIVATE_LOGS_PER_TX is not a hard ceiling in general — a tx that creates and nullifies (squashes)
+// many notes/logs to the same secret can drive that secret's raw tag index arbitrarily higher, since indexes are
+// reserved at log emission time, before squashing is decided, and the kernel's reset/squash loop is not bounded by
+// MAX_PRIVATE_LOGS_PER_TX. No fixed window value closes that gap.
+export const UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN = MAX_PRIVATE_LOGS_PER_TX + 20;
+
+// The number of tags probed per constrained secret in the first round.
+//
+// The probe doubles each round (2, 4, 8, ..., capped at UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN) while every probed
+// index is a hit, stopping at the first missing tag. Constrained delivery is gapless, so a single missing tag proves
+// the stream has ended: at steady state this turns a full WINDOW_LEN probe into two tags. A secret K logs behind
+// catches up in ~log2(K) round-trips while the probe is still doubling (2, 4, 8, 16, 32), but once it saturates the cap
+// and advances WINDOW_LEN tags per round, deeper catch-up is linear at ~K/WINDOW_LEN rounds. Either way it beats both
+// the full window every round and one round per log.
+export const INITIAL_CONSTRAINED_PROBE_LEN = 2;

package/src/tagging/index.ts

@@ -12,7 +12,7 @@
 export { syncTaggedPrivateLogs } from './recipient_sync/sync_tagged_private_logs.js';
 export { syncSenderTaggingIndexes } from './sender_sync/sync_sender_tagging_indexes.js';
 export { persistSenderTaggingIndexRangesForTx } from './persist_sender_tagging_index_ranges.js';
-export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN } from './constants.js';
+export { UNFINALIZED_TAGGING_INDEXES_WINDOW_LEN, INITIAL_CONSTRAINED_PROBE_LEN } from './constants.js';
 export { getAllPrivateLogsByTags, getAllPublicLogsByTagsFromContract } from './get_all_logs_by_tags.js';
 
 // Re-export tagging-related types from stdlib