@aztec/pxe 0.0.1-commit.f504929 → 0.0.1-commit.f5a9928

package/dest/storage/note_store/note_store.js

@@ -1,42 +1,60 @@
+import { createLogger } from '@aztec/foundation/log';
+import { allToCompletion } from '@aztec/foundation/promise';
 import { Semaphore } from '@aztec/foundation/queue';
 import { NoteStatus } from '@aztec/stdlib/note';
 import { StoredNote } from './stored_note.js';
 /**
- * NoteStore manages the storage and retrieval of notes.
+ * NoteStore manages the storage and retrieval of notes using an append-only model.
  *
- * Notes can be active or nullified. This class processes new notes, nullifications, and performs rollback handling in
- * the case of a reorg.
- **/ export class NoteStore {
+ * Notes are written once (keyed by siloedNullifier) and never mutated. They might be deleted in case of reorg though.
+ * Nullifier emissions are recorded as separate append-only entries: a map from nullifier to the number of the block
+ * that emitted it.
+ *
+ * Reorgs are handled by delete-on-prune: the `chain-pruned` event triggers deletion of every note and nullifier
+ * originating on a reorg'd block.
+ */ export class NoteStore {
     storeName = 'note';
+    logger = createLogger('note_store');
     #store;
-    // Note that we use the siloedNullifier as the note id in the store as it's guaranteed to be unique.
+    // Note that we use the siloedNullifier as the note id in this store as it's guaranteed to be unique.
     // Main storage for notes. Avoid performing full scans on it as it contains all notes PXE knows, use
-    // #nullifiersByContractAddress or #nullifiersByNullificationBlockNumber to find relevant note nullifiers that can be
-    // used to read into this map instead.
+    // #nullifiersByContractAddress to find relevant note nullifiers that can be used to read into this map instead.
+    //
     // nullifier => StoredNote (serialized)
     #notes;
     // Indexes which notes (via their nullifiers) belong to a contract. Used in `getNotes` to reduce the amount of notes
     // checked.
+    //
     // contract address => nullifier
-    #nullifiersByContractAddress;
-    // Groups note nullifiers by the block number they were added to the nullifier tree. Used in `rollback` to handle
-    // re-orgs.
-    // block number => nullifier (block number in which nullifier is included)
-    #nullifiersByNullificationBlockNumber;
+    #notesByContractAddress;
+    // block number => nullifier
+    #notesByBlockNumber;
+    // Records, for each nullified note, the block number where its nullifier was emitted.
+    // nullifier => emission block number
+    #nullifierEmissions;
+    // Index of emitted nullifiers by block height, used for performance reasons upon reorgs.
+    // nullification block number => nullifier
+    #nullifierEmissionsByBlockNumber;
     // In-memory changes performed during a not-yet committed job. When `commit` is called with said job's id, these
     // changes are persisted in the DB maps specified above and cleared.
-    // jobId => nullifier => StoredNote (serialized)
+    // jobId => nullifier => StoredNote
     #notesForJob;
+    // Staged nullifier emissions per job.
+    // jobId => nullifier => emission block number
+    #nullifierEmissionsForJob;
     // Per job locks to prevent multiple concurrent writes to affect each other.
     // jobId => lock
     #jobLocks;
     constructor(store){
         this.#store = store;
         this.#notes = store.openMap('notes');
-        this.#nullifiersByContractAddress = store.openMultiMap('note_nullifiers_by_contract');
-        this.#nullifiersByNullificationBlockNumber = store.openMultiMap('note_block_number_to_nullifier');
+        this.#notesByContractAddress = store.openMultiMap('note_nullifiers_by_contract');
+        this.#notesByBlockNumber = store.openMultiMap('note_nullifiers_by_block');
+        this.#nullifierEmissions = store.openMap('note_nullifications_by_nullifier');
+        this.#nullifierEmissionsByBlockNumber = store.openMultiMap('note_nullifications_by_block');
         this.#jobLocks = new Map();
         this.#notesForJob = new Map();
+        this.#nullifierEmissionsForJob = new Map();
     }
     /**
    * Adds multiple notes to the notes store under the specified scope.
@@ -48,7 +66,7 @@ import { StoredNote } from './stored_note.js';
    * @param scope - The scope (user/account) under which to store the notes
    * @param jobId - The job context for staged writes
    */ addNotes(notes, scope, jobId) {
-        return this.#withJobLock(jobId, ()=>this.#store.transactionAsync(()=>Promise.all(notes.map(async (note)=>{
+        return this.#withJobLock(jobId, ()=>this.#store.transactionAsync(()=>allToCompletion(notes.map(async (note)=>{
                     const noteForJob = await this.#readNote(note.siloedNullifier.toString(), jobId) ?? new StoredNote(note, new Set());
                     noteForJob.addScope(scope.toString());
                     this.#writeNote(noteForJob, jobId);
@@ -65,65 +83,80 @@ import { StoredNote } from './stored_note.js';
         this.#getNotesForJob(jobId).set(note.noteDao.siloedNullifier.toString(), note);
     }
     /**
+   * Reads the block number at which a note's nullifier was emitted, layering the current job's staged emission over
+   * committed state, the nullifier emission counterpart to {@link #readNote}. Returns the emission block number if the
+   * nullifier has been emitted (committed or staged in this job), or `undefined` if it has not.
+   */ async #readNullifierEmission(nullifier, jobId) {
+        // Always issue the DB read to keep the IndexedDB transaction alive (see #readNote); the staged emission still takes
+        // precedence if present.
+        const committed = await this.#nullifierEmissions.getAsync(nullifier);
+        const staged = this.#getNullifierEmissionsForJob(jobId).get(nullifier);
+        return staged ?? committed;
+    }
+    #writeNullifierEmission(nullifier, blockNumber, jobId) {
+        this.#getNullifierEmissionsForJob(jobId).set(nullifier, blockNumber);
+    }
+    /**
    * Retrieves notes based on the provided filter criteria.
    *
-   * This method queries both active and optionally nullified notes based on the filter parameters.
+   * A note is considered nullified iff its corresponding nullifier emission has been recorded.
+   *
+   * All DB reads are kicked off before any await so IndexedDB does not auto-commit the transaction mid-read.
    *
    * @param filter - Filter criteria including contractAddress (required), and optional owner,
    *                 storageSlot, status, scopes, and siloedNullifier.
-   * @params jobId - the job context to read from.
-   * @returns Filtered and deduplicated notes (a note might be present in multiple scopes - we ensure it is only
-   * returned once if this is the case)
+   * @param jobId - the job context to read from.
+   * @returns Filtered and deduplicated notes (a note might be present in multiple scopes, but returned at most once)
    */ getNotes(filter, jobId) {
-        if (filter.scopes !== 'ALL_SCOPES' && filter.scopes.length === 0) {
+        if (filter.scopes.length === 0) {
             return Promise.resolve([]);
         }
         return this.#store.transactionAsync(async ()=>{
             const targetStatus = filter.status ?? NoteStatus.ACTIVE;
-            // The code below might read a bit unnatural, the reason is that we need to be careful in how we use `await` inside
-            // `transactionAsync`, otherwise browsers might choose to auto-commit the IndexedDB transaction forcing us to
-            // explicitly handle that condition. The rule we need to honor is: do not await unless you generate a database
-            // read or write or you're done using the DB for the remainder of the transaction. The following sequence is
-            // unsafe in IndexedDB:
-            //
-            // 1. start transactionAsync()
-            // 2. await readDb() <-- OK, transaction alive because we issued DB ops
-            // 3. run a bunch of computations (no await involved) <-- OK, tx alive because we are in the same microtask
-            // 4. await doSthNotInDb() <-- no DB ops issued in this task, browser's free to decide to commit the tx
-            // 5. await readDb() <-- BOOM, TransactionInactiveError
-            //
-            // Note that the real issue is in step number 5: we try to continue using a transaction that the browser might
-            // have already committed.
-            //
-            // We need to read candidate notes which are either indexed by contract address in the DB (in
-            // #nullifiersByContractAddress), or lie in memory for the not yet committed `jobId`.
-            // So we collect promises based on both sources without awaiting for them.
-            const noteReadPromises = new Map();
-            // Awaiting the getValuesAsync iterator is fine because it's reading from the DB
-            for await (const nullifier of this.#nullifiersByContractAddress.getValuesAsync(filter.contractAddress.toString())){
-                // Each #readNote will perform a DB read
-                noteReadPromises.set(nullifier, this.#readNote(nullifier, jobId));
+            // Collect note-read and nullifier-emission-read promises together in one map so all DB reads are in-flight
+            // before any await. This keeps the IndexedDB transaction alive (IndexedDB auto-commits when a new micro-task
+            // starts with no pending read requests), so both promises must be started during the synchronous iteration.
+            const candidates = new Map();
+            // Committed notes indexed by contract address
+            for await (const nullifier of this.#notesByContractAddress.getValuesAsync(filter.contractAddress.toString())){
+                candidates.set(nullifier, {
+                    notePromise: this.#readNote(nullifier, jobId),
+                    nullificationPromise: this.#readNullifierEmission(nullifier, jobId)
+                });
             }
-            // Add staged nullifiers from job, no awaits involved, so we are fine
+            // Staged notes from the current job (not yet committed to the DB index)
             for (const storedNote of this.#getNotesForJob(jobId).values()){
                 if (storedNote.noteDao.contractAddress.equals(filter.contractAddress)) {
                     const nullifier = storedNote.noteDao.siloedNullifier.toString();
-                    if (!noteReadPromises.has(nullifier)) {
-                        noteReadPromises.set(nullifier, Promise.resolve(storedNote));
+                    if (!candidates.has(nullifier)) {
+                        candidates.set(nullifier, {
+                            notePromise: Promise.resolve(storedNote),
+                            nullificationPromise: this.#readNullifierEmission(nullifier, jobId)
+                        });
                     }
                 }
             }
-            // By now we have pending DB requests from all the #readNote calls. Await them all together.
-            const notes = await Promise.all(noteReadPromises.values());
-            // The rest of the function is await-free, and just deals with filtering and sorting our findings.
+            // Await all DB reads together before the await-free tail.
+            const entries = [
+                ...candidates.entries()
+            ];
+            const notes = await allToCompletion(entries.map(([, { notePromise }])=>notePromise));
+            const nullifierEmissions = await allToCompletion(entries.map(([, { nullificationPromise }])=>nullificationPromise));
+            // Await-free tail: filter and sort. No DB ops from here on.
+            // Build a lookup: nullifier => emission block number
+            const emissionByNullifier = new Map();
+            for(let i = 0; i < entries.length; i++){
+                emissionByNullifier.set(entries[i][0], nullifierEmissions[i]);
+            }
             const foundNotes = new Map();
             for (const note of notes){
                 // Defensive: hitting this case means we're mishandling contract indices or in-memory job data
                 if (!note) {
                     throw new Error('PXE note database is corrupted.');
                 }
-                // Apply filters
-                if (targetStatus === NoteStatus.ACTIVE && note.isNullified()) {
+                // A note is nullified once its nullifier emission has been recorded (committed or staged in this job).
+                const nullified = emissionByNullifier.get(note.noteDao.siloedNullifier.toString()) !== undefined;
+                if (targetStatus === NoteStatus.ACTIVE && nullified) {
                     continue;
                 }
                 if (filter.owner && !note.noteDao.owner.equals(filter.owner)) {
@@ -135,7 +168,7 @@ import { StoredNote } from './stored_note.js';
                 if (filter.siloedNullifier && !note.noteDao.siloedNullifier.equals(filter.siloedNullifier)) {
                     continue;
                 }
-                if (filter.scopes !== 'ALL_SCOPES' && note.scopes.intersection(new Set(filter.scopes.map((s)=>s.toString()))).size === 0) {
+                if (note.scopes.intersection(new Set(filter.scopes.map((s)=>s.toString()))).size === 0) {
                     continue;
                 }
                 foundNotes.set(note.noteDao.siloedNullifier.toString(), note.noteDao);
@@ -155,141 +188,62 @@ import { StoredNote } from './stored_note.js';
         });
     }
     /**
-   * Transitions notes from "active" to "nullified" state.
+   * Records emission of the given siloed nullifiers, which causes notes to be considered nullified.
    *
-   * This operation processes a batch of nullifiers to mark the corresponding notes as spent/nullified.
-   * The operation is atomic - if any nullifier is not found, the entire operation fails and no notes are modified.
+   * Each nullifier gets an append-only entry recording the block number at which it was emitted.
    *
-   * applyNullifiers is idempotent: the same nullifier can be applied multiple times without error.
-   * This relaxes constraints on usage of NoteService#validateAndStoreNote, which can then be run concurrently in a Promise.all
-   * context without risking unnecessarily defensive checks failing.
+   * Every nullifier passed must correspond to a note already present in this store. Callers only apply nullifiers for
+   * notes of scopes they track, and a note is always discovered before the nullifier that spends it, so a nullifier
+   * with no matching note signals a bug (broken nonce/index discovery, a sync-ordering error, store corruption, etc).
    *
-   * @param nullifiers - Array of nullifiers with their block numbers to process
+   * `applyNullifiers` is idempotent: a nullifier whose emission is already recorded (committed or staged in this job) is
+   * skipped, so re-applying it neither re-writes the emission, changes note visibility, nor appears in the result.
+   *
+   * @param siloedNullifiers - Array of nullifiers with their block locations to record
    * @param jobId - The job context for staged writes
-   * @returns Array of NoteDao objects that were nullified
-   * @throws Error if any nullifier is not found in this notes store
-   */ applyNullifiers(nullifiers, jobId) {
-        if (nullifiers.length === 0) {
+   * @returns The notes that transition from active to nullified in this call; already-nullified notes are skipped, so
+   *          a repeat application returns an empty array.
+   * @throws If any nullifier has no matching note in this store, or was emitted at block 0.
+   */ applyNullifiers(siloedNullifiers, jobId) {
+        if (siloedNullifiers.length === 0) {
             return Promise.resolve([]);
         }
-        if (nullifiers.some((n)=>n.l2BlockNumber === 0)) {
+        if (siloedNullifiers.some((n)=>n.l2BlockNumber === 0)) {
             return Promise.reject(new Error('applyNullifiers: nullifiers cannot have been emitted at block 0'));
         }
         return this.#withJobLock(jobId, ()=>this.#store.transactionAsync(async ()=>{
-                const notesToNullify = await Promise.all(nullifiers.map(async (nullifierInBlock)=>{
-                    const nullifier = nullifierInBlock.data.toString();
-                    const storedNote = await this.#readNote(nullifier, jobId);
+                // Kick off the note read and the existing-emission read together during the synchronous map so all are in
+                // flight before the first await, which keeps the IndexedDB transaction alive.
+                const resolved = await allToCompletion(siloedNullifiers.map(async (nullifier)=>{
+                    const key = nullifier.data.toString();
+                    const [storedNote, existingEmission] = await allToCompletion([
+                        this.#readNote(key, jobId),
+                        this.#readNullifierEmission(key, jobId)
+                    ]);
                     if (!storedNote) {
-                        throw new Error(`Attempted to mark a note as nullified which does not exist in PXE DB`);
+                        throw new Error(`Attempted to mark a note as nullified which does not exist in PXE DB: ${key}`);
                     }
                     return {
+                        nullifier,
                         storedNote,
-                        blockNumber: nullifierInBlock.l2BlockNumber
+                        alreadyEmitted: existingEmission !== undefined
                     };
                 }));
-                const notesNullifiedInThisCall = new Map();
-                for (const noteToNullify of notesToNullify){
-                    const note = noteToNullify.storedNote;
-                    // Skip already nullified notes
-                    if (note.isNullified()) {
+                // Await-free tail: record an emission only for notes not already nullified, and return exactly those that
+                // transition active -> nullified in this call.
+                const affected = [];
+                for (const { nullifier, storedNote, alreadyEmitted } of resolved){
+                    if (alreadyEmitted) {
                         continue;
                     }
-                    note.markAsNullified(noteToNullify.blockNumber);
-                    this.#writeNote(note, jobId);
-                    notesNullifiedInThisCall.set(note.noteDao.siloedNullifier.toString(), note.noteDao);
+                    this.#writeNullifierEmission(nullifier.data.toString(), nullifier.l2BlockNumber, jobId);
+                    affected.push(storedNote.noteDao);
                 }
-                return [
-                    ...notesNullifiedInThisCall.values()
-                ];
+                return affected;
             }));
     }
     /**
-   * Synchronizes notes and nullifiers to a specific block number.
-   *
-   * This method ensures that the state of notes and nullifiers is consistent with the specified block number.
-   * It restores any notes that were nullified after the given block and deletes any active notes created after that
-   * block.
-   *
-   * IMPORTANT: This method must be called within a transaction to ensure atomicity.
-   *
-   * @param blockNumber - The new chain tip after a reorg
-   * @param synchedBlockNumber - The block number up to which PXE managed to sync before the reorg happened.
-   */ async rollback(blockNumber, synchedBlockNumber) {
-        if (this.#notesForJob.size > 0) {
-            throw new Error('PXE note store rollback is not allowed while jobs are running');
-        }
-        await this.#rewindNullifiedNotesAfterBlock(blockNumber, synchedBlockNumber);
-        await this.#deleteActiveNotesAfterBlock(blockNumber);
-    }
-    /**
-   * Deletes (removes) all notes created after the specified block number.
-   *
-   * Permanently delete notes from the notes store, e.g. during a reorg.
-   *
-   * @param blockNumber - Notes created after this block number will be deleted
-   */ async #deleteActiveNotesAfterBlock(blockNumber) {
-        // Collect notes to delete during iteration to keep IndexedDB transaction alive.
-        const notesToDelete = [];
-        for await (const noteBuffer of this.#notes.valuesAsync()){
-            const storedNote = StoredNote.fromBuffer(noteBuffer);
-            if (storedNote.noteDao.l2BlockNumber > blockNumber) {
-                notesToDelete.push({
-                    nullifier: storedNote.noteDao.siloedNullifier.toString(),
-                    contractAddress: storedNote.noteDao.contractAddress.toString()
-                });
-            }
-        }
-        // Delete all collected notes. Each delete is a DB operation that keeps the transaction alive.
-        for (const { nullifier, contractAddress } of notesToDelete){
-            await this.#notes.delete(nullifier);
-            await this.#nullifiersByContractAddress.deleteValue(contractAddress, nullifier);
-        }
-    }
-    /**
-   * Rewinds nullifications after a given block number.
-   *
-   * This operation "un-nullifies" notes, rolling back nullifications that occurred in orphaned blocks, e.g. during a
-   * reorg.
-   *
-   * @param blockNumber - Revert nullifications that occurred after this block
-   * @param anchorBlockNumber - Upper bound for the block range to process
-   */ async #rewindNullifiedNotesAfterBlock(blockNumber, anchorBlockNumber) {
-        // First pass: collect all nullifiers for all blocks, starting reads during iteration to keep tx alive.
-        const nullifiersByBlock = new Map();
-        for(let i = blockNumber + 1; i <= anchorBlockNumber; i++){
-            const blockNullifiers = [];
-            for await (const nullifier of this.#nullifiersByNullificationBlockNumber.getValuesAsync(i)){
-                // Start read immediately during iteration to keep IndexedDB transaction alive
-                blockNullifiers.push({
-                    nullifier,
-                    noteReadPromise: this.#notes.getAsync(nullifier)
-                });
-            }
-            if (blockNullifiers.length > 0) {
-                nullifiersByBlock.set(i, blockNullifiers);
-            }
-        }
-        // Second pass: await reads and perform writes
-        for (const [block, nullifiers] of nullifiersByBlock){
-            for (const { nullifier, noteReadPromise } of nullifiers){
-                const noteBuffer = await noteReadPromise;
-                if (!noteBuffer) {
-                    throw new Error(`PXE DB integrity error: no note found with nullifier ${nullifier}`);
-                }
-                const storedNote = StoredNote.fromBuffer(noteBuffer);
-                if (storedNote.scopes.size === 0) {
-                    throw new Error(`No scopes found for nullified note with nullifier ${nullifier}`);
-                }
-                storedNote.markAsActive();
-                await Promise.all([
-                    this.#notes.set(nullifier, storedNote.toBuffer()),
-                    this.#nullifiersByNullificationBlockNumber.deleteValue(block, nullifier)
-                ]);
-            }
-        }
-    }
-    /**
-   * Commits in memory job data to persistent storage.
+   * Commits in-memory job data to persistent storage.
    *
    * Called by JobCoordinator when a job completes successfully.
    *
@@ -300,10 +254,12 @@ import { StoredNote } from './stored_note.js';
    */ async commit(jobId) {
         for (const [nullifier, storedNote] of this.#getNotesForJob(jobId)){
             await this.#notes.set(nullifier, storedNote.toBuffer());
-            await this.#nullifiersByContractAddress.set(storedNote.noteDao.contractAddress.toString(), nullifier);
-            if (storedNote.nullifiedAt !== undefined) {
-                await this.#nullifiersByNullificationBlockNumber.set(storedNote.nullifiedAt, nullifier);
-            }
+            await this.#notesByContractAddress.set(storedNote.noteDao.contractAddress.toString(), nullifier);
+            await this.#notesByBlockNumber.set(storedNote.noteDao.l2BlockNumber, nullifier);
+        }
+        for (const [nullifier, blockNumber] of this.#getNullifierEmissionsForJob(jobId)){
+            await this.#nullifierEmissions.set(nullifier, blockNumber);
+            await this.#nullifierEmissionsByBlockNumber.set(blockNumber, nullifier);
         }
         this.#clearJobData(jobId);
     }
@@ -313,12 +269,13 @@ import { StoredNote } from './stored_note.js';
     }
     #clearJobData(jobId) {
         this.#notesForJob.delete(jobId);
+        this.#nullifierEmissionsForJob.delete(jobId);
         this.#jobLocks.delete(jobId);
     }
     /**
    * Functions run withJobLock are forced to wait for each other, i.e. if they share a `jobId`, they run serially
    * instead of concurrently. This is needed because staged data is stored in memory, and concurrent async operations
-   * (e.g., Promise.all in `validateAndStoreNote`) could otherwise interleave and corrupt state.
+   * (e.g., allToCompletion in `validateAndStoreNote`) could otherwise interleave and corrupt state.
    */ async #withJobLock(jobId, fn) {
         let lock = this.#jobLocks.get(jobId);
         if (!lock) {
@@ -340,4 +297,77 @@ import { StoredNote } from './stored_note.js';
         }
         return notesForJob;
     }
+    #getNullifierEmissionsForJob(jobId) {
+        let nullificationsForJob = this.#nullifierEmissionsForJob.get(jobId);
+        if (!nullificationsForJob) {
+            nullificationsForJob = new Map();
+            this.#nullifierEmissionsForJob.set(jobId, nullificationsForJob);
+        }
+        return nullificationsForJob;
+    }
+    /** Returns the nullifiers (note ids) of all notes created at the given block number. Used by delete-on-prune. */ async nullifiersOfNotesAtBlock(blockNumber) {
+        const nullifiers = [];
+        for await (const nullifier of this.#notesByBlockNumber.getValuesAsync(blockNumber)){
+            nullifiers.push(nullifier);
+        }
+        return nullifiers;
+    }
+    /**
+   * Rolls the store back to `toBlock`: deletes every note and nullifier emission originating on a block strictly above
+   * it, as if nothing past that block height ever happened. Used to retract notes and nullifiers on a reorg.
+   *
+   * Must be called inside a transaction owned by the caller (it issues no `transactionAsync` of its own, because the
+   * reorg path wraps it together with other store operations, and IndexedDB has no nested transaction support).
+   *
+   * Throws if any job has uncommitted staged writes, since rolling back mid-job could later re-introduce notes or
+   * nullifier emissions anchored to deleted blocks.
+   */ async rollback(toBlock) {
+        if (this.#notesForJob.size > 0 || this.#nullifierEmissionsForJob.size > 0) {
+            throw new Error('PXE note store rollback is not allowed while jobs are running');
+        }
+        // Snapshot the orphaned (block, nullifier) pairs before mutating so we never delete from the cursor we are
+        // iterating. Scanning from `toBlock + 1` upward covers everything above the rollback target without needing to know
+        // the chain tip. Each nullifier's rows are independent (nullifiers are globally unique), so the deletes run
+        // concurrently. Keeping requests in flight also prevents the IndexedDB transaction from auto-committing mid-way.
+        const orphanedNotes = [];
+        for await (const [block, siloedNullifier] of this.#notesByBlockNumber.entriesAsync({
+            start: toBlock + 1
+        })){
+            orphanedNotes.push({
+                block,
+                siloedNullifier
+            });
+        }
+        let removedNotes = 0;
+        await allToCompletion(orphanedNotes.map(async ({ block, siloedNullifier })=>{
+            const buf = await this.#notes.getAsync(siloedNullifier);
+            if (!buf) {
+                throw new Error(`Note not found for siloedNullifier ${siloedNullifier}`);
+            }
+            const stored = StoredNote.fromBuffer(buf);
+            await this.#notes.delete(siloedNullifier);
+            await this.#notesByContractAddress.deleteValue(stored.noteDao.contractAddress.toString(), siloedNullifier);
+            await this.#notesByBlockNumber.deleteValue(block, siloedNullifier);
+            removedNotes++;
+        }));
+        // Same procedure, with nullifier emissions
+        const orphanedEmissions = [];
+        for await (const [block, siloedNullifier] of this.#nullifierEmissionsByBlockNumber.entriesAsync({
+            start: toBlock + 1
+        })){
+            orphanedEmissions.push({
+                block,
+                siloedNullifier
+            });
+        }
+        await allToCompletion(orphanedEmissions.map(async ({ block, siloedNullifier })=>{
+            await this.#nullifierEmissions.delete(siloedNullifier);
+            await this.#nullifierEmissionsByBlockNumber.deleteValue(block, siloedNullifier);
+        }));
+        this.logger.verbose('rolled back notes and nullifier emissions', {
+            removedNotes,
+            removedNullifierEmissions: orphanedEmissions.length,
+            toBlock
+        });
+    }
 }

package/dest/storage/note_store/stored_note.d.ts

@@ -1,16 +1,11 @@
-import { BlockNumber } from '@aztec/foundation/branded-types';
 import { NoteDao } from '@aztec/stdlib/note';
+/** A note as stored by the PXE: the note DAO plus the scopes that observed it. Append-only — never mutated. */
 export declare class StoredNote {
     readonly noteDao: NoteDao;
     readonly scopes: Set<string>;
-    private _nullifiedAt;
-    constructor(noteDao: NoteDao, scopes: Set<string>, _nullifiedAt?: BlockNumber | undefined);
+    constructor(noteDao: NoteDao, scopes: Set<string>);
     static fromBuffer(buffer: Buffer): StoredNote;
     toBuffer(): Buffer;
     addScope(scope: string): void;
-    markAsNullified(blockNumber: BlockNumber): void;
-    markAsActive(): void;
-    isNullified(): boolean;
-    get nullifiedAt(): BlockNumber | undefined;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmVkX25vdGUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL25vdGVfc3RvcmUvc3RvcmVkX25vdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBRTlELE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUU3QyxxQkFBYSxVQUFVO0lBRW5CLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTztJQUN6QixRQUFRLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUM7SUFDNUIsT0FBTyxDQUFDLFlBQVk7SUFIdEIsWUFDVyxPQUFPLEVBQUUsT0FBTyxFQUNoQixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUNwQixZQUFZLEdBQUUsV0FBVyxHQUFHLFNBQXFCLEVBQ3ZEO0lBRUosTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxjQVUvQjtJQUVELFFBQVEsSUFBSSxNQUFNLENBR2pCO0lBRUQsUUFBUSxDQUFDLEtBQUssRUFBRSxNQUFNLFFBRXJCO0lBRUQsZUFBZSxDQUFDLFdBQVcsRUFBRSxXQUFXLFFBRXZDO0lBRUQsWUFBWSxTQUVYO0lBRUQsV0FBVyxZQUVWO0lBRUQsSUFBSSxXQUFXLDRCQUVkO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmVkX25vdGUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9zdG9yYWdlL25vdGVfc3RvcmUvc3RvcmVkX25vdGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBRTdDLGlIQUErRztBQUMvRyxxQkFBYSxVQUFVO0lBRW5CLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTztJQUN6QixRQUFRLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUM7SUFGOUIsWUFDVyxPQUFPLEVBQUUsT0FBTyxFQUNoQixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUMxQjtJQUVKLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxVQUFVLENBSzVDO0lBRUQsUUFBUSxJQUFJLE1BQU0sQ0FHakI7SUFFRCxRQUFRLENBQUMsS0FBSyxFQUFFLE1BQU0sR0FBRyxJQUFJLENBRTVCO0NBQ0YifQ==

package/dest/storage/note_store/stored_note.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stored_note.d.ts","sourceRoot":"","sources":["../../../src/storage/note_store/stored_note.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,qBAAa,UAAU;IAEnB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;IAC5B,OAAO,CAAC,YAAY;IAHtB,YACW,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EACpB,YAAY,GAAE,WAAW,GAAG,SAAqB,EACvD;IAEJ,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,cAU/B;IAED,QAAQ,IAAI,MAAM,CAGjB;IAED,QAAQ,CAAC,KAAK,EAAE,MAAM,QAErB;IAED,eAAe,CAAC,WAAW,EAAE,WAAW,QAEvC;IAED,YAAY,SAEX;IAED,WAAW,YAEV;IAED,IAAI,WAAW,4BAEd;CACF"}
+{"version":3,"file":"stored_note.d.ts","sourceRoot":"","sources":["../../../src/storage/note_store/stored_note.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,iHAA+G;AAC/G,qBAAa,UAAU;IAEnB,QAAQ,CAAC,OAAO,EAAE,OAAO;IACzB,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;IAF9B,YACW,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B;IAEJ,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAK5C;IAED,QAAQ,IAAI,MAAM,CAGjB;IAED,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5B;CACF"}

package/dest/storage/note_store/stored_note.js

@@ -1,13 +1,11 @@
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 import { NoteDao } from '@aztec/stdlib/note';
-export class StoredNote {
+/** A note as stored by the PXE: the note DAO plus the scopes that observed it. Append-only — never mutated. */ export class StoredNote {
     noteDao;
     scopes;
-    _nullifiedAt;
-    constructor(noteDao, scopes, _nullifiedAt = undefined){
+    constructor(noteDao, scopes){
         this.noteDao = noteDao;
         this.scopes = scopes;
-        this._nullifiedAt = _nullifiedAt;
     }
     static fromBuffer(buffer) {
         const reader = BufferReader.asReader(buffer);
@@ -15,29 +13,15 @@ export class StoredNote {
         const scopes = reader.readVector({
             fromBuffer: (r)=>r.readString()
         });
-        const nullifiedAtRaw = reader.readNumber();
-        const nullifiedAt = nullifiedAtRaw === 0 ? undefined : nullifiedAtRaw;
-        return new StoredNote(noteDao, new Set(scopes), nullifiedAt);
+        return new StoredNote(noteDao, new Set(scopes));
     }
     toBuffer() {
         const scopesArray = [
             ...this.scopes
         ];
-        return serializeToBuffer(this.noteDao, scopesArray.length, ...scopesArray, this._nullifiedAt ?? 0);
+        return serializeToBuffer(this.noteDao, scopesArray.length, ...scopesArray);
     }
     addScope(scope) {
         this.scopes.add(scope);
     }
-    markAsNullified(blockNumber) {
-        this._nullifiedAt = blockNumber;
-    }
-    markAsActive() {
-        this._nullifiedAt = undefined;
-    }
-    isNullified() {
-        return this._nullifiedAt !== undefined;
-    }
-    get nullifiedAt() {
-        return this._nullifiedAt;
-    }
 }

package/dest/storage/open_pxe_stores.d.ts

@@ -0,0 +1,35 @@
+import { KeyStore } from '@aztec/key-store';
+import type { AztecAsyncKVStore } from '@aztec/kv-store';
+import { L2TipsKVStore } from '@aztec/kv-store/stores';
+import type { BlockHash } from '@aztec/stdlib/block';
+import { AddressStore } from './address_store/address_store.js';
+import { AnchorBlockStore } from './anchor_block_store/anchor_block_store.js';
+import { CapsuleStore } from './capsule_store/capsule_store.js';
+import { ContractStore } from './contract_store/contract_store.js';
+import { FactStore } from './fact_store/fact_store.js';
+import { NoteStore } from './note_store/note_store.js';
+import { PrivateEventStore } from './private_event_store/private_event_store.js';
+import { RecipientTaggingStore, SenderTaggingStore, TaggingSecretSourcesStore } from './tagging_store/index.js';
+/**
+ * The set of sub-stores opened against a single `AztecAsyncKVStore` to back PXE state.
+ */
+export type PxeStores = {
+    addressStore: AddressStore;
+    privateEventStore: PrivateEventStore;
+    contractStore: ContractStore;
+    noteStore: NoteStore;
+    anchorBlockStore: AnchorBlockStore;
+    senderTaggingStore: SenderTaggingStore;
+    taggingSecretSourcesStore: TaggingSecretSourcesStore;
+    recipientTaggingStore: RecipientTaggingStore;
+    capsuleStore: CapsuleStore;
+    keyStore: KeyStore;
+    l2TipsStore: L2TipsKVStore;
+    factStore: FactStore;
+};
+/**
+ * Opens every PXE sub-store against the given backing store. The `initialBlockHash` seeds the
+ * `L2TipsKVStore` so it agrees with the node's archiver on the dynamic genesis header hash.
+ */
+export declare function openPxeStores(store: AztecAsyncKVStore, initialBlockHash: BlockHash): PxeStores;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3Blbl9weGVfc3RvcmVzLmQudHMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvc3RvcmFnZS9vcGVuX3B4ZV9zdG9yZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQzVDLE9BQU8sS0FBSyxFQUFFLGlCQUFpQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDekQsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxFQUFFLFNBQVMsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXJELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQUNoRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsTUFBTSw0Q0FBNEMsQ0FBQztBQUM5RSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDaEUsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLG9DQUFvQyxDQUFDO0FBQ25FLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN2RCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFDdkQsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sOENBQThDLENBQUM7QUFDakYsT0FBTyxFQUFFLHFCQUFxQixFQUFFLGtCQUFrQixFQUFFLHlCQUF5QixFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFaEg7O0dBRUc7QUFDSCxNQUFNLE1BQU0sU0FBUyxHQUFHO0lBQ3RCLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDM0IsaUJBQWlCLEVBQUUsaUJBQWlCLENBQUM7SUFDckMsYUFBYSxFQUFFLGFBQWEsQ0FBQztJQUM3QixTQUFTLEVBQUUsU0FBUyxDQUFDO0lBQ3JCLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDO0lBQ25DLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDO0lBQ3ZDLHlCQUF5QixFQUFFLHlCQUF5QixDQUFDO0lBQ3JELHFCQUFxQixFQUFFLHFCQUFxQixDQUFDO0lBQzdDLFlBQVksRUFBRSxZQUFZLENBQUM7SUFDM0IsUUFBUSxFQUFFLFFBQVEsQ0FBQztJQUNuQixXQUFXLEVBQUUsYUFBYSxDQUFDO0lBQzNCLFNBQVMsRUFBRSxTQUFTLENBQUM7Q0FDdEIsQ0FBQztBQUVGOzs7R0FHRztBQUNILHdCQUFnQixhQUFhLENBQUMsS0FBSyxFQUFFLGlCQUFpQixFQUFFLGdCQUFnQixFQUFFLFNBQVMsR0FBRyxTQUFTLENBZTlGIn0=

package/dest/storage/open_pxe_stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"open_pxe_stores.d.ts","sourceRoot":"","sources":["../../src/storage/open_pxe_stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8CAA8C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAEhH;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,yBAAyB,EAAE,yBAAyB,CAAC;IACrD,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,YAAY,EAAE,YAAY,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,aAAa,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,SAAS,GAAG,SAAS,CAe9F"}