fix(store): network notes must be public [main]

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## v0.13.8 (TBD)
+
+- Private notes with the network note attachment are no longer incorrectly considered as network notes (#[#1736](https://github.com/0xMiden/node/pull/1736)).
+
 ## v0.13.7 (2026-02-25)
 
 - Updated `SyncAccountStorageMaps` and `SyncAccountVault` to allow all accounts with public state, including network accounts ([#1711](https://github.com/0xMiden/node/pull/1711)).

crates/proto/src/domain/note.rs

@@ -281,6 +281,10 @@ impl TryFrom<Note> for SingleTargetNetworkNote {
     type Error = NetworkNoteError;
 
     fn try_from(note: Note) -> Result<Self, Self::Error> {
+        if note.metadata().note_type() != NoteType::Public {
+            return Err(NetworkNoteError::PrivateNote);
+        }
+
         // Single-target network notes are identified by having a NetworkAccountTarget attachment
         let attachment = note.metadata().attachment();
         let account_target = NetworkAccountTarget::try_from(attachment)
@@ -318,6 +322,8 @@ where
 pub enum NetworkNoteError {
     #[error("note does not have a valid NetworkAccountTarget attachment: {0}")]
     InvalidAttachment(#[source] NetworkAccountTargetError),
+    #[error("note is private")]
+    PrivateNote,
 }
 
 // NOTE SCRIPT

crates/rpc/src/server/api.rs

@@ -519,13 +519,11 @@ fn endpoint_limits(params: &[(&str, usize)]) -> proto::rpc::EndpointLimits {
 
 /// Cached RPC query parameter limits.
 static RPC_LIMITS: LazyLock<proto::rpc::RpcLimits> = LazyLock::new(|| {
-    use {
-        QueryParamAccountIdLimit as AccountId,
-        QueryParamNoteIdLimit as NoteId,
-        QueryParamNoteTagLimit as NoteTag,
-        QueryParamNullifierLimit as Nullifier,
-        QueryParamStorageMapKeyTotalLimit as StorageMapKeyTotal,
-    };
+    use QueryParamAccountIdLimit as AccountId;
+    use QueryParamNoteIdLimit as NoteId;
+    use QueryParamNoteTagLimit as NoteTag;
+    use QueryParamNullifierLimit as Nullifier;
+    use QueryParamStorageMapKeyTotalLimit as StorageMapKeyTotal;
 
     proto::rpc::RpcLimits {
         endpoints: std::collections::HashMap::from([

crates/store/Cargo.toml

@@ -19,7 +19,7 @@ anyhow                 = { workspace = true }
 deadpool               = { default-features = false, features = ["managed", "rt_tokio_1"], version = "0.12" }
 deadpool-diesel        = { features = ["sqlite"], version = "0.6" }
 deadpool-sync          = { default-features = false, features = ["tracing"], version = "0.1" }
-diesel                 = { features = ["numeric", "sqlite"], version = "2.3" }
+diesel                 = { features = ["numeric", "returning_clauses_for_sqlite_3_35", "sqlite"], version = "2.3" }
 diesel_migrations      = { features = ["sqlite"], version = "2.3" }
 fs-err                 = { workspace = true }
 hex                    = { version = "0.4" }

crates/store/src/db/mod.rs

@@ -3,7 +3,14 @@ use std::ops::RangeInclusive;
 use std::path::PathBuf;
 
 use anyhow::Context;
-use diesel::{Connection, QueryableByName, RunQueryDsl, SqliteConnection};
+use diesel::{
+    BoolExpressionMethods,
+    Connection,
+    ExpressionMethods,
+    QueryableByName,
+    RunQueryDsl,
+    SqliteConnection,
+};
 use miden_node_proto::domain::account::{AccountInfo, AccountSummary};
 use miden_node_proto::generated as proto;
 use miden_node_utils::tracing::OpenTelemetrySpanExt;
@@ -29,8 +36,8 @@ use crate::COMPONENT;
 use crate::db::manager::{ConnectionManager, configure_connection_on_creation};
 use crate::db::migrations::apply_migrations;
 use crate::db::models::conv::SqlTypeConvert;
-use crate::db::models::queries::StorageMapValuesPage;
-use crate::db::models::{Page, queries};
+use crate::db::models::queries::{NetworkNoteType, StorageMapValuesPage};
+use crate::db::models::{Page, deserialize_raw_vec, queries};
 use crate::errors::{DatabaseError, DatabaseSetupError, NoteSyncError, StateSyncError};
 use crate::genesis::GenesisBlock;
 
@@ -321,9 +328,39 @@ impl Db {
 
         let me = Db { pool };
         me.query("migrations", apply_migrations).await?;
+        me.fixup_network_note_classification().await?;
         Ok(me)
     }
 
+    /// Temporary fixup of private notes which were misclassified as network notes.
+    #[instrument(target = COMPONENT, skip_all, err)]
+    async fn fixup_network_note_classification(&self) -> Result<()> {
+        let notes = self
+            .transact("fixup network notes", move |conn| {
+                let updated = diesel::update(schema::notes::table)
+                    .filter(
+                        schema::notes::network_note_type
+                            .eq(NetworkNoteType::SingleTarget as i32)
+                            .and(schema::notes::nullifier.is_null()),
+                    )
+                    .set(schema::notes::network_note_type.eq(NetworkNoteType::None as i32))
+                    .returning(schema::notes::note_id)
+                    .get_results::<Vec<u8>>(conn)?;
+
+                deserialize_raw_vec::<_, NoteId>(updated).map_err(DatabaseError::from)
+            })
+            .await?;
+
+        for note in notes {
+            tracing::info!(
+                note.id = %note,
+                "Fixed private note misclassified as network note"
+            );
+        }
+
+        Ok(())
+    }
+
     /// Loads all the nullifiers from the DB.
     #[instrument(level = "debug", target = COMPONENT, skip_all, ret(level = "debug"), err)]
     pub(crate) async fn select_all_nullifiers(&self) -> Result<Vec<NullifierInfo>> {

crates/store/src/db/models/queries/notes.rs

@@ -878,7 +878,7 @@ impl From<(NoteRecord, Option<Nullifier>)> for NoteInsertRow {
         let attachment = note.metadata.attachment();
 
         let target_account_id = NetworkAccountTarget::try_from(attachment).ok();
-        let network_note_type = if target_account_id.is_some() {
+        let network_note_type = if target_account_id.is_some() && !note.metadata.is_private() {
             NetworkNoteType::SingleTarget
         } else {
             NetworkNoteType::None