diff --git a/docs/docs-developers/docs/aztec-nr/framework-description/state_variables.md b/docs/docs-developers/docs/aztec-nr/framework-description/state_variables.md
index a308805c88dd..6c15e1b2fedd 100644
--- a/docs/docs-developers/docs/aztec-nr/framework-description/state_variables.md
+++ b/docs/docs-developers/docs/aztec-nr/framework-description/state_variables.md
@@ -273,7 +273,7 @@ When working with private state variables, many operations return a `NoteMessage
 #### Delivery Methods
 
 Private notes need to be communicated to their recipients so they know the note exists and can use it. The [`NoteMessage`](pathname:///aztec-nr-api/#api_ref_version/noir_aztec/note/struct.NoteMessage) wrapper forces you to make an explicit choice about how this happens:
-  - [`MessageDelivery::onchain_constrained()`](pathname:///aztec-nr-api/#api_ref_version/noir_aztec/messages/delivery/global.MessageDelivery): Verified in the circuit (most secure, but highest cost) - Use when the sender cannot be trusted to deliver correctly (e.g., protocol fees, multisig config updates). **Warning:** Currently [not fully constrained](https://github.com/AztecProtocol/aztec-packages/issues/14565) - the log's tag is unconstrained.
+  - [`MessageDelivery::onchain_constrained()`](pathname:///aztec-nr-api/#api_ref_version/noir_aztec/messages/delivery/global.MessageDelivery): Verified in the circuit (most secure, but highest cost) - Use when the sender cannot be trusted to deliver correctly (e.g., protocol fees, multisig config updates).
   - [`MessageDelivery::onchain_unconstrained()`](pathname:///aztec-nr-api/#api_ref_version/noir_aztec/messages/delivery/global.MessageDelivery): Message stored onchain but no guarantees on content - Use when the sender is incentivized to deliver correctly but may not have an offchain channel to the recipient.
   - [`MessageDelivery::offchain()`](pathname:///aztec-nr-api/#api_ref_version/noir_aztec/messages/delivery/global.MessageDelivery): Lowest cost, no onchain data - Use when the sender and recipient can communicate and the sender is incentivized to deliver correctly.
 
diff --git a/docs/examples/webapp-tutorial/contracts/src/main.nr b/docs/examples/webapp-tutorial/contracts/src/main.nr
index 5a313b45ebb1..9e010b50b503 100644
--- a/docs/examples/webapp-tutorial/contracts/src/main.nr
+++ b/docs/examples/webapp-tutorial/contracts/src/main.nr
@@ -95,7 +95,7 @@ pub contract PodRacing {
             .at(game_id)
             .at(player)
             .insert(GameRoundNote::new(track1, track2, track3, track4, track5, round, player))
-            .deliver(MessageDelivery::onchain_constrained());
+            .deliver(MessageDelivery::onchain_unconstrained());
 
         self.enqueue(PodRacing::at(self.context.this_address()).validate_and_play_round(
             player,
diff --git a/noir-projects/aztec-nr/aztec/src/messages/delivery/builder.nr b/noir-projects/aztec-nr/aztec/src/messages/delivery/builder.nr
index aacfbcd373e5..d67b3d96652f 100644
--- a/noir-projects/aztec-nr/aztec/src/messages/delivery/builder.nr
+++ b/noir-projects/aztec-nr/aztec/src/messages/delivery/builder.nr
@@ -19,8 +19,7 @@ use super::tag_secret_derivation::TagSecretDerivation;
 /// ## Construction
 ///
 /// The fields are private and there is no public constructor: a `MessageDelivery` can only be produced by a
-/// [`MessageDeliveryBuilder`] that enforces valid configurations, so invalid field combinations cannot be
-/// represented to the consumer.
+/// [`MessageDeliveryBuilder`].
 pub struct MessageDelivery {
     mode: DeliveryMode,
     tag_secret_derivation: TagSecretDerivation,
@@ -144,10 +143,6 @@ impl MessageDelivery {
 
     /// Delivers the message on-chain, guaranteeing the recipient will receive the correct content.
     ///
-    /// >**WARNING**: this delivery mode is [currently NOT fully
-    /// constrained](https://github.com/AztecProtocol/aztec-packages/issues/14565). The log's tag is unconstrained,
-    /// meaning a malicious sender could manipulate it to prevent the recipient from finding the message.
-    ///
     /// ## Use Cases
     ///
     /// This delivery method is suitable for all use cases, since it always works as expected. It is however the most
diff --git a/noir-projects/aztec-nr/aztec/src/messages/delivery/constrained_delivery.nr b/noir-projects/aztec-nr/aztec/src/messages/delivery/constrained_delivery.nr
new file mode 100644
index 000000000000..8d82056ae1cd
--- /dev/null
+++ b/noir-projects/aztec-nr/aztec/src/messages/delivery/constrained_delivery.nr
@@ -0,0 +1,219 @@
+//! Sender-side helpers for constrained message delivery.
+//!
+//! Constrained messages form per-`(sender, recipient, secret)` sequences, each send anchored to the handshake
+//! registry at an incrementing index. Two consequences shape the whole flow: sends on one sequence are strictly
+//! ordered across transactions (parallel sends collide or fail the predecessor check, while distinct recipients are
+//! distinct sequences and parallelize), and batching several sends onto one sequence within a transaction requires
+//! an already-committed handshake.
+//!
+//! See [`constrain_secret`] for how a send is anchored to the registry,
+
+use crate::context::PrivateContext;
+use crate::messages::delivery::OnchainDeliveryMode;
+use crate::nullifier::utils::compute_nullifier_existence_request;
+
+use crate::protocol::{
+    abis::function_selector::FunctionSelector, address::AztecAddress, constants::DOM_SEP__CONSTRAINED_MSG_NULLIFIER,
+    hash::poseidon2_hash_with_separator, traits::ToField,
+};
+
+// The helper cannot import the handshake registry interface because the registry contract depends on aztec-nr. The
+// registry's test suite compares this against its macro-generated `HandshakeRegistry::at(...).method(...).selector`
+// value so signature drift fails in tests.
+pub global VALIDATE_HANDSHAKE_SELECTOR: FunctionSelector =
+    comptime { FunctionSelector::from_signature("validate_handshake((Field),(Field),(u8),Field)") };
+
+pub(crate) fn constrain_secret_and_emit_nullifier(
+    context: &mut PrivateContext,
+    registry: AztecAddress,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    secret: Field,
+    bootstrapped: bool,
+    index: u32,
+) {
+    constrain_secret(
+        context,
+        registry,
+        sender,
+        recipient,
+        secret,
+        bootstrapped,
+        index,
+    );
+    context.push_nullifier_unsafe(compute_constrained_msg_nullifier(sender, recipient, secret, index));
+}
+
+/// Anchors an untrusted `(secret, index)` to the registry before its constrained tag is emitted.
+///
+/// - bootstrapped: the secret is the constrained `non_interactive_handshake` return (source of
+///   truth), so only its `index == 0` start is asserted.
+/// - reuse at index 0: `validate_handshake` binds the oracle-supplied secret to the stored handshake.
+/// - reuse at index > 0: the prior sequence nullifier must exist, anchoring back to the index-0 check.
+fn constrain_secret(
+    context: &mut PrivateContext,
+    registry: AztecAddress,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    secret: Field,
+    bootstrapped: bool,
+    index: u32,
+) {
+    let caller = context.this_address();
+    let mode = OnchainDeliveryMode::onchain_constrained();
+    let mode_field = mode.to_field();
+
+    if bootstrapped {
+        assert(index == 0, "freshly bootstrapped secret must start at index 0");
+    } else if index == 0 {
+        let _ = context.call_private_function(
+            registry,
+            VALIDATE_HANDSHAKE_SELECTOR,
+            [sender.to_field(), recipient.to_field(), mode_field, secret],
+        );
+    } else {
+        let prev_nullifier = compute_constrained_msg_nullifier(sender, recipient, secret, index - 1);
+        context.assert_nullifier_exists(compute_nullifier_existence_request(prev_nullifier, caller));
+    }
+}
+
+/// Computes a constrained send's sequence nullifier.
+///
+/// Every constrained send emits this nullifier so the next send under the same `(sender, recipient, secret)` sequence
+/// can prove its predecessor exists.
+pub(crate) fn compute_constrained_msg_nullifier(
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    secret: Field,
+    index: u32,
+) -> Field {
+    poseidon2_hash_with_separator(
+        [sender.to_field(), recipient.to_field(), secret, index as Field],
+        DOM_SEP__CONSTRAINED_MSG_NULLIFIER,
+    )
+}
+
+mod test {
+    use crate::context::PrivateContext;
+    use crate::hash::hash_args;
+    use crate::messages::delivery::OnchainDeliveryMode;
+    use crate::protocol::{address::AztecAddress, hash::compute_siloed_nullifier, traits::{FromField, ToField}};
+    use crate::test::helpers::test_environment::TestEnvironment;
+    use super::{compute_constrained_msg_nullifier, constrain_secret_and_emit_nullifier, VALIDATE_HANDSHAKE_SELECTOR};
+    use std::test::OracleMock;
+
+    fn assert_current_nullifier_emitted(
+        context: &mut PrivateContext,
+        sender: AztecAddress,
+        recipient: AztecAddress,
+        secret: Field,
+        index: u32,
+    ) {
+        assert_eq(context.nullifiers.len(), 1);
+        assert_eq(
+            context.nullifiers.get(0).inner.value,
+            compute_constrained_msg_nullifier(sender, recipient, secret, index),
+        );
+    }
+
+    #[test]
+    unconstrained fn constrained_helper_emits_current_nullifier() {
+        let env = TestEnvironment::new();
+        let registry = AztecAddress::from_field(1);
+        let sender = AztecAddress::from_field(2);
+        let recipient = AztecAddress::from_field(4);
+        let secret: Field = 1234;
+        let index: u32 = 0;
+
+        env.private_context(|context| {
+            constrain_secret_and_emit_nullifier(context, registry, sender, recipient, secret, true, index);
+
+            assert_current_nullifier_emitted(context, sender, recipient, secret, index);
+            assert_eq(context.private_call_requests.len(), 0);
+            assert_eq(context.nullifier_read_requests.len(), 0);
+        });
+    }
+
+    #[test(should_fail_with = "freshly bootstrapped secret must start at index 0")]
+    unconstrained fn bootstrapped_secret_must_start_at_index_zero() {
+        let env = TestEnvironment::new();
+        let registry = AztecAddress::from_field(1);
+        let sender = AztecAddress::from_field(2);
+        let recipient = AztecAddress::from_field(4);
+
+        env.private_context(|context| {
+            constrain_secret_and_emit_nullifier(context, registry, sender, recipient, 1234, true, 1);
+        });
+    }
+
+    #[test]
+    unconstrained fn reused_secret_at_index_zero_validates_registry_and_emits_nullifier() {
+        let env = TestEnvironment::new();
+        let registry = AztecAddress::from_field(1);
+        let sender = AztecAddress::from_field(2);
+        let recipient = AztecAddress::from_field(4);
+        let secret: Field = 1234;
+        let index: u32 = 0;
+
+        env.private_context(|context| {
+            // The real registry call is covered by integration tests; this unit test only needs a coherent child
+            // call result so `PrivateContext` records the request.
+            let child_call_end_counter = (context.side_effect_counter + 1) as Field;
+            let empty_returns_hash: Field = 0;
+            let _ = OracleMock::mock("aztec_prv_callPrivateFunction")
+                .returns([child_call_end_counter, empty_returns_hash])
+                .times(1);
+
+            constrain_secret_and_emit_nullifier(context, registry, sender, recipient, secret, false, index);
+
+            assert_current_nullifier_emitted(context, sender, recipient, secret, index);
+            assert_eq(context.nullifier_read_requests.len(), 0);
+            assert_eq(context.private_call_requests.len(), 1);
+
+            let request = context.private_call_requests.get(0);
+            assert_eq(request.call_context.msg_sender, context.this_address());
+            assert_eq(request.call_context.contract_address, registry);
+            assert_eq(request.call_context.function_selector, VALIDATE_HANDSHAKE_SELECTOR);
+            assert(!request.call_context.is_static_call);
+            assert_eq(
+                request.args_hash,
+                hash_args([
+                    sender.to_field(),
+                    recipient.to_field(),
+                    OnchainDeliveryMode::onchain_constrained().to_field(),
+                    secret,
+                ]),
+            );
+        });
+    }
+
+    #[test]
+    unconstrained fn reused_secret_above_index_zero_reads_previous_nullifier_and_emits_current_nullifier() {
+        let env = TestEnvironment::new();
+        let registry = AztecAddress::from_field(1);
+        let sender = AztecAddress::from_field(2);
+        let recipient = AztecAddress::from_field(4);
+        let secret: Field = 1234;
+        let index: u32 = 3;
+
+        env.private_context(|context| {
+            let _ = OracleMock::mock("aztec_prv_isNullifierPending").returns(false).times(1);
+
+            constrain_secret_and_emit_nullifier(context, registry, sender, recipient, secret, false, index);
+
+            assert_current_nullifier_emitted(context, sender, recipient, secret, index);
+            assert_eq(context.private_call_requests.len(), 0);
+            assert_eq(context.nullifier_read_requests.len(), 1);
+
+            let read_request = context.nullifier_read_requests.get(0);
+            assert_eq(read_request.contract_address, AztecAddress::zero());
+            assert_eq(
+                read_request.inner.inner,
+                compute_siloed_nullifier(
+                    context.this_address(),
+                    compute_constrained_msg_nullifier(sender, recipient, secret, index - 1),
+                ),
+            );
+        });
+    }
+}
diff --git a/noir-projects/aztec-nr/aztec/src/messages/delivery/handshake.nr b/noir-projects/aztec-nr/aztec/src/messages/delivery/handshake.nr
index ae549f0cda77..d6c26fcd208a 100644
--- a/noir-projects/aztec-nr/aztec/src/messages/delivery/handshake.nr
+++ b/noir-projects/aztec-nr/aztec/src/messages/delivery/handshake.nr
@@ -3,6 +3,7 @@ use crate::protocol::point::EmbeddedCurvePoint;
 use crate::protocol::traits::{Deserialize, Serialize};
 
 use crate::{
+    context::PrivateContext,
     ephemeral::EphemeralArray,
     messages::processing::provided_secret::ProvidedSecret,
     oracle::{call_utility_function::call_utility_function, shared_secret::get_shared_secrets},
@@ -36,6 +37,69 @@ global HANDSHAKE_EPH_PKS_SLOT: Field = sha256_to_field("AZTEC_NR::HANDSHAKE_EPH_
 
 global HANDSHAKE_MODES_SLOT: Field = sha256_to_field("AZTEC_NR::HANDSHAKE_MODES_SLOT".as_bytes());
 
+// The helper cannot import the handshake registry interface because the registry contract depends on aztec-nr. These
+// selector constants pin the registry ABI surface this library calls. The registry's test suite compares them against
+// its macro-generated `HandshakeRegistry::at(...).method(...).selector` values so signature drift fails in tests.
+pub global GET_APP_SILOED_SECRET_SELECTOR: FunctionSelector =
+    comptime { FunctionSelector::from_signature("get_app_siloed_secret((Field),(Field),(u8))") };
+pub global NON_INTERACTIVE_HANDSHAKE_SELECTOR: FunctionSelector =
+    comptime { FunctionSelector::from_signature("non_interactive_handshake((Field),(Field),(u8))") };
+pub global GET_HANDSHAKES_SELECTOR: FunctionSelector =
+    comptime { FunctionSelector::from_signature("get_handshakes((Field),u32)") };
+
+/// Resolves the app-siloed handshake secret, bootstrapping when none exists.
+///
+/// Resolves the secret for `(sender, recipient, mode)`, creating it via the registry's `non_interactive_handshake`
+/// when no handshake exists yet.
+///
+/// Returns `(secret, bootstrapped)`, where `bootstrapped` is true when this call created the handshake.
+///
+/// ## Batching
+///
+/// The reuse-vs-bootstrap decision is a utility call that reads committed state. If no handshake exists yet,
+/// multiple sends in the same transaction can't see each other's pending bootstrap, so each one creates its own
+/// handshake (a fresh secret on a separate sequence) rather than reusing one. A brand-new recipient therefore needs
+/// one landed transaction to establish the handshake before further sends can be batched onto it.
+pub(crate) fn get_or_create_app_siloed_handshake_secret(
+    context: &mut PrivateContext,
+    registry: AztecAddress,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    mode: OnchainDeliveryMode,
+) -> (Field, bool) {
+    let mode_field = mode.to_field();
+
+    // Safety: the response only selects which path runs. On `None` we bootstrap via `non_interactive_handshake`,
+    // whose constrained return value is the secret, so a forged empty response cannot fabricate one; it can only
+    // trigger an unnecessary re-handshake that replaces the registry note. The caller must constrain the returned
+    // `(secret, bootstrapped)` pair against the selected tagging index before emitting a handshake-derived tag.
+    let maybe_secret: Option<Field> = unsafe {
+        let returns = call_utility_function(
+            registry,
+            GET_APP_SILOED_SECRET_SELECTOR,
+            [sender.to_field(), recipient.to_field(), mode_field],
+        );
+        Deserialize::deserialize(returns)
+    };
+
+    maybe_secret.map(|secret| (secret, false)).unwrap_or_else(|| {
+        // Bootstrap: no handshake exists yet. The registry inserts a fresh note and returns the app-siloed
+        // secret to the caller. The constrained return is the source of truth for the secret, so no separate
+        // `validate_handshake` is needed by constrained delivery.
+        // TODO(F-660): dispatch to `perform_handshake(sender, recipient, handshake_type)` once interactive
+        // handshakes are supported.
+        let secret: Field = context
+            .call_private_function(
+                registry,
+                NON_INTERACTIVE_HANDSHAKE_SELECTOR,
+                [sender.to_field(), recipient.to_field(), mode_field],
+            )
+            .get_preimage();
+
+        (secret, true)
+    })
+}
+
 /// Fetches discovered handshakes from the HandshakeRegistry and derives app-siloed tagging secrets for each,
 /// returning them so that [`get_pending_tagged_logs`](crate::oracle::message_processing::get_pending_tagged_logs)
 /// searches for logs tagged with these secrets.
@@ -75,9 +139,12 @@ pub(crate) unconstrained fn get_handshake_secrets(
 
 /// Calls the HandshakeRegistry's `get_handshakes` utility function and deserializes the response.
 unconstrained fn fetch_handshake_page(recipient: AztecAddress, page_offset: u32) -> HandshakePage {
-    let selector = comptime { FunctionSelector::from_signature("get_handshakes((Field),u32)") };
     let args: [Field; 2] = [recipient.to_field(), page_offset as Field];
-    let response = call_utility_function(STANDARD_HANDSHAKE_REGISTRY_ADDRESS, selector, args);
+    let response = call_utility_function(
+        STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+        GET_HANDSHAKES_SELECTOR,
+        args,
+    );
     HandshakePage::deserialize(response)
 }
 
diff --git a/noir-projects/aztec-nr/aztec/src/messages/delivery/mod.nr b/noir-projects/aztec-nr/aztec/src/messages/delivery/mod.nr
index 57b47837846f..d009fb9d9402 100644
--- a/noir-projects/aztec-nr/aztec/src/messages/delivery/mod.nr
+++ b/noir-projects/aztec-nr/aztec/src/messages/delivery/mod.nr
@@ -1,20 +1,23 @@
 mod builder;
 mod mode;
+mod tag;
 mod tag_secret_derivation;
 
+pub mod constrained_delivery;
 pub mod handshake;
 
 use crate::{
     context::PrivateContext,
     messages::{
         encryption::{aes128::AES128, message_encryption::MessageEncryption},
-        logs::utils::compute_discovery_tag,
         offchain_messages::deliver_offchain_message,
     },
+    oracle::notes::get_sender_for_tags,
     utils::remove_constraints::remove_constraints_if,
 };
-use crate::protocol::{address::AztecAddress, constants::DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG, hash::compute_log_tag};
+use crate::protocol::address::AztecAddress;
 use mode::DeliveryMode;
+use tag::derive_log_tag;
 use tag_secret_derivation::TagSecretDerivation;
 
 pub use builder::{
@@ -32,7 +35,7 @@ pub use mode::OnchainDeliveryMode;
 /// note hash's side effect counter is passed and constrained tagging is not in use, then the log will be squashed
 /// alongside the note should its nullifier be emitted in the current transaction. Constrained-tagged logs are not tied
 /// to note squashing, because recipient discovery scans those tags sequentially and a removed log would break the
-/// per-secret index chain.
+/// per-secret index sequence.
 ///
 /// ## Privacy
 ///
@@ -58,29 +61,52 @@ where
     mode.assert_is_constant();
 
     let deliver_as_offchain_message = mode == DeliveryMode::offchain();
-    let is_constrained = mode == DeliveryMode::onchain_constrained();
+    assert_constant(deliver_as_offchain_message);
 
     let tag_secret_derivation = delivery.tag_secret_derivation();
     tag_secret_derivation.assert_is_constant();
 
-    if !deliver_as_offchain_message {
-        let resolved_tag_secret_derivation = resolve_tag_secret_derivation(mode, tag_secret_derivation);
-        resolved_tag_secret_derivation.assert_is_constant();
+    let resolved_tag_secret_derivation = resolve_tag_secret_derivation(mode, tag_secret_derivation);
+    resolved_tag_secret_derivation.assert_is_constant();
 
-        if is_constrained {
-            // Constrained tagging derives the tag from a handshake-registry secret and emits a chain nullifier.
-            std::static_assert(
-                resolved_tag_secret_derivation == TagSecretDerivation::non_interactive_handshake(),
-                "constrained delivery requires non-interactive handshake tag derivation",
-            );
-        } else {
-            // Unconstrained handshake-origin delivery is not yet implemented; see F-698.
-            std::static_assert(
-                resolved_tag_secret_derivation == TagSecretDerivation::address_secret(),
-                "unconstrained handshake delivery not yet implemented (F-698)",
-            );
-        }
+    let sender_override = delivery.sender_override();
+
+    if deliver_as_offchain_message {
+        let contract_address = context.this_address();
+        let ciphertext = remove_constraints_if(
+            true,
+            || AES128::encrypt(encode_into_message_plaintext(), recipient, contract_address),
+        );
+
+        deliver_offchain_message(ciphertext, recipient);
+    } else {
+        do_onchain_private_message_delivery(
+            context,
+            encode_into_message_plaintext,
+            maybe_note_hash_counter,
+            recipient,
+            mode,
+            resolved_tag_secret_derivation,
+            sender_override,
+        );
     }
+}
+
+fn do_onchain_private_message_delivery<Env, let MESSAGE_PLAINTEXT_LEN: u32>(
+    context: &mut PrivateContext,
+    encode_into_message_plaintext: fn[Env]() -> [Field; MESSAGE_PLAINTEXT_LEN],
+    maybe_note_hash_counter: Option<u32>,
+    recipient: AztecAddress,
+    mode: DeliveryMode,
+    resolved_tag_secret_derivation: TagSecretDerivation,
+    sender_override: Option<AztecAddress>,
+) {
+    let is_constrained = mode == DeliveryMode::onchain_constrained();
+    assert_constant(is_constrained);
+
+    assert_valid_tag_derivation_for_mode(mode, resolved_tag_secret_derivation);
+    let onchain_mode = to_onchain_delivery_mode(mode);
+    let sender = resolve_sender(sender_override);
 
     let contract_address = context.this_address();
 
@@ -89,33 +115,67 @@ where
         || AES128::encrypt(encode_into_message_plaintext(), recipient, contract_address),
     );
 
-    if deliver_as_offchain_message {
-        deliver_offchain_message(ciphertext, recipient);
+    let log_tag = derive_log_tag(
+        context,
+        onchain_mode,
+        resolved_tag_secret_derivation,
+        sender,
+        recipient,
+    );
+
+    // This value must be constant to avoid predicating the context calls below, which might result in
+    // the context's arrays having unknown compile time write indices and hence dramatically increasing constraints
+    // when accessing them. In practice this restriction is not a problem as we always know at compile time whether
+    // we're emitting a note or non-note message.
+    assert_constant(maybe_note_hash_counter.is_some());
+
+    // Constrained-tagged logs must not be squashed alongside the note: the recipient discovers them by scanning
+    // the per-secret tag sequence, so removing a log would break the index sequence.
+    let squashable_note_log = maybe_note_hash_counter.is_some() & !is_constrained;
+
+    let log = BoundedVec::from_array(ciphertext);
+    if squashable_note_log {
+        // We associate the log with the note's side effect counter, so that if the note ends up being squashed in
+        // the current transaction, the log will be removed as well.
+        context.emit_raw_note_log_unsafe(log_tag, log, maybe_note_hash_counter.unwrap());
     } else {
-        // TODO(#14565): constrained tagging is not yet wired up. The tag-secret derivation is validated, but the tag is
-        // mocked with the wallet-driven unconstrained derivation so the builder API can land before the constrained
-        // helpers.
-        let discovery_tag = compute_discovery_tag(recipient, delivery.sender_override());
-        let log_tag = compute_log_tag(discovery_tag, DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG);
-
-        // We forbid this value not being constant to avoid predicating the context calls below, which might result in
-        // the context's arrays having unknown compile time write indices and hence dramatically increasing constraints
-        // when accessing them. In practice this restriction is not a problem as we always know at compile time whether
-        // we're emitting a note or non-note message.
-        assert_constant(maybe_note_hash_counter.is_some());
-
-        // Constrained-tagged logs must not be squashed alongside the note: the recipient discovers them by scanning
-        // the per-secret tag sequence, so removing a log would break the index chain.
-        let squashable_note_log = maybe_note_hash_counter.is_some() & !is_constrained;
-
-        let log = BoundedVec::from_array(ciphertext);
-        if squashable_note_log {
-            // We associate the log with the note's side effect counter, so that if the note ends up being squashed in
-            // the current transaction, the log will be removed as well.
-            context.emit_raw_note_log_unsafe(log_tag, log, maybe_note_hash_counter.unwrap());
-        } else {
-            context.emit_private_log_unsafe(log_tag, log);
-        }
+        context.emit_private_log_unsafe(log_tag, log);
+    }
+}
+
+fn assert_valid_tag_derivation_for_mode(mode: DeliveryMode, tag_secret_derivation: TagSecretDerivation) {
+    if mode == DeliveryMode::onchain_constrained() {
+        std::static_assert(
+            tag_secret_derivation == TagSecretDerivation::non_interactive_handshake(),
+            "constrained delivery requires non-interactive handshake tag derivation",
+        );
+    } else {
+        // Unconstrained handshake-origin delivery is not yet implemented; see F-698.
+        std::static_assert(
+            tag_secret_derivation == TagSecretDerivation::address_secret(),
+            "unconstrained handshake delivery not yet implemented (F-698)",
+        );
+    }
+}
+
+fn resolve_sender(sender_override: Option<AztecAddress>) -> AztecAddress {
+    // Safety: tag senders are unconstrained; the sender comes from the builder override or the wallet-provided
+    // default tag sender, which must be an account the PXE controls so it can own and recover the resulting
+    // tagging/handshake state.
+    unsafe {
+        sender_override.unwrap_or_else(|| {
+            get_sender_for_tags().expect(
+                f"Sender for tags is not set when emitting a private log and no override is set. Ensure the wallet provides a default sender.",
+            )
+        })
+    }
+}
+
+fn to_onchain_delivery_mode(mode: DeliveryMode) -> OnchainDeliveryMode {
+    if mode == DeliveryMode::onchain_constrained() {
+        OnchainDeliveryMode::onchain_constrained()
+    } else {
+        OnchainDeliveryMode::onchain_unconstrained()
     }
 }
 
@@ -124,6 +184,9 @@ fn resolve_tag_secret_derivation(
     tag_secret_derivation: TagSecretDerivation,
 ) -> TagSecretDerivation {
     if tag_secret_derivation == TagSecretDerivation::wallet_default() {
+        // TODO(F-699): Resolve wallet-default by first reusing an existing handshake for `(sender, recipient, mode)`
+        // without consulting wallet policy. If none exists, consult the wallet delivery privacy preference before
+        // choosing address-secret delivery or creating a non-interactive handshake.
         if mode == DeliveryMode::onchain_constrained() {
             TagSecretDerivation::non_interactive_handshake()
         } else {
@@ -135,7 +198,10 @@ fn resolve_tag_secret_derivation(
 }
 
 mod test {
-    use super::{DeliveryMode, resolve_tag_secret_derivation, TagSecretDerivation};
+    use crate::protocol::{address::AztecAddress, traits::FromField};
+    use crate::test::helpers::test_environment::TestEnvironment;
+    use super::{DeliveryMode, resolve_sender, resolve_tag_secret_derivation, TagSecretDerivation};
+    use std::test::OracleMock;
 
     #[test]
     fn wallet_default_resolves_for_delivery_mode() {
@@ -172,4 +238,29 @@ mod test {
                 == TagSecretDerivation::non_interactive_handshake(),
         );
     }
+
+    #[test(should_fail_with = "Sender for tags is not set")]
+    unconstrained fn sender_resolution_requires_wallet_default_sender() {
+        let env = TestEnvironment::new();
+        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::<AztecAddress>::none());
+
+        env.private_context(|_context| { let _ = resolve_sender(Option::none()); });
+    }
+
+    #[test]
+    unconstrained fn sender_resolution_uses_override() {
+        let env = TestEnvironment::new();
+        let sender = AztecAddress::from_field(1);
+
+        env.private_context(|_context| { assert_eq(resolve_sender(Option::some(sender)), sender); });
+    }
+
+    #[test]
+    unconstrained fn sender_resolution_uses_wallet_default_sender() {
+        let env = TestEnvironment::new();
+        let sender = AztecAddress::from_field(1);
+        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::some(sender));
+
+        env.private_context(|_context| { assert_eq(resolve_sender(Option::none()), sender); });
+    }
 }
diff --git a/noir-projects/aztec-nr/aztec/src/messages/delivery/tag.nr b/noir-projects/aztec-nr/aztec/src/messages/delivery/tag.nr
new file mode 100644
index 000000000000..69e32c293d5b
--- /dev/null
+++ b/noir-projects/aztec-nr/aztec/src/messages/delivery/tag.nr
@@ -0,0 +1,173 @@
+//! Discovery tag derivation for on-chain message delivery.
+//!
+//! Constrained derivation also emits the sequence nullifier; see [`super::constrained_delivery`].
+
+use crate::context::PrivateContext;
+use crate::messages::delivery::{
+    constrained_delivery::constrain_secret_and_emit_nullifier, handshake::get_or_create_app_siloed_handshake_secret,
+    OnchainDeliveryMode,
+};
+use crate::oracle::notes::{get_app_tagging_secret, get_next_tagging_index};
+use crate::oracle::random::random;
+use crate::protocol::{
+    address::AztecAddress,
+    constants::{DOM_SEP__CONSTRAINED_MSG_LOG_TAG, DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG},
+    hash::{compute_log_tag, poseidon2_hash},
+};
+use crate::standard_addresses::STANDARD_HANDSHAKE_REGISTRY_ADDRESS;
+use super::tag_secret_derivation::TagSecretDerivation;
+
+/// Derives the discovery log tag for an on-chain delivery; the handshake path also emits the sequence
+/// nullifier (see [`derive_handshake_log_tag`]).
+pub(crate) fn derive_log_tag(
+    context: &mut PrivateContext,
+    mode: OnchainDeliveryMode,
+    resolved_tag_secret_derivation: TagSecretDerivation,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+) -> Field {
+    if resolved_tag_secret_derivation == TagSecretDerivation::address_secret() {
+        derive_address_secret_log_tag(sender, recipient, mode)
+    } else {
+        derive_handshake_log_tag(context, sender, recipient, mode)
+    }
+}
+
+fn derive_address_secret_log_tag(sender: AztecAddress, recipient: AztecAddress, mode: OnchainDeliveryMode) -> Field {
+    // Safety: address-derived delivery is unconstrained. The oracle returns `None` for an invalid recipient (one
+    // whose address is not on the curve). To prevent king-of-the-hill attacks we emit a random tag instead of
+    // failing: the log keeps its expected shape, even though no recipient will ever be able to discover the note.
+    unsafe {
+        get_app_tagging_secret(sender, recipient).map_or_else(
+            || compute_log_tag(random(), tag_domain_separator(mode)),
+            |secret| {
+                let index = get_next_tagging_index(secret, mode);
+                tag_from_secret_and_index(secret, index, mode)
+            },
+        )
+    }
+}
+
+fn derive_handshake_log_tag(
+    context: &mut PrivateContext,
+    sender: AztecAddress,
+    recipient: AztecAddress,
+    mode: OnchainDeliveryMode,
+) -> Field {
+    let (secret, bootstrapped) = get_or_create_app_siloed_handshake_secret(
+        context,
+        STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+        sender,
+        recipient,
+        mode,
+    );
+
+    // Safety: the returned index is untrusted and is constrained before the tag is emitted.
+    let index = unsafe { get_next_tagging_index(secret, mode) };
+    constrain_secret_and_emit_nullifier(
+        context,
+        STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+        sender,
+        recipient,
+        secret,
+        bootstrapped,
+        index,
+    );
+
+    tag_from_secret_and_index(secret, index, mode)
+}
+
+fn tag_domain_separator(mode: OnchainDeliveryMode) -> u32 {
+    if mode == OnchainDeliveryMode::onchain_constrained() {
+        DOM_SEP__CONSTRAINED_MSG_LOG_TAG
+    } else {
+        DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG
+    }
+}
+
+fn tag_from_secret_and_index(secret: Field, index: u32, mode: OnchainDeliveryMode) -> Field {
+    compute_log_tag(
+        poseidon2_hash([secret, index as Field]),
+        tag_domain_separator(mode),
+    )
+}
+
+mod test {
+    use crate::protocol::{
+        address::AztecAddress,
+        constants::{DOM_SEP__CONSTRAINED_MSG_LOG_TAG, DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG},
+        hash::{compute_log_tag, poseidon2_hash},
+        traits::FromField,
+    };
+    use crate::test::helpers::test_environment::TestEnvironment;
+    use super::{derive_log_tag, OnchainDeliveryMode, tag_from_secret_and_index, TagSecretDerivation};
+    use std::test::OracleMock;
+
+    #[test]
+    fn tag_from_secret_and_index_uses_mode_domain_separator() {
+        let secret: Field = 1234;
+        let index: u32 = 7;
+        let raw_tag = poseidon2_hash([secret, index as Field]);
+
+        assert_eq(
+            tag_from_secret_and_index(secret, index, OnchainDeliveryMode::onchain_unconstrained()),
+            compute_log_tag(raw_tag, DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG),
+        );
+        assert_eq(
+            tag_from_secret_and_index(secret, index, OnchainDeliveryMode::onchain_constrained()),
+            compute_log_tag(raw_tag, DOM_SEP__CONSTRAINED_MSG_LOG_TAG),
+        );
+    }
+
+    #[test]
+    unconstrained fn address_secret_tag_uses_secret_index_and_mode_domain() {
+        let env = TestEnvironment::new();
+        let sender = AztecAddress::from_field(1);
+        let recipient = AztecAddress::from_field(2);
+        let secret: Field = 7;
+        let index: u32 = 3;
+        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::some(sender));
+        let _ = OracleMock::mock("aztec_prv_getAppTaggingSecret").returns(Option::some(secret));
+        let _ = OracleMock::mock("aztec_prv_getNextTaggingIndex").returns(index);
+
+        env.private_context(|context| {
+            assert_eq(
+                derive_log_tag(
+                    context,
+                    OnchainDeliveryMode::onchain_unconstrained(),
+                    TagSecretDerivation::address_secret(),
+                    sender,
+                    recipient,
+                ),
+                compute_log_tag(
+                    poseidon2_hash([secret, index as Field]),
+                    DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG,
+                ),
+            );
+        });
+    }
+
+    #[test]
+    unconstrained fn address_secret_tag_uses_random_tag_for_invalid_recipient() {
+        let env = TestEnvironment::new();
+        let sender = AztecAddress::from_field(1);
+        let recipient = AztecAddress::from_field(2);
+        let random_tag = 42;
+        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::some(sender));
+        let _ = OracleMock::mock("aztec_prv_getAppTaggingSecret").returns(Option::<Field>::none());
+        let _ = OracleMock::mock("aztec_misc_getRandomField").returns(random_tag);
+
+        env.private_context(|context| {
+            assert_eq(
+                derive_log_tag(
+                    context,
+                    OnchainDeliveryMode::onchain_unconstrained(),
+                    TagSecretDerivation::address_secret(),
+                    sender,
+                    recipient,
+                ),
+                compute_log_tag(random_tag, DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG),
+            );
+        });
+    }
+}
diff --git a/noir-projects/aztec-nr/aztec/src/messages/logs/mod.nr b/noir-projects/aztec-nr/aztec/src/messages/logs/mod.nr
index bbfd03bd051d..9b0b0f1c683b 100644
--- a/noir-projects/aztec-nr/aztec/src/messages/logs/mod.nr
+++ b/noir-projects/aztec-nr/aztec/src/messages/logs/mod.nr
@@ -2,4 +2,3 @@ pub mod arithmetic_generics_utils;
 pub mod event;
 pub mod note;
 pub mod partial_note;
-pub mod utils;
diff --git a/noir-projects/aztec-nr/aztec/src/messages/logs/utils.nr b/noir-projects/aztec-nr/aztec/src/messages/logs/utils.nr
deleted file mode 100644
index d5a74d37a219..000000000000
--- a/noir-projects/aztec-nr/aztec/src/messages/logs/utils.nr
+++ /dev/null
@@ -1,86 +0,0 @@
-use crate::messages::delivery::MessageDelivery;
-use crate::oracle::{notes::{get_app_tagging_secret, get_next_tagging_index, get_sender_for_tags}, random::random};
-use crate::protocol::{address::AztecAddress, hash::poseidon2_hash};
-
-// TODO(#14565): Add constrained tagging
-/// Returns the next discovery tag for a private log sent to `recipient`.
-///
-/// Private logs are encrypted, so the recipient cannot tell which logs are meant for it just by looking at them.
-/// To solve this, sender and recipient derive a shared secret from their keys, and from that secret they produce a
-/// sequence of one-time tags (tag_0, tag_1, ...). The recipient scans for these tags because it can compute the same
-/// sequence. This function returns the next raw (not domain-separated) tag in the sequence.
-pub(crate) fn compute_discovery_tag(recipient: AztecAddress, sender_override: Option<AztecAddress>) -> Field {
-    // Safety: we assume that the sender wants for the recipient to find the tagged note, and therefore that they will
-    // cooperate and use the correct tag. Usage of a bad tag will result in the recipient not being able to find the
-    // note automatically.
-    unsafe {
-        let sender = sender_override.unwrap_or_else(|| {
-            get_sender_for_tags().expect(
-                f"Sender for tags is not set when emitting a private log and no override is set. Ensure the wallet provides a default sender.",
-            )
-        });
-        get_app_tagging_secret(sender, recipient).map_or_else(
-            || {
-                // The oracle returns `None` for invalid recipients. To prevent king-of-the-hill attacks, emit a random
-                // tag instead of failing: the log shape is preserved, even though no recipient can discover the note.
-                random()
-            },
-            |secret| {
-                let index = get_next_tagging_index(secret, MessageDelivery::onchain_unconstrained());
-                poseidon2_hash([secret, index as Field])
-            },
-        )
-    }
-}
-
-mod test {
-    use crate::protocol::{address::AztecAddress, hash::poseidon2_hash, traits::FromField};
-    use crate::test::helpers::test_environment::TestEnvironment;
-    use super::compute_discovery_tag;
-    use std::test::OracleMock;
-
-    #[test(should_fail_with = "Sender for tags is not set")]
-    unconstrained fn no_tag_sender() {
-        let recipient = AztecAddress::from_field(2);
-        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::<AztecAddress>::none());
-        let _ = compute_discovery_tag(recipient, Option::none());
-    }
-
-    #[test]
-    unconstrained fn computes_tag_from_secret_and_index() {
-        let sender = AztecAddress::from_field(1);
-        let recipient = AztecAddress::from_field(2);
-        let secret: Field = 7;
-        let index: u32 = 3;
-        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::some(sender));
-        let _ = OracleMock::mock("aztec_prv_getAppTaggingSecret").returns(Option::some(secret));
-        let _ = OracleMock::mock("aztec_prv_getNextTaggingIndex").returns(index);
-        assert_eq(compute_discovery_tag(recipient, Option::none()), poseidon2_hash([secret, index as Field]));
-    }
-
-    #[test]
-    unconstrained fn uses_random_tag_for_invalid_recipient() {
-        let sender = AztecAddress::from_field(1);
-        let recipient = AztecAddress::from_field(2);
-        let random_tag = 42;
-        let _ = OracleMock::mock("aztec_prv_getSenderForTags").returns(Option::some(sender));
-        let _ = OracleMock::mock("aztec_prv_getAppTaggingSecret").returns(Option::<Field>::none());
-        let _ = OracleMock::mock("aztec_misc_getRandomField").returns(random_tag);
-        assert_eq(compute_discovery_tag(recipient, Option::none()), random_tag);
-    }
-
-    #[test]
-    unconstrained fn does_not_fail_on_an_invalid_recipient() {
-        let mut env = TestEnvironment::new();
-
-        let sender = env.create_light_account();
-
-        env.private_context(|_context| {
-            // The recipient is an invalid address
-            let recipient = AztecAddress { inner: 3 };
-            assert(!recipient.is_valid());
-
-            let _ = compute_discovery_tag(recipient, Option::some(sender));
-        });
-    }
-}
diff --git a/noir-projects/contract-snapshots/tests/snapshots/compile_failure/invalid_event/snapshots__stderr.snap b/noir-projects/contract-snapshots/tests/snapshots/compile_failure/invalid_event/snapshots__stderr.snap
index 4a9d0dca64d0..73a27353c96e 100644
--- a/noir-projects/contract-snapshots/tests/snapshots/compile_failure/invalid_event/snapshots__stderr.snap
+++ b/noir-projects/contract-snapshots/tests/snapshots/compile_failure/invalid_event/snapshots__stderr.snap
@@ -14,7 +14,7 @@ error: event's serialized length exceeds the maximum allowed for private events
    = Call stack:
      1: remove_constraints
              at <repo>/noir-projects/aztec-nr/aztec/src/utils/remove_constraints.nr:<line>:<col>
-     2: do_private_message_delivery
+     2: do_onchain_private_message_delivery
              at <repo>/noir-projects/aztec-nr/aztec/src/messages/delivery/mod.nr:<line>:<col>
      3: EventMessage<Event>::deliver_to
              at <repo>/noir-projects/aztec-nr/aztec/src/event/event_message.nr:<line>:<col>
diff --git a/noir-projects/contract-snapshots/tests/snapshots/expand/avm_gadgets_test_contract/snapshots__expanded.snap b/noir-projects/contract-snapshots/tests/snapshots/expand/avm_gadgets_test_contract/snapshots__expanded.snap
index 32db6054f5b6..c219e2555419 100644
--- a/noir-projects/contract-snapshots/tests/snapshots/expand/avm_gadgets_test_contract/snapshots__expanded.snap
+++ b/noir-projects/contract-snapshots/tests/snapshots/expand/avm_gadgets_test_contract/snapshots__expanded.snap
@@ -2,6 +2,7 @@
 source: tests/snapshots.rs
 expression: stdout
 ---
+
 use aztec::macros::aztec;
 use aztec::macros::aztec;
 
diff --git a/noir-projects/contract-snapshots/tests/snapshots/expand/avm_test_contract/snapshots__expanded.snap b/noir-projects/contract-snapshots/tests/snapshots/expand/avm_test_contract/snapshots__expanded.snap
index b04644838350..88315e0d0378 100644
--- a/noir-projects/contract-snapshots/tests/snapshots/expand/avm_test_contract/snapshots__expanded.snap
+++ b/noir-projects/contract-snapshots/tests/snapshots/expand/avm_test_contract/snapshots__expanded.snap
@@ -2,6 +2,7 @@
 source: tests/snapshots.rs
 expression: stdout
 ---
+
 use aztec::macros::aztec;
 use aztec::macros::aztec;
 
diff --git a/noir-projects/contract-snapshots/tests/snapshots/expand/public_fns_with_emit_repro_contract/snapshots__expanded.snap b/noir-projects/contract-snapshots/tests/snapshots/expand/public_fns_with_emit_repro_contract/snapshots__expanded.snap
index 88d4e8960623..3df63f3bf259 100644
--- a/noir-projects/contract-snapshots/tests/snapshots/expand/public_fns_with_emit_repro_contract/snapshots__expanded.snap
+++ b/noir-projects/contract-snapshots/tests/snapshots/expand/public_fns_with_emit_repro_contract/snapshots__expanded.snap
@@ -2,6 +2,7 @@
 source: tests/snapshots.rs
 expression: stdout
 ---
+
 use aztec::macros::aztec;
 use aztec::macros::aztec;
 
diff --git a/noir-projects/contract-snapshots/tests/snapshots/expand/storage_proof_test_contract/snapshots__expanded.snap b/noir-projects/contract-snapshots/tests/snapshots/expand/storage_proof_test_contract/snapshots__expanded.snap
index d2b1886ef0a6..5a84c91f96e3 100644
--- a/noir-projects/contract-snapshots/tests/snapshots/expand/storage_proof_test_contract/snapshots__expanded.snap
+++ b/noir-projects/contract-snapshots/tests/snapshots/expand/storage_proof_test_contract/snapshots__expanded.snap
@@ -2,6 +2,7 @@
 source: tests/snapshots.rs
 expression: stdout
 ---
+
 use aztec::macros::aztec;
 use aztec::macros::aztec;
 
diff --git a/noir-projects/noir-contracts/Nargo.toml b/noir-projects/noir-contracts/Nargo.toml
index c4309c321917..951b84cfa13e 100644
--- a/noir-projects/noir-contracts/Nargo.toml
+++ b/noir-projects/noir-contracts/Nargo.toml
@@ -46,6 +46,7 @@ members = [
     "contracts/test/benchmarking_contract",
     "contracts/test/calldata_limit_test_contract",
     "contracts/test/child_contract",
+    "contracts/test/constrained_delivery_test_contract",
     "contracts/test/counter/counter_contract",
     "contracts/test/custom_message_contract",
     "contracts/test/custom_sync_state_contract",
diff --git a/noir-projects/noir-contracts/contracts/account/simulated_ecdsa_account_contract/src/main.nr b/noir-projects/noir-contracts/contracts/account/simulated_ecdsa_account_contract/src/main.nr
index 0544820909ac..6a354765ba73 100644
--- a/noir-projects/noir-contracts/contracts/account/simulated_ecdsa_account_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/account/simulated_ecdsa_account_contract/src/main.nr
@@ -27,9 +27,9 @@ pub contract SimulatedEcdsaAccount {
     // Does NOT use #[initializer] so that the macro does not inject
     // assert_initialization_matches_address_preimage_private, which would fail during kernelless
     // simulation because the stub instance has a different initialization hash than the real account.
-    // Emits the same shape of side effects as the real constructor (one nullifier for
-    // SinglePrivateImmutable initialization, one note hash for the key note, and one private
-    // log tied to that note hash) so that gas estimation produces accurate results.
+    // Emits side effects matching the *shape* of the real EcdsaKAccount / EcdsaRAccount constructor (the
+    // key-note storage plus the constrained-delivery handshake bootstrap it triggers) so that kernelless gas
+    // estimation produces accurate results. See the body for the per-effect breakdown and the coupling this creates.
     #[external("private")]
     fn constructor(_signing_pub_key_x: [u8; 32], _signing_pub_key_y: [u8; 32]) {
         // Safety: Random seeds are only used to produce dummy side effects that match the shape of
@@ -56,6 +56,30 @@ pub contract SimulatedEcdsaAccount {
             BoundedVec::from_array(dummy_log),
             self.context.side_effect_counter,
         );
+
+        // The real constructor delivers the key note with `MessageDelivery::onchain_constrained()`, and a
+        // first send bootstraps a handshake: a nested call to `HandshakeRegistry::non_interactive_handshake`
+        // inserts a handshake note (note hash + initialization nullifier) and emits two logs (the note-delivery
+        // log and the recipient discovery log), and the constrained send emits a chain nullifier. We reproduce
+        // only the *shape* of those side effects so gas estimation stays accurate without running the real
+        // handshake.
+        //
+        // This couples the stub to constrained delivery's emitted shape: if the handshake bootstrap or
+        // chain-nullifier emission changes, update these dummies to match or the gas-parity assertion in
+        // e2e_kernelless_simulation.test.ts will fail.
+
+        // Handshake note hash and its initialization nullifier.
+        self.context.push_note_hash(seed + 4);
+        self.context.push_nullifier_unsafe(seed + 5);
+
+        // Chain nullifier emitted by the constrained send.
+        self.context.push_nullifier_unsafe(seed + 6);
+
+        // Handshake note-delivery log and recipient discovery log.
+        let dummy_handshake_note_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 7; MESSAGE_CIPHERTEXT_LEN];
+        self.context.emit_private_log_unsafe(seed + 8, BoundedVec::from_array(dummy_handshake_note_log));
+        let dummy_handshake_discovery_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 9; MESSAGE_CIPHERTEXT_LEN];
+        self.context.emit_private_log_unsafe(seed + 10, BoundedVec::from_array(dummy_handshake_discovery_log));
     }
 
     // @dev: If you globally change the entrypoint signature don't forget to update account_entrypoint.ts
diff --git a/noir-projects/noir-contracts/contracts/account/simulated_schnorr_account_contract/src/main.nr b/noir-projects/noir-contracts/contracts/account/simulated_schnorr_account_contract/src/main.nr
index 9d3959ed947f..daa4403506c9 100644
--- a/noir-projects/noir-contracts/contracts/account/simulated_schnorr_account_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/account/simulated_schnorr_account_contract/src/main.nr
@@ -29,9 +29,9 @@ pub contract SimulatedSchnorrAccount {
     // Does NOT use #[initializer] so that the macro does not inject
     // assert_initialization_matches_address_preimage_private, which would fail during kernelless
     // simulation because the stub instance has a different initialization hash than the real account.
-    // Emits the same shape of side effects as the real constructor (one nullifier for
-    // SinglePrivateImmutable initialization, one note hash for the key note, and one private
-    // log tied to that note hash) so that gas estimation produces accurate results.
+    // Emits side effects matching the *shape* of the real SchnorrAccount constructor (the key-note storage
+    // plus the constrained-delivery handshake bootstrap it triggers) so that kernelless gas estimation
+    // produces accurate results. See the body for the per-effect breakdown and the coupling this creates.
     #[external("private")]
     fn constructor(_signing_pub_key_x: Field, _signing_pub_key_y: Field) {
         // Safety: Random seeds are only used to produce dummy side effects that match the shape of
@@ -58,6 +58,30 @@ pub contract SimulatedSchnorrAccount {
             BoundedVec::from_array(dummy_log),
             self.context.side_effect_counter,
         );
+
+        // The real constructor delivers the key note with `MessageDelivery::onchain_constrained()`, and a
+        // first send bootstraps a handshake: a nested call to `HandshakeRegistry::non_interactive_handshake`
+        // inserts a handshake note (note hash + initialization nullifier) and emits two logs (the note-delivery
+        // log and the recipient discovery log), and the constrained send emits a chain nullifier. We reproduce
+        // only the shape of those side effects so gas estimation stays accurate without running the real
+        // handshake.
+        //
+        // This couples the stub to constrained delivery's emitted shape: if the handshake bootstrap or
+        // chain-nullifier emission changes, update these dummies to match or the gas-parity assertion in
+        // e2e_kernelless_simulation.test.ts will fail.
+
+        // Handshake note hash and its initialization nullifier.
+        self.context.push_note_hash(seed + 4);
+        self.context.push_nullifier_unsafe(seed + 5);
+
+        // Chain nullifier emitted by the constrained send.
+        self.context.push_nullifier_unsafe(seed + 6);
+
+        // Handshake note-delivery log and recipient discovery log.
+        let dummy_handshake_note_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 7; MESSAGE_CIPHERTEXT_LEN];
+        self.context.emit_private_log_unsafe(seed + 8, BoundedVec::from_array(dummy_handshake_note_log));
+        let dummy_handshake_discovery_log: [Field; MESSAGE_CIPHERTEXT_LEN] = [seed + 9; MESSAGE_CIPHERTEXT_LEN];
+        self.context.emit_private_log_unsafe(seed + 10, BoundedVec::from_array(dummy_handshake_discovery_log));
     }
 
     // @dev: If you globally change the entrypoint signature don't forget to update account_entrypoint.ts
diff --git a/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr b/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr
index 7157b985dded..08d000906eb9 100644
--- a/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr
@@ -17,6 +17,9 @@ global NON_INTERACTIVE_HANDSHAKE: u8 = 1;
 /// [`HandshakeRegistry::get_app_siloed_secret`] offchain for an existing handshake, and use
 /// [`HandshakeRegistry::validate_handshake`] to check an app-siloed secret against the current stored handshake. The
 /// private surfaces silo against `msg_sender()`, so a contract can only obtain or validate secrets siloed to itself.
+/// Re-handshaking does not revoke already-started constrained-delivery sequences; it only replaces the registry note
+/// used
+/// for [validation][`HandshakeRegistry::validate_handshake`].
 ///
 /// Currently only implements the non-interactive flow (see [`HandshakeRegistry::non_interactive_handshake`]).
 #[aztec(::aztec::macros::AztecConfig::new().custom_sync_state(crate::handshake_registry_sync))]
@@ -39,7 +42,7 @@ pub contract HandshakeRegistry {
     #[storage]
     struct Storage<Context> {
         /// One current [`HandshakeNote`] per `(recipient, sender, mode)` tuple. Re-handshaking for the same tuple
-        /// replaces the prior sender-owned note, so only the latest handshake remains valid for that mode.
+        /// replaces the registry note; [`HandshakeRegistry::validate_handshake`] accepts only the latest note.
         handshakes: Map<AztecAddress, Map<OnchainDeliveryMode, Owned<PrivateMutable<HandshakeNote, Context>, Context>, Context>, Context>,
     }
 
@@ -53,7 +56,7 @@ pub contract HandshakeRegistry {
     /// Generates a fresh ephemeral key pair `(eph_sk, eph_pk)`, computes the raw ECDH shared secret point
     /// `S = eph_sk * recipient_address_point`, and produces three effects:
     ///
-    /// 1. Inserts or replaces a [`HandshakeNote`] owned by `sender` for `mode`, holding the raw point `S`.
+    /// 1. Inserts or replaces the current [`HandshakeNote`] owned by `sender` for `mode`, holding the raw point `S`.
     /// 2. Emits an encrypted private log under a recipient-keyed tag with payload `[eph_pk.x, mode]`. The
     ///    recipient discovers handshakes addressed to them by scanning their tag and recovers `S` from `eph_pk`
     ///    via their own ECDH (`recipient_isk * eph_pk`). `eph_pk.y` is fixed positive by the
@@ -103,7 +106,7 @@ pub contract HandshakeRegistry {
     /// the caller (`msg_sender()`).
     ///
     /// Apps that receive an `app_siloed_secret` from an untrusted source call this once to validate that secret
-    /// against the registry's stored handshake.
+    /// against the registry's latest stored handshake.
     ///
     /// # Panics
     /// If `mode` is not a recognized delivery mode.
diff --git a/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr b/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr
index b87b85b422b5..092dc0c2bd5f 100644
--- a/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr
+++ b/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr
@@ -1,7 +1,15 @@
 use crate::HandshakeRegistry;
 
 use aztec::{
-    messages::delivery::{handshake::MAX_HANDSHAKES_PER_PAGE, MessageDelivery, OnchainDeliveryMode},
+    messages::delivery::{
+        constrained_delivery::VALIDATE_HANDSHAKE_SELECTOR,
+        handshake::{
+            GET_APP_SILOED_SECRET_SELECTOR, GET_HANDSHAKES_SELECTOR, MAX_HANDSHAKES_PER_PAGE,
+            NON_INTERACTIVE_HANDSHAKE_SELECTOR,
+        },
+        MessageDelivery,
+        OnchainDeliveryMode,
+    },
     oracle::shared_secret::get_shared_secret,
     protocol::{
         address::AztecAddress,
@@ -41,6 +49,30 @@ unconstrained fn setup_with_two_recipients() -> (TestEnvironment, AztecAddress,
     (env, registry_address, sender, recipient_a, recipient_b)
 }
 
+// The constrained-delivery helpers in aztec-nr cannot import this contract because the contract depends on aztec-nr.
+// Assert their selector constants match this contract's macro-generated interface so a signature change on either side
+// fails here instead of silently drifting.
+#[test]
+unconstrained fn selectors_match_the_constrained_delivery_helper() {
+    let registry = HandshakeRegistry::at(AztecAddress::from_field(1));
+    let sender = AztecAddress::from_field(2);
+    let recipient = AztecAddress::from_field(3);
+
+    assert_eq(
+        registry.get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED).selector,
+        GET_APP_SILOED_SECRET_SELECTOR,
+    );
+    assert_eq(
+        registry.non_interactive_handshake(sender, recipient, ONCHAIN_CONSTRAINED).selector,
+        NON_INTERACTIVE_HANDSHAKE_SELECTOR,
+    );
+    assert_eq(
+        registry.validate_handshake(sender, recipient, ONCHAIN_CONSTRAINED, 0).selector,
+        VALIDATE_HANDSHAKE_SELECTOR,
+    );
+    assert_eq(registry.get_handshakes(recipient, 0).selector, GET_HANDSHAKES_SELECTOR);
+}
+
 #[test]
 unconstrained fn non_interactive_handshake_stores_handshake_for_sender_and_recipient() {
     let (env, registry_address, sender, _, recipient) = setup();
diff --git a/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/Nargo.toml b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/Nargo.toml
new file mode 100644
index 000000000000..6c29997b4b4b
--- /dev/null
+++ b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/Nargo.toml
@@ -0,0 +1,11 @@
+[package]
+name = "constrained_delivery_test_contract"
+authors = [""]
+compiler_version = ">=0.25.0"
+type = "contract"
+
+[dependencies]
+aztec = { path = "../../../../aztec-nr/aztec" }
+balance_set = { path = "../../../../aztec-nr/balance-set" }
+field_note = { path = "../../../../aztec-nr/field-note" }
+handshake_registry_contract = { path = "../../standard/handshake_registry_contract" }
diff --git a/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/main.nr b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/main.nr
new file mode 100644
index 000000000000..b52c3e96d146
--- /dev/null
+++ b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/main.nr
@@ -0,0 +1,87 @@
+//! Thin wrappers around constrained delivery for TXE tests.
+use aztec::macros::aztec;
+
+mod test;
+
+#[aztec]
+pub contract ConstrainedDeliveryTest {
+    use aztec::{
+        macros::{events::event, functions::external, storage::storage},
+        messages::delivery::{MessageDelivery, OnchainDeliveryMode},
+        oracle::notes::get_next_tagging_index,
+        protocol::{
+            address::AztecAddress,
+            constants::DOM_SEP__CONSTRAINED_MSG_LOG_TAG,
+            hash::{compute_log_tag, poseidon2_hash},
+        },
+        standard_addresses::STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+        state_vars::{Owned, PrivateSet},
+    };
+    use balance_set::BalanceSet;
+    use field_note::FieldNote;
+    use handshake_registry_contract::HandshakeRegistry;
+
+    #[event]
+    struct DeliveryEvent {
+        value: Field,
+    }
+
+    #[storage]
+    struct Storage<Context> {
+        notes: Owned<PrivateSet<FieldNote, Context>, Context>,
+        balances: Owned<BalanceSet<Context>, Context>,
+    }
+
+    #[external("private")]
+    fn next_index_for_secret(secret: Field) -> u32 {
+        // Safety: test-only observation of the index the PXE hands out next for this secret.
+        unsafe {
+            get_next_tagging_index(secret, MessageDelivery::onchain_constrained())
+        }
+    }
+
+    #[external("private")]
+    fn emit_note(recipient: AztecAddress) {
+        self.storage.notes.at(recipient).insert(FieldNote { value: 1 }).deliver(MessageDelivery::onchain_constrained());
+    }
+
+    #[external("private")]
+    fn emit_maybe_note(recipient: AztecAddress) {
+        self.storage.balances.at(recipient).add(1).deliver_to(recipient, MessageDelivery::onchain_constrained());
+    }
+
+    #[external("private")]
+    fn emit_event(recipient: AztecAddress) {
+        self.emit(DeliveryEvent { value: 1 }).deliver_to(recipient, MessageDelivery::onchain_constrained());
+    }
+
+    #[external("private")]
+    fn emit_two_events(recipient: AztecAddress) {
+        self.emit(DeliveryEvent { value: 1 }).deliver_to(recipient, MessageDelivery::onchain_constrained());
+        self.emit(DeliveryEvent { value: 2 }).deliver_to(recipient, MessageDelivery::onchain_constrained());
+    }
+
+    /// Test reads go through this wrapper so the registry sees this contract as
+    /// [HandshakeRegistry::get_app_siloed_secret]'s msg_sender.
+    #[external("utility")]
+    unconstrained fn get_app_siloed_secret(
+        sender: AztecAddress,
+        recipient: AztecAddress,
+        mode: OnchainDeliveryMode,
+    ) -> Option<Field> {
+        let registry = HandshakeRegistry::at(STANDARD_HANDSHAKE_REGISTRY_ADDRESS);
+        self.call(registry.get_app_siloed_secret(sender, recipient, mode))
+    }
+
+    /// Test-only: emits a log under the constrained tag for `(secret, index)` WITHOUT the sequence nullifier. A landed
+    /// constrained-tagged log advances the PXE's per-secret index, so this lets tests reach the `index > 0` branch;
+    /// deliberately skipping the nullifier drives the negative test.
+    #[external("private")]
+    fn emit_constrained_log_without_nullifier(secret: Field, index: u32) {
+        let log_tag = compute_log_tag(
+            poseidon2_hash([secret, index as Field]),
+            DOM_SEP__CONSTRAINED_MSG_LOG_TAG,
+        );
+        self.context.emit_private_log_unsafe(log_tag, BoundedVec::from_array([secret]));
+    }
+}
diff --git a/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/test.nr b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/test.nr
new file mode 100644
index 000000000000..4001064ab170
--- /dev/null
+++ b/noir-projects/noir-contracts/contracts/test/constrained_delivery_test_contract/src/test.nr
@@ -0,0 +1,88 @@
+//! Tests for constrained delivery through the public message-delivery API.
+//!
+//! These tests exercise the sender-side helper flow indirectly via constrained note/event delivery: resolve or
+//! bootstrap the app-siloed handshake secret, reserve the next per-secret index, constrain that index, emit the
+//! sequence nullifier, then emit the tagged private log. The malformed-log test lands a constrained tag without its
+//! sequence nullifier so the next real delivery must reject the broken sequence.
+use crate::ConstrainedDeliveryTest;
+
+use aztec::{
+    messages::delivery::{MessageDelivery, OnchainDeliveryMode},
+    protocol::address::AztecAddress,
+    standard_addresses::STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+    test::helpers::test_environment::{CallPrivateOptions, DeployOptions, ExecuteUtilityOptions, TestEnvironment},
+};
+use handshake_registry_contract::HandshakeRegistry;
+
+// Modes have no public constructors, so the tests derive them through the delivery builder API.
+global ONCHAIN_CONSTRAINED: OnchainDeliveryMode = MessageDelivery::onchain_constrained().into();
+
+unconstrained fn setup() -> (TestEnvironment, AztecAddress, AztecAddress, AztecAddress, AztecAddress) {
+    let mut env = TestEnvironment::new();
+
+    let sender = env.create_light_account();
+    let recipient = env.create_light_account();
+
+    let registry_address = env
+        .deploy_opts(DeployOptions::new().with_salt(1).with_secret(0), "@handshake_registry_contract/HandshakeRegistry")
+        .without_initializer();
+    assert_eq(registry_address, STANDARD_HANDSHAKE_REGISTRY_ADDRESS);
+
+    let test_address = env.deploy("ConstrainedDeliveryTest").without_initializer();
+
+    (env, registry_address, test_address, sender, recipient)
+}
+
+/// Constrained delivery resolves the current app secret through `HandshakeRegistry::get_app_siloed_secret`, which TXE
+/// denies by default. Authorize the registry as a utility-call target for calls that emit constrained messages.
+unconstrained fn authorizing(registry_address: AztecAddress) -> CallPrivateOptions<0, 1> {
+    CallPrivateOptions::new().with_authorized_utility_call_targets([registry_address])
+}
+
+#[test]
+unconstrained fn rehandshake_replaces_registry_secret_for_future_delivery() {
+    let (env, registry_address, test_address, sender, recipient) = setup();
+    let test_contract = ConstrainedDeliveryTest::at(test_address);
+    let registry = HandshakeRegistry::at(registry_address);
+
+    env.call_private_opts(sender, authorizing(registry_address), test_contract.emit_event(recipient));
+    let first_secret = env
+        .execute_utility_opts(
+            ExecuteUtilityOptions::new().with_from(test_address),
+            registry.get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED),
+        )
+        .expect(f"first delivery should have stored a handshake");
+
+    let _ = env.call_private(sender, registry.non_interactive_handshake(sender, recipient, ONCHAIN_CONSTRAINED));
+    let second_secret = env
+        .execute_utility_opts(
+            ExecuteUtilityOptions::new().with_from(test_address),
+            registry.get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED),
+        )
+        .expect(f"re-handshake should have stored a replacement handshake");
+    assert(first_secret != second_secret, "re-handshake should produce a distinct secret");
+
+    env.call_private_opts(sender, authorizing(registry_address), test_contract.emit_event(recipient));
+
+    let next_index = env.call_private(sender, test_contract.next_index_for_secret(second_secret));
+    assert_eq(next_index, 1);
+}
+
+#[test(should_fail_with = "reading an unknown nullifier")]
+unconstrained fn fails_at_index_above_zero_without_prior_nullifier() {
+    let (env, registry_address, test_address, sender, recipient) = setup();
+    let test_contract = ConstrainedDeliveryTest::at(test_address);
+    let registry = HandshakeRegistry::at(registry_address);
+
+    let _ = env.call_private(sender, registry.non_interactive_handshake(sender, recipient, ONCHAIN_CONSTRAINED));
+    let secret = env
+        .execute_utility_opts(
+            ExecuteUtilityOptions::new().with_from(test_address),
+            registry.get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED),
+        )
+        .expect(f"handshake should be siloed for the test contract");
+
+    env.call_private(sender, test_contract.emit_constrained_log_without_nullifier(secret, 0));
+
+    let _ = env.call_private_opts(sender, authorizing(registry_address), test_contract.emit_event(recipient));
+}
diff --git a/noir-projects/noir-contracts/contracts/test/note_getter_contract/src/main.nr b/noir-projects/noir-contracts/contracts/test/note_getter_contract/src/main.nr
index d25b0b6dbfde..193a21837008 100644
--- a/noir-projects/noir-contracts/contracts/test/note_getter_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/test/note_getter_contract/src/main.nr
@@ -25,12 +25,14 @@ pub contract NoteGetter {
         packed_set: Owned<PrivateSet<PackedNote, Context>, Context>,
     }
 
+    // This function is called from tests that execute it across many parallel txs.
+    // Since constrained delivery doesn't support it, this function must use unconstrained delivery instead.
     #[external("private")]
     fn insert_note(value: Field) {
         let owner = self.msg_sender();
         let note = FieldNote { value };
 
-        self.storage.set.at(owner).insert(note).deliver(MessageDelivery::onchain_constrained());
+        self.storage.set.at(owner).insert(note).deliver(MessageDelivery::onchain_unconstrained());
     }
 
     #[external("utility")]
@@ -48,7 +50,7 @@ pub contract NoteGetter {
         let owner = self.msg_sender();
         let note = PackedNote { high, low };
 
-        self.storage.packed_set.at(owner).insert(note).deliver(MessageDelivery::onchain_constrained());
+        self.storage.packed_set.at(owner).insert(note).deliver(MessageDelivery::onchain_unconstrained());
     }
 
     #[external("utility")]
diff --git a/noir-projects/noir-contracts/contracts/test/state_vars_contract/src/main.nr b/noir-projects/noir-contracts/contracts/test/state_vars_contract/src/main.nr
index 2b38bb6e63db..cff9cf2610b3 100644
--- a/noir-projects/noir-contracts/contracts/test/state_vars_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/test/state_vars_contract/src/main.nr
@@ -93,12 +93,14 @@ pub contract StateVars {
         self.storage.public_immutable.read()
     }
 
+    // This function is called from tests that execute it across many parallel txs.
+    // Since constrained delivery doesn't support it, this function must use unconstrained delivery instead.
     #[external("private")]
     fn initialize_private_immutable(randomness: Field, value: Field) {
         let owner = self.msg_sender();
         let new_note = FieldNote { value };
 
-        self.storage.private_immutable.at(owner).initialize(new_note).deliver(MessageDelivery::onchain_constrained());
+        self.storage.private_immutable.at(owner).initialize(new_note).deliver(MessageDelivery::onchain_unconstrained());
     }
 
     #[external("private")]
@@ -107,7 +109,7 @@ pub contract StateVars {
         let private_mutable = FieldNote { value };
 
         self.storage.private_mutable.at(owner).initialize(private_mutable).deliver(
-            MessageDelivery::onchain_constrained(),
+            MessageDelivery::onchain_unconstrained(),
         );
     }
 
@@ -115,7 +117,7 @@ pub contract StateVars {
     fn update_private_mutable(randomness: Field, value: Field) {
         let owner = self.msg_sender();
         self.storage.private_mutable.at(owner).replace(|_old_note| FieldNote { value }).deliver(
-            MessageDelivery::onchain_constrained(),
+            MessageDelivery::onchain_unconstrained(),
         );
     }
 
@@ -131,7 +133,7 @@ pub contract StateVars {
                 let new_value = old_note.value + 1;
                 FieldNote { value: new_value }
             })
-            .deliver(MessageDelivery::onchain_constrained());
+            .deliver(MessageDelivery::onchain_unconstrained());
     }
 
     #[external("utility")]
diff --git a/noir-projects/noir-contracts/contracts/test/stateful_test_contract/src/main.nr b/noir-projects/noir-contracts/contracts/test/stateful_test_contract/src/main.nr
index a2306c0e258b..4c2e1648c37b 100644
--- a/noir-projects/noir-contracts/contracts/test/stateful_test_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/test/stateful_test_contract/src/main.nr
@@ -41,7 +41,7 @@ pub contract StatefulTest {
     fn create_note(owner: AztecAddress, value: Field) {
         if (value != 0) {
             let note = FieldNote { value };
-            self.storage.notes.at(owner).insert(note).deliver(MessageDelivery::onchain_constrained());
+            self.storage.notes.at(owner).insert(note).deliver(MessageDelivery::onchain_unconstrained());
         }
     }
 
@@ -50,7 +50,7 @@ pub contract StatefulTest {
     fn create_note_no_init_check(owner: AztecAddress, value: Field) {
         if (value != 0) {
             let note = FieldNote { value };
-            self.storage.notes.at(owner).insert(note).deliver(MessageDelivery::onchain_constrained());
+            self.storage.notes.at(owner).insert(note).deliver(MessageDelivery::onchain_unconstrained());
         }
     }
 
@@ -61,7 +61,9 @@ pub contract StatefulTest {
 
         let _ = self.storage.notes.at(sender).pop_notes(NoteGetterOptions::new().set_limit(2));
 
-        self.storage.notes.at(recipient).insert(FieldNote { value: 92 }).deliver(MessageDelivery::onchain_constrained());
+        self.storage.notes.at(recipient).insert(FieldNote { value: 92 }).deliver(
+            MessageDelivery::onchain_unconstrained(),
+        );
     }
 
     #[external("public")]
diff --git a/noir-projects/noir-contracts/contracts/test/test_log_contract/src/main.nr b/noir-projects/noir-contracts/contracts/test/test_log_contract/src/main.nr
index f3a3b20c3ecf..18ad00eac1aa 100644
--- a/noir-projects/noir-contracts/contracts/test/test_log_contract/src/main.nr
+++ b/noir-projects/noir-contracts/contracts/test/test_log_contract/src/main.nr
@@ -66,18 +66,20 @@ pub contract TestLog {
         self.context.emit_private_log_unsafe(tag3, BoundedVec::from_array(payload3));
     }
 
+    // This function is called from tests that execute it across many parallel txs.
+    // Since constrained delivery doesn't support it, this function must use unconstrained delivery instead.
     #[external("private")]
     fn emit_encrypted_events(other: AztecAddress, preimages: [Field; 4]) {
         let event0 = ExampleEvent0 { value0: preimages[0], value1: preimages[1] };
 
-        self.emit(event0).deliver_to(self.msg_sender(), MessageDelivery::onchain_constrained());
+        self.emit(event0).deliver_to(self.msg_sender(), MessageDelivery::onchain_unconstrained());
 
         // We duplicate the emission, but swapping the sender and recipient:
-        self.emit(event0).deliver_to(other, MessageDelivery::onchain_constrained());
+        self.emit(event0).deliver_to(other, MessageDelivery::onchain_unconstrained());
 
         let event1 = ExampleEvent1 { value2: AztecAddress::from_field(preimages[2]), value3: preimages[3] as u8 };
 
-        self.emit(event1).deliver_to(self.msg_sender(), MessageDelivery::onchain_constrained());
+        self.emit(event1).deliver_to(self.msg_sender(), MessageDelivery::onchain_unconstrained());
     }
 
     #[external("public")]
diff --git a/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr b/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr
index 42e699e8da82..d5143af64c42 100644
--- a/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr
+++ b/noir-projects/noir-protocol-circuits/crates/types/src/constants.nr
@@ -730,6 +730,8 @@ pub global DOM_SEP__NOTE_COMPLETION_LOG_TAG: u32 = 3372669888;
 pub global DOM_SEP__UNCONSTRAINED_MSG_LOG_TAG: u32 = 1485357192;
 /// Domain separator for constrained message delivery log tags. Used by [`crate::hash::compute_log_tag`].
 pub global DOM_SEP__CONSTRAINED_MSG_LOG_TAG: u32 = 3715244738;
+/// Domain separator for nullifiers used during constrained delivery.
+pub global DOM_SEP__CONSTRAINED_MSG_NULLIFIER: u32 = 3723577546;
 /// Domain separator for non-interactive handshake log tags emitted by the handshake registry contract. Used by
 /// [`crate::hash::compute_log_tag`].
 pub global DOM_SEP__NON_INTERACTIVE_HANDSHAKE_LOG_TAG: u32 = 4046403018;
diff --git a/noir-projects/noir-protocol-circuits/crates/types/src/constants_tests.nr b/noir-projects/noir-protocol-circuits/crates/types/src/constants_tests.nr
index 96bc17853b0c..92e7295289d3 100644
--- a/noir-projects/noir-protocol-circuits/crates/types/src/constants_tests.nr
+++ b/noir-projects/noir-protocol-circuits/crates/types/src/constants_tests.nr
@@ -10,10 +10,11 @@ use crate::{
         DOM_SEP__AUTHWIT_OUTER, DOM_SEP__BLOB_CHALLENGE_Z, DOM_SEP__BLOB_GAMMA_ACC,
         DOM_SEP__BLOB_GAMMA_FINAL, DOM_SEP__BLOB_HASHED_Y_LIMBS, DOM_SEP__BLOB_Z_ACC,
         DOM_SEP__BLOCK_HEADER_HASH, DOM_SEP__BLOCK_HEADERS_HASH, DOM_SEP__CONSTRAINED_MSG_LOG_TAG,
-        DOM_SEP__CONTRACT_ADDRESS_V2, DOM_SEP__CONTRACT_CLASS_ID, DOM_SEP__ECDH_FIELD_MASK,
-        DOM_SEP__ECDH_SUBKEY, DOM_SEP__EVENT_COMMITMENT, DOM_SEP__EVENT_LOG_TAG,
-        DOM_SEP__FUNCTION_ARGS, DOM_SEP__INITIALIZATION_NULLIFIER, DOM_SEP__INITIALIZER,
-        DOM_SEP__IVSK_M, DOM_SEP__MERKLE_HASH, DOM_SEP__MESSAGE_NULLIFIER, DOM_SEP__NHK_M,
+        DOM_SEP__CONSTRAINED_MSG_NULLIFIER, DOM_SEP__CONTRACT_ADDRESS_V2,
+        DOM_SEP__CONTRACT_CLASS_ID, DOM_SEP__ECDH_FIELD_MASK, DOM_SEP__ECDH_SUBKEY,
+        DOM_SEP__EVENT_COMMITMENT, DOM_SEP__EVENT_LOG_TAG, DOM_SEP__FUNCTION_ARGS,
+        DOM_SEP__INITIALIZATION_NULLIFIER, DOM_SEP__INITIALIZER, DOM_SEP__IVSK_M,
+        DOM_SEP__MERKLE_HASH, DOM_SEP__MESSAGE_NULLIFIER, DOM_SEP__NHK_M,
         DOM_SEP__NON_INTERACTIVE_HANDSHAKE_LOG_TAG, DOM_SEP__NOTE_COMPLETION_LOG_TAG,
         DOM_SEP__NOTE_HASH, DOM_SEP__NOTE_HASH_NONCE, DOM_SEP__NOTE_NULLIFIER,
         DOM_SEP__NULLIFIER_MERKLE, DOM_SEP__OVSK_M, DOM_SEP__PARTIAL_ADDRESS,
@@ -143,7 +144,7 @@ impl<let NUM_VALUES: u32, let NUM_U32_VALUES: u32> HashedValueTester<NUM_VALUES,
 
 #[test]
 fn hashed_values_match_derived() {
-    let mut tester = HashedValueTester::<72, 65>::new();
+    let mut tester = HashedValueTester::<73, 66>::new();
 
     // -----------------
     // Domain separators
@@ -180,6 +181,10 @@ fn hashed_values_match_derived() {
         DOM_SEP__CONSTRAINED_MSG_LOG_TAG,
         "constrained_msg_log_tag",
     );
+    tester.assert_dom_sep_matches_derived(
+        DOM_SEP__CONSTRAINED_MSG_NULLIFIER,
+        "constrained_msg_nullifier",
+    );
     tester.assert_dom_sep_matches_derived(
         DOM_SEP__NON_INTERACTIVE_HANDSHAKE_LOG_TAG,
         "non_interactive_handshake_log_tag",
diff --git a/yarn-project/constants/src/constants.gen.ts b/yarn-project/constants/src/constants.gen.ts
index e57889caba37..744acff17fb8 100644
--- a/yarn-project/constants/src/constants.gen.ts
+++ b/yarn-project/constants/src/constants.gen.ts
@@ -525,6 +525,7 @@ export enum DomainSeparator {
   NOTE_COMPLETION_LOG_TAG = 3372669888,
   UNCONSTRAINED_MSG_LOG_TAG = 1485357192,
   CONSTRAINED_MSG_LOG_TAG = 3715244738,
+  CONSTRAINED_MSG_NULLIFIER = 3723577546,
   NON_INTERACTIVE_HANDSHAKE_LOG_TAG = 4046403018,
   PRIVATE_LOG_FIRST_FIELD = 2769976252,
   PUBLIC_LEAF_SLOT = 1247650290,
diff --git a/yarn-project/end-to-end/src/e2e_2_pxes.test.ts b/yarn-project/end-to-end/src/e2e_2_pxes.test.ts
index f7e7a904a2f6..0bacafd279a0 100644
--- a/yarn-project/end-to-end/src/e2e_2_pxes.test.ts
+++ b/yarn-project/end-to-end/src/e2e_2_pxes.test.ts
@@ -143,7 +143,10 @@ describe('e2e_2_pxes', () => {
     expect(storedValueOnA).toEqual(newValueToSet);
   });
 
-  it('private state is "zero" when PXE does not have the account secret key', async () => {
+  // TODO(F-741): `expectTokenBalance(walletB, token, accountAAddress, 0n)` throws
+  // "No public key registered". Handshake discovery (get_shared_secrets) needs the scope's
+  // keys, which this PXE lacks for a foreign account.
+  it.skip('private state is "zero" when PXE does not have the account secret key', async () => {
     const userABalance = 100n;
     const userBBalance = 150n;
 
diff --git a/yarn-project/end-to-end/src/e2e_constrained_delivery.test.ts b/yarn-project/end-to-end/src/e2e_constrained_delivery.test.ts
new file mode 100644
index 000000000000..021a88b8b4e7
--- /dev/null
+++ b/yarn-project/end-to-end/src/e2e_constrained_delivery.test.ts
@@ -0,0 +1,157 @@
+import type { AztecAddress } from '@aztec/aztec.js/addresses';
+import { BatchCall } from '@aztec/aztec.js/contracts';
+import type { Wallet } from '@aztec/aztec.js/wallet';
+import { HandshakeRegistryContract } from '@aztec/noir-contracts.js/HandshakeRegistry';
+import { ConstrainedDeliveryTestContract } from '@aztec/noir-test-contracts.js/ConstrainedDeliveryTest';
+import { STANDARD_HANDSHAKE_REGISTRY_ADDRESS } from '@aztec/standard-contracts/handshake-registry/constants';
+
+import { jest } from '@jest/globals';
+
+import { AUTOMINE_E2E_OPTS } from './fixtures/fixtures.js';
+import { ensureHandshakeRegistryPublished, setup } from './fixtures/setup.js';
+
+const ONCHAIN_CONSTRAINED = { inner: 3 };
+
+describe('constrained delivery', () => {
+  jest.setTimeout(300_000);
+
+  let teardown: () => Promise<void>;
+  let wallet: Wallet;
+  let sender: AztecAddress;
+  let recipient: AztecAddress;
+  let batchRecipient: AztecAddress;
+  let batchRecipient2: AztecAddress;
+  let batchRecipient3: AztecAddress;
+  let batchRecipient4: AztecAddress;
+  let contract: ConstrainedDeliveryTestContract;
+  let registry: HandshakeRegistryContract;
+
+  beforeAll(async () => {
+    ({
+      teardown,
+      wallet,
+      accounts: [sender, recipient, batchRecipient, batchRecipient2, batchRecipient3, batchRecipient4],
+    } = await setup(6, { ...AUTOMINE_E2E_OPTS }));
+
+    await ensureHandshakeRegistryPublished(wallet, sender);
+    ({ contract } = await ConstrainedDeliveryTestContract.deploy(wallet).send({ from: sender }));
+    registry = HandshakeRegistryContract.at(STANDARD_HANDSHAKE_REGISTRY_ADDRESS, wallet);
+  });
+
+  afterAll(() => teardown());
+
+  it('reuses an existing standard-registry constrained handshake', async () => {
+    await contract.methods.emit_note(recipient).send({ from: sender });
+
+    const { result: secretAfterFirstSend } = await contract.methods
+      .get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED)
+      .simulate({ from: sender });
+    expect(secretAfterFirstSend).toBeDefined();
+
+    await contract.methods.emit_event(recipient).send({ from: sender });
+
+    const { result: secret } = await contract.methods
+      .get_app_siloed_secret(sender, recipient, ONCHAIN_CONSTRAINED)
+      .simulate({ from: sender });
+    // The second send reuses the handshake rather than bootstrapping a new one: the secret is unchanged.
+    expect(secret).toEqual(secretAfterFirstSend);
+
+    const { result: index } = await contract.methods.next_index_for_secret(secret).simulate({ from: sender });
+
+    expect(index).toEqual(2n);
+  });
+
+  // Constrained sends to one recipient form a strictly ordered sequence, so concurrent and batched sends behave
+  // differently: parallel txs collide on the shared index nullifier, same-tx batches work only once the handshake is
+  // committed, and batches that bootstrap a brand-new recipient re-handshake onto separate secrets. Each test uses
+  // its own recipient.
+  describe('concurrency and batching', () => {
+    // Constrained sends to one `(sender, recipient)` pair are strictly ordered: the first send bootstraps the
+    // handshake and every send emits a nullifier keyed only on `(sender, recipient, secret, index)`. Two sends fired
+    // in parallel read the same index and collide, so one tx is rejected. Marked `it.failing` because this is a
+    // protocol limitation, not a bug: it documents the constraint and will start failing (prompting its removal) if
+    // parallel sends to a single pair ever become supported. The working alternative is the batched test below.
+    it.failing('cannot fan out constrained sends on the same sequence in parallel', async () => {
+      await Promise.all([
+        contract.methods.emit_note(recipient).send({ from: sender }),
+        contract.methods.emit_note(recipient).send({ from: sender }),
+      ]);
+    });
+
+    // CAN batch (1): a contract call may emit several constrained messages to one recipient in a single tx; each
+    // later emit proves the previous nullifier as a same-tx pending nullifier. The handshake must already be
+    // committed (see the re-handshake test below), so it is established first; a fresh recipient starts at index 0,
+    // so two emits land indices 0 and 1 and the next index is 2.
+    it('lands multiple constrained sends from a single contract call on an established handshake', async () => {
+      await registry.methods
+        .non_interactive_handshake(sender, batchRecipient, ONCHAIN_CONSTRAINED)
+        .send({ from: sender });
+
+      await contract.methods.emit_two_events(batchRecipient).send({ from: sender });
+
+      const { result: secret } = await contract.methods
+        .get_app_siloed_secret(sender, batchRecipient, ONCHAIN_CONSTRAINED)
+        .simulate({ from: sender });
+      expect(secret).toBeDefined();
+
+      const { result: index } = await contract.methods.next_index_for_secret(secret).simulate({ from: sender });
+      expect(index).toEqual(2n);
+    });
+
+    // CAN batch (2): client-side BatchCall aggregates separate calls into one tx with the same effect. The two
+    // emit_note calls that fail as parallel txs (above) succeed batched, given an established handshake.
+    it('lands the same two sends when aggregated into one tx with BatchCall', async () => {
+      await registry.methods
+        .non_interactive_handshake(sender, batchRecipient2, ONCHAIN_CONSTRAINED)
+        .send({ from: sender });
+
+      await new BatchCall(wallet, [
+        contract.methods.emit_note(batchRecipient2),
+        contract.methods.emit_note(batchRecipient2),
+      ]).send({ from: sender });
+
+      const { result: secret } = await contract.methods
+        .get_app_siloed_secret(sender, batchRecipient2, ONCHAIN_CONSTRAINED)
+        .simulate({ from: sender });
+      expect(secret).toBeDefined();
+
+      const { result: index } = await contract.methods.next_index_for_secret(secret).simulate({ from: sender });
+      expect(index).toEqual(2n);
+    });
+
+    // CANNOT batch onto a brand-new recipient, even within a single contract call. The registry lookup that decides
+    // reuse-vs-bootstrap is a utility call reading committed state, so the second emit cannot see the first emit's
+    // pending bootstrap and re-handshakes onto a fresh secret (each handshake mints a new shared secret). The registry
+    // keeps the second handshake, which holds a single log, so the next index is 1, not 2. This is why the
+    // established-handshake tests above seed the handshake first.
+    it('re-handshakes instead of reusing when sends bootstrap a new recipient in the same tx', async () => {
+      await contract.methods.emit_two_events(batchRecipient3).send({ from: sender });
+
+      const { result: secret } = await contract.methods
+        .get_app_siloed_secret(sender, batchRecipient3, ONCHAIN_CONSTRAINED)
+        .simulate({ from: sender });
+      expect(secret).toBeDefined();
+
+      const { result: index } = await contract.methods.next_index_for_secret(secret).simulate({ from: sender });
+      expect(index).toEqual(1n);
+    });
+
+    // The same new-recipient limitation holds via client-side BatchCall: the two aggregated emit_note calls each
+    // bootstrap and re-handshake onto separate secrets (the utility read can't see the first's pending bootstrap),
+    // so the next index is 1, not 2. Confirms the constraint is in the utility read, not the batching mechanism.
+    it('re-handshakes instead of reusing when BatchCall sends bootstrap a new recipient in the same tx', async () => {
+      await new BatchCall(wallet, [
+        contract.methods.emit_note(batchRecipient4),
+        contract.methods.emit_note(batchRecipient4),
+      ]).send({ from: sender });
+
+      const { result: secret } = await contract.methods
+        .get_app_siloed_secret(sender, batchRecipient4, ONCHAIN_CONSTRAINED)
+        .simulate({ from: sender });
+      expect(secret).toBeDefined();
+
+      const { result: index } = await contract.methods.next_index_for_secret(secret).simulate({ from: sender });
+      expect(index).toEqual(1n);
+    });
+  });
+});
diff --git a/yarn-project/end-to-end/src/e2e_pending_note_hashes_contract.test.ts b/yarn-project/end-to-end/src/e2e_pending_note_hashes_contract.test.ts
index 30d3e84d9c5b..61eb3a4fce6b 100644
--- a/yarn-project/end-to-end/src/e2e_pending_note_hashes_contract.test.ts
+++ b/yarn-project/end-to-end/src/e2e_pending_note_hashes_contract.test.ts
@@ -127,24 +127,51 @@ describe('e2e_pending_note_hashes_contract', () => {
 
   it('Squash! Aztec.nr function can "create" and "nullify" note in the same TX but the constrained note log survives', async () => {
     // Kernel will squash the noteHash and its nullifier, but NOT the note log: constrained-delivery logs are not
-    // linked to the note for squashing, because a removed log would break the index chain.
+    // linked to the note for squashing, because a removed log would break the index sequence.
     const mintAmount = 65n;
 
     const deployedContract = await deployContract();
 
     const sender = owner;
+    const insertConstrainedSelector = await deployedContract.methods.insert_note_constrained.selector();
+    const getThenNullifySelector = await deployedContract.methods.get_then_nullify_note.selector();
+
+    // The first constrained send to a fresh sender/recipient sequence bootstraps the HandshakeRegistry. Assert that
+    // separately so the reused-sequence assertions below only observe the app note inserted and nullified in the
+    // measured tx.
+    await deployedContract.methods
+      .test_insert_then_get_then_nullify_all_in_nested_calls(
+        1n,
+        owner,
+        sender,
+        insertConstrainedSelector,
+        getThenNullifySelector,
+      )
+      .send({ from: owner });
+    // Bootstrap emits a registry note hash, a registry initialization nullifier, and a constrained-delivery sequence
+    // nullifier. The app note hash and app note nullifier are still squashed.
+    await expectNoteHashesSquashedExcept(1);
+    await expectNullifiersSquashedExcept(2);
+    // It also emits three private logs:
+    // 1. registry HandshakeNote delivery log;
+    // 2. registry recipient-discovery log;
+    // 3. app constrained note-delivery log.
+    await expectNoteLogsSquashedExcept(3);
+
     await deployedContract.methods
       .test_insert_then_get_then_nullify_all_in_nested_calls(
         mintAmount,
         owner,
         sender,
-        await deployedContract.methods.insert_note_constrained.selector(),
-        await deployedContract.methods.get_then_nullify_note.selector(),
+        insertConstrainedSelector,
+        getThenNullifySelector,
       )
       .send({ from: owner });
 
     await expectNoteHashesSquashedExcept(0);
-    await expectNullifiersSquashedExcept(0);
+    // Constrained delivery always emits its sequence nullifier. The one allowed nullifier below is that delivery
+    // nullifier, not the app note's nullifier, which remains squashed together with its note hash.
+    await expectNullifiersSquashedExcept(1);
     await expectNoteLogsSquashedExcept(1);
   });
 
diff --git a/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution.test.ts b/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution.test.ts
index 3082b816e7f4..bc70e96e76d3 100644
--- a/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution.test.ts
+++ b/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution.test.ts
@@ -4,8 +4,17 @@ import { Fr } from '@aztec/foundation/curves/bn254';
 import { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
 import type { KeyStore } from '@aztec/key-store';
 import { StatefulTestContractArtifact } from '@aztec/noir-test-contracts.js/StatefulTest';
-import { WASMSimulator } from '@aztec/simulator/client';
-import { FunctionCall, FunctionSelector, FunctionType, encodeArguments } from '@aztec/stdlib/abi';
+import { type CircuitSimulator, WASMSimulator } from '@aztec/simulator/client';
+import { HandshakeRegistryArtifact } from '@aztec/standard-contracts/handshake-registry';
+import { STANDARD_HANDSHAKE_REGISTRY_ADDRESS } from '@aztec/standard-contracts/handshake-registry/constants';
+import {
+  type ContractArtifact,
+  FunctionCall,
+  FunctionSelector,
+  FunctionType,
+  encodeArguments,
+  getFunctionArtifactByName,
+} from '@aztec/stdlib/abi';
 import { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { BlockHash, type L2TipsProvider } from '@aztec/stdlib/block';
 import {
@@ -17,7 +26,7 @@ import type { AztecNode } from '@aztec/stdlib/interfaces/server';
 import { PublicKeys, deriveKeys, hashPublicKey } from '@aztec/stdlib/keys';
 import { AppTaggingSecret, AppTaggingSecretKind, MessageContext, SiloedTag } from '@aztec/stdlib/logs';
 import { Note, NoteDao } from '@aztec/stdlib/note';
-import { makeL2Tips } from '@aztec/stdlib/testing';
+import { makeL2Tips, randomContractInstanceWithAddress } from '@aztec/stdlib/testing';
 import {
   BlockHeader,
   CallContext,
@@ -436,6 +445,88 @@ describe('Utility Execution test suite', () => {
       });
     });
 
+    // Pins the production oracle's default-authorization allowlist for cross-contract utility reads of the
+    // standard HandshakeRegistry: only get_handshakes and get_app_siloed_secret are allowed, everything else is
+    // denied.
+    describe('cross-contract utility authorization', () => {
+      const prepareNestedUtilityCall = async (
+        targetContractAddress: AztecAddress,
+        contractArtifact: ContractArtifact,
+        functionName: string,
+      ) => {
+        const functionArtifact = {
+          ...getFunctionArtifactByName(contractArtifact, functionName),
+          contractName: contractArtifact.name,
+        };
+        const selector = await FunctionSelector.fromNameAndParameters(functionName, functionArtifact.parameters);
+        const callerInstance = await randomContractInstanceWithAddress({}, contractAddress);
+        const targetInstance = await randomContractInstanceWithAddress({}, targetContractAddress);
+
+        contractStore.getFunctionArtifactWithDebugMetadata.mockResolvedValue(functionArtifact);
+        contractStore.getContractInstance.mockImplementation(address => {
+          if (address.equals(contractAddress)) {
+            return Promise.resolve(callerInstance);
+          }
+          if (address.equals(targetContractAddress)) {
+            return Promise.resolve(targetInstance);
+          }
+          return Promise.reject(new Error(`Unexpected contract instance lookup for ${address}`));
+        });
+
+        return selector;
+      };
+
+      const makeNestedSimulator = () => {
+        const nestedSimulator = mock<CircuitSimulator>();
+        nestedSimulator.executeUserCircuit.mockResolvedValue({ partialWitness: new Map(), returnWitness: new Map() });
+        return nestedSimulator;
+      };
+
+      let nestedSimulator: ReturnType<typeof makeNestedSimulator>;
+      // The standard HandshakeRegistry reads the oracle default-authorizes, mapped to the args each is called with.
+      let defaultAuthorizedHandshakeRegistryReads: Map<string, Fr[]>;
+
+      beforeEach(() => {
+        nestedSimulator = makeNestedSimulator();
+        utilityExecutionOracle = makeOracle({ simulator: nestedSimulator });
+        defaultAuthorizedHandshakeRegistryReads = new Map<string, Fr[]>([
+          ['get_handshakes', []],
+          ['get_app_siloed_secret', [Fr.random(), Fr.random(), new Fr(3)]],
+        ]);
+      });
+
+      afterEach(() => {
+        contractSyncService.ensureContractSynced.mockClear();
+        nestedSimulator.executeUserCircuit.mockClear();
+      });
+
+      it.each(HandshakeRegistryArtifact.functions.map(fn => fn.name))(
+        'authorizes %s only if it is in the standard HandshakeRegistry read allowlist',
+        async name => {
+          const selector = await prepareNestedUtilityCall(
+            STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+            HandshakeRegistryArtifact,
+            name,
+          );
+
+          if (defaultAuthorizedHandshakeRegistryReads.has(name)) {
+            const args = defaultAuthorizedHandshakeRegistryReads.get(name) ?? [];
+            await expect(
+              utilityExecutionOracle.callUtilityFunction(STANDARD_HANDSHAKE_REGISTRY_ADDRESS, selector, args),
+            ).resolves.toEqual([]);
+            expect(contractSyncService.ensureContractSynced).toHaveBeenCalled();
+            expect(nestedSimulator.executeUserCircuit).toHaveBeenCalled();
+          } else {
+            await expect(
+              utilityExecutionOracle.callUtilityFunction(STANDARD_HANDSHAKE_REGISTRY_ADDRESS, selector, []),
+            ).rejects.toThrow('Cross-contract utility call denied: No execution hooks configured');
+            expect(contractSyncService.ensureContractSynced).not.toHaveBeenCalled();
+            expect(nestedSimulator.executeUserCircuit).not.toHaveBeenCalled();
+          }
+        },
+      );
+    });
+
     describe('getMessageContextsByTxHash', () => {
       const service = new EphemeralArrayService();
 
diff --git a/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution_oracle.ts b/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution_oracle.ts
index 84a27e63724a..f398542c3654 100644
--- a/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution_oracle.ts
+++ b/yarn-project/pxe/src/contract_function_simulator/oracle/utility_execution_oracle.ts
@@ -847,12 +847,7 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
     );
 
     if (!targetContractAddress.equals(this.contractAddress)) {
-      // The HandshakeRegistry is called during every contract's sync to discover handshake secrets.
-      // It is a standard contract that only reads its own state, so it is always authorized.
-      const isHandshakeRegistryRead =
-        targetContractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS) &&
-        functionSelector.equals(await FunctionSelector.fromSignature('get_handshakes((Field),u32)'));
-      if (!isHandshakeRegistryRead) {
+      if (!(await isStandardHandshakeRegistryUtilityRead(targetContractAddress, functionSelector))) {
         const [callerInstance, targetInstance] = await Promise.all([
           this.getContractInstance(this.contractAddress),
           this.getContractInstance(targetContractAddress),
@@ -1017,3 +1012,25 @@ export class UtilityExecutionOracle implements IMiscOracle, IUtilityExecutionOra
     return this.callContext.contractAddress;
   }
 }
+
+const STANDARD_HANDSHAKE_REGISTRY_GET_HANDSHAKES_SIGNATURE = 'get_handshakes((Field),u32)';
+const STANDARD_HANDSHAKE_REGISTRY_GET_APP_SILOED_SECRET_SIGNATURE = 'get_app_siloed_secret((Field),(Field),(u8))';
+
+async function doesSelectorHaveSignature(functionSelector: FunctionSelector, signature: string): Promise<boolean> {
+  return functionSelector.equals(await FunctionSelector.fromSignature(signature));
+}
+
+async function isStandardHandshakeRegistryUtilityRead(
+  targetContractAddress: AztecAddress,
+  functionSelector: FunctionSelector,
+): Promise<boolean> {
+  if (!targetContractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS)) {
+    return false;
+  }
+
+  const [isGetHandshakes, isGetAppSiloedSecret] = await Promise.all([
+    doesSelectorHaveSignature(functionSelector, STANDARD_HANDSHAKE_REGISTRY_GET_HANDSHAKES_SIGNATURE),
+    doesSelectorHaveSignature(functionSelector, STANDARD_HANDSHAKE_REGISTRY_GET_APP_SILOED_SECRET_SIGNATURE),
+  ]);
+  return isGetHandshakes || isGetAppSiloedSecret;
+}