BEGIN_COMMIT_OVERRIDE
feat: add public log filtering by tag (#21561)
feat: default to kernelless simulations (#21575)
fix(aztec-node): throw on existing nullifier in
getLowNullifierMembershipWitness (#21472)
fix: update nullifier non-inclusion test expectations after early oracle
throw (#21600)
refactor(pxe): type and audit legacy oracle mappings (#21569)
END_COMMIT_OVERRIDE

…shipWitness (#21472)

As I was going through TODOs I found this ancient TODO of mine (from
November 2023):

```
   * Note: This function returns the membership witness of the nullifier itself and not the low nullifier when
   * the nullifier already exists in the tree. This is because the `getPreviousValueIndex` function returns the
   * index of the nullifier itself when it already exists in the tree.
   * TODO: This is a confusing behavior and we should eventually address that.
```

In this PR i handle it by instead throwing an error in this scenario.

This doesn't modify the interface so it was not urgent to do but felt
like it makes sense to do now anyway so I went with it.

(Pinged this PR to alpha team)

## Summary

- `getLowNullifierMembershipWitness` now throws a descriptive error when
the queried nullifier already exists in the tree, instead of silently
returning the nullifier's own witness (which is wrong for a
non-inclusion proof)
- Removes the long-standing TODO about confusing behavior (open since
Nov 2023)
- Adds `@throws` JSDoc to both the interface and implementation
- Adds unit tests for the throw and undefined-return paths

## Context

Previously, `getPreviousValueIndex` returns the nullifier's own index
when `alreadyPresent: true`. The method just logged a warning and
returned that witness anyway. The Noir circuit would catch this
implicitly (the `low < target` assertion fails), but the error surfaced
as a cryptic circuit assertion rather than a clear "nullifier already
exists" message.

## Test plan

- Unit tests added in `server.test.ts` covering both the throw-on-exists
and return-undefined paths
- All 34 existing tests in `server.test.ts` continue to pass
- Build, format, and lint pass


🤖 Generated with [Claude Code](https://claude.com/claude-code)

BEGIN_COMMIT_OVERRIDE
feat: entrypoint replay protection (#21649)
feat: guard BoundedVec oracle returns against dirty trailing storage
(#21589)
fix: add bounds when allocating arrays in deserialization (#21622)
feat: implement manual Packable for structs with sub-Field members
(#21576)
fix(aztec-node): throw on existing nullifier in
getLowNullifierMembershipWitness (#21472)
fix: use trait dispatch for array Packable::unpack in card_game_contract
(#21683)
fix(p2p): penalize peers for errors during response reading (#21680)
fix: update nullifier non-inclusion test expectations after early oracle
throw (backport #21600) (#21615)
fix(aztec-nr): fix OOB index with nonzero offset (#21613)
fix(builder): persist contractsDB across blocks within a checkpoint
(#21520)
fix(stdlib): accept null return_type for void Noir functions (#21647)
feat: gas estimations on send (#21646)
fix(validator): process block proposals from own validator keys in HA
setups (backport #21603) (#21659)
fix(p2p): penalize peer on tx rejected by pool (#21677)
fix(sequencer): fix checkpoint budget redistribution for multi-block
slots (#21692)
feat: sync cache invalidation oracle (backport #21459) (#21730)
feat!: make AES128 decrypt oracle return Option (backport #21696)
(#21735)
feat!: include init_hash in private initialization nullifier (backport
#21427) (#21736)
fix(sequencer): extract gas and blob configs from valid requests only
(A-677) (#21747)
chore: backport #21744 — replace dead BOOTSTRAP_TO env var with
bootstrap.sh build arg (#21748)
refactor: revert remove assert_bounded_vec_trimmed (#21758)
END_COMMIT_OVERRIDE