fix: anchor stream from_block at creation to close startup polling gap

[agentotto]

Problem

poll_events initialised from_block lazily on the first poll cycle by calling eth_blockNumber() at that moment. In engine.rs, registry_stream() is called before backfill_commitments(), so the stream exists but hasn't fired its first poll when backfill runs.

Gap window

t0  registry_stream() called — stream created, from_block = None
t1  backfill_commitments() fetches logs [0 .. chain-head-at-t1]
t2  backfill completes, mark_ready() called
t3  POLL_INTERVAL expires → first poll fires → eth_blockNumber() = N

Any ChainCommitted event emitted in blocks (t1-head .. N] is never fetched: backfill stopped at t1-head and the poll loop starts querying from N+1.

Why this is fatal

The keccak chain is a hash chain: each commit's keccakChain field must equal keccak256(prev_head || new_commits). Missing even one ChainCommitted means the relay's in-memory local_chain diverges from the on-chain chain. Every subsequent commit will produce the wrong keccakChain and be rejected by satellites, permanently stalling the log.

Fix

Fetch the current chain head in registry_stream() (before backfill hands off) and pass it as anchor_block to poll_events(). The unfold state is initialised with that concrete u64 instead of None, so the first poll queries [anchor_block+1 .. latest].

Backfill and live-poll overlap at anchor_block (both may process that exact block), but commit_chained deduplicates by chain head — no double-counting.

Test

poll_stream_captures_event_emitted_during_backfill_window — uses alloy's MockTransport and tokio's paused time to simulate a ChainCommitted event landing at block 6 during the backfill window (anchor = 5), advances the mock clock past POLL_INTERVAL, and asserts the event is yielded by the stream.

[agentotto]

Code Review Summary

Fix correctness ✅

1. Gap is closed: anchor_block = get_block_number() is called in registry_stream() before backfill_commitments() runs. Backfill covers [0, latest_at_backfill_rpc] (no explicit to_block); the live poll covers [anchor_block+1, ∞). Together they are gapless.

2. Overlap is safe: Both backfill and the first poll may process events at anchor_block. commit_chained deduplicates by chain_head, so double-processing is harmless.

3. anchor_block=0: Safe. The guard latest <= from_block fires, preventing a u64 underflow in from_block + 1.

4. get_block_number failure: Changed from silent retry to a hard error propagated to engine::run(). Correct trade-off — cannot anchor without a block number.

Test quality ✅

poll_stream_captures_event_emitted_during_backfill_window faithfully reproduces the exact failure mode (anchor=5, block 6 mined during backfill, first poll must capture it). Uses alloy MockTransport + tokio paused time — no network, no flakiness. Topic constant is derived from the ABI binding so it breaks loudly if the event signature changes.

One remaining gap (non-blocking)

The wiring in registry_stream() that threads anchor_block into poll_events() is not directly tested — would need a full WorldChain mock. The unit test covers the critical logic; the wiring is a compiler-checked one-liner.