fix(#116): split parent-walk backfill cap from RPC inline cap

[Reiers]

Closes #116.

What

Bridge-off cold boot (--no-fallback-rpc) reached the seeded anchor via ChainExchange (#91/#109) and then never advanced. Every gossip block was skipped with backfillFail incrementing 1:1 with sub-rcv, and (once visibility was added) the terminal warn was bridge-off backfill gap 45 > cap 3.

Root cause: net/blockingest.parentWalkBackfill gated the anchor→tip gap on g.backfillCap (default 3 epochs) BEFORE calling chainExchangeBackfill. That 3-epoch cap was designed for the RPC inline path (inlineBackfill, one glif round-trip per epoch) where 3 is the right ceiling. The parent-walk path has completely different economics: chainExchangeBackfill iterates 900-tipset chunks capped internally at maxBackfillTipsets = 20000 and is designed to bridge whole anchor→tip stretches in one shot. The 3-epoch outer gate short-circuited it before it could run.

The docstring on chainExchangeBackfill even says so: "a snapshot-free boot from a stale quorum anchor can be thousands of epochs behind live head - so we LOOP."

Fix

Split the two paths' caps.

cap	scope	default	rationale
backfillCap	RPC inline path (inlineBackfill)	3 (unchanged)	one glif round-trip per epoch — small ceiling protects the upstream
parentWalkCap (new)	parent-walk path (parentWalkBackfill)	2880 (~24h on 30s epochs)	chainxchg does one iterative request per 900-tipset chunk, bitswap fallback linear but bounded

parentWalkCap gates:

1. The upfront gap > cap check at the top of parentWalkBackfill.
2. The len(collected) > cap check inside the bitswap fallback walk.

chainExchangeBackfill's internal maxBackfillTipsets = 20000 remains the ultimate ceiling — nothing changes on that inner path.

Also fixed: silent backfill failure

process() swallowed the inlineBackfill error and just incremented backfillFailed, so an operator staring at a stalled sync saw backfillFail=N in the periodic stats and had no way to know why. This PR:

• Adds log.Warnw("gossip inline-backfill failed", err, block_epoch, cur_head, parent_walk, chain_fetcher) at the error-swallow site.
• Upgrades the chainxchg backfill failed; falling back to per-CID walk from Debugw to Infow (same reason).

Verification

Live darwin/arm64 vs calibration, 2026-07-11

Test 1 (fresh anchor, small gap): 4-min soak. Head advanced 3881463 → 3881477. sub-rcv=22 installed=4 backfilled=14 backfillFail=0. Zero Glif hits.

Test 2 (stale anchor, 63-epoch gap): Used a 30-minute-old anchor at epoch 3881418 (live head was 3881481 at boot). First gossip block triggered a single chainxchg backfill for the whole 63-epoch gap; head advanced to bh.Height - 1 in seconds and continued from there. backfillFail=0 throughout the run. Zero Glif hits.

Regression test

TestIngestor_ParentWalkAcceptsGapAboveRPCCap (new): 49-epoch gap (above DefaultBackfillCap=3, below DefaultParentWalkCap=2880) with parentWalk=true + fake ChainFetcher. Verifies:

• backfillFailed = 0 (no cap rejection)
• backfilled = 1 (one pass fired)
• installed = 1 (head adopted the gossip block)
• HeadEpoch = 60 (advanced to gossip target)
• fetcher.calls = 1 (single chainxchg request for the whole gap)

TestIngestor_InlineBackfillRespectsCapsToSkip (existing) still passes — RPC-path 3-epoch ceiling is unchanged.

Suite

• CGO_ENABLED=0 go build ./... clean
• CGO_ENABLED=0 go vet ./... clean
• go test -count=1 -timeout 300s ./... — all 55 packages ok, including the new test in net/blockingest

#104 impact

This blocks Phase 1 (snapshot-free boot) of the calibration dress rehearsal until landed. Without it, any bridge-off cold boot where init and daemon-start aren't back-to-back is wedged; with it, a stale-anchor cold boot stitches to live tip in one chainxchg round-trip and stays in sync via gossip thereafter.

Non-scope

• The unified parentWalkBackfill code path itself is unchanged: chainxchg first, bitswap fallback on error, both bounded now by the same parentWalkCap.
• No change to the RPC/glif path defaults or semantics.
• Log-visibility change is opinionated but justified by the diagnosis experience (it took real live-log instrumentation to find this; the operator UX shouldn't require that).