Summary

The Reset drain loop at SubtreeProcessor.go:1355-1361 silently drops one boundary batch per Reset call. Fix: introduce LockFreeQueue.dequeueBatchUntil (peek-before-dequeue) and rewrite the drain loop to use it.

The bug

validUntilMillis := time.Now().UnixMilli()
for {
    batch, found := stp.queue.dequeueBatch(0)
    if !found || batch.time > validUntilMillis {
        // we are done
        break
    }
}

dequeueBatch(0) bypasses the queue filter and removes the head batch unconditionally. Then batch.time is checked. If the batch is too new, the loop breaks - but the batch is already gone from the queue and nothing puts it back. Net effect: one batch worth of fresh txs lost per Reset call.

Reset runs during reorgs, FSM transitions, and recovery operations. Under heavy concurrent enqueue (the documented use case for this codebase), each Reset statistically catches a batch in the window between time.Now() snapshot and the drain reaching the boundary. Those txs never get mined.

Fix

New dequeueBatchUntil on LockFreeQueue with inclusive-until semantics (admit iff batch.time <= maxTimeMillis). Peeks at batch.time before removing the batch, so the boundary batch is never lost.

The Reset drain becomes:

validUntilMillis := stp.clock.Now().UnixMilli()
for {
    if _, found := stp.queue.dequeueBatchUntil(validUntilMillis); !found {
        break
    }
}

Also switches the time anchor from time.Now() to stp.clock.Now() so the Reset path runs through the existing clock seam - consistent with the other validFromMillis call sites and necessary for deterministic future testing of Reset under reorg pressure.

Test changes

• New Test_dequeueBatchUntilPreservesPostBoundaryBatch - regression guard. Enqueues a pre-snapshot and a post-snapshot batch via the clock seam, drains up to the snapshot, asserts the post-snapshot batch survives in the queue. Also covers the inclusive boundary (batch.time == maxTimeMillis admits) and the empty-queue case.

Test plan

• go vet ./services/blockassembly/subtreeprocessor/ - clean
• go test -race -count=1 ./services/blockassembly/subtreeprocessor/ - pass (155s). TestResetMarksAssemblyTxsAsNotOnLongestChainBeforeClearing still passes - Reset behavior is preserved for the documented invariants.
• go test -race -count=1 ./services/blockassembly/ - pass (101s).

Series context

Fourth in a series from the same investigation:

• test(blockassembly/subtreeprocessor): add clock seam for deterministic tests #841 (merged) - clock seam: package-level clock interface enabling deterministic time-dependent tests.
• fix(blockassembly/subtreeprocessor): zero-guard validFromMillis in dequeueDuringBlockMovement #846 (merged) - zero-guard validFromMillis in dequeueDuringBlockMovement.
• test(blockassembly/subtreeprocessor): rapid property tests for validFromMillis admit logic #848 (open) - rapid property tests for the validFromMillis admit logic.
• this PR - Reset drain boundary fix.

Independent of #848 - depends only on #841's clock seam (already on main).