feat(early-kickout): tune production kickout thresholds

[stedfn]

Tunes the early-kickout thresholds to the values settled in the protocol-status meeting: a 1000-block grace window at the start of each epoch, at least 100 missed chunks, and under 80% chunk production. Behind ProtocolFeature::EarlyKickout (v152, nightly only); off the feature the gate is false and behavior is unchanged.

The miss floor rises from 20 to 100. The per-producer sample-size floor (EARLY_KICKOUT_MINIMUM_OBSERVED_BLOCKS = 50) is removed and replaced by a start-of-epoch grace: no producer is blacklisted until the anchor is at least 1000 blocks into its epoch, so upgrade-restart downtime early in an epoch does not trigger kickout. The grace is a height grace (anchor height minus epoch-start height), enforced in the shared blacklist_for_epoch gate that both the record-block seeder and the get_chunk_producer_blacklist accessor call, so the two cannot drift.

Both callers resolve the epoch start defensively: at genesis the EpochStart row does not exist yet, so a missing start is treated as "just started" (grace, empty blacklist); any other lookup error propagates rather than being masked as an empty blacklist.

Tests recalibrate the blacklist math for the 100-miss floor, grow the integration drives past the 1000-block grace, add a grace-boundary test that also checks the seeder and accessor agree at the first active anchor, and make the epoch-boundary-reset test non-vacuous under the grace.

[codecov]

Codecov Report

❌ Patch coverage is 88.46154% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.31%. Comparing base (3ca97df) to head (c821cfb).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
chain/epoch-manager/src/adapter.rs	84.61%	1 Missing and 1 partial ⚠️
chain/epoch-manager/src/lib.rs	92.30%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #16049      +/-   ##
==========================================
+ Coverage   73.27%   73.31%   +0.03%     
==========================================
  Files         857      857              
  Lines      188902   189206     +304     
  Branches   188902   189206     +304     
==========================================
+ Hits       138412   138707     +295     
+ Misses      46075    46070       -5     
- Partials     4415     4429      +14     

Flag	Coverage Δ
pytests-nightly	1.22% <0.00%> (-0.01%)	⬇️
unittests	69.95% <0.00%> (+0.04%)	⬆️
unittests-nightly	69.98% <88.46%> (+0.04%)	⬆️
unittests-spice	65.59% <88.46%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Pull request overview

Tunes the nightly EarlyKickout (v152) thresholds to values agreed in the protocol-status meeting: miss floor raised from 20 to 100, per-producer sample-size floor removed, and a 1000-block start-of-epoch grace window added to absorb upgrade-restart downtime. The grace is enforced inside the shared blacklist_for_epoch helper so the record-block seeder and the get_chunk_producer_blacklist accessor cannot drift, with both callers defensively resolving a missing EpochStart row (genesis / pre-genesis) as "just started" while propagating any other error. Tests are recalibrated for the new floor, driven past the 1000-block grace, and a grace-boundary test additionally cross-checks that the seeder and the accessor pick the same producer at the exact activation edge.

Changes:

• EARLY_KICKOUT_MIN_MISSES 20 → 100; removed EARLY_KICKOUT_MINIMUM_OBSERVED_BLOCKS; added EARLY_KICKOUT_EPOCH_GRACE_BLOCKS = 1000
• blacklist_for_epoch gains a blocks_into_epoch parameter; returns empty inside the grace window
• Accessor (get_chunk_producer_blacklist) and seeder (seed_chunk_producers) both compute blocks_into_epoch from the aggregator's epoch, mapping EpochOutOfBounds from a missing epoch-start row to anchor_height (grace, empty) and propagating any other error
• Tests recalibrated for the 100-miss floor; nightly tests drive past 1000 blocks; new get_chunk_producer_blacklist_respects_epoch_grace verifies the exact grace boundary and seeder/accessor agreement; boundary-reset test grown to a length > grace so the epoch-mismatch reset is non-vacuous
• Changelog entry added

Reviewed changes

Per-file summary

File	Description
CHANGELOG.md	New nightly-feature entry describing the tuned thresholds
chain/epoch-manager/src/lib.rs	Constants retuned; blacklist_for_epoch takes blocks_into_epoch; seeder computes it with EpochOutOfBounds → "just started" fallback
chain/epoch-manager/src/adapter.rs	Accessor computes blocks_into_epoch (same fallback), uses read-guard EpochManager methods directly to avoid re-taking self.read()
chain/epoch-manager/src/tests/early_kickout.rs	Blacklist-math tests recalibrated; nightly drivers grown past 1000 blocks; new grace-boundary test; drive_targeted_misses restricted to stable

Findings

Non-blocking (nits, follow-ups, suggestions):

• chain/epoch-manager/src/tests/early_kickout.rs:514 — Doc comment on seeded_rows_match_blacklist_aware_sampler now starts with lowercase // the seeded .... It looks like an accidental edit while touching the surrounding block — the sentence is standalone, so it should be // The seeded ....
• CHANGELOG.md:17 — The entry references #15843 (the feature-introduction PR) rather than this PR (#16049). If the intent is to describe the tuned feature as of merge, referencing the current PR (or both) is more discoverable; if feat(early-kickout): early chunk producer kickout blacklisting #15843 is the canonical link on purpose, ignore.
• chain/epoch-manager/src/tests/early_kickout.rs:773 — Unrelated to the tuning: the seed_walk_bounded_under_finality_stall docstring gains a "(a future cache tightens it)" aside. Comment references unimplemented future work and will rot; consider dropping it or linking a tracking issue.

✅ Approved