Summary
The cargo-mutants gate on #348 is red for structural reasons, and a full-timeout re-run surfaced five genuine survivors in REX6-only code.
This issue tracks both: adding the killing tests, and tuning/refactoring the gate so per-mutant timeouts stop drowning the signal.
None of the survivors is a defect in shipped code — current behavior at all five sites was re-verified correct; a survivor means a future regression on that line would not be caught.
Origin: #348 review threads (flyq's consolidated review, vincent-k2026's follow-up with the survivor list, confirmed by local re-verification on 2026-07-24).
Confirmed survivors (line numbers at 2454768)
Verified by applying each mutation and running cargo test -p mega-evm (the gate's package scope): 0 failures = survived.
| # |
Site |
Mutation |
Blind spot / future-regression shape |
| 1 |
evm/execution.rs:255 |
delete ! on the is_eip7702() check in scan_applied_eip7702_authorizations |
no test covers an authority that already carries delegation or contract code; miscounts applied-authority accounting (the sibling mutant on the same line's is_empty() check IS killed by the rex5 suite) |
| 2 |
evm/execution.rs:270 |
&& → || in the authority_was_empty classification |
net-new over-marking (state growth / SALT charge) undistinguished by any test |
| 3 |
evm/instructions.rs:1813 |
- → + in create_rex6 (create_contract_storage_gas - drained) |
gas overcharge when the storage stipend drains during CREATE; no exact-gas assertion with stipend + create |
| 4 |
evm/instructions.rs:1944 |
- → + in sstore (sstore_set_storage_gas - drained) |
same shape on the first-write SSTORE surcharge |
| 5 |
sandbox/execution.rs:400 |
delete the Err(e) arm of the keyless occupancy-read match |
worst shape: fail-closed becomes fail-open — a DB error (e.g. missing witness account) is silently absorbed by the _ => {} arm and the keyless deploy proceeds; no test injects a DB error here |
Suggested killing tests: function-level unit tests for the scanner's gates (chain-id, u64::MAX nonce, code gate, simulated-nonce sequencing) for #1/#2; exact-gas assertions under a drained stipend for #3/#4; an erroring-DB harness asserting KeylessDeployError::InternalError for #5.
Chronic timeouts
The gate run on #348 reports 206 mutants tested in 85m: 59 caught, 100 unviable, 47 timeouts — zero missed among completed, but every timeout hits the 132s per-mutant test ceiling.
Clusters: evm/execution.rs 22 (11 in scan_applied_eip7702_authorizations), evm/instructions.rs 13, limit/* 11.
Root cause: the killing tests for the new handler code are full-EVM integration tests, so each mutant pays a full suite run that exceeds the ceiling on a loaded runner.
Remediation direction (ordered)
- Land the unit tests above — they kill these mutants in milliseconds and deterministically drain most of the timeout cluster (the same functions dominate it).
- If a residual timeout tail remains, raise the gate's timeout multiplier before reaching for suppressions; none of the current timeouts are equivalent mutants, so
mutants/suppressions.toml is the last resort.
- Possible later refactor of the gate itself (not scheduled): a fast test tier for mutant runs (unit-only profile), sharding the mutant list across runners, and/or treating
timeout as inconclusive-with-report instead of gate-red so genuine missed results stay visible.
REX6-only accounting throughout, so this is pre-stabilization work: it should land before REX6 is scheduled anywhere, together with #353.
Summary
The
cargo-mutants gateon #348 is red for structural reasons, and a full-timeout re-run surfaced five genuine survivors in REX6-only code.This issue tracks both: adding the killing tests, and tuning/refactoring the gate so per-mutant timeouts stop drowning the signal.
None of the survivors is a defect in shipped code — current behavior at all five sites was re-verified correct; a survivor means a future regression on that line would not be caught.
Origin: #348 review threads (flyq's consolidated review, vincent-k2026's follow-up with the survivor list, confirmed by local re-verification on 2026-07-24).
Confirmed survivors (line numbers at 2454768)
Verified by applying each mutation and running
cargo test -p mega-evm(the gate's package scope): 0 failures = survived.evm/execution.rs:255!on theis_eip7702()check inscan_applied_eip7702_authorizationsis_empty()check IS killed by the rex5 suite)evm/execution.rs:270&&→||in theauthority_was_emptyclassificationevm/instructions.rs:1813-→+increate_rex6(create_contract_storage_gas - drained)evm/instructions.rs:1944-→+insstore(sstore_set_storage_gas - drained)sandbox/execution.rs:400Err(e)arm of the keyless occupancy-read match_ => {}arm and the keyless deploy proceeds; no test injects a DB error hereSuggested killing tests: function-level unit tests for the scanner's gates (chain-id,
u64::MAXnonce, code gate, simulated-nonce sequencing) for #1/#2; exact-gas assertions under a drained stipend for #3/#4; an erroring-DB harness assertingKeylessDeployError::InternalErrorfor #5.Chronic timeouts
The gate run on #348 reports
206 mutants tested in 85m: 59 caught, 100 unviable, 47 timeouts— zero missed among completed, but every timeout hits the 132s per-mutant test ceiling.Clusters:
evm/execution.rs22 (11 inscan_applied_eip7702_authorizations),evm/instructions.rs13,limit/*11.Root cause: the killing tests for the new handler code are full-EVM integration tests, so each mutant pays a full suite run that exceeds the ceiling on a loaded runner.
Remediation direction (ordered)
mutants/suppressions.tomlis the last resort.timeoutas inconclusive-with-report instead of gate-red so genuinemissedresults stay visible.REX6-only accounting throughout, so this is pre-stabilization work: it should land before REX6 is scheduled anywhere, together with #353.