Mutation gate: five confirmed REX6 survivors and chronic per-mutant timeouts

[RealiCZ]

Summary

The cargo-mutants gate on #348 is red for structural reasons, and a full-timeout re-run surfaced five genuine survivors in REX6-only code.
This issue tracks both: adding the killing tests, and tuning/refactoring the gate so per-mutant timeouts stop drowning the signal.
None of the survivors is a defect in shipped code — current behavior at all five sites was re-verified correct; a survivor means a future regression on that line would not be caught.

Origin: #348 review threads (flyq's consolidated review, vincent-k2026's follow-up with the survivor list, confirmed by local re-verification on 2026-07-24).

Confirmed survivors (line numbers at 2454768)

Verified by applying each mutation and running cargo test -p mega-evm (the gate's package scope): 0 failures = survived.

#	Site	Mutation	Blind spot / future-regression shape
1	evm/execution.rs:255	delete ! on the is_eip7702() check in scan_applied_eip7702_authorizations	no test covers an authority that already carries delegation or contract code; miscounts applied-authority accounting (the sibling mutant on the same line's is_empty() check IS killed by the rex5 suite)
2	evm/execution.rs:270	&& → || in the authority_was_empty classification	net-new over-marking (state growth / SALT charge) undistinguished by any test
3	evm/instructions.rs:1813	- → + in create_rex6 (create_contract_storage_gas - drained)	gas overcharge when the storage stipend drains during CREATE; no exact-gas assertion with stipend + create
4	evm/instructions.rs:1944	- → + in sstore (sstore_set_storage_gas - drained)	same shape on the first-write SSTORE surcharge
5	sandbox/execution.rs:400	delete the Err(e) arm of the keyless occupancy-read match	worst shape: fail-closed becomes fail-open — a DB error (e.g. missing witness account) is silently absorbed by the _ => {} arm and the keyless deploy proceeds; no test injects a DB error here

Suggested killing tests: function-level unit tests for the scanner's gates (chain-id, u64::MAX nonce, code gate, simulated-nonce sequencing) for #1/#2; exact-gas assertions under a drained stipend for #3/#4; an erroring-DB harness asserting KeylessDeployError::InternalError for #5.

Chronic timeouts

The gate run on #348 reports 206 mutants tested in 85m: 59 caught, 100 unviable, 47 timeouts — zero missed among completed, but every timeout hits the 132s per-mutant test ceiling.
Clusters: evm/execution.rs 22 (11 in scan_applied_eip7702_authorizations), evm/instructions.rs 13, limit/* 11.
Root cause: the killing tests for the new handler code are full-EVM integration tests, so each mutant pays a full suite run that exceeds the ceiling on a loaded runner.

Remediation direction (ordered)

1. Land the unit tests above — they kill these mutants in milliseconds and deterministically drain most of the timeout cluster (the same functions dominate it).
2. If a residual timeout tail remains, raise the gate's timeout multiplier before reaching for suppressions; none of the current timeouts are equivalent mutants, so mutants/suppressions.toml is the last resort.
3. Possible later refactor of the gate itself (not scheduled): a fast test tier for mutant runs (unit-only profile), sharding the mutant list across runners, and/or treating timeout as inconclusive-with-report instead of gate-red so genuine missed results stay visible.

REX6-only accounting throughout, so this is pre-stabilization work: it should land before REX6 is scheduled anywhere, together with #353.