fix(evm): make EnrichedMegaTx's cached tx_size/da_size reachable

[RealiCZ]

Summary

EnrichedMegaTx<T>'s MegaTransactionExt override for tx_size/estimated_da_size could never dispatch — the trait methods carry a where Self: Encodable2718 bound that EnrichedMegaTx never satisfied, so every caller silently recomputed from the raw inner transaction instead of reusing the precomputed fields.
This defeated the entire purpose of the wrapper: mega-reth's sequencer hot path already precomputes da_size/tx_size (often from a cheap mempool-cached value) and wraps it in EnrichedMegaTx expecting it to be reused, but MegaBlockExecutor::run_transaction ignored that and recomputed every time.
Closes #324.

Fix:

• Add impl Encodable2718 for EnrichedMegaTx<T> (delegating to the inner transaction) so the bound is satisfiable.
• run_transaction's existing signature is untouched — it's shared with the standard BlockExecutor::execute_transaction_with_commit_condition path, which is constrained by alloy_evm's ExecutableTx and can't require MegaTransactionExt.
• Add a new opt-in run_transaction_enriched / execute_mega_transaction_enriched entry point that reads tx_size/da_size from the outer Tx (hitting EnrichedMegaTx's cache) instead of unwrapping to the raw inner transaction.
• Benchmarked the isolated call cost: recompute is ~410-780ns depending on calldata size; the fixed path is ~0.36-0.37ns, matching a raw field read (crates/mega-evm/benches/enriched_tx.rs).

Trust boundary hardening:

• run_transaction_enriched feeds Tx-reported tx_size/da_size directly into pre_execution_check's consensus-relevant limit checks with no validation, and EnrichedMegaTx::new is a public constructor that accepts arbitrary values. Added a debug_assert cross-check against a fresh recompute (compiled out in release, so it costs nothing in production) and documented the caller contract on both run_transaction_enriched and EnrichedMegaTx::new.
• This is safe for the current single-sequencer architecture (the cache is always computed by the same trusted process); the doc comments call out that a future validation-path use of this method would need a different guarantee.

Test plan

• New unit test asserts EnrichedMegaTx's trait-dispatched tx_size/estimated_da_size/tx_hash return the stored fields, not a recomputed value.
• New MegaBlockExecutor integration test proves the fix changes real behavior: with a tx_da_size_limit set between a deliberately understated stored da_size and the real recomputed value, the same transaction is rejected under run_transaction and — before the debug_assert was added — was accepted under run_transaction_enriched.
• A second test (#[cfg(debug_assertions)], #[should_panic]) proves the debug_assert safety net actually catches that exact mismatch in debug/test builds. Verified it correctly does not run under cargo test --release (the assert compiles out there by design — documented as the intended profile-dependent trade-off, not an oversight).
• Ran the diff-scoped cargo mutants --in-diff gate locally against the full change: 0 missed mutants.
• Full cargo test -p mega-evm (debug and --release) and cargo test -p mega-evme pass.
• cargo fmt --all --check, cargo clippy --workspace --lib --examples --tests --benches --all-features --locked (debug and --release, checked for unused-import regressions from the new cfg(debug_assertions) gating), cargo sort --check, cargo doc -p mega-evm --no-deps (no new warnings), and the no_std/riscv64 target check all pass.
• cargo bench -p mega-evm --bench enriched_tx run locally to verify the new benchmark actually executes (not just compiles).

[github-actions]

🧬 Mutation testing — ✅ PASS

Nothing to test — no mutants were generated on the changed lines.

[codecov]

Codecov Report

❌ Patch coverage is 97.05882% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 94.6%. Comparing base (5a2ea61) to head (50589a9).

Files with missing lines	Patch %	Lines
crates/mega-evm/src/block/helpers.rs	83.3%	1 Missing ⚠️

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[claude]

Label check

The spec:stable and api:compatible labels look correct now.

Missing comp:misc
mutants/suppressions.toml lives in the mutants/ directory at the repo root, outside all component crates, so comp:misc should be added alongside comp:core to accurately reflect that this PR touches non-core repo infrastructure.

[github-actions]

🧬 Mutation testing — ✅ PASS

Diff mutation score: 100.0% (2/2 viable mutants killed)

• caught: 2
• survived (real gaps): 0
• timed out (inconclusive): 0
• suppressed (equivalent/dead-code): 0
• unviable: 11 · timeout total: 0

No new test gaps introduced by this change. 🎉

[claude]

⚠️ 1 finding

• Summary: focused re-review of the EnrichedMegaTx cache-reachability fix, the new run_transaction_enriched entry point, and its test/bench surface.
• Nice: the debug_assert cross-check on run_transaction_enriched closes the trust-boundary risk of EnrichedMegaTx::new accepting arbitrary sizes without paying anything in release, and the #[cfg(debug_assertions)] #[should_panic] test proves that safety net actually fires on a mismatch — profile-dependent trade-off is documented on the method rather than left as a footgun.
• The run_transaction / run_transaction_enriched / run_transaction_with_sizes split cleanly separates the two size-resolution paths without changing the existing BlockExecutor-backed signature, and the mutation-test refresh replaces the suppressed-as-dead entry with a real assertion that the stored fields are what dispatches.
• Inline comments: 1 anchorable finding on the new Encodable2718 for EnrichedMegaTx<T> impl (type_flag delegation is incomplete).
• No still-open prior review threads.

[RealiCZ]

Thanks for the re-review. Addressed the inline type_flag finding directly on the thread (verified it wasn't actually mis-framing today, applied the suggested delegation anyway for consistency with this file's other trait impls — see 446020e).

Also went back and closed the codecov patch-coverage gap (14 lines, 67.4%) that was still open at that point: execute_mega_transaction_enriched had no test caller at all, and run_transaction_enriched's only test deliberately panics via its debug_assert before ever reaching the success path — so there was no happy-path test proving the enriched path actually succeeds and returns the cached values when they're accurate. Added one (446020e), reran scripts/coverage_mega_evm.sh locally to confirm all 14 lines are now covered.

comp:misc label added per the earlier bot comment — mutants/suppressions.toml is repo infra outside any crate, so that was a fair catch.

[claude]

Clean

• Reviewed the EnrichedMegaTx cache-plumbing fix: new Encodable2718 for EnrichedMegaTx impl to satisfy the trait bound, additive run_transaction_enriched / execute_mega_transaction_enriched entry points that read cached sizes, debug_assert cross-check against a fresh recompute, and matching tests + benchmark.
• run_transaction (shared with BlockExecutor::execute_transaction_with_commit_condition) is left untouched, so existing callers keep the recomputing behavior — the new path is opt-in.
• Trust-boundary risk (public EnrichedMegaTx::new + no release-mode revalidation before consensus-relevant limit checks) is called out explicitly in the doc comments on both EnrichedMegaTx::new and run_transaction_enriched, and the debug_assert gives a debug/CI safety net at zero release cost.
• Tests: the debug-only should_panic test proves the safety net actually fires on a mismatched cache, and the release-safe happy-path test proves execute_mega_transaction_enriched returns an outcome carrying the cached values.
• No new actionable findings.
• Still open from earlier reviews: none — the prior type_flag delegation thread was addressed in 446020e and has now been resolved.

[claude]

⚠️ 1 finding

• Summary: reviewed the refactor unifying run_transaction and the removed run_transaction_enriched back into one entry point (fd4e93d), plus the OverriddenTx / Recovered<&MegaTxEnvelope> trait plumbing and the reworked block-executor tests.
• Inline comments: 1 anchorable finding on the new pub fn run_transaction_with_sizes docstring.
• Body-only items:
  • PR description is stale after the final refactor commit. It still says "run_transaction's existing signature is untouched" and describes a new opt-in run_transaction_enriched / execute_mega_transaction_enriched entry point, but the last commit unified those back into run_transaction and added MegaTransactionExt + Encodable2718 bounds to it — a real API-surface change reviewers relying on the description would miss. Worth updating before the squash-merge, since the PR body is the default squash-commit body.
• Still open from earlier reviews: none (prior type_flag delegation and CodeQL nonce threads are both resolved).

Positive notes on the refactor itself:

• Unifying run_transaction and run_transaction_enriched via a MegaTransactionExt + Encodable2718 bound is a clean simplification — callers no longer pick a variant, and the trait-dispatched read of tx_size/da_size is the same code path for both cached and bare txs.
• Adding the debug_assert cross-check on run_transaction (and pushing the trust-boundary doc onto it) is a nice consolidation of the safety net — a bare tx passes trivially, a cached override gets validated in debug/test builds.
• The new Encodable2718 for EnrichedMegaTx<T> and OverriddenTx<T> delegations look correct: they forward to the inner tx, so any consensus-relevant encoded-size read is faithful to the raw transaction.

[claude]

[Minor] run_transaction_with_sizes is now pub, but its docstring lacks the trust-boundary warning that run_transaction carries. Sizes flow directly into BlockLimiter::pre_execution_check (via its tx_encode_size_limit/tx_da_size_limit/block cumulative-size checks) with no validation and — unlike run_transaction — no debug_assert cross-check, so an external caller reaching for this as a mere "I already have the sizes, skip recomputation" optimization can silently bypass consensus-relevant limits.

The only in-crate caller besides run_transaction is execute_transaction_with_commit_condition in the same file (which recomputes fresh sizes on line 649–650), so the pub visibility is only meaningful for external callers. If pub is intentional, please duplicate (or explicitly link to) the "Correctness" section from run_transaction so callers see the same warning they would have seen if they had implemented MegaTransactionExt. Alternatively consider pub(crate) — external callers who want the shortcut can implement MegaTransactionExt and get the debug_assert safety net for free.

Suggested change

	/// the sizes for you and cross-checks any cached values.
	/// Shared body of [`MegaBlockExecutor::run_transaction`] and the `alloy_evm`
	/// block-execution path: `tx_size`/`da_size` are resolved by the caller (recomputed or read
	/// from a cache), this only consumes them.
	///
	/// This is the escape hatch for callers whose `Tx` cannot implement [`MegaTransactionExt`]
	/// (e.g. the `alloy_evm` `ExecutableTx`-constrained path): they resolve the sizes themselves
	/// and pass them in. Prefer [`MegaBlockExecutor::run_transaction`] otherwise, which resolves
	/// the sizes for you and cross-checks any cached values.
	///
	/// # Correctness
	///
	/// `tx_size`/`da_size` feed directly into `BlockLimiter::pre_execution_check` (via its
	/// `tx_encode_size_limit`/`tx_da_size_limit`/block cumulative-size checks) with **no**
	/// validation against the real encoded transaction, and (unlike
	/// [`MegaBlockExecutor::run_transaction`]) **no** `debug_assert` cross-check. Callers MUST
	/// ensure the values accurately reflect `tx` — an understated value lets a transaction
	/// bypass a limit it should have been rejected by. Prefer implementing
	/// [`MegaTransactionExt`] on `Tx` and calling [`MegaBlockExecutor::run_transaction`]
	/// instead, which gains the cross-check safety net for free.

[claude]

🧭 Re-review update

• Reviewed the incremental diff since 446020e: the refactor (fd4e93d) folds run_transaction_enriched back into a single run_transaction<Tx: MegaTransactionExt + Encodable2718 + Copy> — dispatching sizes through the trait so EnrichedMegaTx reuses its cache while a bare Recovered<...> uses the recomputing default, with the debug_assert cross-check now sitting on the unified entry — plus the added Recovered<&MegaTxEnvelope> test coverage (50589a9). The unification is a nice simplification: one entry point, choice made at compile time, and the trust-boundary contract lives with the primary API.
• Verified: (a) removed mutation suppressions match the newly reachable overrides, and the fresh EnrichedMegaTx / Recovered<&MegaTxEnvelope> mutation tests cover them; (b) the alloy_evm::execute_transaction_with_commit_condition path still recomputes and routes through run_transaction_with_sizes, so its size semantics are unchanged from before the PR; (c) new Typed2718/Encodable2718/MegaTransactionExt impls on bin/mega-evme OverriddenTx<T> correctly delegate to inner, so replay callers satisfy the new bounds without changing execution semantics.
• No new actionable findings this round.

Still open from earlier reviews:

• crates/mega-evm/src/block/executor.rs:424 — run_transaction_with_sizes docstring still lacks the trust-boundary warning that run_transaction carries. Since the refactor kept it pub as the escape hatch for the ExecutableTx-constrained path and it has no debug_assert safety net, external callers reaching for it as a size-shortcut can still silently bypass tx_encode_size_limit/tx_da_size_limit/block cumulative-size checks. Either duplicate/link the Correctness section from run_transaction, or narrow visibility to pub(crate) — the only in-tree caller besides run_transaction is execute_transaction_with_commit_condition in the same file.

[vincent-k2026]

Retracted.

[vincent-k2026]

LGTM.