Routing gate coverage matrix

Routing gate coverage matrix

Auto-generated by scripts/routing_gate_coverage.py under CPython 3.11 with PYTHONHASHSEED=0 (the arc model is interpreter-specific and operand-level coverage is hash-seed sensitive). Do not edit by hand; run the script to regenerate.

Each row is a branch point (a gate) in a layout/routing/ dispatch handler or post-pass. A gate has two or more arms; the cells list how many corpus fixtures exercise each arm. An arm reached by 0 fixtures is an un-exercised gate arm: either no shipped topology takes that path (author a fixture, or confirm it is defensive/dead).

974/1318 gates fully exercised (both/all arms hit by some fixture); 344 gates have at least one un-exercised arm.

Modules scoped to routing decision gates; invariants.py (the validate=True checker) and __init__.py are excluded.

The Triage column carries a curated verdict for gaps no fixture can close: defensive (a guard arm a valid topology never violates), candidate-dead (no constructible topology reaches it; left in place pending a separate deletion review), or needs-review (not yet classified). A blank cell means the gap is still open for a fixture. 260 gaps carry a triage verdict.

arranger.py

1/1 gates fully exercised.

All gates have every arm exercised by the corpus.

bundle.py

5/10 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
51	if abs(dx) > COORD_TOLERANCE and abs(dy) > COORD_TOLERANCE:	->L52
111	if n_legs < 1:	->L112	defensive — Defensive guard: build_concentric_bundle rejects a centreline of fewer than two vertices. Every caller (route_along / route_straight and the handler centrelines) builds a >=2-vertex polyline, so the raise arm is never taken.
181	if n_legs < 1:	->L182	defensive — Defensive guard: build_tapered_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken.
183	if not 0 <= transition_leg <= n_legs:	->L184	defensive — Defensive guard: build_tapered_bundle rejects a transition_leg outside [0, n_legs]. Handlers pass a literal 1 against a 3- or 4-vertex centreline, so the raise arm is never taken.
245	if n_legs < 1:	->L246	defensive — Defensive guard: build_offset_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle and build_tapered_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken.

centrelines.py

5/5 gates fully exercised.

All gates have every arm exercised by the corpus.

common.py

106/145 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
133	if junction is None:	->L134
136	if len(pts) < 2:	->L137
156	if not any(	->L164
339	if top is None or bottom is None:	->L340	defensive — Defensive in iter_inter_row_gaps (consumed by inter_row_gap_upper_row and _inter_row_gap_band): adjacent rows in the sorted section-row set both contain sections, so row_bottom_edge / row_top_edge resolve; the None skip arm guards a row with no sections that the iteration never yields.
473	if not facing:	->L474
485	if s.bbox_h <= 0:	->L486	defensive — Degenerate-bbox guard in _grid_row_bands: a laid-out section always has bbox_h > 0, so the skip arm only protects against a zero/negative-height section that the layout never produces.
532	if right > left and left - tol <= x <= right + tol:	->L533
584	if n == 0:	->L585	defensive — Empty-bundle guard: all callers (normalize.py 291/1648, inter_section_handlers.py 783/796/2132) derive bundle_widths from a non-empty bundle line count, so n is always >=1; the empty-list arm is never taken.
586	if bundle_index < 0 or bundle_index >= n:	->L587	defensive — Contract guard raising IndexError on an out-of-range bundle_index. Callers always pass an in-range index (0<=i<n); the raise arm fires only on a caller-contract violation no valid call produces.
825	if abs(pts[k - 1][0] - x0) > COORD_TOLERANCE:	->L826	defensive — Interior horizontal segments only occur in 6-point bypass U-shapes whose flanking legs are always vertical (same x on each side); routes with non-vertical flanks are normalize_exempt and filtered out. The prev-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
827	if abs(pts[k + 2][0] - x1) > COORD_TOLERANCE:	->L828	defensive — Mirror of the prev-flank guard: a bypass trunk’s trailing flank is always vertical, so the next-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
858	if abs(y4 - y3) > COORD_TOLERANCE or abs(x4 - x3) <= COORD_TOLERANCE:	->L859	defensive — Trunk-not-horizontal guard in port_peeloff_tail, reached only after the earlier port-lead and riser checks returned early. In an orthogonal route segments alternate H/V, so the segment preceding a vertical riser is always horizontal; instrumenting the corpus the guard is reached but the non-horizontal-trunk arm never fires. Defensive against a degenerate collinear tail the router does not produce.
932	if trunk_ys[-1] - trunk_ys[0] <= COORD_TOLERANCE:	->L933	needs-review — Degenerate single-Y trunk band in iter_port_peeloff_bundles: a peel-off bundle is yielded only when its members ride trunks at distinct depths, so the equal-depth arm guards a same-Y bundle the trunk-slot materialization never leaves; render-diff confirms no visual change.
937	if len(signs) != 1:	->L938	defensive — Mixed-peel-end guard in iter_port_peeloff_bundles: a concentric peel-off bundle into a LEFT entry port is always fed from the left, so every member’s trunk traverses toward the peel corner with the same trunk_sign. Lines approaching from the right of the port form an entry-wrap route, not a peel-off tail (verified: a right-side source produces zero peel tails), so the bundle never mixes signs. Belt-and-suspenders beyond the contiguity check.
1040	if not src or not tgt:	->L1041	defensive — Null-endpoint guard: the parser creates a Station for every edge endpoint, so graph.stations.get() never returns None for a real edge; the continue arm only guards a malformed graph.
1102	elif tgt_sec:	->L1110	defensive — The else (col_key=round(sx)) needs an L-shaped (dx!=0,dy!=0) inter edge whose target resolves to no section. Only exit_port->junction edges lack a target section, and junction positioning makes those axis-aligned (same-X RIGHT exit or same-Y BOTTOM exit), never L-shaped, so the else is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1197	if dx > 0:	->L1200	defensive — Leftward (dx<=0) near-source fallback: the symmetric mirror of the rightward fallback. Reached only when section info is unavailable AND no adjacent column resolves; valid layouts take the rightward fallback, but the leftward mirror is kept for robustness.
1208	if st is not None and st.is_port:	->L1206	defensive — Null/non-port guard: after _resolve_sections both endpoints of an inter-section edge are ports/junctions and graph.stations.get() resolves them, so the False (None or non-port) arm only guards a malformed pre-resolve graph.
1257	if sec.bbox_w <= 0:	->L1258	defensive — Zero-width-section guard: the loop scans all graph.sections, but after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts don’t produce.
1305	if sec.bbox_w <= 0:	->L1306	defensive — Zero-width-section guard in the squeeze re-centring loop: like its #1 twin, after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts do not produce.
1339	if src and not src.is_port:	->L1337	defensive — Null/port-source guard: edges to an exit port always originate at an internal (non-port) station after _resolve_sections, so the continue arm (None or port source) only guards a malformed pre-resolve graph.
1355	for i in range(len(pts) - 1):	->L1356, ->L1372	defensive — point_on_polyline is used only by the —animate renderer (render/animate.py); the matrix’s render-path coverage sweep calls render_svg without animation, so none of its branches are reached. Exercised instead by test_animation.py / test_routing.py.
1360	if seg_len2 == 0:	->L1361, ->L1364	defensive — point_on_polyline degenerate-segment branch, reached only via the —animate renderer (render/animate.py); the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py, not the corpus.
1361	if abs(point[0] - ax) <= tol and abs(point[1] - ay) <= tol:	->L1362, ->L1363	defensive — point_on_polyline zero-length-segment hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1365	if t < -0.01 or t > 1.01:	->L1366, ->L1367	defensive — point_on_polyline parameter-range branch, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1370	if abs(point[0] - proj_x) <= tol and abs(point[1] - proj_y) <= tol:	->L1355, ->L1371	defensive — point_on_polyline projection hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1432	if all_in_range:	->L1434	defensive — cross_row bypass guard: the False arm (no sections in the column range -> return clearance) needs an empty [lo,hi] column span, which a valid multi-section pipeline routing cross_row never has; a degenerate-range guard.
1457	if endpoints:	->L1460	defensive — Non-cross_row bypass guard: the endpoints list always includes the source and target sections (both in src_row), so it is never empty; the default-clearance arm only guards a degenerate empty endpoint set.
1470	if src_row is not None:	->L1482	defensive — Header-clamp guard: the False arm (src_row is None) needs an unresolvable source section, but inter-section bypass sources always resolve to a grid row after layout; a guard against an unresolved source that doesn’t occur.
1552	if station is None:	->L1553	defensive — None-station guard: every production caller passes a concrete Station (grep-verified); the None arm only guards the typed Station|None parameter.
1558	for e in graph.edges_to(station.id):	->L1580	defensive — Upstream edges_to loop-exit: every fan-out junction is emitted with an exit_port->junction edge whose source carries the source section id, so the upstream loop always returns; the fall-through to the type-contract return None is the never-taken no-upstream fallback.
1560	if other and other.section_id:	->L1558	defensive — edges_to upstream guard: a junction’s incoming neighbour is always an exit_port with section_id set, so the False (continue) arm only guards a junction-to-junction edge that valid construction never produces.
1562	if sec:	->L1558	defensive — edges_to section-lookup guard: graph.sections.get(section_id) returning None requires a section_id absent from graph.sections, a corrupted state no valid parse produces; null-guard.
1568	for e in graph.edges:	->L1580	defensive — No-preference graph.edges scan loop-exit: a fan-out junction always has a sectioned incident port (its exit/entry ports carry a section_id), so the loop always returns and never exhausts graph.edges; the fall-through to the type-contract return None is the never-taken no-neighbour fallback.
1570	if e.source == station.id:	->L1571	defensive — Junction-as-source arm of the no-preference scan: fan-out junctions are emitted exit_port->junction before junction->entry_port, so graph.edges encounters the junction as a target (elif arm) first and returns; the source arm is a cheap structural guard whose deadness rests on emit order, not a hard type invariant.
1576	if other and other.section_id:	->L1568	defensive — prefer_upstream=False neighbour guard: a junction’s neighbours are always sectioned ports, so the False (continue) arm only guards a junction-to-junction edge valid construction never produces.
1578	if sec:	->L1568	defensive — prefer_upstream=False section-lookup guard: graph.sections.get(section_id) returning None requires a missing section_id (corrupted state); null-guard.
1643	if dy > 0:	->L1648	defensive — Multi-row upward-crossing arm: grid rows are assigned topologically and upward inter-section routes take other handlers (a same-row/around-section path), never reaching inter_row_channel_y’s multi-row branch with dy<=0; verified by an upward multi-row fixture that bypasses this code.
1653	if dy > 0:	->L1654	defensive — Near-target fallback block, gated behind the L801 resolve guard: since every call resolves to different-row sections (see that entry), the fallback is never reached, so neither dy arm fires.

context.py

67/106 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
129	if succ_port and succ_port.is_entry:	->L123	defensive — A merge junction is defined as one whose single successor is the section entry port it was inserted before, so succ_port is always a present entry port; the reject arm (successor absent or non-entry) never fires.
138	if st is None:	->L139	defensive — _col_for_id looks up junction and predecessor IDs that are always present in graph.stations; the missing-station early-return never fires.
144	if not mst:	->L145	defensive — mjid ranges over junctions, a subset of junction_ids all present in graph.stations; the missing-station continue never fires.
147	if tgt_col is None:	->L148	defensive — A merge junction always resolves to a grid column (it sits adjacent to its entry-port section); the unresolved-column continue never fires.
151	for e in graph.edges_from(mjid):	->L165	defensive — The entry-port search finds the merge junction’s sole entry-port successor on the first edge and breaks (real exit arc 139->147), so the loop never runs to exhaustion and the for-completion arm never fires.
153	if ep and ep.is_entry:	->L151	defensive — The merge junction’s only outgoing edge targets its entry port, so the first iteration matches and breaks; the loop-back arm (a non-entry edge before the entry port) never fires.
170	if not pred:	->L171	defensive — edge.source for an edge into the junction is always a present station; the missing-predecessor continue never fires.
214	if m_col is not None:	->L224	defensive — Reached only for junctions in trunk_source, which by construction resolved a column, so m_col is never None and the no-column skip arm never fires.
227	if ep and ep.is_entry:	->L225	defensive — Same merge-junction invariant in the skip-edge pass: the junction’s lone successor is its entry port, so the loop-back over a non-entry edge never fires.
231	if m_col is not None:	->L206	defensive — As the first occurrence, in the index-exclude pass: a trunk-source junction always has a resolved column, so the no-column skip arm never fires.
341	for e in graph.edges:	->L342, ->L344	defensive — In the public compute_junction_fan_info, called only from _guard_fan_bundles_coincide_or_separate (a validate=True guard). The coverage sweep renders with validate=False, so this function never runs on the render path; it is exercised by the layout-invariant test surface instead.
369	if port_st is None:	->L370	defensive — Ports listed in a section’s entry_ports/exit_ports always have a backing station; the missing-station continue never fires.
382	if ctx.station_offsets:	->L384	defensive — compute_station_offsets returns a 0.0 entry for every (station, line) of any graph with edges, so the render path always passes a non-empty dict; the falsy-return arm guards only the route_edges(station_offsets=None) call path used by tests, which the sweep never exercises.
389	if not ctx.station_offsets:	->L390	defensive — Pairs with _get_offset’s guard: compute_station_offsets is never empty on the render path, so _max_offset_at’s early-return arm guards only the route_edges(station_offsets=None) call path used by tests.
437	if port.section_id is None:	->L438, ->L439
469	for pid in section.entry_ports:	->L470, ->L472
470	if line_id in graph.station_lines(pid):	->L469, ->L471
498	if port is not None:	->L499, ->L502
503	for sid in section.station_ids:	->L504, ->L508
505	if not station.is_port:	->L503, ->L506
527	if section is None:	->L528
536	if sec and sec.grid_col >= 0:	->L538	defensive — After section placement every resolved section carries a non-negative grid_col, so the None-return for an unplaced/missing column never fires.
544	if sec and sec.grid_row >= 0:	->L546	defensive — After section placement every resolved section carries a non-negative grid_row, so the None-return for an unplaced/missing row never fires.
558	if sec is None:	->L559	defensive — _resolve_section_colrow is called for ports/junctions that always resolve to a section; the None-section early-return never fires (mirrors the grid-sentinel guards at L395/L403).
598	if psec is None:	->L599
643	if psec is None or pst is None:	->L644
694	if len(sources) != 1:	->L695
697	if jst is None:	->L698
700	if src_col is None or src_row is None:	->L701
708	if tgt is None or not (tgt.is_port or edge.target in graph.junction_ids):	->L709
714	if tcol is None or trow is None:	->L715
724	if len(reach) < 2:	->L725
738	if len({d > 0 for d in drow.values()}) != 1:	->L739
784	if not src or not tgt:	->L785	defensive — Edge endpoints are always present stations; the missing-endpoint continue never fires.
878	if not jst:	->L879	defensive — jid ranges over junction_ids, all present in graph.stations; the missing-station continue never fires.
881	if src_col is None:	->L882	defensive — A fan-out junction always resolves to a grid column; the unresolved-column continue never fires.
919	if not tgt or not (tgt.is_port or edge.target in junction_ids):	->L920	defensive — A junction’s outgoing inter-section edges always target a port or another junction (junctions are synthesised only on exit-port -> entry-port chains); the skip arm for a plain-station target never fires.
922	if tgt_col is None:	->L923	defensive — A junction’s port/junction target always resolves to a grid column; the unresolved-column continue never fires.
1025	if edge.line_id in line_pos:	->L1024	defensive — line_pos is built from the line IDs of the very all_outgoing list this loop iterates, so the membership test is always true: the reject/loop-back arm (L684) is an unreachable tautology and the enter-body static arc (L686) is a phantom of the real 685->687. Vestigial tautological guard. The deliberate gap is pinned by test_genuine_dead_arm_not_masked_as_covered (arc normalization must not merge the never-taken branch onto the live one). Reclassified defensive (#762).

core.py

12/14 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
185	if not src or not tgt:	->L186	defensive — Main edge-loop guard against a missing endpoint station. After section resolution every edge endpoint exists in graph.stations (parse _ensure_station’s all referenced nodes; resolved chains insert their own ports/junctions), so the guard never fires and only the proceed-to-routing arm is reachable.
198	if result is not None:	->L177	defensive — Append-guard after the priority-ordered handler chain. The final handler _route_intra_section is total: its three early returns and its _route_diagonal fallback (annotated -> RoutedPath, single return statement) always yield a RoutedPath, so result is never None and every edge appends. The None arm is unreachable.

corners.py

10/10 gates fully exercised.

All gates have every arm exercised by the corpus.

inter_section.py

0/4 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
98	if pair not in _CW_TURNS and pair not in _CCW_TURNS:	->L-96, ->L99	defensive — Corner.post_init turn-validity check. inter_section.py is the descriptor/documentation module (distinct from inter_section_handlers.py); no src module imports it, so it never loads during the render-corpus sweep (confirmed absent from sys.modules after rendering the whole corpus) and both arms show 0 hits. Corner instances are module-level constants built from valid right-angle turns, so the raise can only fire on a source edit. Exercised by test_inter_section_descriptor.py.
107	if (self.in_tangent, self.out_tangent) in _CW_TURNS:	->L108, ->L109	defensive — Corner.handedness property. Same module-load story: inter_section.py is never imported on the render path, so neither the CW nor the CCW arm is reachable by any render topology. Both branches are exercised by test_inter_section_descriptor.py.
155	for prev, curr in zip(self.corners, self.corners[1:]):	->L156, ->L158	defensive — TurnSequence.parity loop over consecutive corners. parity is descriptor-level documentation (runtime wrap handlers preserve bundle ordering via per-corner offset propagation regardless of this value); nothing on the render path reads it, and the module is never imported during the sweep. Exercised by test_inter_section_descriptor.py.
156	if prev.handedness != curr.handedness:	->L155, ->L157	defensive — Handedness-change counter inside TurnSequence.parity. Off the render path for the same reason (inter_section.py never loaded during rendering); both arms are exercised by test_inter_section_descriptor.py’s parity-contract tests.

inter_section_handlers.py

104/160 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
490	if f.horizontal is Direction.L:	->L493	defensive — Near-vertical same-column junction channel push: the junction always sits right of its same-column LEFT entry, so horizontal is always Direction.L; the Direction.R arm never fires (#762). Defensive.
529	and f.src_row is not None	->L542	defensive — LEFT-entry inter-row L-shape guard. Every LEFT-entry inter-section edge reaching this condition has a resolved source grid row (f.src_col/f.tgt_col are asserted non-None just above and the row resolves alongside), so the f.src_row is None short-circuit out of the L-shape branch is never taken.
530	and f.tgt_row is not None	->L542	defensive — Companion guard to f.src_row in the same LEFT-entry inter-row L-shape condition: the target grid row is likewise always resolved here, so the f.tgt_row is None short-circuit out of the branch is never taken.
552	if section and section.bbox_w > 0:	->L554
560	if section and section.bbox_w > 0:	->L562
586	if _v_segment_crosses_other_section(graph, corner_x, src.y, ey, exclude):	->L587	defensive — Drop-in viability test in _right_entry_drop_in_is_clear (#889). The cross-row RIGHT-entry rule fires only when the earlier bypass / plough rules ceded the edge, i.e. no section sits between source and port, so the outward-side descent runs clear; the not-clear arm covers only an exotic descent blocked by a wide same-column sibling no corpus fixture builds. Defensive.
692	if min(drop_xs) < _section_right_edge(graph, tgt) - COORD_TOLERANCE:	->L693
695	if _v_segment_crosses_other_section(graph, dx, src.y, tgt.y, exclude):	->L696
736	if route is not None:	->L738
785	if src_col is not None and src_col > 0:	->L795
839	if route is not None:	->L842
910	if _corridor_is_viable(ctx, src, tgt):	->L911	needs-review — Reachable only via a defective render (inter-row corridor grazes the source section); see #722.
936	if abs(ep.y - f.sy) < ctx.curve_radius:	->L937	defensive — Merge entry-port Y tracks the source/junction Y, so a sub-curve_radius exit->entry gap never arises (the same-Y rule already handles dy<tol); corpus instrumentation across the fixtures (#762) confirms the arm is never taken. Defensive.
939	if ep_port and ep_port.side == PortSide.LEFT:	->L945	defensive — Contract guard in _route_inter_section: a merge entry port always resolves to a Port on the LEFT side here, so the non-LEFT/None arm (fall through to _route_l_shape at L344) is never taken (0/128). The earlier ‘multiline phantom’ note was inaccurate — this is a recorded gate whose arm is never taken. Defensive guard. Reclassified defensive (#762).
942	if _corridor_is_viable(ctx, src, ep):	->L944	needs-review — Reachable only via a defective render (route skirts/crosses section boundary); see #724.
1415	if ctx.station_offsets:	->L1417	defensive — _run_pass_c_guards always populates ctx.station_offsets before route_edges, and RAILS mode returns earlier; the empty-offsets arm never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1463	if sx >= (left_edge + right_edge) / 2:	->L1466	defensive — Defensive symmetry: a merge feeder junction sits in the inter-column gap downstream of its fork, i.e. right of its source section’s centre, so the exit-right arm always fires in the corpus. The exit-left arm mirrors it for a junction sitting left of centre; no fixture places a merge feeder there.
1504	if src is None or tgt is None:	->L1505	defensive — Endpoint lookup guard in _would_route_around_section_below; every edge endpoint is a registered station after parse+resolve, so graph.stations.get never returns None here. Defensive.
1541	if _would_route_around_section_below(other, ctx):	->L1542	defensive — Competing-sibling detection in _has_around_section_sibling, routed through the dispatch table (#813). A non-bypass sibling feeding the same merge junction sits in an adjacent column or a gap with no same-row intervening section, so it dispatches to an L-shape, not the around-below loop; corpus instrumentation across the fixtures confirms the arm is never taken. Defensive.
1847	if trunk_v_up_pull_away:	->L1856	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
1886	this_xmin - gap_left >= SECTION_ROUTE_CLEARANCE	->L1887, ->L1890
1887	and gap_right - around_xmax >= SECTION_ROUTE_CLEARANCE	->L1889, ->L1890
1966	if src_sec is not None and src_sec.bbox_w > 0:	->L2014	defensive — A bypass source section always resolves and has bbox_w>0 (the parser never emits an empty section); the None/zero-width arm never fires.
2074	if route is None:	->L2075
2102	if route is None:	->L2103	defensive — Defensive in _declare_trunk: _route_inter_section only reaches the declaration after a matched rule (or the L-shape fall-through) produced a route, so the None guard never fires on the corpus; it mirrors _declare_channel’s same guard for a handler that returns None.
2271	while cur is not None and cur not in seen:	->L2287
2280	if cur in graph.junctions:	->L2286
2328	if (	->L2334
2549	if _h_segment_crosses_other_section(graph, src.x, final_x, src.y, exclude):	->L2550	defensive — Traverse-first clearance test in _top_entry_side_fan_traverse_clears (#1349). The below-side fan branch only reaches this gate when its junction also feeds an aligned straight drop; the corpus fan sits a clear row above its target, so the source-Y traverse never crosses another section and the fall-back-to-staircase arm is not exercised. Defensive.
2623	and src_sec is not None	->L2642	defensive — Inter-row exit mid-Y clearance bump (the n>1 multi-line branch). When more than one line shares the exit the source section always resolves, so the src_sec is None short-circuit past the clearance bump is never taken.
2624	and tgt_sec is not None	->L2642	defensive — Companion to src_sec in the same n>1 mid-Y clearance branch: the target section always resolves there, so the tgt_sec is None short-circuit past the bump is never taken.
2646	elif abs(dx) > ctx.curve_radius:	->L2647
2650	if src.id in ctx.graph.junctions:	->L2660	needs-review — Reachable only via a defective render (LR->TB TOP-entry routing); see #720.
2651	for je in ctx.graph.edges_to(src.id):	->L2660
2653	if js and js.is_port:	->L2651	needs-review — Reachable only via a defective render (LR->TB TOP-entry routing); see #720.
2654	if abs(js.x - src.x) <= COORD_TOLERANCE:	->L2657
2966	if tgt_col is not None:	->L2971	defensive — tgt_col from _resolve_section_col on a valid LEFT entry port is always non-None (sections get grid_col>=0 after auto-layout).
2968	if shared_vx is not None:	->L2971	defensive — _fan_left_entry_descent_x returns None only when col_left<=0; col_left_edge for the target’s own column is always >0.
3017	if entry_side is PortSide.LEFT:	->L3020
3052	if entry_port is None:	->L3053	defensive — _route_around_section_below is always called with a non-None entry_port (both dispatch sites pass a checked station).
3063	if trunk_src is None or trunk_src == edge.source:	->L3065	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
3082	if gap_right <= gap_left:	->L3083	defensive — The column-gap enforcer keeps inter-column gaps positive, so gap_right>gap_left always holds at the target row.
3109	if col_left <= 0.0:	->L3110	defensive — col_left_edge’s 0.0 default only fires for a column with no sections; the target’s own column always holds its section.
3125	if tgt is None:	->L3126	defensive — Edge targets are always registered stations after resolve; the None arm never fires.
3148	if entry_port is None:	->L3149	defensive — Every caller of _corridor_is_viable passes a non-None entry_port.
3151	if ep_port is None or ep_port.side != PortSide.LEFT:	->L3152	needs-review — Reachable only via a defective render (route skirts/crosses section boundary); see #724.
3155	if src_row is None or ep_row is None or src_col is None or ep_col is None:	->L3156	defensive — _resolve_section_colrow returns (None,None) only for a station with no section; valid entry ports always have a section with non-negative grid coords.
3242	if fan is not None:	->L3250	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3250	elif gap_bottom > gap_top:	->L3251, ->L3253	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3258	if fan is None and gap_bottom > gap_top:	->L3259	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3269	if fan is not None and ep_col is not None:	->L3271	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3271	if vx is None:	->L3272	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3384	if ep_section and ep_section.bbox_w > 0:	->L3387	defensive — entry_port.section_id is always set and the section has bbox_w>0 after layout; the else arm never fires.
3668	if gap_bottom <= gap_top:	->L3669	defensive — The row-gap enforcer keeps stacked rows separated, so the inter-row band above a target row (row_bottom_edge(tgt_row-1) up to row_top_edge(tgt_row)) has positive height whenever a RIGHT entry is fed from a higher row; the degenerate-band arm guards an abutting-rows layout placement never produces.
3672	if not _inter_row_band_fits(gap_top, gap_bottom):	->L3673	defensive — Band-fit test in _right_entry_gap_above_is_clear (#889), reached only when the cross-row RIGHT-entry drop-in is not clear (the exotic blocked-descent case above). The corpus always takes the drop-in, so neither arm of the gap-above fallback is exercised. Defensive.
3752	if not normalize_exempt:	->L3756

intra_handlers.py

39/63 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
80	if not section:	->L81	defensive — _route_entry_runway only runs on an entry-port -> internal-station edge; the target of such an edge always carries a section_id that resolves, so the guard’s return-None arm protects against a malformed graph rather than a topology.
87	if section.direction == "RL" and port.side != PortSide.RIGHT:	->L88
89	if section.direction not in ("LR", "RL"):	->L90	defensive — No TB/BT entry reaches _route_entry_runway: TB LEFT/RIGHT entries are consumed by _route_tb_lr_entry and TB/BT TOP/BOTTOM entries by _route_perp_entry (both earlier in the dispatch chain), and a BT section is never produced (the direction directive accepts only LR/RL/TB; 0/391 corpus sections are BT). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
135	if abs(nearest_src - sx) < src_min + ctx.diagonal_run:	->L136	defensive — Entry-runway ‘too tight’ return cannot fire: |nearest_src - entry_port_x| is floored at SECTION_X_PADDING (50px, the entry port sits at section.bbox_x = min(internal_station_x) - SECTION_X_PADDING), while src_min + diagonal_run = CURVE_RADIUS(10) + MIN_STRAIGHT_PORT(5) + DIAGONAL_RUN(30) = 45px. Since 50 >= 45 the guard is always False.
146	elif sy_blocked:	->L147	defensive — Entry-runway trunk-row non-consumer bypass (#1293). Both-rows-blocked fall-through: a non-consumer sits on BOTH the entry row and the target trunk row, leaving no clear runway row. No corpus fixture has a doubly-blocked flow-side entry; defensive.
158	if abs(diag_start_x - sx) <= abs(last_blocker - sx):	->L159	defensive — Entry-runway trunk-row non-consumer bypass (#1293). Descent-clips-blocker fall-through: the join-biased diagonal cannot start past the furthest target-row non-consumer (a blocker within diagonal_run+tgt_min of the target). Corpus blockers sit far enough forward; defensive.
187	for k in range(len(points) - 1):	->L188, ->L193	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
190	for bbox in footprints:	->L187, ->L191	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
191	if segment_intersects_bbox(x1, y1, x2, y2, bbox):	->L190, ->L192	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
222	if not st or st.is_port:	->L223
228	and line not in graph.station_lines(sid)	->L230	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
231	if not blockers:	->L234	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
242	if lead_end - sx < min_straight or tx - tail_start < min_straight:	->L243, ->L244	defensive — Trunk-row entry bow (#1315). No-room return: the flat lead-in before the rise, or the flat tail after the drop, is shorter than a port’s minimum straight. A corpus blocker sits far enough from both the port and the target to leave room, so the fall-through to a plain straight run is defensive.
244	if over_end - over_start < 2 * ctx.curve_radius:	->L245, ->L247	defensive — Trunk-row entry bow (#1315). No-room return: the flat run over the blocker(s) is shorter than two corner radii, so the bump’s corners would overlap. The blocker-span-plus-clearance always exceeds 2*CURVE_RADIUS for corpus fixtures; defensive.
247	for sign in _bow_side_order(section_stations, blockers, sy, over_start, over_end):	->L248, ->L259	defensive — Trunk-row entry bow (#1315). Loop-exhausted fall-through (both sides fail the clearance check): every corpus bow clears on its first (roomier) side, so the exit past the loop that returns a plain straight run is defensive.
257	if _bow_clears_markers(points, section_stations):	->L247, ->L258	defensive — Trunk-row entry bow (#1315). Retry arm (the roomier side’s bow rakes a marker, so the other side is tried): _bow_side_order puts the side with the farthest off-trunk marker first, and the fixed bump height clears it, so no corpus fixture falls to the second side; defensive.
277	for st in section_stations:	->L278, ->L289	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
278	if st.id in blocker_ids:	->L279, ->L280	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
280	if not (	->L283, ->L284	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
285	if dy < -COORD_TOLERANCE_FINE:	->L286, ->L287	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
287	elif dy > COORD_TOLERANCE_FINE:	->L277, ->L288
305	if not (tgt.x - src.x <= 0 and abs(dy) > CROSS_ROW_THRESHOLD and not same_section):	->L307	defensive — _route_fold_edge: the not-same_section precondition is never satisfied at the intra-section handlers, so the fold (False) arm is never taken: cross-section edges are consumed by _route_inter_section upstream (0/391 corpus fixtures reach this branch with differing sections), and a sectionless flat graph’s serpentine fold is routed before this handler too (verified: a flat fold over the threshold does not reach the arm). The cross-row fold branch is shadowed. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
460	if abs(tgt.x - src.x) >= COORD_TOLERANCE:	->L462	defensive — _route_near_zero_gap_straight: a same-section, non-TB intra edge with |tgt.x - src.x| < COORD_TOLERANCE (1px) and non-zero dy is not constructible, so the straight-return (False) arm is never taken: layering assigns increasing X along edges so the minimum |dx| at _route_intra_section across the corpus is 50px (port spacing / off-track output lead). TB same-track edges that could reach |dx|=0 are intercepted by _route_tb_internal before this handler. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
528	if not (same_sec or is_exit_port):	->L529	defensive — _is_side_branch_ascent reaches this classification (44/391 corpus fixtures) but no fixture takes the reject arm: a target sitting within offset_step*2 of the source section’s trunk Y is always a same-section internal station or that section’s exit port. The arm needs a target at the source’s trunk Y that belongs to a different section or is a non-exit port, which the trunk-alignment geometry does not produce. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.

normalize.py

160/210 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
106	if s.bbox_w <= 0:	->L107	defensive — Degenerate-bbox guard in _section_intrudes: a laid-out section always has bbox_w > 0; the skip arm guards a zero/negative-width section the layout never produces.
190	if right <= left:	->L191
193	for k, x, y_lo, y_hi, seg_down in iter_vertical_segments(rp):	->L196
252	if ch is not None:	->L250
258	if gap_right <= gap_left:	->L259
381	go is not None	->L387
382	and gt is not None	->L387
419	if len(pts) < 2:	->L420
437	if abs(x3 - x2) > COORD_TOLERANCE or abs(y3 - y2) <= COORD_TOLERANCE:	->L438	defensive — Every non-exempt inter-section route ends with a vertical descent into the target Y then a short horizontal port lead (V->H tail); routes with non-V tails are normalize_exempt. The second-to-last-not-vertical reject in _final_port_approach is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
737	if rp.curve_radii is None:	->L738	defensive — curve_radii is always a concrete list for inter-section routes (every inter-section handler sets it); the None arm in _set_vchannel_x is a belt-and-suspenders guard.
740	if 0 <= radius_idx < len(rp.curve_radii):	->L739	defensive — Bounds guard in _set_vchannel_x: radius_idx in (k-1, k) for a real channel stays in range; the out-of-range skip arm is defensive.
847	if rp is None:	->L848	defensive — Defensive guard: every merge feeder edge is routed, so the by-key lookup in _merge_feeder_groups always resolves; the skip arm is never taken.
854	if trunk_rp is None or trunk_src_st is None:	->L855	defensive — Defensive guard in _merge_feeder_groups: a merge with a trunk_source always has a routed trunk edge and a resolvable trunk station, so the skip arm is never taken.
857	if trunk_ch is None:	->L858	defensive — Defensive guard: the merge trunk route opens horizontal-then-vertical (lead into the gap, then descend), so its initial fan-out descent is always found; the skip arm is never taken.
866	if ch is None:	->L867
981	elif far_y < t.y - COORD_TOLERANCE:	->L975	defensive — Degenerate-leg guard in _trunk_slot_features: a trunk’s flanking legs are genuine vertical legs (far_y differs from the trunk y), so neither the below nor the above classification is skipped; the fall-through arm needs a zero-height leg the layout never produces.
1011	if feats is None:	->L1012	defensive — Unused default-arg branch: all three callers of _band_order_crossings pass feats explicitly, so the feats-is-None compute-it arm is never taken.
1170	if len(trunks) < 2:	->L1171, ->L1172	defensive — Early-return in _suboptimal_trunk_bands, called only from the guard* validator (phases/guards.py) and a unit test, never on the production render path. The coverage sweep renders with validate=False, so neither arm registers. Defensive (exercised via the validate=True guard / test surface; cf. #728 validate-only precedent).
1174	for grp in groups:	->L1175, ->L1193	defensive — _suboptimal_trunk_bands diagnostic loop: validate-only, not reached by the render-path coverage sweep (see the len(trunks)<2 note).
1175	if len({id(t.route) for t in grp}) < 2:	->L1176, ->L1177	defensive — Single-route-group skip in _suboptimal_trunk_bands, validate-only: called from the guard* validator and a unit test, not the production render path the validate=False sweep exercises. Defensive.
1177	if not any(not t.route.normalize_exempt for t in grp):	->L1178, ->L1179	defensive — _suboptimal_trunk_bands diagnostic guard: validate-only, not on the render path.
1179	for sign in (1, -1):	->L1174, ->L1180	defensive — _suboptimal_trunk_bands direction loop: validate-only, not on the render path.
1182	if len(slots) < 2 or len(slots) > _MAX_BAND_PERMUTE:	->L1183, ->L1184	defensive — _suboptimal_trunk_bands slot-count guard: validate-only, not on the render path.
1191	if best < cur:	->L1179, ->L1192	defensive — _suboptimal_trunk_bands crossing-comparison: validate-only, not on the render path.
1325	if band is not None:	->L1331	defensive — Same-line dogleg: the band-found arm is exercised by dogleg_exempt_sameline; the band-is-None arm is defensive (both colliding trunks route through _center_inter_row_channel, so the trunk Y always resolves to a gap band).
1346	if down_ok and up_ok and (cross_down is None) != (cross_up is None):	->L1348	defensive — Same-line dogleg side selection. The crossing-decided true arm (->1297, pick the side whose riser does not pierce the exempt run) is exercised by dogleg_exempt_sameline. The false fall-through (->1298) needs either an out-of-band side or a crossing-equal tie, neither reachable by a clean topology: the reachable dogleg regime rigidly fixes the inter-row band so down_room/up_room stay >= min_sep=6 (observed 14/26 across the corpus and every constructed variant; perturbing the grid loses the regime), and the only realizable tie is both-cross (a crossing-free tie needs degenerate zero-length exempt risers) which co-occurs with section-crossing / dogleg-crosses-exempt guard failures and is never a shippable render.
1348	elif down_ok and (not up_ok or prefer_down):	->L1349, ->L1350	defensive — Same-line dogleg tie / out-of-band fallback, reached only after the L1296 if is false, which a clean topology never produces (see that gate): the true arm (->1299, lean down on a tie) needs a crossing-free tie that requires degenerate risers, and the false arm (->1300) needs down_ok False, which the regime’s fixed inter-row band (down_room >= min_sep) never yields.
1350	elif up_ok:	->L1351, ->L1353	defensive — Same-line dogleg move-up / give-up fallback, reached only when both L1296 and L1298 are false. The true arm (->1301, move up because the lower gap is too tight) needs down_ok False and the else arm (->1303, leave fused) needs both rooms below min_sep; the reachable regime’s inter-row band is auto-widened so both rooms stay >= min_sep=6 (observed 14/26), so neither is reached by a valid topology.
1376	if band is not None:	->L1381	defensive — Distinct-line dogleg: the band-found arm (->1327) is exercised by dogleg_exempt_distinct (#702). The remaining band-is-None arm (->1331) is defensive: a trunk reaching this second loop collides with an exempt bypass obstacle that lives in an inter-row gap, so _inter_row_gap_band(ctx, t.y) always resolves to a band - the same mechanism already accepted for the sibling ‘if band is not None:::#1’.
1391	if below_ok and above_ok and (cross_below is None) != (cross_above is None):	->L1393	defensive — Distinct-line dogleg side selection. The crossing-decided true arm (->1342) is exercised by dogleg_exempt_distinct. The false fall-through (->1343) needs a crossing-equal tie; a crossing-free tie requires degenerate zero-length exempt risers and the only realizable tie is both-cross, which trips _guard_no_dogleg_crosses_exempt_trunk plus the section-crossing guards and is never a shippable render.
1393	elif below_ok and (not above_ok or prefer_below):	->L1394, ->L1395	defensive — Distinct-line dogleg tie fallback, reached only after L1341 is false (a tie), which a clean topology never produces (see that gate). The true arm (->1344, lean below) would fire on such a tie; the false arm (->1345) is unreachable because below_ok always holds and prefer_below is always true (t.y == hit.y in this regime).
1395	elif above_ok:	->L1396, ->L1398	defensive — Distinct-line dogleg move-up/skip branch: unreachable because the below branch is always taken (t.y == hit.y, below_ok true); covers both the move-up and the gap-too-tight continue.
1418	if sg[0].sign_x != t.sign_x:	->L1419	defensive — Both callers of _coincident_trunk_slots pre-filter input to a single traversal direction (band = [t for t in grp if t.sign_x == sign]), so within the function sg[0].sign_x != t.sign_x is always False; the opposing-direction continue is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1449	if rp.curve_radii is None:	->L1450	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_htrunk is a defensive guard.
1461	if 0 <= k - 1 < len(rp.curve_radii):	->L1463	defensive — Bounds guard in _restack_htrunk: trunk index k >= 1 so k-1 >= 0 is always in range; the skip arm is defensive.
1463	if k < len(rp.curve_radii) and k + 2 < len(pts):	->L-1428	defensive — Bounds guard in _restack_htrunk: for a real interior trunk k and k+2 are in range; the skip arm is defensive.
1524	if down is None or len(up.points) < 2:	->L1525	defensive — Every line entering a fan-out junction also exits it to an entry port, so _fanout_route_maps always pairs a downstream route for each (jid, line_id) upstream; all handlers emit >=2-point routes. The skip arm in _join_fanout_upstream_tails is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1613	if col is None:	->L1614	defensive — Defensive guard in _convergence_line_order: a peel-off riser channel always resolves to a source-section column, so the unresolved-column early return is never taken on the corpus.
1654	if not 0 <= far < len(pts):	->L1655
1657	if abs(dx) > COORD_TOLERANCE:	->L1651
1659	if not votes:	->L1660
1765	if rep_x[a] != rep_x[b]:	->L1767	defensive — The routing system assigns distinct x offsets to every line sharing a column gap, so two distinct lines in one gap-bundle corridor never share a representative x; the equal-rep_x tiebreak fall-through in _distinct_line_order is unreachable (exhaustive corpus scan confirms). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1802	if rp.curve_radii is None:	->L1803	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_channel is a defensive guard.
1813	if 0 <= k - 1 < len(rp.curve_radii):	->L1815	defensive — Bounds guard in _restack_channel: the skip arm fires only for k==0 (channel at the route start), which the restacked gap channels (interior verticals after a horizontal lead-in) never are.
1815	if k < len(rp.curve_radii) and k + 2 < len(pts):	->L1825	defensive — Bounds guard in _restack_channel: the skip arm guards k or k+2 out of range for a real interior channel; defensive.
1827	if abs(ly - pts[1][1]) < COORD_TOLERANCE:	->L-1772	defensive — A re-stacked gap channel at points-index 1 always has a horizontal lead-in (L-shape and bypass routes open with a horizontal segment); routes opening non-horizontally are normalize_exempt and skipped by the materialization. The non-horizontal-lead return in _restack_channel is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1889	for _ in range(8):	->L1914	defensive — The 8-iteration exhaustion arm of _clear_channel_x_in_band requires 9+ sections chained across a single column band to shift the channel x eight times without resolving, which no constructible topology produces. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1910	elif right_ok:	->L1913	defensive — The both-bounds-fail return of _clear_channel_x_in_band requires a blocking section spanning the entire inter-column gap (so neither cleared edge fits within bound_left/bound_right); a cross-row section cannot span a gap defined as the space between same-row sections. Unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1938	if s.bbox_w <= 0:	->L1939	defensive — Degenerate-bbox guard in _h_segment_crosses_other_section: mirror of the bbox_w<=0 guard; sections always have positive width.
1971	if s.bbox_w <= 0:	->L1972	defensive — Degenerate-bbox guard in _v_segment_crosses_other_section: mirror of the _h_segment_crosses_other_section guard; sections always have positive width.

offsets.py

281/360 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
82	if edge.target in inbound:	->L84	defensive — inbound is pre-built as {sid: set() for sid in graph.stations}, so every station id in the graph is a key. All edge endpoints are guaranteed to be in graph.stations after parsing (regular nodes via register_station, ports via add_port->add_station, junctions via add_station), so edge.target is always found in inbound and the False branch (54->56) is never taken.
84	if edge.source in outbound:	->L81	defensive — outbound is pre-built from graph.stations keys identically to inbound. All edge sources are registered stations by construction (regular nodes, ports, junctions), so edge.source is always found in outbound and the False branch (56->53) is never taken.
121	if not src or not tgt:	->L122	defensive — _build_same_y_adj calls graph.stations.get(edge.source/target). All edge endpoints are registered stations after _resolve_sections (regular nodes, ports, junctions all go through add_station), so both .get() calls always return non-None Station objects and the if not src or not tgt branch is never taken.
323	if ordered != expected:	->L324	defensive — The raise arm of _assert_sections_anchored_on_trunk, a backstop on the postcondition of _reindex_section_local: an independent section (no flat-frame neighbour) always lands on the contiguous top-anchored levels 0,step,…,(m-1)*step by construction, so the mismatch arm never fires across the corpus. It guards against a future change that stops re-anchoring such a section.
366	while cur is not None and cur not in seen:	->L375
401	if slot is None:	->L402
414	if neighbour is None:	->L415
506	if not src:	->L507	defensive — _section_line_feeders calls graph.stations.get(edge.source) for edges feeding an entry port. All edge sources are registered stations after _resolve_sections (exit ports, junctions, and merge junctions are all added via add_station), so .get() always returns a non-None Station and if not src is never True.
540	if reverse:	->L541	needs-review — Reachable only on a reconvergence section that is also a serpentine fold, where the fold corner crosses lines mid-curve and the return-row bundle sits one offset too low (#705). Exercise with a clean fixture once #705 is fixed.
571	if section is None:	->L572
595	if not all(lid in feeder_off for lid in continuing):	->L596
603	if lid in new_off:	->L602
625	if section is not None:	->L623
627	if len(set(feeder_row.values())) < 2:	->L628
645	for pid in section.entry_ports:	->L655
647	if entry_port is None:	->L648
649	for edge in graph.edges_to(pid):	->L645
690	if seam is None:	->L691
712	if not all(lid in feeder_off for lid in primary_lines):	->L713
761	if new_order is None:	->L764
840	while stack:	->L854	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
842	if cur in seen:	->L843	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
846	if e.line_id != lid:	->L847
852	if src and not src.is_port and src.section_id == sec_id:	->L845	defensive — The false arm fires when an edge source is an internal station (not a port) whose section_id differs from sec_id. After _resolve_sections(), all inter-section edges run through port stations; no direct edge from an internal station of section A to an internal station of section B exists. DFS back-walk via edges_to() from within a section can only reach: (a) entry ports (return True), (b) same-section internal stations (pushed), or (c) other-section ports (is_port=True, skipped by port and port.is_entry check). Cross-section internal stations are structurally unreachable via direct edges after resolution.
938	if not target_id:	->L939	defensive — An exit-only line at station sid is identified by being present in station_lines(sid) but absent from ctx.inbound[sid]. station_lines() returns lines appearing in any edge whose source or target is sid. For a line to be exit-only at sid, it must appear in at least one outbound edge from sid; otherwise it would not appear in station_lines(sid) at all. If an outbound edge exists, outbound_target[(sid, lid)] is always set, so target_id is never None when execution reaches L422. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
941	if not target_st:	->L942	defensive — After parse and layout, every edge target ID in a MetroGraph maps to a station in graph.stations. The guard protects against a structurally malformed graph where an edge references a nonexistent station ID, which cannot occur with valid .mmd input processed through the parser and _resolve_sections().
958	for other in lines:	->L966	defensive — In _reorder_one_exit_line, the loop over lines always finds the swap partner: desired_off is the min or max of all_offs, which by construction is held by another line, so the loop-exhausted-without-match arm is never taken (0/128). Defensive. Reclassified defensive (#762).
966	if swap_lid is None:	->L967	defensive — In _reorder_one_exit_line, swap_lid is None only if the loop over lines exhausts without a match, but desired_off (min or max of all_offs) is always held by another line, so the early-return guard never fires (0/128). Defensive. Reclassified defensive (#762).
1011	if (cur_sid, cur_lid) in visited:	->L1012	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1023	if abs(nbr_cur - new_off) < _OFFSET_EQ_TOLERANCE:	->L1024	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1030	if len(nbr_lines) < 2:	->L1034	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1034	for other_lid in nbr_lines:	->L1016, ->L1035	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1035	if other_lid == cur_lid:	->L1036, ->L1037	defensive — Inside _propagate_offset_swap’s same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the loop body (incl. this self-skip guard) never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762).
1037	if (	->L1034, ->L1041	defensive — Inside _propagate_offset_swap’s same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the inner collision check never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762).
1045	if max_steps <= 0:	->L1046	defensive — max_steps = len(graph.stations) * len(graph.lines). Each BFS iteration dequeues one (station, line) pair and marks it visited; visited pairs are skipped on re-encounter. The number of distinct (station, line) pairs is bounded by |stations| * |lines|, so the BFS can perform at most that many productive steps before the queue empties. The while queue and max_steps > 0 condition therefore always exits via the queue-empty branch; max_steps reaches zero only if more productive steps occur than unique pairs, which is impossible in a finite graph.
1073	if lid not in seen:	->L1070	defensive — The iterator at L554 is sorted(set(sec_entry_lines), ...). The outer set() deduplicates the list before iteration, so each lid appears exactly once and seen never contains it when processed. The false arm (lid already in seen) is logically unreachable — the dedup happens at set construction, making the seen guard dead code. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1177	if src_st and not src_st.is_port:	->L1175	defensive — In _rewrite_edges_with_junctions (resolve.py L594), edges to exit ports are always created as Edge(source=edge.source, target=exit_port_id) where edge.source is the original inter-section edge’s source — an internal section station, not a port. So src_st is never None and src_st.is_port is always False. The false arm cannot be taken by any valid parsed graph.
1181	if internal_offs:	->L1169	defensive — Exit ports are only created when inter-section edges exist (resolve.py _create_port_stations iterates exit_group_edges which is populated only from actual edges). Every TB LEFT/RIGHT exit port therefore has at least one edge from an internal station, so internal_offs is never empty when the loop is entered. The false arm is a defensive guard against an impossible empty-feeder state.
1211	if src_st and not src_st.is_port:	->L1209	defensive — Same invariant as L602: edges to LR/RL exit ports are always from internal (non-port) stations, created by _rewrite_edges_with_junctions (resolve.py L594-595). The false arm (src_st is None or src_st.is_port) cannot be taken by any valid parsed graph.
1267	if trunk_feeder_id is not None:	->L1276	defensive — len(unique_ys) < 2 means every port line’s feeder stations average to a single Y. Under track-per-line layout, distinct lines occupy distinct tracks, so a shared Y across >=2 lines implies one trunk feeder carrying all of them (trunk_feeder_id set); the no-trunk arm is therefore not reached by a track-separated topology.
1301	if anchor_feeders:	->L1304
1326	if port_off is not None:	->L1324	defensive — _compute_base_offsets runs before _propagate_to_junctions and sets ctx.offsets[(sid, lid)] for every station-line pair in the graph; exit ports are stations, so ctx.offsets.get((exit_port_id, lid)) is never None for any lid in graph.station_lines(jid). The loop-back arm (714->712) requires a junction line with no exit-port offset, which base-offset initialization makes structurally impossible.
1342	if port_st is None:	->L1343
1344	for edge in graph.edges_from(port_id):	->L1348
1346	if consumer is not None and not consumer.is_port:	->L1344
1418	if entry_section is None:	->L1419	defensive — Defensive null guard: every port in graph.ports is created by the resolver with a valid section_id, so graph.sections.get(port_obj.section_id) is never None at routing time. The continue branch is a safety net against a malformed port that no valid graph produces.
1422	if not src or not src.is_port:	->L1423	defensive — In the resolved graph, all edges to entry ports come from either exit ports or junctions, both of which are is_port=True stations. A direct internal-station-to-entry-port edge does not exist after _resolve_sections rewrites inter-section edges into port-chain form. There is no valid topology where an edge to a TOP entry port has a source that is not a port.
1470	if not src or not src.is_port:	->L1471	defensive — _propagate_lr_rl_exit_to_entry iterates edges_to(port_id) for LEFT/RIGHT entry ports. In the resolved graph, all edges to entry ports originate from exit ports or junctions, which are always is_port=True stations. A direct internal-station-to-entry-port edge does not exist after resolution. The true arm (775->776) requires a source that is not a station or not a port, which no valid resolved topology produces.
1497	if paired_off is not None:	->L1495	defensive — _compute_base_offsets sets ctx.offsets[(sid, lid)] for every station-line pair before _propagate_lr_rl_exit_to_entry runs. Exit ports are stations. The for-loop at L791 iterates graph.station_lines(port_id) which equals graph.station_lines(exit_port_id) (enforced by the exit_lines != entry_lines guard at L788). For each lid, ctx.offsets.get((exit_port_id, lid)) is therefore never None. The loop-back arc (793,791) for the paired_off-is-None case is structurally unreachable.
1503	if tgt_st and not tgt_st.is_port:	->L1501	defensive — edges_from(port_id) for an entry port yields edges to internal section stations. In the resolved graph, entry ports are connected directly to internal (non-port) stations; there are no entry-port-to-entry-port or entry-port-to-exit-port edges. So tgt_st is always a valid non-port station, and the loop-back arm (799->797) where tgt_st is None or is_port is unreachable for any valid resolved graph.
1538	if entry.side not in (PortSide.LEFT, PortSide.RIGHT):	->L1539	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam exit/entry reconciliation to horizontal (LEFT/RIGHT) entry ports, whose per-line offsets are Y like the TB exit’s. A TOP/BOTTOM entry stores X-offsets, so copying across would be a category error. No corpus fixture routes a TB LEFT/RIGHT exit directly into a TOP/BOTTOM entry at the same Y, so the skip arm is never taken; defensive against that cross-axis seam.
1546	if len(shared) < 2:	->L1547	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam reconciliation to multi-line bundles, where a constant per-line offset delta means the lines share an order and only the bundle anchoring differs (the auto-folded serpentine case in #1198). A single shared line carries no bundle order to preserve and is left to the single-line corridor passes; no corpus fixture reaches the pass with fewer than two shared lines, so the skip arm is never taken.
1644	if not sec_stations:	->L1645	defensive — The parser calls _remove_empty_sections() (resolve.py:26) which deletes any section whose station_ids list is empty before port creation. Ports are only added to station_ids during _create_port_stations() (resolve.py:527), which runs AFTER _remove_empty_sections(). Therefore every section in graph.sections at layout time has at least one non-port station; sec_stations is never empty.
1675	if not any(	->L1678	defensive — The L920 check returns None when offsets are EXACTLY equal to expected (exact float ==). The L926 check returns None when differences are less than _OFFSET_EQ_TOLERANCE (0.001). Since all offsets are integer multiples of OFFSET_STEP (3.0px), any non-zero difference is exactly 3.0 or more, which is >> 0.001. So L920 catches exact matches and L926 can never catch a case L920 missed; the near-equal window (0,0.001) is unreachable with 3.0px discrete steps.
1819	if max_steps <= 0:	->L1820	defensive — max_steps = n_sec_stations * len(graph.lines). The BFS visits each (station_id, line_id) pair at most once (the visited set at L1017 prevents revisits). The total distinct pairs is bounded by n_sec_stations * len(graph.lines) = max_steps. Since max_steps decrements by 1 per loop iteration and the loop exits when the queue is empty (naturally after at most max_steps unique visits), the condition max_steps <= 0 is never True; the while-loop guard already prevents the body from executing when the queue is empty.
1833	if sec_a is None and id_a in graph.ports:	->L1834	defensive — The true arm requires sec_a is None AND id_a in graph.ports simultaneously. Junction stations (section_id=None) are added only via graph.add_junction() which calls graph.add_station() but NOT graph.add_port(). graph.add_port() (model.py:483) requires a Port object with a non-None section_id (Port.section_id is typed str, not Optional[str], per model.py:218). Therefore no station with section_id=None can ever be in graph.ports; the conjunction sec_a is None AND id_a in graph.ports is unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1835	if sec_b is None and id_b in graph.ports:	->L1836	defensive — Same argument as L1084: id_b in graph.ports requires the station to have been registered via graph.add_port(), which always supplies a non-None section_id for the created station. A station with section_id=None (sec_b is None) is a junction created by add_junction(), which never calls add_port(). The precondition sec_b is None AND id_b in graph.ports is therefore unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1898	if (tgt_id, lid) not in ctx.offsets:	->L1899	defensive — The True branch (missing entry-port offset -> ok=False) is unreachable because phase 7 (_compute_entry_port_offsets) runs before this function (phase 8a) and assigns an offset for every (entry_port_id, line_id) pair in the graph. By the time _align_junction_to_entry_port runs, ctx.offsets is populated for all entry ports, so the guard never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1909	if all(	->L1914	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. The already-aligned arm (->1190) is exercised by the corpus; the body arm (->1192) is the reachable-but-defective one.
1916	for edge in graph.edges_to(jid):	->L1917, ->L1928	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1918	if src_port and not src_port.is_entry:	->L1919, ->L1925	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its else arm (->1203) is additionally defensive: the sole feeder of a >=2-line fan-out junction is its exit port, a non-entry port.
1919	if feeding_exit is None:	->L1920, ->L1921	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1921	elif feeding_exit != edge.source:	->L1916, ->L1922	defensive — This arm (single_exit=False due to multiple distinct exit ports feeding one junction) requires one junction to receive edges from two different exit ports. But _rewrite_edges_with_junctions in resolve.py creates exactly one junction per exit port fan-out, wired exclusively from that exit port’s edges. A junction always has a single upstream exit port; the elif is structurally unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1928	for lid, off in desired.items():	->L1929, ->L1930	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1930	if single_exit and feeding_exit is not None:	->L1869, ->L1931	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its False arm (->1147) is additionally defensive: a >=2-line junction reaching this body is always a single-exit-port-fed fan-out junction (merge junctions carry one line and are skipped by len(j_lines)<2).
1932	if exit_lines == set(j_lines):	->L1869, ->L1933	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its lines-differ arm (->1147) is additionally defensive: a fan-out junction carries exactly its single exit port’s fanned lines, so exit_lines == j_lines always.
1934	if abs(exit_st.y - j_st.y) <= _SAME_Y_TOLERANCE:	->L1869, ->L1935	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its Y-differs arm (->1147) is additionally defensive: only a BOTTOM-exit junction is offset in Y from its exit, but such a junction sits below the consumer row and never meets the body’s all-entries-within-tolerance precondition.
1935	for lid, off in desired.items():	->L1869, ->L1936	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
2095	if tgt_col is None:	->L2096	defensive — Defensive guard in _convergence_feeders: a LEFT entry port section always has a grid column after placement, so the unresolved-target-column early return is never taken.
2101	if src is None:	->L2102	defensive — Defensive guard in _convergence_feeders: every edge feeding an entry port has a source station, so the missing-source early return is never taken.
2104	if col is None:	->L2105	defensive — Defensive guard in _convergence_feeders: every edge feeding a LEFT entry port has a source whose section resolves to a grid column after placement, so the unresolved-source-column early return is never taken.
2135	if feeders is None:	->L2136, ->L2137
2152	sec is None	->L2156	defensive — Bypass-convergence LEFT-entry feeder scan: the loop only inspects existing LEFT entry ports, whose section always resolves, so the leading sec is None short-circuit that skips the port is never taken.
2224	if src is None:	->L2225
2310	for _ in range(max_iterations):	->L-2282	defensive — _reconcile_horizontal_offsets iterates at most 10 times and breaks early when no change occurs. The arc L1338->(-1310) represents loop exhaustion without early-break (all 10 iterations consumed). On any valid parsed graph, the reconciliation converges in at most a handful of iterations because each iteration resolves at least one edge conflict or reaches a fixed point. The 10-iteration ceiling is a backstop against hypothetical oscillating graphs; normal topologies stabilize in 1-3 passes.
2466	if dag is not None:	->L2474
2469	for succ in dag.successors.get(stack.pop(), ()):	->L2470
2470	if succ not in affected:	->L2469, ->L2471
2479	if not offs:	->L2480

perp.py

9/12 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
122	if not feeders:	->L123	defensive — No-feeder guard in _perp_entry_crossing_x: the helper is called only from _route_perp_entry when a multi-line bundle shares the port with a per-line stagger, and a TOP/BOTTOM entry port in that case is always reached by a bundled inter-section feeder (dy!=0, so compute_bundle_info indexes it). The empty-feeders return-None arm is a contract guard, never taken across the corpus.
154	if entry_port is None or not entry_port.is_entry:	->L155	defensive — _aligned_horizontal_drop_entry only fires for a TOP/BOTTOM exit on a horizontal-flow section (the rest of _perp_riser_lateral’s callers are caught earlier). The return-None arm is taken when such an exit feeds a junction or several targets rather than one entry port; corpus instrumentation across every examples/ fixture finds no horizontal-flow perp exit feeding a non-single-entry, so the arm is never taken and the riser falls back to the perp reflection.
161	if needs_perp_approach_fan(graph, entry_port.id):	->L162	defensive — _aligned_horizontal_drop_entry exempts a distinct-line approach fan, whose intra drop fans onto per-line channels (_perp_approach_fan_x) rather than the entry’s single per-line offset. Reaching it needs a horizontal-flow perp exit dropping straight into a single approach-fan entry; corpus instrumentation finds none, so the arm is never taken and the riser keeps the perp reflection.

postprocess.py

93/111 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
65	if ctx.station_offsets is None:	->L66	defensive — Null guard in _spread_diagonal_bundles. compute_station_offsets returns a non-Optional dict and every render-path route_edges call passes it; the only caller leaving station_offsets at its None default is the validate-only _ensure_routes (guards.py), which the render sweep does not run. The early return never fires on a rendered topology, mirroring the matching assert in _apply_diagonal_spread.
203	if abs(dx_diag) <= COORD_TOLERANCE_FINE:	->L204	defensive — Defensive guard: a near-vertical baked diagonal (dx_diag ~ 0) already separates near-fully along the baked X axis, so it needs no Y spread and the divide-by-dx_diag is skipped. No corpus fixture bakes a near-vertical diagonal, so the guard arm is never taken.
422	if not is_fork_join and (	->L431	defensive — Enters the multi_diag block, which needs a non-fork-join station (<=1 distinct predecessor and successor) carrying both a 4-point diagonal and a 2-point flat incoming route. Raw route shape is a pure function of endpoint coordinates, so all lines on one edge share one shape: n_unique_in and n_unique_flat_in can never both be >=1 for a single-predecessor station, and n_unique_in/out are <=1 when not fork-join. multi_diag is unsatisfiable (0 of 6173 corpus calls). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
472	if multi_diag:	->L473	defensive — multi_diag branch of _flat_connects_to_internal_chain; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate at the same line text), so the function is only ever called with multi_diag False. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
473	if any(_is_chain_predecessor(graph, ctx, r.edge.source) for r in flat_in):	->L474, ->L475	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, which is never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
475	if any(_is_internal_station(graph, r.edge.target) for r in flat_out):	->L476, ->L477	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
516	if abs(v) < COORD_TOLERANCE_FINE:	->L517
590	if multi_diag:	->L591	defensive — multi_diag branch selecting the flat-segment X extent in _centering_candidate; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
602	if not multi_diag:	->L609	defensive — The skip-this-block arm fires only when multi_diag is True, which is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
612	if abs(in_flat) < 1 or abs(out_flat) < 1:	->L613
639	if in_rp and len(ctx.diag_out_targets.get(in_rp.edge.source, set())) > 1:	->L640
718	if abs(other.y - station.y) > 1:	->L708	defensive — The loop-back arm (skip appending a column companion) fires only when another non-port station in the same section shares the moving station’s x (within 1px) and its y (within 1px) - two near-coincident distinct stations, forbidden by the no-overlap invariant.
761	if ox is None:	->L762	defensive — Null guard in _align_uncentered_siblings. The loop iterates visible non-port stations and original_x is built from every non-port station, so ox is always present; the guard never fires.
788	if max(moved_xs) - min(moved_xs) <= 1.0:	->L789	defensive — Early-exit for the agree case: all movers land within 1px of each other. Unreachable for natural pipelines because the engine always seats one fan branch on the hub’s trunk row, vetoing companion consensus for the whole column, so moved is empty and the outer guard fires first.
794	if majority_count <= len(moved) / 2:	->L795	defensive — The no-clear-majority arm. Movers in a column either converge to one consensus x or sit off it only via hub/exit-port collinearity at a fixed >=20px quantum; the consensus cluster is always the strict majority, so majority_count is never <= half (0 of corpus, no probe topology reproduces a split). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
801	if not outliers:	->L802	defensive — The no-outliers arm in the movers-disagree branch. Disagreement only arises from hub/exit-port collinearity at a >=20px quantum, never sub-pixel, so whenever spread exceeds 1px at least one mover rounds >1px from the majority x. outliers is never empty here. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
810	if abs(rp.points[0][0] - old_x) < STATION_MOVE_TOLERANCE:	->L809	defensive — Per-route anchor guard: only an outgoing route whose start sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station (e.g. an L-shape or bypass leg not snapped by _apply_station_moves); dragged stations in the corpus only carry position-anchored routes, so it never fires.
813	if abs(rp.points[-1][0] - old_x) < STATION_MOVE_TOLERANCE:	->L812	defensive — Per-route anchor guard: only an incoming route whose end sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station; dragged stations in the corpus only carry position-anchored routes, so it never fires.

rail.py

16/24 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
49	if st is None:	->L50	defensive — _line_rail_y is only ever called with a real station id (on_rail.id, edge.source/target, or a sibling edge endpoint), all of which exist in graph.stations - the route loop pre-filters None endpoints at the src/tgt guard. The None arm is a contract guard no render-path call reaches.
57	if line_id in section_rails:	->L60	defensive — The whole-graph rail connector routes port-to-port edges through _line_rail_y, exercising the in-rails arm. The fall-through (a port carrying a line absent from its own section’s rail map) cannot occur: a port carries only lines its section’s stations carry, all present in per_line_y. Defensive fallback.
68	if line_id in served and len(st.rail_used_ys) == len(served):	->L70	defensive — Reached only for a non-port spanning station, whose rail_used_ys is station_lines_ordered filtered to the section’s per_line_y - itself built from the same _section_lines_in_order. So a served line is always in per_line_y (lengths match) and _line_rail_y is only called with a line the touching edge carries (always served). The fall-through return st.y is a defensive fallback no render-path call reaches.
99	if sib_rails:	->L104	defensive — _off_track_drop_order is only called for an off-track elbow edge that exists in graph.edges, so the feeder<->consumer set it scans always contains at least that edge; the empty-sib_rails arm (skip the mirror-corner reversal) is a contract guard no render-path call reaches.
227	if exit_port.side is not PortSide.RIGHT or entry_port.side is not PortSide.LEFT:	->L228	defensive — Whole-graph rail mode stacks sections vertically and resolve.py always sides an inter-section edge as a RIGHT exit feeding a LEFT entry, so the early-return arm (an unmodelled side pairing) is a structural fallback no rail topology reaches.
231	if up is None or down is None:	->L232	defensive — Null guard over the two ports’ sections in the rail inter-section connector; a boundary port’s section_id always resolves in graph.sections, so the early-return arm is a contract guard no render-path call reaches.
325	if conn is not None:	->L321	defensive — Skips the straight-rail fallback when _route_inter_section_connector handled a port-to-port bundle. The connector returns a route for every whole-graph rail inter-section edge (always a RIGHT exit feeding a LEFT entry), so the None arm (fall through to straight-rail routing) is a structural fallback no rail topology reaches.
334	if src is None or tgt is None:	->L335	defensive — Null guard over an edge’s endpoints; every graph.edges endpoint exists in graph.stations, so the continue arm is a contract guard no render-path call reaches.

reversal.py

45/57 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
172	if not src or not src.is_port:	->L173	defensive — Phase 1a (_detect_tb_bottom_top_entries) iterates edges feeding a TOP entry port. Entry ports are synthetic nodes created by section resolution; the only edges targeting them are the resolved chain’s exit_port->entry_port and junction->entry_port links, so edge.source is always a registered port or junction station (both is_port=True). The continue (missing or non-port source) is a structural-contract guard no valid topology reaches.
200	if receiver not in reversed_secs:	->L199	defensive — BFS dedup guard in _detect_tb_bottom_top_entries: the False arm fires when a TB section is queued as a vertical receiver via two different positive_fan paths. The detection only registers a receiver when a BOTTOM exit PORT directly feeds a TOP entry port (edge.source is the exit port). A TB section reached by two upstream sections is fed through a fork/merge junction, so the edges into its TOP entry originate at the junction, not a port — the detection skips them and the receiver is never queued twice. A diamond renders (examples/topologies/tb_bottom_exit_fork_diamond.mmd) but does not drive this arm. The guard is correct and necessary to prevent double-queueing and ensure BFS termination should a direct double-feed ever arise.
237	if jid in seen:	->L238	defensive — Cycle guard in _entry_ports_through_junctions’ junction walk. The True arm fires only if a junction is reached twice while walking out from one exit-port-fed junction (a junction reachable by two paths). Resolved peel-off fans are trees, so no junction is revisited and the arm is unreached; the guard keeps the walk terminating should chained junctions ever form a cycle.
245	if port and port.is_entry:	->L240	defensive — _entry_ports_through_junctions collects the entry ports a peel-off junction fan lands on. Each junction out-edge targets either another junction (consumed by the prior edge.target in junction_ids continue) or an entry port; no junction fans directly to a station or exit port across the corpus. The non-entry arm is therefore a structural-contract guard never reached.
283	if not src or not tgt:	->L284	defensive — _build_section_adjacency iterates graph.edges; every edge endpoint is a registered station, so graph.stations.get never returns None for edge.source or edge.target. The continue is a defensive null guard no valid graph reaches.
297	if entry and entry.section_id and entry.section_id != src.section_id:	->L293	defensive — _build_section_adjacency records a section successor reached through a peel-off junction. entry_id comes from _entry_ports_through_junctions, which returns only registered entry-port stations, so graph.stations.get(entry_id) is always present and carries a section_id. The only un-exercised arm is entry.section_id == src.section_id — a junction fanning back into its own source section — which a resolved peel-off fan never produces. Defensive structural-contract guard.
323	if not section:	->L324	defensive — _propagate_reversal_along_rows iterates sec_id values drawn from reversed_secs, which only ever holds real section ids added from graph.sections. graph.sections.get(sec_id) is never None; the continue is a defensive null guard.
334	if not succ:	->L335	defensive — succ_id comes from sec_successors, built only from real tgt.section_id values, so graph.sections.get(succ_id) is never None and the continue (->187) is a defensive null guard. The fall-through static arm (->188) is phantom: control falls into the following multi-line if (, whose first operand line carries the real arc L186->189.
338	or (sec_id, succ_id) in horizontal_succ_pairs	->L330
390	if not src:	->L391	defensive — _section_fed_by_tb_lr_exit iterates edges feeding a LEFT/RIGHT entry port; edge.source is always a registered station, so graph.stations.get is never None. Defensive null guard.
396	if not s2 or not s2.is_port:	->L397	defensive — Junction look-through: s2 is the source of an edge feeding a fold junction. Junctions are synthetic resolution nodes fed only by exit ports or upstream junctions (both is_port=True), so s2 is always present and port-like. The continue is a structural-contract guard no valid topology reaches.
403	elif src.is_port:	->L388	defensive — Edge feeding a LEFT/RIGHT entry port whose source is not a junction; src is then always an exit port (is_port=True), because resolved chains feed entry ports only from exit ports or junctions. The elif is always true, so the implicit fall-through to the loop (->223) is a structural-contract guard no valid topology reaches.

seam.py

5/6 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
75	if feeder is None or consumer is None:	->L76

tb_handlers.py

16/20 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
156	if diag_end < diag_start:	->L157	defensive — Degenerate-collapse clamp for an ascending diagonal: fires only when the run is shorter than 2*MIN_STRAIGHT_EDGE (20px). Every caller feeds grid-placed station coordinates whose run-axis separation is at least one grid pitch (Y_SPACING=40 / X_SPACING=60); _route_entry_runway additionally pre-guards with room < src_min + diagonal_run. The 20px collapse threshold is never reached.
162	if diag_end > diag_start:	->L163	defensive — Descending-run mirror of the ascending collapse clamp (#1 of if diag_end < diag_start:): fires only when |run| < 2*MIN_STRAIGHT_EDGE (20px), but connected diagonal endpoints are always >= one grid pitch (40/60px) apart on the run axis. Unreachable degenerate-geometry guard.
372	if tgt_sec is not None and tgt_sec.direction not in ("TB", "BT"):	->L376	defensive — Perp-entry drop crossing-X override: the edge’s target is always a sectioned station, so tgt_sec resolves and the tgt_sec is None short-circuit to the plain drop is never taken; the direction in (TB, BT) arm (a drop continuing into a vertical-flow trunk) and the horizontal-target arm are both exercised.
374	if crossing_x is not None:	->L376	defensive — Pair of context.py::if not indices: - the helper returns None only when no bundled feeder reaches the port, but a horizontal-flow section taking a perpendicular entry is always fed by a bundled inter-section edge, so crossing_x resolves. The crossing_x-is-None fall-through is a defensive guard, never taken across the corpus.