Routing gate coverage matrix

Routing gate coverage matrix

Auto-generated by scripts/routing_gate_coverage.py under CPython 3.11 with PYTHONHASHSEED=0 (the arc model is interpreter-specific and operand-level coverage is hash-seed sensitive). Do not edit by hand; run the script to regenerate.

Each row is a branch point (a gate) in a layout/routing/ dispatch handler or post-pass. A gate has two or more arms; the cells list how many corpus fixtures exercise each arm. An arm reached by 0 fixtures is an un-exercised gate arm: either no shipped topology takes that path (author a fixture, or confirm it is defensive/dead).

2266/3202 gates fully exercised (both/all arms hit by some fixture); 936 gates have at least one un-exercised arm.

Modules scoped to routing decision gates; invariants.py (the validate=True checker) and __init__.py are excluded.

The Triage column carries a curated verdict for gaps no fixture can close: defensive (a guard arm a valid topology never violates), candidate-dead (no constructible topology reaches it; left in place pending a separate deletion review), or needs-review (not yet classified). A blank cell means the gap is still open for a fixture. 390 gaps carry a triage verdict.

arranger.py

1/1 gates fully exercised.

All gates have every arm exercised by the corpus.

bundle.py

5/7 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
51	if abs(dx) > COORD_TOLERANCE and abs(dy) > COORD_TOLERANCE:	->L52
281	if len(centerline) < 2:	->L282	defensive — Single enforcement point for the bundle-centreline contract: a fanned bundle needs at least one leg, i.e. a >=2-vertex centreline. All three public builders (build_concentric_bundle / build_tapered_bundle / build_offset_bundle) funnel through _fan_bundle, which owns this one guard in place of the four per-builder re-checks the corpus never took (#1438). Every caller builds a >=2-vertex polyline by construction, so the raise arm stays un-exercised.

centrelines.py

12/16 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
78	if (	->L86
444	if route.curve_radii is not None:	->L446
475	or edge.target not in ctx.graph.ports	->L478	needs-review — The lane-change step declines a run whose target is not the port the connector is drawn to: a run into a merge ends where the convergence planner re-seats it, so spending a target runway there leaves a zero-length tail. tests/fixtures/hash_seed_determinism/seed_41.mmd reaches the arm (its __junction_33 hands lines into __merge_11 and __merge_15 a lane out, with room to step), but the sweep’s corpus roots do not include tests/fixtures/hash_seed_determinism, so no swept fixture evaluates it.
476	or run_direction is None	->L478	defensive — The lane-change step reads its run direction off the connector’s own two endpoints rather than assuming an axis. segment_direction returns None for a leg that is diagonal or collapsed, which the straight-connector families that reach this helper never hand it: both settle their endpoints on one row or one column before routing, so no fixture can present a diagonal pair here.

common.py

207/275 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
95	if not self.incoming_source_id:	->L96	defensive — A source turnout is planned from a concrete incoming RoutedPath, so its incoming source id is always the non-empty edge source. The empty-id arm rejects directly constructed or corrupted frozen metadata and is covered by constructor tests.
97	if self.continuing_target_id == "":	->L98	defensive — A non-terminal source turnout copies its continuing target id from a concrete RoutedPath edge, while terminal mode uses None. The empty-string state is not produced by a valid graph and is rejected by focused constructor tests.
99	if self.incoming_direction not in (Direction.R, Direction.L):	->L100	defensive — Source-turnout eligibility admits only an incoming horizontal segment and freezes that measured direction. A vertical incoming direction is inconsistent plan metadata; focused constructor tests exercise rejection.
101	if self.outgoing_direction not in (Direction.U, Direction.D):	->L102	defensive — Source-turnout eligibility admits only a vertical arm into a TOP or BOTTOM entry and freezes that measured direction. A horizontal outgoing direction is inconsistent plan metadata; focused constructor tests exercise rejection.
103	if not math.isfinite(self.radius) or self.radius <= 0:	->L104	defensive — SourceTurnout is frozen engine metadata whose radius is derived from the positive layout curve radius plus a non-negative lane projection. A non-finite or non-positive value can only come from direct construction or corrupted plan state; focused constructor tests exercise rejection.
185	for edge in graph.edges_from(port_id):	->L189
187	if not consumer.is_port:	->L185
371	if top is None or bottom is None:	->L372	defensive — Defensive in iter_inter_row_gaps (consumed by inter_row_gap_upper_row and _inter_row_gap_band): adjacent rows in the sorted section-row set both contain sections, so row_bottom_edge / row_top_edge resolve; the None skip arm guards a row with no sections that the iteration never yields.
569	if s.bbox_h <= 0:	->L570	defensive — Degenerate-bbox guard in _grid_row_bands: a laid-out section always has bbox_h > 0, so the skip arm only protects against a zero/negative-height section that the layout never produces.
688	if n == 0:	->L689	defensive — Empty-bundle guard: all callers (normalize.py 291/1648, inter_section_handlers.py 783/796/2132) derive bundle_widths from a non-empty bundle line count, so n is always >=1; the empty-list arm is never taken.
690	if bundle_index < 0 or bundle_index >= n:	->L691	defensive — Contract guard raising IndexError on an out-of-range bundle_index. Callers always pass an in-range index (0<=i<n); the raise arm fires only on a caller-contract violation no valid call produces.
1019	if abs(pts[k - 1][0] - x0) > COORD_TOLERANCE:	->L1020	defensive — Interior horizontal segments only occur in 6-point bypass U-shapes whose flanking legs are always vertical (same x on each side); routes with non-vertical flanks are normalize_exempt and filtered out. The prev-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1021	if abs(pts[k + 2][0] - x1) > COORD_TOLERANCE:	->L1022	defensive — Mirror of the prev-flank guard: a bypass trunk’s trailing flank is always vertical, so the next-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1076	if abs(y4 - y3) > COORD_TOLERANCE or abs(x4 - x3) <= COORD_TOLERANCE:	->L1077	defensive — Trunk-not-horizontal guard in port_peeloff_tail, reached only after the earlier port-lead and riser checks returned early. In an orthogonal route segments alternate H/V, so the segment preceding a vertical riser is always horizontal; instrumenting the corpus the guard is reached but the non-horizontal-trunk arm never fires. Defensive against a degenerate collinear tail the router does not produce.
1239	if (	->L1246	defensive — Cohort shape rejection in _iter_same_destination_cohorts, shared by both same-destination iterators: the members must land on distinct adjacent lanes within one offset step of each other. Each member’s port_y is the lane its peel-off tail rides into the port, i.e. the slot the entry-port allocator dealt that line, and the cohort is already complete over the port’s lines one gate earlier. Swept over the whole corpus, the only LEFT/RIGHT entry port where two lines share a stored lane offset is rail_inter_section.mmd’s two__entry_left_1, where rail mode stores no offsets at all and the long iterator’s own graph.station_is_rail screen drops rails first; no tail-bearing route pair anywhere shares a port arrival Y, and a complete n-line side-entry port occupies one contiguous band at one step pitch so its extent cannot exceed (n-1)*step. The rejection therefore only fires for directly supplied geometry, as the synthetic bundle tests build.
1301	while current not in seen:	->L1320	defensive — Resolved metro graphs are acyclic, so feeder tracing reaches a port or a rejection return before revisiting a connector. Loop exhaustion is the defensive cycle stop.
1310	if current not in graph.junctions:	->L1311	defensive — A destination approach traced toward its feeder traverses only resolver-created junctions before reaching a section port. Encountering an ordinary station in that connector chain indicates malformed resolved edges.
1348	or exit_port is None	->L1353	defensive — _flow_exit_feeding_route_source returns a station id only after graph.ports.get(id) has already produced a port for it, so the id it hands back is always a key of graph.ports and this second lookup cannot miss. The arm protects a caller that supplies its own exit id.
1351	or tail.port_lead_sign != 1	->L1353	defensive — port_lead_sign is +1 when the tail’s final leg enters its port rightward. The operand one place earlier restricts the cohort to LEFT-side entry ports, which sit on their section’s flow-start edge and so are entered rightward, and 121 fixtures reach this operand with +1 every time. A leftward lead into a LEFT entry port would mean the route doubling back over the section it is entering.
1363	if cohort.suffix_run < minimum_run - COORD_TOLERANCE:	->L1364	defensive — Resolver-owned LEFT-entry leads provide at least two curve radii of common landing runway. The short-suffix arm rejects inconsistent or manually supplied routes before they can enter settlement.
1366	if overlap <= COORD_TOLERANCE or (	->L1369	defensive — A plannable short-overlap cohort is emitted only with a positive shared vertical runway. Zero overlap is rejected before settlement; the positive short arm is exercised by same_destination_short_overlap.
1461	if reject_collinear_touch:	->L1464	defensive — The lenient arm’s only caller is invariants._segments_properly_cross, and invariants.py is outside this matrix by design: its branches fire under validate=True, a separate test surface. The strict arm is the routing-side crossing test, reached by the two same-destination fixtures. Both flags are exercised by tests/test_gate_reconciliation_1746.py and the crossing checks in tests/layout_validator.py.
1464	elif (d1 > 0) == (d2 > 0) or (d3 > 0) == (d4 > 0):	->L1465, ->L1466	defensive — The lenient sign test, reached only when reject_collinear_touch is False; see that gate’s verdict. Its one caller is the validator module this matrix excludes, so no sweep fixture evaluates it.
1467	if abs(denominator) <= COORD_TOLERANCE:	->L1468	defensive — Near-parallel guard in _proper_segment_crossing, reached only after both straddle tests (d1d2 < 0 and d3d4 < 0) have passed, which already excludes parallel and collinear pairs. Routing draws every segment on the 0/45/90 lattice, so a straddling pair meets at 45 or 90 degrees and |denominator| = |a||b|sin(theta) >= 0.707|a||b|; both segments are longer than the 2px floor the settlement machinery can express, putting |denominator| above 2.8 against a COORD_TOLERANCE of 1.0. The arm can only fire for directly supplied sub-pixel geometry.
1500	if abs(dx) <= COORD_TOLERANCE and abs(dy) <= COORD_TOLERANCE:	->L1501	needs-review — Degenerate-segment guard in _positive_collinear_overlap: a candidate segment shorter than the coordinate tolerance has no direction to project onto. Reached only from the same-destination conflict scans, which run when at least one member’s proposed tail differs from the point already drawn — same_destination_short_overlap and same_destination_vertical_convergence, the two corpus maps that move a tail. Both hand the helper only full-length legs, so no candidate segment collapses below tolerance. Exercised synthetically by tests/test_same_destination_vertical_bundle.py, which builds the off-slot bundle; needs-review because an in-corpus witness is authorable, not because the arm is unreachable.
1509	if hi - lo <= COORD_TOLERANCE:	->L1511	needs-review — Span test in _positive_collinear_overlap; the un-exercised arm is the positive-overlap one that goes on to compute the overlap endpoints. Reached only from the same-destination conflict scans, so its only witnesses are the two corpus maps that move a tail (same_destination_short_overlap and same_destination_vertical_convergence), and every collinear pair they scan meets in at most a point, leaving the helper to return None each time. The arm wants a proposal whose moved riser runs alongside a collinear neighbour over a real length. Exercised synthetically by tests/test_same_destination_vertical_bundle.py; needs-review because an in-corpus witness is authorable, not because the arm is unreachable.
1537	if crossing := _proper_segment_crossing(a0, a1, b0, b1):	->L1538	needs-review — Self-crossing detection over one proposal’s own non-adjacent segments. Only same_destination_short_overlap and same_destination_vertical_convergence reach the scan at all, and the furthest any of their tails travels onto its slot is 17px — far too little for the re-columned riser to reach the member’s own upstream body. The arm wants a member whose slot column sits far enough from its drawn peel-x, or whose upstream body doubles back close enough to it, that the moved riser crosses an earlier segment of the same route. needs-review because that shape is authorable, not because the arm is unreachable.
1547	if overlap := _positive_collinear_overlap(a0, a1, b0, b1):	->L1548	needs-review — The self-conflict scan’s second predicate: a proposal doubling back onto the column of one of its own earlier vertical segments, so the two overlap with positive length. Same three same-destination maps reach it and none re-uses an own column when its tail shifts 4-17px. Recorded separately from the proper-crossing gate on the statement above because the predicate differs: a collinear overlap is invisible to _proper_segment_crossing, which returns None on any shared endpoint or parallel pair.
1587	if overlap := _positive_collinear_overlap(a0, a1, b0, b1):	->L1588	needs-review — Cross-route collinear overlap between two distinct lines, the arm that records the conflict. Reached only from the same-destination conflict scans, whose witnesses are the two corpus maps that move a tail (same_destination_short_overlap and same_destination_vertical_convergence); across both, no scanned pair of collinear segments from different lines shares a positive-length span, so the helper never returns an overlap — the same missing witness the sibling if hi - lo <= COORD_TOLERANCE: entry records. Exercised synthetically by tests/test_same_destination_vertical_bundle.py; needs-review because an in-corpus witness is authorable, not because the arm is unreachable.
1650	if moves and tail_segment_is_held(route, segment_rank, target_x):	->L1651	needs-review — Ownership refusal in feasible_same_destination_approach_proposals: a member whose tail must move onto its slot is refused when the move is not this pass’s to make. moves is live in the corpus — instrumenting the call site the way the matrix exercises it (compute_layout plus render_svg, PYTHONHASHSEED=0), same_destination_short_overlap carries the assembly tail 13px and 17px off its slot across proposals and the audit tail 4px, and same_destination_vertical_convergence carries the upper tail 4px. The gate is therefore reached with a true left operand and still falls through: for every corpus mover the ownership terms are all false, because the tail segment is this pass’s own to move. The arm wants a moving member whose segment another owner already holds — a planner-owned exit turn outside the replannable set, a convergence- or route-system-owned segment boundary, a fan-route emitter, or a standing route reservation. Exercised synthetically by tests/test_same_destination_vertical_bundle.py::test_new_plan_owned_riser_conflict_refuses_tail_move_atomically, which builds the off-slot bundle against a conflicting owner; needs-review because an in-corpus witness is authorable, not because the arm is unreachable.
1656	if moves and _section_intrudes(	->L1664	needs-review — Refusal when the slot column’s riser would run within EDGE_TO_BUNDLE_CLEARANCE of a section box that is neither the route’s source nor its target section. moves is live here: same_destination_short_overlap moves the assembly tail 13px and 17px across proposals and the audit tail 4px, and same_destination_vertical_convergence moves the upper tail 4px. The refusal is un-exercised because those risers run inside open inter-section corridor, not because no corpus tail moves. The arm wants a cohort whose tighter slot column pushes a riser up against a neighbouring section’s bbox.
1673	if old_gap is not None and new_gap is None:	->L1674	needs-review — Refusal when the drawn peel-x sits in a declared inter-section gap column but the slot column has none, which would strand the riser outside any gap the plan owns. The three cohorts that do move a tail shift it 4-17px and stay inside one gap column, so gap_lo_for_x returns the same non-None value for both x values. The arm wants a move that leaves the gap band, e.g. a cohort whose outermost slot lands past the corridor edge.
1692	if new_gap is not None and new_gap != old_gap:	->L1693	needs-review — Gap-slot re-declaration for a move that lands in a different gap column: the old column’s slot is dropped and a new one appended. Un-exercised for the same measured reason as the old_gap/new_gap refusal above — the moving cohorts shift 4-17px within one column, so new_gap equals old_gap — but this arm is the only coverage of the gap_slots rewrite, not of a refusal. A fixture whose slot column crosses a gap-column boundary closes it.
1758	and abs(start[0] - other_start[0]) < required - COORD_TOLERANCE_FINE	->L1760	needs-review — The same-destination approach proposal is abandoned when a proposed member column would sit closer than the co-travelling lane clearance to another vertical channel. Every shipped corpus proposal clears that distance because the member gap allocator seats each corridor against its neighbours before the proposal is built, so the refusal arm has no fixture; revisit once a corpus map needs a proposal the allocator cannot pre-separate.
1766	if proposed_conflicts - baseline_conflicts:	->L1767	needs-review — Conflict refusal in feasible_same_destination_approach_proposals: the whole bundle is abandoned when moving its tails onto their slots would introduce a crossing or overlap the current geometry does not have. The comparison is live — same_destination_short_overlap and same_destination_vertical_convergence both reach it with tails genuinely off their slots — but neither proposal adds a conflict, so the refusal never fires. Covered synthetically by the atomic-refusal test in tests/test_same_destination_vertical_bundle.py; needs-review pending an in-corpus witness whose slot move introduces a fresh crossing.
1814	if any(	->L1817	defensive — Opposing-entry candidates inherit distinct port lanes from station offsets. A duplicate adjacent lane can only arise from inconsistent precomputed geometry, so the skip is a defensive shape guard.
1818	if port_ys[-1] - port_ys[0] > (n - 1) * step + COORD_TOLERANCE:	->L1819
1821	if max(peel_xs) - min(peel_xs) > (n - 1) * step + COORD_TOLERANCE:	->L1822
1825	if shared_hi - shared_lo < min_common_approach - COORD_TOLERANCE:	->L1826	defensive — Inter-row placement reserves at least the two-corner runway used by side-port peel-off handlers, so complete opposing entry tails share at least min_common_approach vertically. A shorter overlap is malformed settled geometry; test_invalid_opposing_candidate_is_rejected[insufficient-common-approach] exercises the guard.
2096	if pinned_bases and any(	->L2099
2109	if k == 0 or k + 2 >= len(points):	->L2110
2279	if band is not None:	->L2284	defensive — exempt_dogleg_lanes band clamp: the band-found arm is exercised by dogleg_exempt_distinct (#702), whose distinct-line dogleg pass hands this helper the inter-row gap band the colliding trunk sits in. The band-is-None arm is defensive - the pass only reaches the helper for a trunk fused with an exempt bypass obstacle living in an inter-row gap, so the band always resolves.
2376	elif tgt_sec:	->L2384	defensive — The else (col_key=round(sx)) needs an L-shaped (dx!=0,dy!=0) inter edge whose target resolves to no section. Only exit_port->junction edges lack a target section, and junction positioning makes those axis-aligned (same-X RIGHT exit or same-Y BOTTOM exit), never L-shaped, so the else is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
2475	if dx > 0:	->L2478	defensive — Leftward (dx<=0) near-source fallback: the symmetric mirror of the rightward fallback. Reached only when section info is unavailable AND no adjacent column resolves; valid layouts take the rightward fallback, but the leftward mirror is kept for robustness.
2486	if st is not None and st.is_port:	->L2484	defensive — Null/non-port guard: after _resolve_sections both endpoints of an inter-section edge are ports/junctions and graph.stations.get() resolves them, so the False (None or non-port) arm only guards a malformed pre-resolve graph.
2535	if sec.bbox_w <= 0:	->L2536	defensive — Zero-width-section guard: the loop scans all graph.sections, but after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts don’t produce.
2583	if sec.bbox_w <= 0:	->L2584	defensive — Zero-width-section guard in the squeeze re-centring loop: like its #1 twin, after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts do not produce.
2617	if not src.is_port:	->L2615
2633	for i in range(len(pts) - 1):	->L2634, ->L2650	defensive — point_on_polyline is used only by the —animate renderer (render/animate.py); the matrix’s render-path coverage sweep calls render_svg without animation, so none of its branches are reached. Exercised instead by test_animation.py / test_routing.py.
2638	if seg_len2 == 0:	->L2639, ->L2642	defensive — point_on_polyline degenerate-segment branch, reached only via the —animate renderer (render/animate.py); the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py, not the corpus.
2639	if abs(point[0] - ax) <= tol and abs(point[1] - ay) <= tol:	->L2640, ->L2641	defensive — point_on_polyline zero-length-segment hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
2643	if t < -0.01 or t > 1.01:	->L2644, ->L2645	defensive — point_on_polyline parameter-range branch, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
2648	if abs(point[0] - proj_x) <= tol and abs(point[1] - proj_y) <= tol:	->L2633, ->L2649	defensive — point_on_polyline projection hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
2743	if all_in_range:	->L2747	defensive — cross_row bypass guard: the False arm (no sections in the column range -> return clearance) needs an empty [lo,hi] column span, which a valid multi-section pipeline routing cross_row never has; a degenerate-range guard.
2770	if endpoints:	->L2773	defensive — Non-cross_row bypass guard: the endpoints list always includes the source and target sections (both in src_row), so it is never empty; the default-clearance arm only guards a degenerate empty endpoint set.
2783	if src_row is not None:	->L2795	defensive — Header-clamp guard: the False arm (src_row is None) needs an unresolvable source section, but inter-section bypass sources always resolve to a grid row after layout; a guard against an unresolved source that doesn’t occur.
2790	if safe_cap >= row_bottom:	->L2793	defensive — The false arm is a defensive midpoint fallback for an inter-row gap too narrow to clear both an upper-row bypass and the lower section header. Placement reserves the routing band before bypass geometry is computed, so settled corpus layouts provide enough clearance for the safe-cap arm.
2889	if section.bbox_w <= 0:	->L2890	defensive — Degenerate-bbox guard in _h_segment_penetrates_section (the single-section predicate shared by _h_segment_crosses_other_section and _packed_cell_mate_obstructs): sections always have positive width after layout.
2972	if station is None:	->L2973	defensive — None-station guard: every production caller passes a concrete Station (grep-verified); the None arm only guards the typed Station|None parameter.
2978	for port in junction_source_ports(graph, station.id):	->L2997	defensive — Upstream loop-exit in resolve_section: every fan-out junction is emitted with an exit_port->junction edge whose source port carries a section id, so junction_source_ports always yields a sectioned port and the loop returns; the fall-through to the type-contract return None is the never-taken no-upstream fallback.
2980	if sec:	->L2978	defensive — Upstream section-lookup guard: graph.sections.get(section_id) returning None requires a section_id absent from graph.sections, a corrupted state no valid parse produces; null-guard.
2986	for e in graph.edges:	->L2997	defensive — No-preference graph.edges scan loop-exit: a fan-out junction always has a sectioned incident port (its exit/entry ports carry a section_id), so the loop always returns and never exhausts graph.edges; the fall-through to the type-contract return None is the never-taken no-neighbour fallback.
2987	if e.source == station.id:	->L2988	defensive — Junction-as-source arm of the no-preference scan: fan-out junctions are emitted exit_port->junction before junction->entry_port, so graph.edges encounters the junction as a target (elif arm) first and returns; the source arm is a cheap structural guard whose deadness rests on emit order, not a hard type invariant.
2993	if other.section_id:	->L2986	defensive — The prefer_upstream=False scan reads a junction’s incident neighbour on either side, always a sectioned station or port; the section-less (False) arm only guards a junction-to-junction edge valid construction never produces.
2995	if sec:	->L2986	defensive — prefer_upstream=False section-lookup guard: graph.sections.get(section_id) returning None requires a missing section_id (corrupted state); null-guard.
3005	if section is None:	->L3006	defensive — resolve_section_colrow accepts a station whose owning section may not resolve. Production routing passes resolved ports or junctions with an incident sectioned port, so the None return only protects a malformed or incomplete graph.
3048	if reserved is None or abs(src_row - tgt_row) != 1:	->L3049
3104	if dy > 0:	->L3109	defensive — Multi-row upward-crossing arm: grid rows are assigned topologically and upward inter-section routes take other handlers (a same-row/around-section path), never reaching inter_row_channel_y’s multi-row branch with dy<=0; verified by an upward multi-row fixture that bypasses this code.

context.py

83/111 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
301	if not mst:	->L302	defensive — mjid ranges over junctions, a subset of junction_ids all present in graph.stations; the missing-station continue never fires.
304	if tgt_col is None:	->L305	defensive — A merge junction always resolves to a grid column (it sits adjacent to its entry-port section); the unresolved-column continue never fires.
362	if m_col is None:	->L363	defensive — Reached only for junctions in trunk_source, which by construction resolved a column, so m_col is never None and the skip arm never fires.
374	if pred_col is None:	->L375	defensive — A merge feeder is a junction fed by an exit port, which always resolves a column, so the skip arm never fires.
393	if ep and ep.is_entry:	->L391	defensive — Every outgoing edge of a classified convergence junction targets its sole entry port, so the non-entry arm never fires in the skip-edge pass.
561	if port_st is None:	->L562	defensive — Ports listed in a section’s entry_ports/exit_ports always have a backing station; the missing-station continue never fires.
581	if not ctx.station_offsets:	->L582	defensive — Pairs with _get_offset’s guard: compute_station_offsets is never empty on the render path, so _max_offset_at’s early-return arm guards only the route_edges(station_offsets=None) call path used by tests.
665	if port.section_id is None:	->L666, ->L667
697	for pid in section.entry_ports:	->L698, ->L700
698	if line_id in graph.station_lines(pid):	->L697, ->L699
726	if port is not None:	->L727, ->L730
731	for sid in section.station_ids:	->L732, ->L736
733	if not station.is_port:	->L731, ->L734
764	if sec and sec.grid_col >= 0:	->L766	needs-review — grid-col sentinel: a rail-mode section carries grid_col == -1 (it is placed outside the section grid), so the negative-column arm returning None is load-bearing, not dead. No corpus routing path resolves a rail section’s column, so the arm is un-exercised, but a rail topology can reach it; do not fold into a non-optional accessor.
772	if sec and sec.grid_row >= 0:	->L773, ->L774	needs-review — grid-row sentinel: a rail-mode section carries grid_row == -1 (placed outside the section grid), so the negative-row arm returning None is load-bearing, not dead. No corpus routing path resolves a rail section’s row, so the arm is un-exercised, but a rail topology can reach it; do not fold into a non-optional accessor.
863	if sec is None:	->L864	defensive — _resolve_section_colrow is called for ports/junctions that always resolve to a section; the None-section early-return never fires (mirrors the grid-sentinel guards at L395/L403).
916	if src.col is None or tgt.col is None:	->L917	defensive — _hop_needs_bypass is called only for endpoints whose columns the caller already resolved, so the no-column early-return never fires.
1015	if pst is None:	->L1016	needs-review — pst = graph.stations.get(port.id): a port is always registered as a backing station, so the guard is never taken across the corpus. Kept as a station-id string read (no Edge in hand), the idiom deferred by the #1438 single-endpoint migration for a future station-id accessor; the sibling section lookup here was migrated to graph.section_for_port.
1175	if not jst:	->L1176	defensive — jid ranges over junction_ids, all present in graph.stations; the missing-station continue never fires.
1178	if src_col is None:	->L1179	defensive — A fan-out junction always resolves to a grid column; the unresolved-column continue never fires.
1217	if not (tgt.is_port or edge.target in junction_ids):	->L1218
1220	if tgt_col is None:	->L1221	defensive — A junction’s port/junction target always resolves to a grid column; the unresolved-column continue never fires.
1341	if edge.line_id in line_pos:	->L1340	defensive — line_pos is built from the line IDs of the very all_outgoing list this loop iterates, so the membership test is always true: the reject/loop-back arm (L684) is an unreachable tautology and the enter-body static arc (L686) is a phantom of the real 685->687. Vestigial tautological guard. The deliberate gap is pinned by test_genuine_dead_arm_not_masked_as_covered (arc normalization must not merge the never-taken branch onto the live one). Reclassified defensive (#762).
1370	if not (tgt.is_port or edge.target in graph.junction_ids):	->L1371
1414	if jst is None:	->L1415
1417	if src_row is None or col is None:	->L1418	defensive — In _compute_fan_corridors, a fanning junction always resolves to a section column and row; the unresolved continue guards a malformed graph the render path never produces.
1472	if tgt_col is None:	->L1473	needs-review — Defensive: _fan_bypass_band skips a fan edge whose target has no resolvable grid column; every corpus fan target resolves a column, so the skip arm is unexercised.
1478	if _is_row_level_bottom_row_climb(	->L1487	needs-review — _fan_bypass_band skips a fan’s bypass branch that is a bottommost-row climb to a higher-row entry port over a clear row-level corridor: emission keeps that branch at the source’s own Y, so pulling the shared bypass band down for it would desync the derived exit-turn plan. tests/fixtures/topologies/twoline_fanout_up.mmd reaches the skip arm, but the sweep’s corpus roots do not include tests/fixtures/topologies, so no swept fixture evaluates it.

convergences.py

212/382 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
202	if edge_rank is None:	->L203
284	if owned:	->L278
300	if route is None:	->L301
321	if route is None:	->L322
335	if family is None:	->L336
344	if not runs:	->L345
366	if axis.axis is not DemandAxis.X:	->L367
383	if route.exit_lane_transition_plan_id is not None:	->L384
416	if not candidates:	->L417
435	if vertical and abs(endpoint[0] - target[0]) <= COORD_TOLERANCE:	->L438
439	if elbow != endpoint and elbow != target:	->L440, ->L441
445	if route.offset_regime is OffsetRegime.DEFERRED:	->L446
459	for rank, (start, end) in enumerate(zip(route.points, route.points[1:])):	->L477
462	runway <= COORD_TOLERANCE	->L465
471	if abs(prior[0] - start[0]) + abs(prior[1] - start[1]) > COORD_TOLERANCE:	->L476
473	if direction_axis(incoming) is not direction_axis(approach):	->L476
526	if exit_turn_geometry != _exit_turn_geometry(route):	->L527
538	if approach is None:	->L539
591	if direction in {Direction.R, Direction.L}:	->L595
620	if len(route.points) < 2:	->L621
630	if axis is DemandAxis.X:	->L636
631	if abs(start[1] - end[1]) > COORD_TOLERANCE:	->L632
636	if abs(start[0] - end[0]) > COORD_TOLERANCE:	->L637, ->L638
640	if extent_end - extent_start > COORD_TOLERANCE:	->L619
726	if primary_landing is None or trunk_axis.axis is not DemandAxis.X:	->L727
755	if axis is DemandAxis.X:	->L757
805	if any(edge not in edge_order for edge in edges):	->L806
841	if not incoming_edges or not outgoing_edges:	->L842
847	if group.line_id not in line_order:	->L848
864	if trunk_edge_key is None:	->L865
913	if route is not None:	->L917
917	if route is None:	->L918
934	if any(	->L938
952	if (	->L957
957	for edge_key in incoming_edges:	->L958, ->L961
1015	if _shared_terminal_landing_drops_exit_turn(	->L1020	needs-review — The shared-terminal convergence declines ownership when seating its carrier would strand the carrier’s own exit turn (issue #1949). tests/fixtures/topologies/convergence_shared_terminal_exit_turn.mmd takes the decline arm, but the gate sweep globs tests/fixtures/ non-recursively, so the fixture under its topologies/ subdirectory is not evaluated here; the render-diff and the dedicated regression tests own it instead.
1116	if (	->L1128
1160	if continuation.covered_by_member_id is not None:	->L1161
1269	if topology is None:	->L1270
1357	if plan.trunk_axis is None:	->L1358	defensive — _turn_crosses_shared_run’s no-trunk-axis skip, a gate the restored conflict conditions added whose ordinal collided with a pre-existing baseline key, so the ratchet acknowledged it without a verdict. Its sole caller is _system_conflict’s trunk-pair scan, whose trunks tuple is built only from plans with a trunk axis, so the plan handed over always has one.
1388	if _points_coincide(*segment):	->L1389
1413	if (	->L1421	needs-review — _opposing_landing_approaches’ SHARED_APPROACH_CHANNEL condition: two feeders of one line whose approach runs stand on one coordinate travelling against each other. The loop reaches this pair test on 17 fixtures, so the shape of the scan is exercised. Neutralising _settle_opposing_landing_channels makes it fire on merge_bottom_row_bypass and merge_feeder_shared_channel_gap, at separation 0 with 150px of overlap, so that pass alone is what keeps it silent; the two opening passes account for none of it. Reachable. Reaching it is now a feasibility refusal rather than a change of emitter — see #1712.
1456	or abs(start[1] - end[1]) > COORD_TOLERANCE	->L1463
1459	if direction_axis(incoming) is not landing.approach_axis:	->L1463
1568	if opening_follows_flank:	->L1569
1630	if landing.opening_turn_segment is None:	->L1631
1633	if landing.approach_axis is DemandAxis.X:	->L1637
1635	if runway < curve_radius - COORD_TOLERANCE:	->L1636
1666	landing.approach_axis is DemandAxis.X	->L1670	needs-review — _reseat_landing_cross moves a stated opening turn only on an X approach, because the opening turn names a column and _landing_cross_segment reads a perpendicular approach’s crossing row off the runway whatever opening turn the landing carries. The false arm is the perpendicular class the widened _settle_opposing_landing_channels scope newly admits; corpus-wide every counter-running same-line pair that conflicts approaches on X. Reachable.
1667	and landing.opening_turn_segment is not None	->L1670	defensive — The second operand of the same condition. A landing that states an opening turn coordinate states its segment with it, so on an X approach the operand is true wherever the first is; it narrows the Optional _reseat_landing_opening requires.
1672	if runway < curve_radius - COORD_TOLERANCE:	->L1673, ->L1674	needs-review — _reseat_landing_cross refusing a seat that costs the approach corner its radius, on the runway-stated branch. Un-exercised because that branch is itself un-exercised; see if landing.opening_turn_segment is not None:::#1. Reachable.
1686	for rank, landing in enumerate(landings):	->L1687, ->L1694
1687	if landing.member_id not in member_ids:	->L1688, ->L1689
1690	if reseated is None:	->L1691, ->L1692
1727	if opening_segment is not None:	->L1736
1945	if any(	->L1950	needs-review — _packed_lane’s decline arm: packing a run onto the pitch of its nearest bundle neighbour would seat it inside a second neighbour’s pitch. Reachable — 3-lane bundles exist in the corpus (_packed_lane sees len(neighbours)==2 on examples/guide/03b_fan_in_merge.mmd) — but no fixture makes the candidate breach the far lane. Wants a fixture.
2007	if axis is None or axis.axis is not DemandAxis.X:	->L2008
2045	if plan.edge in owned_edges:	->L2046	defensive — _member_corridor_runs skips a frozen member plan whose edge a convergence already owns, but the two sets are disjoint by construction: build_member_geometry_execution never freezes a plan for an edge in _convergence_member_edges (member_geometry.py:1010), and resolved_member_edges is derived from the same scaffold predicate. 3830 frozen member plans across 348 fixtures, zero hits.
2054	or abs(before[0] - start[0]) > COORD_TOLERANCE	->L2057	needs-review — Rejects an interior horizontal whose leading flank is not vertical. Reachable: _member_corridor_runs walks raw plan.points with no normalize filter, and the corpus already freezes an H-D-H member polyline (examples/topologies/rail_boundary_bundle_fan.mmd), so one extra leg makes a horizontal run diagonal-flanked. Not the same contract as the look-alike defensive pair in common.py::iter_horizontal_trunks, which is fed only normalize-filtered bypass U-shapes. Wants a fixture.
2055	or abs(after[0] - end[0]) > COORD_TOLERANCE	->L2057	needs-review — Mirror of the leading-flank reject: an interior horizontal whose trailing flank is not vertical. Same H-D-H evidence and the same reason it is not covered by the common.py precedent. Wants a fixture.
2097	if run is None:	->L2098	defensive — _pack_cotravelling_corridor_runs skips a plan with no X-axis trunk run. _trunk_corridor_run returns None only when trunk_axis is absent or is DemandAxis.Y; every plan reaching here is owns_geometry, and owns_geometry => trunk_axis is not None is asserted at four call sites. One root cause with the module’s other DemandAxis.X scope guards: no corpus topology produces a vertical convergence trunk (346 calls, all X).
2156	if run is None:	->L2157
2189	if axis is None:	->L2190
2231	if axis is None or axis.axis is not DemandAxis.X:	->L2232
2241	if primary is None:	->L2242
2254	or landing.opening_turn_segment is None	->L2256
2267	if reseated is not None:	->L2250
2318	obstacle_segment is None	->L2323	defensive — A resident is read back from settled on every comparison, and laning moves its cross run rather than removing it, so the segment is drawable whenever it is read. The operand guards the Optional that read returns.
2319	or landing_segment is None	->L2323
2334	if reseated is None:	->L2335
2340	landing.member_id == plan.primary_trunk_member_id	->L2363	defensive — The first conjunct of the widened flank-carry condition. Its false arm is the ordinary feeder landing, which every fixture re-seating a landing takes; the coverage tool reports the operand separately from the conjunction above it.
2341	and plan.trunk_axis is not None	->L2363	defensive — _settle_opposing_landing_channels carries the trunk flank only when the landing it re-seated is the plan’s primary trunk member. A plan naming a primary trunk member always states the trunk axis that member travels, so the false arm is unreachable through this conjunction; it narrows the Optional for the flank move below.
2342	and plan.trunk_axis.axis is landing.approach_axis	->L2363	needs-review — The flank follows a re-seated landing only where flank and landing are measured on one axis. Every primary-trunk landing the corpus re-seats approaches on its own trunk’s axis, so the false arm wants a fixture whose trunk travels one axis while its primary trunk member’s landing approaches on the other — a perpendicular approach into a convergence, which is the class the widened scope newly admits. Reachable.
2372	if (	->L2305	defensive — A landing enters ordered only because _landing_cross_segment admitted it, and laning moves that run rather than removing it, so the read that names the landing as a resident always finds a segment. The gate guards the Optional that read returns.
2387	if axis is None:	->L2388
2411	if coordinate is not None:	->L2416
2453	if endpoint is None:	->L2454
2476	if plan.trunk_axis is None:	->L2477	defensive — Pre-existing gap, re-keyed from #1 by the restored _turn_crosses_shared_run guard that now takes that ordinal (unchanged [0,11] split). _lane_trunk_flanks’ skip for a plan with no trunk axis. Every plan reaching it is PLANNED — the two _settle_convergence_geometry call sites filter on owns_geometry and the third caller passes freshly built planned plans — and validate_convergence_plans asserts trunk_axis is not None for exactly those, so a plan that took this skip would abort on that assertion rather than render. _build_planned_convergence can construct such a plan, so the guard is defensive in practice rather than unconstructible.
2502	if coordinate is not None:	->L2508	needs-review — Pre-existing gap, re-keyed from #2 by the newly inserted packing gates (unchanged [0,2] split). _nearest_lane’s fall-through when no flank candidate clears the runway: it runs 9 times, always against a single obstacle, and in 5 of those one of the two candidates is already rejected by the curve-radius runway test, so a shorter flank runway rejects both. Reachable; wants a fixture.
2562	for seat, obstacle in obstacles:	->L-2547, ->L2563	needs-review — The give-way loop in _lane_trunk_flanks, entered only when no lane one clearance from the residents leaves the arriving flank a full turn radius to its endpoint. No corpus fixture crowds two same-line counter-running flanks that tightly, so the loop body is un-entered. Reachable, and exercised by test_a_flank_with_no_lane_of_its_own_is_given_way_to_by_the_resident and by test_a_resident_gives_way_to_a_lane_clear_of_the_flanks_around_it.
2564	if axis is None:	->L2565, ->L2566
2576	if lane is None:	->L2577, ->L2578	needs-review — A resident asked to give way that has no reachable lane of its own either. Un-entered because the give-way path itself is un-entered on the corpus. Reachable; a fixture is a channel with no seat for either run, which is the population #1712 exists to give room to.
2597	if flank_rank != 1:	->L2599
2608	if fork is None:	->L2609, ->L2617
2685	if forked:	->L2686
2686	if abs(flank_coordinate - landing_coordinate) <= COORD_TOLERANCE:	->L2687, ->L2688
2690	if abs(endpoint - flank_coordinate) <= clearance:	->L2691
2714	if forked:	->L2715, ->L2716	needs-review — _landing_gives_way_to_flank joins the landing to the flank’s column when the two are one stroke off a shared fork, and steps it one clearance off otherwise. Neither arm is reached because _flank_settled_column never declines on the corpus: all 32 crowded landing/flank pairs seat with 9px to spare. Reachable; a fixture needs an inter-column gap below MERGE_GAP_MIN carrying a chained convergence.
2789	if endpoint is None:	->L2790	defensive — _flank_lane needs the endpoint its flank turns onto to price the runway. ConvergenceTrunkAxis states source and target endpoint coordinates together or not at all, and every construction site in this module passes both, so the arm guards the Optional rather than a shape the planner builds.
2800	if coordinate is None:	->L2801
2813	if reseated is not None:	->L2814, ->L2817
2878	if not (	->L2881
2897	if axis is None or axis.axis is not DemandAxis.X:	->L2898	defensive — Pre-existing gap, re-keyed from #2 by the newly inserted packing gates (unchanged [0,18] split). The axis is None half cannot fire: callers filter on plan.owns_geometry and owns_geometry => trunk_axis is not None is asserted at 4 sites. The DemandAxis.Y half is unsettled — a vertical trunk axis is constructible in code (_direct_axis_points / _shared_terminal_axis yield Y for a vertical approach) but no corpus topology produces one; if a TB convergence trunk is shown constructible this reclassifies reachable-but-benign (the guard returns the right empty answer).
2955	if primary_edge is not None and plan.primary_trunk_member_id is not None:	->L2940
3162	if not carries_coupled_primary and any(	->L3168	needs-review — Reached by the corpus at 897747b0 and no longer: the branch’s later commits (908637eb..04209e3d) changed which paths fire, so this arm lost its last covering fixture rather than becoming unreachable. Left un-exercised deliberately — the render corpus is frozen for a measurement against main, so no fixture was authored.
3174	if endpoint is None or abs(endpoint - column) <= curve_radius:	->L3175
3192	if (endpoint - candidate) * toward_endpoint <= curve_radius:	->L3193
3247	if axis is None:	->L3248	defensive — A resident flank in _give_way_to was seated from a plan whose trunk axis was read to build it, so the plan still states one. The guard narrows the Optional before the flank move.
3391	if plan.trunk_axis is None or plan.trunk_axis.axis is not DemandAxis.X:	->L3392
3473	for candidate_coordinate in direct_candidates:	->L3499	needs-review — Reached by the corpus at 897747b0 and no longer: the branch’s later commits (908637eb..04209e3d) changed which paths fire, so this arm lost its last covering fixture rather than becoming unreachable. Left un-exercised deliberately — the render corpus is frozen for a measurement against main, so no fixture was authored.
3484	if not moved_channels or any(	->L3489	needs-review — Reached by the corpus at 897747b0 and no longer: the branch’s later commits (908637eb..04209e3d) changed which paths fire, so this arm lost its last covering fixture rather than becoming unreachable. Left un-exercised deliberately — the render corpus is frozen for a measurement against main, so no fixture was authored.
3490	if any(	->L3494	needs-review — Reached by the corpus at 897747b0 and no longer: the branch’s later commits (908637eb..04209e3d) changed which paths fire, so this arm lost its last covering fixture rather than becoming unreachable. Left un-exercised deliberately — the render corpus is frozen for a measurement against main, so no fixture was authored.
3495	if not landing_feasible(candidate_coordinate):	->L3496
3499	if coordinate is None:	->L3500	needs-review — Reached by the corpus at 897747b0 and no longer: the branch’s later commits (908637eb..04209e3d) changed which paths fire, so this arm lost its last covering fixture rather than becoming unreachable. Left un-exercised deliberately — the render corpus is frozen for a measurement against main, so no fixture was authored.
3505	if (	->L3509
3528	if not obstacles:	->L3530	defensive — The ordinal moved when the endpoint check left this condition; the arm is the ordinary no-crowding case _lane_trunk_flanks takes on most plans.
3536	for coordinate in candidates:	->L3515, ->L3537
3537	if not _inside_usable_gap(gap_edges, coordinate):	->L3538, ->L3539
3545	if moved_plan is None:	->L3546, ->L3547
3556	if moved_channel is None or any(	->L3560, ->L3561
3565	if (	->L3569, ->L3570	candidate-dead — Pre-existing gap, re-keyed from #8 by the gates the restored conflict conditions inserted earlier in the file (same never-executed line, same [0,0] split). Dead sub-block of _settle_opposing_gap_flanks’ landing-opening move: its enclosing if not obstacles: never takes the has-obstacles arm, so no non-flank plan gap channel is ever crowded by a resident one and nothing below line 3072 runs. What would settle it is a fixture whose settled convergence gap channel crowds a resident member channel of a different line in the same column gap.
3582	if first.system_id != second.system_id:	->L3583
3584	if first.claimant_member_ids & second.claimant_member_ids:	->L3585	needs-review — _channels_share_source_carrier’s shared-claimant shortcut. Its sole caller is _validate_final_convergence_feasibility, which pairs a convergence plan channel against a frozen member channel; the intersection is non-empty only when the plan’s channel names the very member it is compared with, which no corpus fixture produces. Reachable in principle, wants a fixture.
3591	if first.member_geometry_owned == second.member_geometry_owned:	->L3592	needs-review — _channels_share_source_carrier’s equal-ownership rejection. Its sole caller always pairs a convergence-owned channel with a member-owned one, so the two flags always differ and the rejection arm is unreachable from that caller. Reachable only if a second caller compares two channels of one owner.
3765	if _direction(*landing_segment) not in (Direction.U, Direction.D):	->L3766
3770	if endpoint is None or _shared_source_bundle_stroke(	->L3778
3783	if shortfall <= SAME_COORD_TOLERANCE:	->L3785
3798	if gap is None:	->L3799, ->L3800
3820	if not negative or not positive:	->L3821, ->L3822
3848	if current is None or requirement.required > current.required:	->L3757, ->L3849
3896	if first_plan.trunk_axis.axis is DemandAxis.X:	->L3900	needs-review — The Y-axis half of the opening-arm delta measurement. Six fixtures reach it and all take the X half, for the one root cause shared with this module’s other DemandAxis.X scope guards: no corpus topology produces a vertical convergence trunk. Not a guard — both halves are correct code for their axis — so it is reachable exactly when a vertical trunk axis is. What would settle it is a TB convergence whose _direct_axis_points / _shared_terminal_axis yields DemandAxis.Y.
3903	if first_delta * second_delta < 0:	->L3906	needs-review — OPPOSING_OPENING_CHANNEL: two arms of one line that turn on one shared column and then open to opposite sides of their source. Six fixtures reach the test with a genuine shared-opening pair, and in every one the two trunks open the same way, which the code below reads as one stroke branching to several destinations. Neutralising _settle_opposing_landing_channels makes it fire on merge_bottom_row_bypass and merge_feeder_shared_channel_gap; neutralising _settle_shared_opening_pivots and _settle_shared_source_openings does not, and the pivot pass cannot suppress it in any case because its group key partitions by the travel direction of flank 1. Reachable; reaching it is a feasibility refusal rather than a change of emitter — see #1712.
3920	if opposing_approaches is not None:	->L3921	needs-review — The refusal arm for the SHARED_APPROACH_CHANNEL conflict _opposing_landing_approaches reports. Un-exercised for exactly the reason that helper’s own pair test is (convergences.py::if (::#4): the helper is called on 18 fixtures and returns None on every one. Reachable; closing it and closing #4 are the same fixture.
3965	if same_line and first_direction is not second_direction:	->L3970	needs-review — SHARED_TRUNK_CHANNEL for a same-line pair whose outward and return legs crowd one channel and which _settle_shared_trunk_channels could seat no lane for: both runs boxed in by the obstacles either side of them, since the arriving flank now gives way to a resident and the resident gives way back. Read in the travel frame the laning pass decides in, so it no longer fires on a rank-1/rank-3 pair that pass deliberately fused. Neutralising that pass makes it fire 5 times on merge_around_below_leftmost, all central-run pairs at separation 0 and 6px. Reachable; reaching it is a feasibility refusal rather than a change of emitter — see #1712.
3971	if (	->L3998
4018	if conflict is not None:	->L4019
4027	if requirements:	->L4028, ->L4030
4055	if shared_carrier and separation > COORD_TOLERANCE:	->L4056
4062	if (	->L4073	defensive — Pre-existing gap, re-keyed from #11 by the gates the restored conflict conditions inserted earlier in the file (unchanged [0,18] split). validate_convergence_plans’ re-check that a landing’s join point sits on its plan’s own trunk axis and on the trunk route’s polyline. The join point is derived from the trunk axis when the plan is built and consume_convergence_route connects the emitted endpoint to it, so taking the raise arm means the planner contradicted its own axis: an engine bug and a hard abort, not a shippable topology.
4080	if _gap_channels_crowd(	->L4087
4103	if not plan.owns_geometry:	->L4104
4167	if not plan.owns_geometry:	->L4168
4190	owner_edge not in edge_ranks	->L4194
4229	if not plan.owns_geometry:	->L4230
4248	if ownership.edge in by_edge:	->L4249
4373	for item in system_plans:	->L4374, ->L4384
4642	if not horizontal and not vertical:	->L4643
4666	if interval[1] - interval[0] > COORD_TOLERANCE:	->L4651
4669	for interval_start, interval_end in sorted(intervals):	->L4677
4672	if interval_start > covered_until + COORD_TOLERANCE:	->L4673
4675	if covered_until >= extent_end - COORD_TOLERANCE:	->L4669
4699	if axis.axis is DemandAxis.X:	->L4722
4819	if not candidates:	->L4820
4927	if not 0 <= flank_rank < len(route.points) - 1:	->L4928
4946	if actual is None:	->L4947
4953	direction is not landing.approach_direction	->L4957
4954	or handedness is not landing.corner_handedness	->L4957
4955	or runway < landing.minimum_runway - COORD_TOLERANCE	->L4957
4974	opening is None	->L4978
4975	or abs(opening.x - landing.opening_turn_coordinate) > COORD_TOLERANCE	->L4978
4976	or emitted_segment != landing.opening_turn_segment	->L4978
4987	if query is None:	->L4988
4993	if not plan.owns_geometry:	->L4994
5003	if (	->L5017	defensive — Pre-existing gap, re-keyed from #12 by the gates the restored conflict conditions inserted earlier in the file (unchanged [0,18] split). The raise for a covered continuation absent from the carrier member that is recorded as covering it. _reconcile_continuation_ownership only names a carrier whose route already spans the continuation’s endpoints, so the raise arm reports an engine bug and aborts the render; no valid topology reaches it.
5021	if plan.primary_trunk_member_id == membership.member_id:	->L5026
5044	if opening is None:	->L5045
5045	if not clearance_pending:	->L5046, ->L5052
5069	if ctx.validate_final_route_frames and not clearance_pending:	->L5071
5086	if not clearance_pending and any(	->L5090	needs-review — The endpoint-agreement refusal is deferred only while a provisional convergence plan carries a published boundary-clearance requirement. Production rendering settles that grant and immediately observes a strict plan with clearance publication disabled, so the same guard is active before anything can render. No committed corpus fixture reaches the provisional shortfall; the controlled regression lowers the placement floor to exercise both arms.
5091	if ctx.validate_final_route_frames and not clearance_pending:	->L-4985
5105	if not plan.owns_geometry:	->L5106
5107	if plan.system_id in execution.query.clearance_requirement_system_ids:	->L5108
5116	if trunk_route is None or not _route_covers_trunk(trunk_route, plan.trunk_axis):	->L5117
5126	if route is None:	->L5127
5132	if (	->L5137	candidate-dead — Pre-existing gap, re-keyed from #13 by the gates the restored conflict conditions inserted earlier in the file (unchanged [0,0] split). Never executed rather than half-taken: its enclosing if continuation.covered_by_member_id is not None: never takes the None arm on any of the 18 fixtures that validate a planned convergence, so an uncovered outgoing continuation does not exist in this corpus. What would settle it is a topology whose continuation no endpoint owner’s route spans, which _reconcile_continuation_ownership would then leave uncovered.
5144	if any(	->L5148
5168	if (	->L5177
5183	if (	->L5194
5210	if route is None or membership is None:	->L5211
5216	if any(	->L5220

core.py

24/33 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
192	for handler in (_route_tb_section, _route_entry_runway, _route_intra_section):	->L197
234	if scaffold is None:	->L241
256	if rail_execution is not None:	->L260
460	if result is not None:	->L-410	defensive — Append-guard after the priority-ordered handler chain. The final handler _route_intra_section is total: its three early returns and its _route_diagonal fallback (annotated -> RoutedPath, single return statement) always yield a RoutedPath, so result is never None and every edge appends. The None arm is unreachable.
462	if system_execution is not None:	->L464
482	if system.system_id != expected.system_id:	->L485
503	if system_execution is not None and next_system_rank != len(	->L506
631	if system_execution is not None:	->L639
663	if validate_final_route_frames:	->L665

corners.py

9/11 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
77	if corner_idx < 0 or corner_idx >= n_corners:	->L78	defensive — Bounds check for resolve_curve_radius_at. Production callers use indices from range(n_corners) or recorded corner buckets, so an invalid index requires a caller-contract violation and is covered as an error case by the corner unit tests.
573	if vertical is Direction.D:	->L575, ->L580

exit_turns.py

183/288 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
496	if not replacements:	->L497
725	if key not in ctx.station_offsets and port_key not in ctx.station_offsets:	->L726
738	if len({coordinate for _line, _offset, coordinate in values}) != len(values):	->L739
811	if source_run_direction not in {Direction.R, Direction.L}:	->L812
901	if source_run_direction not in run_axis:	->L902
906	if abs(delta) <= COORD_TOLERANCE:	->L907
910	if horizontal:	->L913
914	if actual_run is not source_run_direction:	->L915
944	if route is None:	->L945
947	if len(points) < 3:	->L948
952	if run_direction is None or turn_direction is None:	->L953
979	if off_column_decline is not None and source_run_direction not in {	->L983
984	if family_id is RouteFamilyId.MERGE_ENTRY_STRAIGHT:	->L985
1079	if entry_geometry.seam.turn_direction is None:	->L1080
1165	if abs(turn_delta) <= COORD_TOLERANCE:	->L1166
1193	if abs(turn_delta) <= COORD_TOLERANCE:	->L1194	defensive — _plain_l_shape_turn_requirement’s flat-hop guard, which both its callers exclude: _standard_l_shape_turn_requirement returns its own missing-source-turn for a flat delta before delegating, and the cell-mate gap drop only classifies when the target section sits one grid row below the source (_bypass_route_kind requires tgt_row == src_row + 1), which puts the two ports on different rows. The duplicated guard therefore never fires.
1322	if kind is _BypassRoute.LEFT_ENTRY_FAMILY:	->L1323
1326	if kind is _BypassRoute.RIGHT_ENTRY_CROSS_ROW:	->L1327
1328	if kind is _BypassRoute.L_SHAPE:	->L1329
1335	if kind is _BypassRoute.LEFT_EXIT_AROUND_BELOW:	->L1336
1481	if direction_axis(transition.run_direction) is DemandAxis.X:	->L1485
1536	if len(candidates) != 1:	->L1537
1543	if direction_axis(run_direction) is DemandAxis.Y:	->L1544
1571	if transition is None:	->L1572
1608	target_crossing is None	->L1611
1609	or abs(source_crossing - target_crossing) > COORD_TOLERANCE	->L1611
1633	target_crossing is None	->L1636
1634	or abs(geometry.cross_lo - target_crossing) > COORD_TOLERANCE	->L1636
1706	if direction_axis(run_direction) is DemandAxis.Y:	->L1707
1732	if transition is None:	->L1734
1765	if len(entry_group_ids) != 1:	->L1766
1772	if family_id is None:	->L1773
1801	requirement.run_direction is not None	->L1814
1802	and requirement.turn_direction is not None	->L1814
1803	and requirement.launch_coordinate is not None	->L1814
1804	and requirement.minimum_runway is not None	->L1814
1823	and requirement.turn_direction is not None	->L1830
1835	and family_id is not RouteFamilyId.MERGE_ENTRY	->L1838
1863	if any(len(runs) > 1 for runs in straight_runs_by_lane.values()):	->L1864	defensive — The opposed-source-run recogniser: a lane whose turn-less members disagree on the direction they leave the shared source. Every member of one exit group leaves through one exit port, whose side fixes the outward ray, and a collinear target on the other side of that port is a backward hop the engine rejects before routing. The arm names a classification that contradicts itself and declines the plan; no exit group produces it.
2015	if any(	->L2026
2040	if membership is not None and membership.axis is not None:	->L2041
2118	if not _lane_arms_read_as_one_stroke(	->L2121	defensive — The reject protects a planner seed set where an unpinned cohort lands within one curve radius of a same-rank axis already claimed by a pinned cohort. Production topology planning pins or separates those cohorts before this check. test_free_lane_arm_overlapping_a_pinned_corner_uses_legacy constructs the incomplete seed set directly and covers the fallback reason.
2235	if reason is not None:	->L2236
2338	if not outbound_edges or missing_connectors:	->L2339
2440	if final_classification.legacy_reason is not None:	->L2441
2442	elif tuple(seed.family_id for seed in final_classification.seeds) != tuple(	->L2445
2707	if incumbent.id == plan.id:	->L2709
2733	if prior is None:	->L2734
2777	if owners and plan.id not in owners:	->L2778
2778	for owner in owners:	->L2779, ->L2780
2793	and plan.id in conflicting_plan_ids	->L2795
2811	and axis.fixed_anchor_offset is not None	->L2800
2812	and abs(proposed - axis.fixed_anchor_offset) > COORD_TOLERANCE	->L2814
3002	if abs(first_offset - second_offset) > COORD_TOLERANCE:	->L3004
3004	for owner in (first_owner, second_owner):	->L3001, ->L3005
3005	if owner is not None:	->L3004, ->L3006
3012	if not additions:	->L3014
3076	if assignment.planned_family_id is RouteFamilyId.BOTTOM_EXIT_JUNCTION:	->L3077
3111	if route is None:	->L3112
3117	if assignment.planned_family_id is not RouteFamilyId.TB_BOTTOM_EXIT:	->L3118
3132	if route is None:	->L3133, ->L3139
3147	if geometry.bundle_offsets is None:	->L3148
3240	if scaffold is None:	->L3241
3248	if scaffold is None:	->L3249	defensive — The second None check protects the manual or incomplete graph fallback after rebuilding a missing retained scaffold. Parsed render-path graphs publish one canonical scaffold during fan planning, so the fixture corpus never reaches a rebuild that can return None. Direct planner tests retain the fallback for graph construction without topology.
3287	if overridden_dispositions:	->L3288
3289	for plan_id in overridden_dispositions:	->L3290, ->L3301
3345	if transition_key in transition_by_edge:	->L3346
3369	if len(points) >= 3:	->L3376
3372	segment_direction(before, start) is run_direction	->L3376
3373	and segment_direction(start, end) is turn_direction	->L3376
3417	assignment is None	->L3422
3418	or membership.axis is None	->L3422
3419	or assignment.run_direction is None	->L3422
3420	or assignment.turn_direction is None	->L3422
3479	if ctx.exit_turns is None:	->L3480
3490	if family_id is not assignment.planned_family_id:	->L3491
3503	if (	->L3512
3521	run is None	->L3526
3522	or turn is None	->L3526
3523	or assignment.launch_coordinate is None	->L3526
3524	or assignment.minimum_runway is None	->L3526
3530	if segment_rank is None:	->L3531
3551	if planned_corner_offsets is None:	->L3552
3618	if source_turn_changed and settled is None:	->L3619
3646	if rank is None:	->L3647
3713	if current.keys() != snapshot.geometry.keys():	->L3714
3728	if current[key] != state:	->L3729
3759	or exit_turn_plan.system_id in skip_system_ids	->L3761
3765	station_id not in graph.stations	->L3768
3766	or lane.line_id not in graph.station_lines(station_id)	->L3768
3774	if (station_id, lane.line_id) not in station_offsets or (	->L3781
3789	if len(transition_routes) != 1:	->L3790
3827	route.exit_lane_transition_plan_id != str(exit_turn_plan.id)	->L3832
3828	or route.offset_regime is not OffsetRegime.BAKED	->L3832
3829	or route.points != expected_route.points	->L3832
3830	or route.curve_radii != expected_route.curve_radii	->L3832
3848	if not _fixed_axis_matches_plan(	->L3853
3859	if any(	->L3868
3876	if len(member_routes) != 1:	->L3877
3884	if route.exit_turn_family_id != assignment.planned_family_id.value:	->L3885
3892	if route.exit_turn_axis_id is not None:	->L3893
3901	if (	->L3915
3923	route.exit_turn_axis_id != str(assignment.axis_id)	->L3926
3924	or route.exit_turn_segment_rank is None	->L3926
3937	if (	->L3959

inter_section_handlers.py

203/344 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
429	if section is None:	->L430
668	and f.src_row is not None	->L695	defensive — LEFT-entry inter-row L-shape guard. Every LEFT-entry inter-section edge reaching this condition has a resolved source grid row (f.src_col/f.tgt_col are asserted non-None just above and the row resolves alongside), so the f.src_row is None short-circuit out of the L-shape branch is never taken.
669	and f.tgt_row is not None	->L695	defensive — Companion guard to f.src_row in the same LEFT-entry inter-row L-shape condition: the target grid row is likewise always resolved here, so the f.tgt_row is None short-circuit out of the branch is never taken.
748	if src_sec is None:	->L749
752	if edges is None:	->L753
776	if section and section.bbox_w > 0:	->L778
784	if section and section.bbox_w > 0:	->L786
810	if _v_segment_crosses_other_section(graph, corner_x, src.y, ey, exclude):	->L811	defensive — Drop-in viability test in _right_entry_drop_in_is_clear (#889). The cross-row RIGHT-entry rule fires only when the earlier bypass / plough rules ceded the edge, i.e. no section sits between source and port, so the outward-side descent runs clear; the not-clear arm covers only an exotic descent blocked by a wide same-column sibling no corpus fixture builds. Defensive.
916	if min(drop_xs) < _section_right_edge(graph, tgt) - COORD_TOLERANCE:	->L917
919	if _v_segment_crosses_other_section(graph, dx, src.y, tgt.y, exclude):	->L920
960	if route is not None:	->L962
1161	if route is not None:	->L1175
1306	if _corridor_is_viable(ctx, src, tgt):	->L1307	needs-review — Reachable only via a defective render (inter-row corridor grazes the source section); see #722.
1327	if kind is _LeftEntryRoute.CORRIDOR:	->L1328
1354	if target_port is None:	->L1355
1373	if sibling_port is None or not sibling_port.is_entry:	->L1374
1436	if sibling_route is None or len(sibling_route.points) < 6:	->L1437
1448	if (	->L1453
1594	if abs(ep.y - f.sy) < ctx.curve_radius:	->L1595	defensive — Merge entry-port Y tracks the source/junction Y, so a sub-curve_radius exit->entry gap never arises (the same-Y rule already handles dy<tol); corpus instrumentation across the fixtures (#762) confirms the arm is never taken. Defensive.
1597	if ep_port and ep_port.side in (PortSide.TOP, PortSide.BOTTOM):	->L1598
1599	if ep_port and ep_port.side == PortSide.LEFT:	->L1605	defensive — Contract guard in _route_inter_section: a merge entry port always resolves to a Port on the LEFT side here, so the non-LEFT/None arm (fall through to _route_l_shape at L344) is never taken (0/128). The earlier ‘multiline phantom’ note was inaccurate — this is a recorded gate whose arm is never taken. Defensive guard. Reclassified defensive (#762).
1602	if _corridor_is_viable(ctx, src, ep):	->L1604	needs-review — Reachable only via a defective render (route skirts/crosses section boundary); see #724.
1626	if tgt_sec is None:	->L1627, ->L1628	defensive — Defensive guard in _fan_shares_inter_row_channel: the edge is a fan branch into an entry port, which always resolves to a section, so the None arm is unreachable in practice.
1628	if port.side is PortSide.TOP:	->L1629, ->L1634
2063	if len(_INTER_SECTION_RULE_BY_FAMILY) != len(_INDEXED_INTER_SECTION_RULES):	->L2064, ->L2067
2069	if _INTER_SECTION_RULES is _INDEXED_INTER_SECTION_RULES:	->L2071
2094	if not is_inter:	->L2095
2105	if family_id is not RouteFamilyId.STANDARD_L_SHAPE:	->L2106
2119	route is None	->L2120
2120	and membership is not None	->L2121, ->L2130
2121	and membership.assignment is not None	->L2122, ->L2130
2122	and membership.plan.disposition is ExitTurnDisposition.PLANNED	->L2124, ->L2130
2130	if route is not None:	->L2135
2274	if planned_transition is not None:	->L2275
2495	if query is None:	->L2496	defensive — Production routing runs after layout publishes FanPlanExecution. The None arm preserves the ordinary dispatcher for direct or incomplete routing contexts.
2520	if ctx.station_offsets:	->L2522	defensive — _run_pass_c_guards always populates ctx.station_offsets before route_edges, and RAILS mode returns earlier; the empty-offsets arm never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
2627	if query is None:	->L2628
2631	if binding is None:	->L2632
2636	plan.disposition is not FanPlanDisposition.PLANNED	->L2642
2637	or emission.emitter is not FanRouteEmitter.BOTTOM_EXIT_RIGHT_LANDINGS	->L2642
2638	or plan.fork_station_id != edge.source	->L2642	defensive — FanPlan membership validation requires every emission source to equal fork_station_id. This operand catches a frozen-plan/source mismatch before materialisation.
2639	or target_port is None	->L2642	defensive — The planner creates this emitter only for a resolved landing port. A missing target port therefore indicates graph or plan drift after publication.
2640	or target_port.side is not PortSide.RIGHT	->L2642	defensive — BOTTOM_EXIT_RIGHT_LANDINGS is selected only when every target is a RIGHT entry. The non-RIGHT arm is a defensive check that the frozen target still satisfies that contract.
2651	if port is None or port.side is not PortSide.RIGHT or section is None:	->L2652	defensive — The planned emitter is created only from existing RIGHT landing ports with owning sections. This guard rejects stale or corrupted port references during materialisation.
2655	if section not in landing_sections:	->L2646	defensive — The planner admits this emitter only when branches land in distinct sections, so the duplicate-section arm cannot occur for a valid frozen emission. It remains a materialisation-time drift check.
2657	if len(landing_sections) != len(plan.branches):	->L2658	defensive — The planner emits this route family only when every branch lands in one distinct RIGHT-entry section. A count mismatch can arise only if the frozen emission and plan have drifted apart.
2660	if plan.entry_runway is None:	->L2661	defensive — Every PLANNED FanPlan is validated with both runways before publication. The None arm is a runtime drift check for an incomplete plan object.
2664	if not source_lines or edge.line_id not in source_lines:	->L2665	defensive — The planned emitter requires a non-empty offset_line_order whose line set exactly matches its emissions. The missing-line arm protects routing from a malformed frozen plan.
2691	if route is None:	->L2692
2727	if tgt_port is None or tgt_port.side != PortSide.LEFT:	->L2728
2730	if ep_col is None or ep_row is None:	->L2731
2733	if corner_x is None:	->L2734
2856	if _would_route_around_section_below(other, ctx):	->L2857	defensive — Competing-sibling detection in _has_around_section_sibling, routed through the dispatch table (#813). A non-bypass sibling feeding the same merge junction sits in an adjacent column or a gap with no same-row intervening section, so it dispatches to an L-shape, not the around-below loop; corpus instrumentation across the fixtures confirms the arm is never taken. Defensive.
2991	if trunk_shape.around_below:	->L2992
3000	if flank_xs:	->L2979
3091	if src_row is None or tgt_row is None or src_col is None or tgt_col is None:	->L3092	defensive — _is_row_level_bottom_row_climb’s null guard; neither swept caller can pass a None coordinate. _bypass_geometry asserts src_col/tgt_col non-None and only calls it under cross_row, and cross_row is True only when both rows are set: merge_trunk_force_cross_row returns False unless src_row is not None and tgt_row == src_row, and the other disjunct requires both rows non-None. _fan_bypass_band passes non-None src_col/src_row and a checked tgt_col, and any placed target entry-port section resolves a non-negative grid_row. No fixture in the render corpus reaches the None arm.
3245	and corridor.bypass_band_y >= base_y - COORD_TOLERANCE	->L3255	needs-review — Safety fallback: the shared bypass band is the deepest sibling’s bypass_bottom_y, so a branch’s own base_y never exceeds it; the arm that would decline a shallower shared band (guarding a predicate mismatch) is unexercised in the corpus.
3367	if trunk_v_up_pull_away:	->L3376	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
3406	this_xmin - gap_left >= SECTION_ROUTE_CLEARANCE	->L3407, ->L3425
3407	and gap_right - around_xmax >= SECTION_ROUTE_CLEARANCE	->L3409, ->L3425
3456	if src_sec is not None and src_sec.bbox_w > 0:	->L3506	defensive — A bypass source section always resolves and has bbox_w>0 (the parser never emits an empty section); the None/zero-width arm never fires.
3638	if facts.src_col is None or facts.tgt_col is None:	->L3639
3643	if shape.around_below:	->L3644
3648	or _bypass_route_kind(facts) is not _BypassRoute.U_BYPASS	->L3650
3739	if ctx.exit_turns is None:	->L3740
3743	membership is None	->L3746
3748	if abs(start[0] - end[0]) > COORD_TOLERANCE:	->L3749
3812	membership is None	->L3815
3820	if abs(start[0] - end[0]) > COORD_TOLERANCE:	->L3821	defensive — _seat_bypass_descent reads the segment at BYPASS_DESCENT_RANK, which the U-bypass builder emits as the descent between the two gap corners and is vertical by construction. The non-vertical bail guards a route whose point order does not match the shape the caller just built.
3859	if route is not None:	->L3861
3887	if route is None:	->L3888	defensive — Defensive in _declare_trunk: _route_inter_section only reaches the declaration after a matched rule (or the L-shape fall-through) produced a route, so the None guard never fires on the corpus; it mirrors _declare_channel’s same guard for a handler that returns None.
3915	if route is None:	->L3916	defensive — _declare_channel deliberately accepts RoutedPath | None so declining builders can be ignored. Production callers currently pass concrete routes; the None no-op remains a defensive helper contract.
3962	if route is None:	->L3963	defensive — _declare_placed_channels accepts RoutedPath | None to match _declare_trunk and _declare_channel, but all three call sites have already established the route (an assert on the left-entry corridor, a RuntimeError when a planned fan emitter omits a member, and a locally built U-bypass), so the None no-op is a helper contract nothing exercises.
3976	if (lo, matched_row, direction) in declared:	->L3978	needs-review — The un-exercised arm is the fresh declaration, not the dedupe skip: declared is seeded from the slots the handler’s targeted _declare_channel calls already made, and on the corpus every gap-landing leg of a frozen frame is one of those, so the sweep only ever skips. The declaration fires where two targeted declarations collapse onto one gap and direction, leaving a third leg holding a gap nothing named — the case the left-entry corridor and U-bypass call sites are commented for.
4183	while cur is not None and cur not in seen:	->L4199
4189	if port.side == PortSide.LEFT:	->L4191
4192	if cur in graph.junctions:	->L4198
4279	if (	->L4285
4464	if geometry is None:	->L4465
4563	if abs(tgt.x - src.x) <= ctx.curve_radius:	->L4564
4576	if _h_segment_crosses_other_section(graph, src.x, final_x, src.y, exclude):	->L4577	defensive — Traverse-first clearance test in _top_entry_side_fan_traverse_clears (#1349). The below-side fan branch only reaches this gate when its junction also feeds an aligned straight drop; the corpus fan sits a clear row above its target, so the source-Y traverse never crosses another section and the fall-back-to-staircase arm is not exercised. Defensive.
4704	if abs(tgt.x - src.x) > COORD_TOLERANCE or src.id not in ctx.graph.junctions:	->L4705
4739	if feeder is not None:	->L4744
4898	if direction is None:	->L4899
4926	if len(points) < 3:	->L4927
4978	if not section_ids:	->L4979
5058	if mid_y is None:	->L5075
5090	channel_y is None	->L5120
5092	and src_sec is not None	->L5120	defensive — Inter-row exit mid-Y clearance bump (the n>1 multi-line branch). When more than one line shares the exit the source section always resolves, so the src_sec is None short-circuit past the clearance bump is never taken.
5093	and tgt_sec is not None	->L5120	defensive — Companion to src_sec in the same n>1 mid-Y clearance branch: the target section always resolves there, so the tgt_sec is None short-circuit past the bump is never taken.
5122	if exit_side is not None:	->L5124
5124	elif abs(dx) > ctx.curve_radius:	->L5125, ->L5127
5128	if src.id in ctx.graph.junctions:	->L5129, ->L5141	needs-review — Reachable only via a defective render (LR->TB TOP-entry routing); see #720.
5129	for je in ctx.graph.edges_to(src.id):	->L5130, ->L5141
5131	if js.is_port:	->L5129, ->L5132
5132	if abs(js.x - src.x) <= COORD_TOLERANCE:	->L5133, ->L5135
5147	if exit_side is not None and not straight_drop:	->L5157
5195	if not straight_drop:	->L5199	needs-review — A top-entry fan branch fed straight from directly above the junction (straight_drop) keeps its lead-in column at the source X rather than the shared fan pivot; the corpus’s fan branches all carry horizontal travel, so the straight-drop arm is unexercised.
5197	if lead is Direction.R:	->L5199	needs-review — A top-entry fan branch leading LEFT out of the junction skips the _v1_corner_x right-edge clearance bump; the corpus’s fan branches all lead right, so the left-lead arm is unexercised.
5224	if straight_drop:	->L5225
5301	if ctx.exit_turns is None:	->L5302	needs-review — _perp_entry_turn_is_planned answers False for the pre-plan context the exit-turn planner probes emitters with; ctx.exit_turns is bound only for emission. That context does reach these emitters — the same guard in _seat_bypass_descent takes its None arm on packed_cell_right_exit_left_entry_wrap — but no corpus probe reaches the TOP/BOTTOM-entry L-shape records this predicate feeds.
5386	if src_sec is None or tgt_sec is None or src_sec.grid_row >= tgt_sec.grid_row:	->L5389
5556	if src_section and src_section.bbox_w > 0:	->L5557
5577	if tgt_sec is None:	->L5578
5648	if src_col is None:	->L5649
5892	if src_sec is not None:	->L5923	defensive — Defensive guard in the fanned entry-wrap source-clearance lift: a fan-out junction always resolves to its source section, so the None arm is unreachable in practice.
5929	if tgt_col is not None:	->L5934	defensive — tgt_col from _resolve_section_col on a valid LEFT entry port is always non-None (sections get grid_col>=0 after auto-layout).
5931	if shared_vx is not None:	->L5934	defensive — _fan_left_entry_descent_x returns None only when col_left<=0; col_left_edge for the target’s own column is always >0.
6057	if entry_side is PortSide.LEFT:	->L6060
6125	if entry_port is None:	->L6126	defensive — _route_around_section_below is always called with a non-None entry_port (both dispatch sites pass a checked station).
6136	if trunk_src is None or trunk_src == edge.source:	->L6138	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
6189	if col_left <= 0.0:	->L6190	defensive — col_left_edge’s 0.0 default only fires for a column with no sections; the target’s own column always holds its section.
6226	if entry_port is None:	->L6227	defensive — Every caller of _corridor_is_viable passes a non-None entry_port.
6233	if src_row is None or ep_row is None or src_col is None or ep_col is None:	->L6234	defensive — _resolve_section_colrow returns (None,None) only for a station with no section; valid entry ports always have a section with non-negative grid coords.
6320	if fan is not None and corridor is not None and corridor.band_y is not None:	->L6324	needs-review — Corridor-feeder shared inter-row band gate: the corpus’s corridor feeders belong to fans whose corridor carries a band_y, so the short-circuit past it (no corridor or bypass-only) is unexercised; it falls to the elif fan-is-not-None global-band branch.
6324	elif fan is not None:	->L6328, ->L6333	needs-review — Corridor-feeder fallback for a fan whose junction earned no corridor (its in-column gap below does not fit the bundle); the corpus’s fans all earn a corridor, so this global-band branch is unexercised.
6333	elif gap_bottom > gap_top:	->L6334, ->L6338	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
6343	if fan is None and gap_bottom > gap_top:	->L6344	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
6357	if fan is not None and ep_col is not None:	->L6359	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
6359	if vx is None:	->L6360	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
6461	if ep_section and ep_section.bbox_w > 0:	->L6464	defensive — entry_port.section_id is always set and the section has bbox_w>0 after layout; the else arm never fires.
6758	for claim in ctx.convergences.prior_channel_claims_for_edge(edge):	->L6759
6759	if claim.line_id != edge.line_id or claim.owner_source == edge.source:	->L6760, ->L6761
6761	if not (corner_x - COORD_TOLERANCE <= claim.x <= gap_right + COORD_TOLERANCE):	->L6762, ->L6763
6763	if min(hi, claim.y_hi) - max(lo, claim.y_lo) > COORD_TOLERANCE:	->L6758, ->L6764
6837	if _leadout_self_meets_sibling_descent(ctx, edge, corner_x, f.sy, hy, gap_right):	->L6838
6969	if gap_bottom <= gap_top:	->L6970	defensive — The row-gap enforcer keeps stacked rows separated, so the inter-row band above a target row (row_bottom_edge(tgt_row-1) up to row_top_edge(tgt_row)) has positive height whenever a RIGHT entry is fed from a higher row; the degenerate-band arm guards an abutting-rows layout placement never produces.
6973	if not _inter_row_band_fits(gap_top, gap_bottom):	->L6974	defensive — Band-fit test in _right_entry_gap_above_is_clear (#889), reached only when the cross-row RIGHT-entry drop-in is not clear (the exotic blocked-descent case above). The corpus always takes the drop-in, so neither arm of the gap-above fallback is exercised. Defensive.
7128	if gap_bottom <= gap_top:	->L7129
7130	if not _inter_row_band_fits(gap_top, gap_bottom):	->L7131
7141	if f.v_segment_crosses_other_section(vx, gy, tgt.y):	->L7142
7236	if source is None or source.bbox_w <= 0:	->L7237
7249	if cellmate_left is None or other.bbox_x < cellmate_left:	->L7243
7289	if band0_bottom <= band0_top or not _inter_row_band_fits(band0_top, band0_bottom):	->L7290
7291	if band1_bottom <= band1_top or not _inter_row_band_fits(band1_top, band1_bottom):	->L7292
7293	if band1_top <= band0_bottom + COORD_TOLERANCE:	->L7294
7309	if f.v_segment_crosses_other_section(corner_x, band0_y, band1_y, exclude):	->L7310
7366	if geom is None:	->L7367
7369	if f.v_segment_crosses_other_section(geom.lead_x, src.y, geom.band0_y):	->L7370
7371	if f.h_segment_crosses_other_section(geom.lead_x, geom.corner_x, geom.band0_y):	->L7372
7373	if f.h_segment_crosses_other_section(geom.corner_x, geom.vx, geom.band1_y):	->L7374

intra_handlers.py

53/80 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
84	if not section:	->L85	defensive — _route_entry_runway only runs on an entry-port -> internal-station edge; the target of such an edge always carries a section_id that resolves, so the guard’s return-None arm protects against a malformed graph rather than a topology.
91	if section.direction == "RL" and port.side != PortSide.RIGHT:	->L92
93	if section.direction not in ("LR", "RL"):	->L94	defensive — No TB/BT entry reaches _route_entry_runway: TB LEFT/RIGHT entries are consumed by _route_tb_lr_entry and TB/BT TOP/BOTTOM entries by _route_perp_entry (both earlier in the dispatch chain), and a BT section is never produced (the direction directive accepts only LR/RL/TB; 0/391 corpus sections are BT). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
139	if abs(nearest_src - sx) < src_min + ctx.diagonal_run:	->L140	defensive — Entry-runway ‘too tight’ return cannot fire: |nearest_src - entry_port_x| is floored at SECTION_X_PADDING (50px, the entry port sits at section.bbox_x = min(internal_station_x) - SECTION_X_PADDING), while src_min + diagonal_run = CURVE_RADIUS(10) + MIN_STRAIGHT_PORT(5) + DIAGONAL_RUN(30) = 45px. Since 50 >= 45 the guard is always False.
150	elif sy_blocked:	->L151	defensive — Entry-runway trunk-row non-consumer bypass (#1293). Both-rows-blocked fall-through: a non-consumer sits on BOTH the entry row and the target trunk row, leaving no clear runway row. No corpus fixture has a doubly-blocked flow-side entry; defensive.
162	if abs(diag_start_x - sx) <= abs(last_blocker - sx):	->L163	defensive — Entry-runway trunk-row non-consumer bypass (#1293). Descent-clips-blocker fall-through: the join-biased diagonal cannot start past the furthest target-row non-consumer (a blocker within diagonal_run+tgt_min of the target). Corpus blockers sit far enough forward; defensive.
191	for k in range(len(points) - 1):	->L192, ->L197	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
194	for bbox in footprints:	->L191, ->L195	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
195	if segment_intersects_bbox(x1, y1, x2, y2, bbox):	->L194, ->L196	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
226	if not st or st.is_port:	->L227
232	and line not in graph.station_lines(sid)	->L234	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
235	if not blockers:	->L238	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
246	if lead_end - sx < min_straight or tx - tail_start < min_straight:	->L247, ->L248	defensive — Trunk-row entry bow (#1315). No-room return: the flat lead-in before the rise, or the flat tail after the drop, is shorter than a port’s minimum straight. A corpus blocker sits far enough from both the port and the target to leave room, so the fall-through to a plain straight run is defensive.
248	if over_end - over_start < 2 * ctx.curve_radius:	->L249, ->L251	defensive — Trunk-row entry bow (#1315). No-room return: the flat run over the blocker(s) is shorter than two corner radii, so the bump’s corners would overlap. The blocker-span-plus-clearance always exceeds 2*CURVE_RADIUS for corpus fixtures; defensive.
251	for sign in _bow_side_order(section_stations, blockers, sy, over_start, over_end):	->L252, ->L263	defensive — Trunk-row entry bow (#1315). Loop-exhausted fall-through (both sides fail the clearance check): every corpus bow clears on its first (roomier) side, so the exit past the loop that returns a plain straight run is defensive.
261	if _bow_clears_markers(points, section_stations):	->L251, ->L262	defensive — Trunk-row entry bow (#1315). Retry arm (the roomier side’s bow rakes a marker, so the other side is tried): _bow_side_order puts the side with the farthest off-trunk marker first, and the fixed bump height clears it, so no corpus fixture falls to the second side; defensive.
281	for st in section_stations:	->L282, ->L295	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
282	if st.id in blocker_ids:	->L283, ->L284	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
284	if not (	->L289, ->L290	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
291	if dy < -COORD_TOLERANCE_FINE:	->L292, ->L293	defensive — Trunk-row entry bow (#1315). Exercised by tests/fixtures/regressions/entry_trunk_row_bow.mmd, which is kept out of the validate=True corpus and the gate-coverage corpus (it exercises the always-on render path only), so no clean corpus fixture takes this arm. The render-path invariant test test_entry_trunk_row_bow_clears_non_consumer covers the drawn detour.
293	elif dy > COORD_TOLERANCE_FINE:	->L281, ->L294
311	if not (tgt.x - src.x <= 0 and abs(dy) > CROSS_ROW_THRESHOLD and not same_section):	->L313	defensive — _route_fold_edge: the not-same_section precondition is never satisfied at the intra-section handlers, so the fold (False) arm is never taken: cross-section edges are consumed by _route_inter_section upstream (0/391 corpus fixtures reach this branch with differing sections), and a sectionless flat graph’s serpentine fold is routed before this handler too (verified: a flat fold over the threshold does not reach the arm). The cross-row fold branch is shadowed. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
478	if abs(tgt.x - src.x) >= COORD_TOLERANCE:	->L480	defensive — _route_near_zero_gap_straight: a same-section, non-TB intra edge with |tgt.x - src.x| < COORD_TOLERANCE (1px) and non-zero dy is not constructible, so the straight-return (False) arm is never taken: layering assigns increasing X along edges so the minimum |dx| at _route_intra_section across the corpus is 50px (port spacing / off-track output lead). TB same-track edges that could reach |dx|=0 are intercepted by _route_tb_internal before this handler. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
549	if not (same_sec or is_exit_port):	->L550	defensive — _is_side_branch_ascent reaches this classification (44/391 corpus fixtures) but no fixture takes the reject arm: a target sitting within offset_step*2 of the source section’s trunk Y is always a same-section internal station or that section’s exit port. The arm needs a target at the source’s trunk Y that belongs to a different section or is a non-exit port, which the trunk-alignment geometry does not produce. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
584	if not preds or not succs:	->L585	defensive — A bypass V exists to carry lines from one station to another, so by the time _bypass_v_is_one_way_step runs (only for a bypass endpoint of a routed edge) the V always has at least one predecessor and one successor edge. The empty-list return-False arm guards a malformed graph rather than a topology, so it stays un-exercised.
660	if sibling is None:	->L661	defensive — Lookup guard on ctx.fork_targets ids, which are collected from graph edges and therefore always resolve in graph.stations; a missing sibling is only possible for a hand-built context whose fork map names stations the graph does not carry.
705	if tgt.is_terminus and edge.target in ctx.join_stations:	->L706

member_geometry.py

122/184 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
256	if run_direction is None or turn_direction is None:	->L257
258	if (run_direction in {Direction.R, Direction.L}) == (	->L261
395	if not section_ids:	->L396
511	if ctx.exit_turns is None or not pending_plan_ids:	->L512
677	if source is None or source is route:	->L679
706	if route is None:	->L707
742	if edge is None or family_id is None:	->L743
977	if route.exit_lane_transition_plan_id is not None:	->L978
979	if route.fan_plan_id is not None or route.fan_route_emitter is not None:	->L980
981	if convergence_owns_segment_boundary(route, segment_rank):	->L982
1041	if bounds.band is not None and not bounds.band.lo <= candidate <= bounds.band.hi:	->L1042	needs-review — _candidate_clears_runway’s band rejection, unreachable while if band is not None:::#1 never populates a band on this path. Reachable.
1181	if abs(channel.x - target) <= COORD_TOLERANCE:	->L1183	needs-review — _align_same_line_channels’ re-seat arm. Its one fixture (genomeassembly_organellar) still reaches the gate but now finds the channel already on its carrier’s claim coordinate, so the reseat is skipped. Bisecting the range shows 0f58d60c — ranking member channels over a gap’s whole population — is what makes the claim and the channel coincide on arrival, not the bundle-pitch packing. Reachable; the frozen render corpus means no fixture was authored.
1206	if coordinate is not None:	->L1161, ->L1207
1278	if overlap <= MIN_CORRIDOR_Y_OVERLAP:	->L1279
1372	if item.candidate.route.line_id in claim.line_ids and (	->L1375	needs-review — feasible()‘s same-line-carrier clause, which forbids a candidate delta that would split a carrier the bundle already shares with a claim. No fixture reaches the feasibility search with a same-line source-compatible claim in range: _align_same_line_channels seats such a member on its claim before the bundle allocation runs. Reachable, wants a fixture.
1375	if abs(coordinate - claim.coordinate) > COORD_TOLERANCE:	->L1376, ->L1377	needs-review — The rejection inside feasible()‘s same-line-carrier clause. Unreached for the same reason as its enclosing gate if item.candidate.route.line_id in claim.line_ids and (:::#1. Reachable.
1517	if radii is not None:	->L1522
1518	if 0 <= rank - 1 < len(radii):	->L1520
1520	if rank < len(radii):	->L1522
1566	elif abs(start[0] - end[0]) <= COORD_TOLERANCE:	->L1556
1634	if movable_run:	->L1635
1653	if boundary < 1:	->L1654	defensive — The short-overlap target sits below at least one grid row, so its upper row boundary is positive. A row-zero target has no upper boundary to enlarge and is defensively declined.
1660	if not negative:	->L1661	defensive — A positive target boundary always has at least one section in the row above in a valid packed grid. The empty-negative-side arm protects sparse or externally mutated section grids.
1728	if not route.is_inter_section or len(route.points) < 2:	->L1729	defensive — Source turnouts are defined only for drawable inter-section members. Intra-section and degenerate paths cannot cross a hidden section fork and are intentionally ignored.
1773	if horizontal_siblings and not continuing:	->L1774	defensive — A same-line horizontal sibling at a hidden fork must continue in the incoming direction. The opposite-tangent arm is rejected and covered by the focused lifecycle-safety test.
1848	if any(not _points_coincide(centre, centres[0]) for centre in centres[1:]):	->L1849	defensive — Concentric radii are derived from the same peer projection, which algebraically gives one centre. The mismatch arm guards future candidate families that violate that construction.
1851	if any(	->L1857	defensive — A continuing source trunk is accepted only when its first runway can hold the largest concentric turnout. Resolver spacing guarantees this; the short-runway rejection is covered by focused turnout tests.
1858	if any(	->L1863	defensive — Incoming and vertical source runways must each hold their assigned turnout radius. Production eligibility satisfies this; focused tests exercise rejection of a shortened incoming member.
1925	if len(system_ids) != 1:	->L1926	defensive — A complete same-destination bundle is resolved through one canonical route system. Mixed-system entries cannot be settled atomically and are defensively skipped.
1932	if ctx.exit_turns is not None:	->L1948	defensive — Production planning installs exit-turn execution before member settlement. The null arm supports isolated helper construction and cannot own replannable turns.
1935	if membership is None or membership.axis is None:	->L1937	needs-review — Routes without exit-turn membership or an owned axis are supported cohort members: they remain geometrically movable while declining exit-turn replanning. The corpus does not yet carry that ownership mix. Reachable; wants a minimal fixture.
1939	assignment is not None	->L1933, ->L1940	defensive — Operand arm of the replannable-membership contract: production exit-turn memberships carry assignments; missing assignments are malformed plan state exercised by contract tests.
1940	and membership.axis.claimant_member_ids == (membership.member_id,)	->L1933, ->L1941	defensive — Only a singly claimed axis may be replanned independently during same-destination settlement. Shared-axis plans are excluded to preserve their other claimants.
1941	and membership.member_id in cohort_member_ids	->L1933, ->L1942	defensive — Membership is queried from an edge already resolved into the cohort, so its member id belongs to that cohort. The guard rejects an inconsistent scaffold/query pair.
1942	and assignment.run_direction in {Direction.R, Direction.L}	->L1933, ->L1943	defensive — A replannable same-destination peel-off is sourced from a horizontal trunk assignment. Non-horizontal run directions belong to other exit-turn families and are defensively excluded.
1943	and assignment.turn_direction in {Direction.U, Direction.D}	->L1933, ->L1944	defensive — The settlement cohort has a vertical destination riser, so its owned exit turn is perpendicular. A horizontal turn direction is incompatible plan metadata and is defensively excluded.
1944	and route.exit_turn_segment_rank == len(route.points) - 3	->L1933, ->L1946	defensive — A plannable destination peel-off owns the penultimate turn. Other segment ranks identify a different turn family and cannot be rewritten by this settlement.
1959	if proposals is None:	->L1960	needs-review — A valid short same-destination cohort can be blocked by another route or reserved channel, causing proposal feasibility to reject the cohort atomically. The current corpus has no blocker-shaped witness. Reachable; wants a minimal fixture whose unchanged render is visually reviewed.
1981	if membership is None or membership.assignment is None:	->L1983	needs-review — A route without exit-turn membership is supported: it can participate in a feasible same-destination cohort while declining the optional settled-turn ownership refresh. A membership with no assignment is malformed, but the collapsed gate also covers the valid no-membership case. Reachable; wants a minimal fixture.
1987	if allow_clearance_requirements or shortfall > COORD_TOLERANCE:	->L1988	defensive — The apply pass runs only after the measured shortfall has been granted and removed. Seeing an outstanding shortfall while requirements are disabled would mean boundary settlement failed to move the target.
1995	membership is not None	->L1996	needs-review — Routes without exit-turn membership are a supported outcome of optional ownership refresh: proposal geometry is accepted without publishing settled-turn metadata. The render corpus currently exercises only owned members here. Reachable; wants a minimal fixture.
1996	and membership.assignment is not None	->L1997, ->L2002	defensive — A recorded exit-turn membership used for settlement carries its frozen assignment by construction. Missing assignment metadata is an incomplete ownership record, covered by member-plan contract tests.
1997	and route.points[rank][0] != proposal.points[rank][0]	->L1999, ->L2002	needs-review — Equal-X proposals are a supported no-rewrite outcome: the route accepts its proposal geometry without refreshing settled-turn metadata. Focused unit tests exercise it, but the render corpus has no authored topology for this valid arm. Reachable; wants a minimal fixture.
2054	if context is not None:	->L2056	defensive — _convergence_context_route returns None only when ctx.edge_by_key has no entry for the key, and edge_by_key is built from every graph.edge while the key comes from scaffold.edge_order, which is derived from the same edges. Same never-taken lookup as the sibling if edge is None guard on the non-convergence path (0 of 141 fixtures).
2057	if key in ctx.skip_edges:	->L2058	candidate-dead — Subsumed by the convergence-edge check two lines above. Instrumenting all 348 fixtures: ctx.skip_edges holds exactly one merge-junction->entry-port hop, it is always present in scaffold.edge_order, and it is always also a convergence member edge, so the loop continues at the convergence arm and never tests skip_edges (0 of 141 fixtures). Proposed simplification: drop the two lines. Not applied here — deletion is a deliberate separate pass, and a skip hop that is not convergence-owned is not ruled out by contract.
2060	if edge is None:	->L2061
2064	if family_id is None:	->L2065
2087	if system_id not in failures:	->L2091
2308	if resolved not in execution._semantic_corner_templates:	->L2309	defensive — Every emitted route is resolved from the same member execution that owns its semantic template. Missing lookup is an observer/emission mismatch guarded by member-plan tests.
2314	if edge is None or family_id is None:	->L2315	defensive — Semantic-corner templates are applied only to emitted routes registered in both the edge and family indexes. Missing either index entry is an incomplete observer contract.
2399	or route.curve_radii is None	->L2403	defensive — Every materialized exit-turn plan reaching corner-cohort settlement carries its frozen radius tuple. A missing tuple denotes incomplete direct or corrupted plan state; the guard prevents the optional metadata from being indexed.
2401	or route.curve_radii[rank] >= curve_radius - COORD_TOLERANCE_FINE	->L2404	needs-review — _restore_clear_planned_landing_radii only has work for a member whose landing corner was sized below the standard curve radius. Instrumenting the pass across the whole corpus: 2294 multi-line exit-turn members reach this operand and every one already carries the full radius at its exit_turn_segment_rank (a further 5880 short-circuit on the rank/radii operands ahead of it), so the operand always short-circuits to continue. The arm wants a settled multi-line exit-turn plan in which a clearance-limited concentric sizing shrank one member’s landing corner. Per the triage doc’s correction-pass rule this is a missing witness, not a guard a valid graph cannot violate.
2406	if (	->L2410, ->L2411	needs-review — Runway re-check inside _restore_clear_planned_landing_radii: the restore is declined when resolve_curve_radius_at says the member’s points cannot carry the full radius after all. Both arms are un-exercised because control never reaches the statement — the radius operand two lines above always short-circuits, as its own entry records with the 2294-member measurement. Either arm needs the same missing shape: a shrunken landing corner on a settled multi-line exit turn.
2456	if tuple(route.route_system_owned_segment_ranks) != plan.owned_segment_ranks:	->L2457
2462	if actual != (channel.start, channel.end):	->L2463
2479	if radius_index >= len(radii):	->L2480	defensive — Every radius flanking a frozen plan-owned channel must survive emission. Production materialises the plan’s complete radius tuple; test_member_geometry_validator_attributes_missing_flanking_radius exercises the attributed failure.
2486	if offsets is None or bases is None or offset is None or base is None:	->L2487
2491	if radius_index + 2 >= len(route.points):	->L2492	defensive — A frozen member corner with a published radius must retain all three defining points. Production plans emit complete paths; test_member_geometry_validator_attributes_missing_corner_points exercises the attributed failure for malformed emitted geometry.
2507	if abs(actual_radius - expected_radius) > COORD_TOLERANCE_FINE:	->L2508	defensive — Final member-plan validation aborts when a plan-owned channel corner disagrees with its recorded concentric inputs. Valid production geometry derives that radius from the same inputs; both failure flanks are exercised by test_member_geometry_validator_rejects_changed_flanking_radius.
2522	if radius_index >= len(radii):	->L2523	defensive — Post-emission assertion in validate_member_geometry_emission: an owned corner index present in plan.curve_radii is missing from the emitted route’s list. fresh_member_route copies plan.curve_radii element for element, or leaves both None, and no later pass shortens a route’s radius list, so the two lists have equal length whenever the plan has radii at all. The raise is a construction-bug guard rather than a topology outcome.
2527	if abs(radii[radius_index] - planned_radius) > COORD_TOLERANCE_FINE:	->L2528	defensive — The same validator’s radius-value flank: an owned corner, one of whose adjacent segment ranks is in plan.owned_segment_ranks, whose emitted radius differs from the planned one. Route-system-owned segment boundaries are exactly what the normalize and settlement passes are barred from re-sizing (route_system_owns_segment_boundary gates every one of them), so an owned corner reaches emission carrying the radius planning gave it. The raise fires only if a pass mutates owned geometry.
2548	if actual_offset != expected_offset or actual_base != expected_base:	->L2549	defensive — The same validator’s concentric-inputs flank: the offset/base pair recorded for an owned corner’s two segment ranks must still match the plan’s. fresh_member_route copies both maps wholesale and only record_concentric_corner rewrites them, which the same ownership bar keeps off owned boundaries. Distinct from the radius-value raise above in that a pass could in principle re-record the inputs and still land on the planned radius; both are construction-bug guards.

normalize.py

410/543 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
227	if mid - half < gap_left - COORD_TOLERANCE:	->L228
229	if mid + half > gap_right + COORD_TOLERANCE:	->L230
409	if abs(overlap) > COORD_TOLERANCE:	->L410	defensive — The symmetric-divergence recognizer rejects opposite vertical legs whose spans overlap instead of meeting at one endpoint. Corpus candidates reaching this helper are same-source branch openings and therefore meet at the shared turn Y; the overlapping arm is a defensive rejection for malformed or independently routed channels.
415	if channel.idx == 0:	->L416	defensive — A declared gap channel participating in a same-source divergence follows the branch’s horizontal opening and therefore cannot be the route’s first segment. The zero-index arm defensively rejects a vertical-first route shape.
420	if abs(turn[1] - start[1]) > COORD_TOLERANCE or abs(dx) <= COORD_TOLERANCE:	->L421	defensive — The opening segment before a declared same-source divergence channel is a non-degenerate horizontal run by construction. The non-horizontal or zero-length arm defensively rejects a route shape that cannot provide a shared trunk endpoint.
426	if a_trunk is None or b_trunk is None:	->L427	defensive — A symmetric divergence is considered only for declared gap channels produced by a same-source branch opening. Those channels follow a horizontal opening run, so both opening trunks resolve; the missing-trunk arm defensively rejects a different route shape.
472	if any(abs(base - bases[0]) > COORD_TOLERANCE for base in bases[1:]):	->L473
501	if not chans:	->L502
531	if clearance <= 0:	->L532
547	if any(	->L552
749	if gap_right <= gap_left:	->L750
791	if ctx.exit_turns is None:	->L792
809	if route.curve_radii is None or membership is None:	->L810	defensive — A validation-eligible settled exit-turn route is emitted from its member plan with explicit radii and membership in the same exit-turn execution. Missing either reports incomplete engine ownership; both arms are exercised by test_gap_plan_radius_validator_rejects_incomplete_ownership.
814	if planned_offsets is None:	->L815
820	if allocated_offsets is None or allocated_bases is None:	->L821	defensive — A validation-eligible settled exit turn must publish both offset and base tuples before emission. Missing either is an engine-contract violation exercised by test_gap_plan_radius_validator_rejects_incomplete_ownership.
837	dx is None	->L842
838	or base_radius is None	->L842
839	or not 0 <= radius_index < len(route.curve_radii)	->L842
840	or radius_index + 2 >= len(route.points)	->L842
850	if (	->L854	defensive — The settled exit-turn radius mismatch raises only after construction or a later pass changes a recorded planned corner without updating its concentric inputs. Valid production derives both values together; test_gap_plan_validator_rejects_a_changed_corner_radius exercises both failure flanks.
885	if gap_right <= gap_left:	->L886
1004	if not fits(ceiling):	->L1005
1005	if not fits(floor):	->L1006, ->L1007
1008	for _ in range(iterations):	->L1009, ->L1011
1129	if (	->L1139
1155	if reference is None:	->L1156
1220	go is not None	->L1226
1221	and gt is not None	->L1226
1258	if len(pts) < 2:	->L1259
1274	if abs(y2 - y1) > COORD_TOLERANCE or abs(x2 - x1) <= COORD_TOLERANCE:	->L1275
1351	if slot is None or trunk is None or trunk[0] != k:	->L1352	needs-review — _reconcile_moved_trunk_slot’s precondition guard: the re-banded leg is not the route’s first interior horizontal run, or the route declared no trunk slot. The docstring states this as a real filter (‘only the trunk the slot describes can retarget it’), and _bundle_divergent_distinct_traverses hands it every distinct-line traverse leg, so a non-trunk leg or a slotless route reaches it; all 3 corpus fixtures happen to pass. Reachable; wants a fixture.
1362	if any(abs(channel.x - ref_x) > COORD_TOLERANCE for channel in planned[1:]):	->L1363
1363	if ctx.validate_final_route_frames:	->L1364, ->L1365
1409	if channel is None:	->L1410
1482	if planned and max(planned) - min(planned) > COORD_TOLERANCE:	->L1483
1488	if ref is not None:	->L1489
1555	for group in _merge_feeder_groups(routes, ctx):	->L1556
1559	if movable_channels:	->L1555, ->L1560
1597	if not downs or not ups:	->L1599
1600	for descent in downs:	->L-1566, ->L1601
1602	if col in moved:	->L1603, ->L1604
1605	for up in ups:	->L1606, ->L1615
1606	if up.route.line_id != descent.route.line_id:	->L1607, ->L1608	defensive — _clear_merge_trunk_opposite_arm skips an up-arm carrying a different line from the down-trunk, since only a same-line opposite arm folds the line back over itself. The corpus’s one fork sends a single line both ways, so the different-line skip arm stays un-exercised. Defensive against a fork whose opposite arms carry distinct lines.
1608	if abs(up.x - descent.x) > radius:	->L1609, ->L1610
1611	if overlap <= COORD_TOLERANCE:	->L1612, ->L1613	defensive — _clear_merge_trunk_opposite_arm skips an opposite arm within a curve radius of the down-trunk but not overlapping it in Y, since without a shared Y span there is no fold-back to clear. The corpus’s qualifying fork overlaps in Y, so the no-overlap skip arm stays un-exercised. Defensive against a near-column opposite arm that clears the trunk vertically.
1615	if target_x is None:	->L1616, ->L1617
1618	for ch in downs:	->L1600, ->L1619
1619	if abs(ch.x - descent.x) <= COORD_TOLERANCE:	->L1618, ->L1620	defensive — _clear_merge_trunk_opposite_arm moves every down-leg sharing the folding descent’s column and skips those on other columns. The corpus’s one folding descent carries all its down-legs on a single shared column, so the other-column skip arm stays un-exercised. Defensive against a fork with down-legs spread over several columns.
1639	if k == desc.idx + 1:	->L1638	defensive — In _fanout_traverse_leg: the corpus fan-out routes carry the traverse as their only interior horizontal trunk, so the loop matches on the first trunk and the non-match arm is never taken. Defensive.
1788	if lower > upper + COORD_TOLERANCE_FINE:	->L1789
1799	if anchored and abs(target - reference) > COORD_TOLERANCE_FINE:	->L1800	defensive — In _coincide_same_line_fanout_traverses: a fan-owned traverse is snapped onto its convergence-plan-owned sibling’s band, but the movable member’s own reserved claim band may forbid that Y. The corpus fan-owned traverses carry no claim band that conflicts with the anchor, so the target always lands on the reference and the skip arm is never taken. Defensive against a movable member whose reservation excludes the anchor’s band.
1807	if any(	->L1817
1837	abs(p0[1] - p1[1]) > COORD_TOLERANCE	->L1841
1838	or abs(p1[0] - p2[0]) > COORD_TOLERANCE	->L1841
1839	or abs(p2[1] - p3[1]) > COORD_TOLERANCE	->L1841
1858	if source_col is None:	->L1859
1874	if route_system_owns_segment_boundary(route, opening.idx):	->L1875
1889	if not sibling_xs:	->L1890
1892	if new_x <= max(sibling_xs) + ctx.curve_radius + COORD_TOLERANCE:	->L1893
1895	if _section_intrudes(	->L1902
1939	if len(turns) != 1:	->L1940	defensive — In _bundle_divergent_distinct_traverses: every fan in the corpus turns its traverses the same way, so the mixed-direction skip is never taken. Defensive.
1965	if any(	->L1969
2034	for _ in range(len(buckets) + 1):	->L2119	defensive — Bounded fixpoint repair for coincident corner radii. The budget is one sweep per bucket plus one, and the pass asserts it always leaves through the early break, so exhausting the range is unreachable by construction. 347 fixtures enter the body; multi-bucket propagation is exercised directly by test_unify_refreshes_a_shared_route_after_changing_one_corner.
2083	if not reference_fits(lower):	->L2084	defensive — The lower bound is constructed from each member’s minimum resolvable concentric radius, so at least that bound fits valid route geometry. Failure denotes contradictory synthetic corner inputs.
2211	if not is_side_entry_port(ctx.graph, port_id):	->L2212	needs-review — A peel-off tail whose merge-resolved terminal port is not a LEFT/RIGHT entry is skipped in _align_merge_fed_confluence_to_band. Every corpus peel-off tail resolves to a side entry port, so the reject arm has no fixture; it needs a tail whose merge chain ends at a top/bottom or exit port.
2236	if trunk_ys[-1] - trunk_ys[0] <= COORD_TOLERANCE:	->L2237	needs-review — Equal-depth guard on a merge-fed confluence: every corpus confluence rides its shared band at distinct depths, so the same-Y reject arm has no fixture.
2238	if not trunk_depths_contiguous(trunk_ys, n, step):	->L2239	needs-review — Non-contiguous-depth guard on a merge-fed confluence: corpus confluences seat their bands one offset step apart, so the gapped-depth reject arm has no fixture.
2262	if len(deltas) != 1:	->L2263	needs-review — Anchor-disagreement guard: every corpus merge-fed confluence carries a single plan-owned anchor, so the arm where two anchors imply different rigid ladder offsets has no fixture.
2280	if _descent_crosses_section(ctx.graph, ch, slot.peel_x):	->L2281	needs-review — Feasibility guard: re-seating the free descent outboard of the anchors clears every section in the corpus, so the section-intrusion reject arm has no fixture.
2285	if blocked or settled:	->L2286	needs-review — A merge-fed confluence is re-seated only when a free leg is off its band-earned slot and unblocked. The move arm (rather than this skip) is reachable and is reached by test_merge_confluence_band_order_1835’s inlined riboseq annotation/riboseq bundle into orf_calling, where _restack_channel fires and resolves the crossing. That map is excluded from the corpus fixture roots because it trips an unrelated symmetric-diamond centreline abort under validate=True (#1836), so no corpus fixture exercises this arm yet; committing that map as a real topology fixture is blocked on #1836.
2362	if opposing_bundle is not None and {	->L2365	defensive — iter_opposing_entry_confluences requires the complete direct-port line set, while by_port can only add a member through convergence-junction aliasing. Resolved convergence junctions replace the direct approach rather than coexist with a complete direct-port bundle, so unequal ownership sets require an inconsistent route/context pair. test_opposing_group_with_an_extra_mapped_approach_uses_generic_ownership exercises the defensive fallback.
2372	if any(	->L2381
2499	if tail is None:	->L2500
2503	if n < 2:	->L2504
2509	if len(signs) != 1:	->L2510
2514	if trunk_ys[-1] - trunk_ys[0] <= COORD_TOLERANCE:	->L2515
2524	if tail_overlap(tail_by_line) < 2 * curve_radius - COORD_TOLERANCE:	->L2525
2527	if x_follows_trunk_direction(vertical_sign, trunk_sign) == (	->L2531
2555	if any(	->L2560
2599	if has_planned_channel and any(	->L2604
2689	if abs(delta) <= COORD_TOLERANCE:	->L2690	defensive — _snap_merge_feeder_group skips a merge feeder whose opening descent already sits on the trunk’s shared column (no shift needed). The corpus’s merge feeders all reach the trunk from a distinct column, so the already-coincident skip arm stays un-exercised. Defensive and idempotent across the routing replays a render performs.
2816	if rp.curve_radii is None:	->L2817	defensive — curve_radii is always a concrete list for inter-section routes (every inter-section handler sets it); the None arm in _reseat_concentric_flanking is a belt-and-suspenders guard.
3028	if route.curve_radii is None:	->L3029	defensive — Fan-opening channels are selected from a real horizontal-to-vertical turn, and production turn builders attach radius metadata to that shape. The None arm protects a synthetic or incomplete RoutedPath.
3135	if port is not None and port.is_entry:	->L3137
3205	if (	->L3212	candidate-dead — Fan-descent re-seating declines when any member’s channel boundary is route-system-owned and the group is not already on adjacent tracks. Reaching this gate with an owned channel means the gate above it let the group through on settle_frozen_arcs and tight, since a route-system boundary is one of the ways _planner_owns_channel answers true, so tight is already true here and this arm’s not tight cannot hold. Instrumented across the whole corpus under four option settings: 122,516 evaluations of the gate, zero fires, and still zero when the condition is widened to _planner_owns_channel itself. No construction reaches the arm.
3225	if any(	->L3230
3375	if not verticals:	->L3376	defensive — Shape guard in _land_feeder_on_run: a merge branch feeder is built as a descent into a tail, so it always has a vertical leg. Reachable in principle only if a feeder’s source Y coincides with the trunk channel level, collapsing the descent below COORD_TOLERANCE (#1597).
3380	if k + 2 != len(pts) - 1 or y_hi - y_lo < radius:	->L3381	defensive — Shape guard in _land_feeder_on_run. _route_merge_branch emits exactly four waypoints, while an alternate attached-source construction or a malformed hand-built route can add points; the second half rejects a descent too short to re-form its corner. Neither shape occurs in the corpus (#1597).
3391	if rp.curve_radii is not None:	->L3393	defensive — Truncating the tail in _land_feeder_on_run keeps curve_radii aligned with the shortened waypoint list when metadata is present. Hand-built routes may omit that metadata, so the field cannot be treated as always present (#1597).
3494	if discretionary and not _restack_fits_corridor_claims(	->L3497	needs-review — A discretionary all-exempt trunk reorder is abandoned when no stack top seats the reordered corridors inside the bands their reservations claim. Every shipped corpus channel is reorderable within its claims because _peer_widths charges each boundary for the nested stack drawn in it, so the claim is already sized for the arrangement the plan produces and the refusal arm has no fixture. Reachable in principle: a plan that splits one corridor’s trunks further apart than its own claim is wide asks for a seating no stack top provides. Revisit once a corpus map produces one.
3697	elif far_y < t.y - COORD_TOLERANCE:	->L3691	defensive — Degenerate-leg guard in _trunk_slot_features: a trunk’s flanking legs are genuine vertical legs (far_y differs from the trunk y), so neither the below nor the above classification is skipped; the fall-through arm needs a zero-height leg the layout never produces.
3727	if feats is None:	->L3728	defensive — Unused default-arg branch: all three callers of _band_order_crossings pass feats explicitly, so the feats-is-None compute-it arm is never taken.
3962	if len(trunks) < 2:	->L3963, ->L3964	defensive — Early-return in _suboptimal_trunk_bands, called only from the guard* validator (phases/guards.py) and a unit test, never on the production render path. The coverage sweep renders with validate=False, so neither arm registers. Defensive (exercised via the validate=True guard / test surface; cf. #728 validate-only precedent).
3966	for grp in groups:	->L3967, ->L3970	defensive — _suboptimal_trunk_bands diagnostic loop: validate-only, not reached by the render-path coverage sweep (see the len(trunks)<2 note).
3967	if len({id(t.route) for t in grp}) < 2:	->L3968, ->L3969	defensive — Single-route-group skip in _suboptimal_trunk_bands, validate-only: called from the guard* validator and a unit test, not the production render path the validate=False sweep exercises. Defensive.
4124	if band is not None:	->L4130	defensive — Same-line dogleg: the band-found arm is exercised by dogleg_exempt_sameline; the band-is-None arm is defensive (both colliding trunks route through _center_inter_row_channel, so the trunk Y always resolves to a gap band).
4145	if down_ok and up_ok and (cross_down is None) != (cross_up is None):	->L4147	defensive — Same-line dogleg side selection. The crossing-decided true arm (->1297, pick the side whose riser does not pierce the exempt run) is exercised by dogleg_exempt_sameline. The false fall-through (->1298) needs either an out-of-band side or a crossing-equal tie, neither reachable by a clean topology: the reachable dogleg regime rigidly fixes the inter-row band so down_room/up_room stay >= min_sep=6 (observed 14/26 across the corpus and every constructed variant; perturbing the grid loses the regime), and the only realizable tie is both-cross (a crossing-free tie needs degenerate zero-length exempt risers) which co-occurs with section-crossing / dogleg-crosses-exempt guard failures and is never a shippable render.
4147	elif down_ok and (not up_ok or prefer_down):	->L4148, ->L4149	defensive — Same-line dogleg tie / out-of-band fallback, reached only after the L1296 if is false, which a clean topology never produces (see that gate): the true arm (->1299, lean down on a tie) needs a crossing-free tie that requires degenerate risers, and the false arm (->1300) needs down_ok False, which the regime’s fixed inter-row band (down_room >= min_sep) never yields.
4149	elif up_ok:	->L4150, ->L4152	defensive — Same-line dogleg move-up / give-up fallback, reached only when both L1296 and L1298 are false. The true arm (->1301, move up because the lower gap is too tight) needs down_ok False and the else arm (->1303, leave fused) needs both rooms below min_sep; the reachable regime’s inter-row band is auto-widened so both rooms stay >= min_sep=6 (observed 14/26), so neither is reached by a valid topology.
4190	if below_ok and above_ok and (cross_below is None) != (cross_above is None):	->L4192	defensive — Distinct-line dogleg side selection. The crossing-decided true arm is exercised by dogleg_exempt_distinct. The false fall-through needs a crossing-equal tie among trunks the pass moves (those closer than their corridor separation); the corpus has none - a crossing-free tie needs degenerate zero-length exempt risers, and the one forced both-cross transit (riboseq_inter_row_corridor) sits at exactly the separation, so the pass leaves it in place rather than reaching this selection.
4192	elif below_ok and (not above_ok or prefer_below):	->L4193, ->L4194	defensive — Distinct-line dogleg tie fallback, reached only after L1341 is false (a tie), which a clean topology never produces (see that gate). The true arm (->1344, lean below) would fire on such a tie; the false arm (->1345) is unreachable because below_ok always holds and prefer_below is always true (t.y == hit.y in this regime).
4194	elif above_ok:	->L4195, ->L4197	defensive — Distinct-line dogleg move-up/skip branch: unreachable because the below branch is always taken (t.y == hit.y, below_ok true); covers both the move-up and the gap-too-tight continue.
4213	and span[0] < crossed[1]	->L4205
4214	and crossed[0] < span[1]	->L4216
4338	if i in relocated:	->L4339	defensive — Re-entry skip in the co-travelling separation worklist. A track is re-queued only while it is still un-relocated, so the second copy of a track queued twice before its first pop is the only way to reach the skip; across the corpus every re-queued track is popped before it moves, so the taken arm never fires. Defensive against a crowded stack whose neighbours re-queue one track twice, where taking it twice would break the one-move-per-track bound.
4357	if (	->L4367	needs-review — A secondary lane declines to move when it faces no pinned obstacle but the obstacle it would step around already holds a fixed segment, so stepping cannot separate them. Every corpus crowding either pins its obstacle or leaves the obstacle’s segments free, so the skip has no fixture; it needs a topology where a non-primary lane meets a fixed-segment obstacle.
4411	if any(	->L4414
4494	if cleared is None:	->L4495	defensive — The residual-cluster fallback gives up on a fused cluster when neither the up nor the down stack of its movable lanes clears every section, claim band and other lane. The corpus’s one residual cluster (riboseq_inter_row_corridor) is stranded against a pinned trunk with room on its open side, so a stack clears and the give-up arm stays un-exercised. Defensive against a cluster boxed on both sides, which has no non-fused seating to reach.
4523	if i in relocated:	->L4524	defensive — Re-entry skip in _tighten_overwide_movable_lanes’ worklist. A lane is re-queued when a tightened neighbour may let it draw in too, but the corpus’s one tightening move is a single lane with no over-wide neighbour to re-queue, so nothing is ever popped after relocating. Defensive against a bundle where one tighten frees a second, mirroring the same guard in the separation loop.
4539	if not _lane_move_is_grounded(lane, target, ctx):	->L4540	defensive — In _tighten_overwide_movable_lanes: the tighter slot is abandoned when it enters a section or overruns a claim band. The corpus’s one tightening move (riboseq_inter_row_corridor’s rnaseq) is grounded, so the not-grounded abandon arm is never taken. Defensive against a bundle whose inner slot is blocked by a section or reservation.
4542	if any(moved.fuses_with(other, step) for other in lanes if other is not lane):	->L4543	defensive — In _tighten_overwide_movable_lanes: the tighter slot one step from a lane’s nearest co-traveller is abandoned when it would fuse with another lane. The corpus’s one tightening move (riboseq_inter_row_corridor’s rnaseq) draws clear, so the would-fuse abandon arm is never taken. Defensive against a slot boxed in by a third lane.
4585	if sg[0].sign_x != t.sign_x:	->L4586	defensive — Both callers of _coincident_trunk_slots pre-filter input to a single traversal direction (band = [t for t in grp if t.sign_x == sign]), so within the function sg[0].sign_x != t.sign_x is always False; the opposing-direction continue is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
4616	if rp.curve_radii is None:	->L4617	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_htrunk is a defensive guard.
4628	if 0 <= k - 1 < len(rp.curve_radii):	->L4630	defensive — Bounds guard in _restack_htrunk: trunk index k >= 1 so k-1 >= 0 is always in range; the skip arm is defensive.
4630	if k < len(rp.curve_radii) and k + 2 < len(pts):	->L-4595	defensive — Bounds guard in _restack_htrunk: for a real interior trunk k and k+2 are in range; the skip arm is defensive.
4689	if down is None or len(up.points) < 2:	->L4690	needs-review — Un-exercised on origin/main too; 897747b0 covered it on 13 fixtures and HEAD is back to main’s [0,138] split, so this is a return to main’s behaviour rather than a new gap. Reachable by construction (main’s baseline lists it as an open gap already). No fixture authored — the render corpus is frozen for a measurement against main.
4735	if len(targets) != 1:	->L4736
4745	if col is None:	->L4746	defensive — Defensive guard in _convergence_line_order: a peel-off riser channel always resolves to a source-section column, so the unresolved-column early return is never taken on the corpus.
4786	if not 0 <= far < len(pts):	->L4787
4789	if abs(dx) > COORD_TOLERANCE:	->L4783
4791	if not votes:	->L4792
4895	if ca != cb:	->L4897
4897	if rep_x[a] != rep_x[b]:	->L4898, ->L4899	defensive — The routing system assigns distinct x offsets to every line sharing a column gap, so two distinct lines in one gap-bundle corridor never share a representative x; the equal-rep_x tiebreak fall-through in _distinct_line_order is unreachable (exhaustive corpus scan confirms). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
4927	if rp.curve_radii is None:	->L4928	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_channel is a defensive guard.
4930	if not 0 <= radius_idx < len(rp.curve_radii):	->L4931
4954	if abs(ly - pts[1][1]) < COORD_TOLERANCE:	->L-4904	defensive — A re-stacked gap channel at points-index 1 always has a horizontal lead-in (L-shape and bypass routes open with a horizontal segment); routes opening non-horizontally are normalize_exempt and skipped by the materialization. The non-horizontal-lead return in _restack_channel is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
4992	if anchor_section_id is not None and anchor_side is not None:	->L4994	defensive — _gap_channel_base falls back to the column gap when passed a null anchor. All six call sites (in _route_bypass) pass the bypass source/target section id, which is None only when that endpoint has no resolvable section (src_sec_id/tgt_sec_id in _route_bypass); the corpus has no bypass with a sectionless endpoint, so the null-anchor arm is never taken. Defensive guard for a sectionless bypass endpoint.
5047	elif right_ok:	->L5050	candidate-dead — The give-up arm in _clear_channel_x_in_band (neither the left nor the right cleared position lies within the caller’s bound window). Both bounds are only ever supplied together by the cross-row bypass legs in _bypass_geometry (inter_section_handlers.py, the gap1/gap2 calls guarded by if cross_row:); every other caller passes at most one bound, so left_ok/right_ok defaults to True on the unset side and this arm cannot be reached from them. For an interior column pair those two bounds come from column_gap_edges reading the neighbouring sections’ own edges, and _enforce_min_column_gaps/_enforce_min_row_gaps actively widen that same gap whenever a wider bundle needs to cross it, so a blocker large enough to defeat both directions would also have widened the bound that bounds it. The one place the bound is not backed by that widening is the map’s own outermost edge, where column_gap_edges degenerates to a single point (no neighbouring column to widen against) — exactly the riboseq_inter_row_corridor case that used to reach this arm before #1789. off_grid_gap_bundle_midpoint now seats the channel at that same degenerate edge, read from the routed bundle’s own row, so it can no longer land inside the section whose row defines the degenerate bound. It would still fail if a different row of the same off-grid column reached further toward the map edge than the routed row and the scan’s Y-band reached into that other row, but the only two call sites that ever supply dual bounds build a Y-band confined to the routed leg’s own row plus the immediate inter-row gap (verified against riboseq_inter_row_corridor’s own geometry, whose exercising band never reached the neighbouring row), so no swept fixture presents that shape. Two hand-built topologies replicating the off-grid-column, different-row-is-wider shape failed to reach _bypass_geometry’s cross-row dual-bound legs at all — the U-bypass dispatch conditions that select this code path did not fire for either. What would close it is a U-bypass route between two off-grid-column rows where the non-routed sibling row reaches further toward the map edge than the routed row over the exact band the descent scans.
5468	if not blockers:	->L5469
5671	if route.curve_radii is None:	->L5672
5685	if not members:	->L5686
5730	if (	->L5738
5744	if reference is None:	->L5745

offsets.py

509/612 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
155	if edge.target in inbound:	->L157	defensive — inbound is pre-built as {sid: set() for sid in graph.stations}, so every station id in the graph is a key. All edge endpoints are guaranteed to be in graph.stations after parsing (regular nodes via register_station, ports via add_port->add_station, junctions via add_station), so edge.target is always found in inbound and the False branch (54->56) is never taken.
157	if edge.source in outbound:	->L154	defensive — outbound is pre-built from graph.stations keys identically to inbound. All edge sources are registered stations by construction (regular nodes, ports, junctions), so edge.source is always found in outbound and the False branch (56->53) is never taken.
459	if ordered != expected:	->L460	defensive — The raise arm of _assert_sections_anchored_on_trunk, a backstop on the postcondition of _reindex_section_local: an independent section (no flat-frame neighbour) always lands on the contiguous top-anchored levels 0,step,…,(m-1)*step by construction, so the mismatch arm never fires across the corpus. It guards against a future change that stops re-anchoring such a section.
507	while cur is not None and cur not in seen:	->L516
564	if neighbour is None:	->L565
585	if slot is None:	->L586
767	if reverse:	->L768	needs-review — Reachable only on a reconvergence section that is also a serpentine fold, where the fold corner crosses lines mid-curve and the return-row bundle sits one offset too low (#705). Exercise with a clean fixture once #705 is fixed.
798	if section is None:	->L799
822	if not all(lid in feeder_off for lid in continuing):	->L823
830	if lid in new_off:	->L829
852	if section is not None:	->L850
854	if len(set(feeder_row.values())) < 2:	->L855
874	if entry_port is None:	->L875
917	if seam is None:	->L918
939	if not all(lid in feeder_off for lid in primary_lines):	->L940
988	if new_order is None:	->L991
1100	if swap_line is None:	->L1101	defensive — The desired peel order is a permutation of the offsets already assigned to the complete fan-out exit bundle, so each displaced line’s target offset is held by another line. A missing swap partner requires an incomplete or duplicate offset map; recompacted_fanout_exit exercises the successful swap body.
1140	if cur in seen:	->L1141	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1150	if not src.is_port and src.section_id == sec_id:	->L1143
1236	if not target_id:	->L1237	defensive — An exit-only line at station sid is identified by being present in station_lines(sid) but absent from ctx.inbound[sid]. station_lines() returns lines appearing in any edge whose source or target is sid. For a line to be exit-only at sid, it must appear in at least one outbound edge from sid; otherwise it would not appear in station_lines(sid) at all. If an outbound edge exists, outbound_target[(sid, lid)] is always set, so target_id is never None when execution reaches L422. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1239	if not target_st:	->L1240	defensive — After parse and layout, every edge target ID in a MetroGraph maps to a station in graph.stations. The guard protects against a structurally malformed graph where an edge references a nonexistent station ID, which cannot occur with valid .mmd input processed through the parser and _resolve_sections().
1257	if swap_lid is None:	->L1258	defensive — In _reorder_one_exit_line, swap_lid is None only if the loop over lines exhausts without a match, but desired_off (min or max of all_offs) is always held by another line, so the early-return guard never fires (0/128). Defensive. Reclassified defensive (#762).
1314	if abs(nbr_cur - new_off) < _OFFSET_EQ_TOLERANCE:	->L1315	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1336	if max_steps <= 0:	->L1337	defensive — max_steps = len(graph.stations) * len(graph.lines). Each BFS iteration dequeues one (station, line) pair and marks it visited; visited pairs are skipped on re-encounter. The number of distinct (station, line) pairs is bounded by |stations| * |lines|, so the BFS can perform at most that many productive steps before the queue empties. The while queue and max_steps > 0 condition therefore always exits via the queue-empty branch; max_steps reaches zero only if more productive steps occur than unique pairs, which is impossible in a finite graph.
1364	if lid not in seen:	->L1361	defensive — The iterator at L554 is sorted(set(sec_entry_lines), ...). The outer set() deduplicates the list before iteration, so each lid appears exactly once and seen never contains it when processed. The false arm (lid already in seen) is logically unreachable — the dedup happens at set construction, making the seen guard dead code. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1491	for _ in range(len(graph.stations) + 1):	->L1508
1495	if edge is None:	->L1496
1498	if nxt in seen:	->L1499
1582	if not src_st.is_port:	->L1580
1586	if internal_offs:	->L1574	defensive — Exit ports are only created when inter-section edges exist: resolve.py _create_port_stations iterates topology.exit_groups, which parser/route_topology.py builds from its exit_members map, populated one entry per resolved inter-section edge. Every TB LEFT/RIGHT exit port therefore has at least one edge from an internal station, so internal_offs is never empty when the loop is entered. The false arm is a defensive guard against an impossible empty-feeder state.
1616	if not src_st.is_port:	->L1614
1747	if anchor_feeders:	->L1750
1765	if port_off is not None:	->L1763	defensive — _compute_base_offsets runs before junction propagation and creates an offset for every station-line pair. A divergence exit port and its junction carry the same connector lines, so this lookup always succeeds; the missing-offset arm protects an incomplete synthetic context.
1850	if not ctx.bundle_re_slots_whole[(junction_id, exit_port_id)]:	->L1851
1863	if len(drops) == len(lines):	->L1847
1960	if port_st is None:	->L1961
2035	if not src.is_port:	->L2036
2192	if not src.is_port:	->L2193
2219	if paired_off is not None:	->L2217	defensive — _compute_base_offsets sets ctx.offsets[(sid, lid)] for every station-line pair before _propagate_lr_rl_exit_to_entry runs. Exit ports are stations. The for-loop at L791 iterates graph.station_lines(port_id) which equals graph.station_lines(exit_port_id) (enforced by the exit_lines != entry_lines guard at L788). For each lid, ctx.offsets.get((exit_port_id, lid)) is therefore never None. The loop-back arc (793,791) for the paired_off-is-None case is structurally unreachable.
2225	if not tgt_st.is_port:	->L2223
2277	if set(inherited) != set(graph.station_lines(port_id)):	->L2278	defensive — _inherit_level_convergence_entry_offsets skips a convergence entry port when the lines it inherits from its immediate feeders do not cover every line the port carries. A convergence entry’s lines are, by construction, exactly the union of its inbound edges’ lines, and each inbound edge supplies that line’s feeder offset, so the inherited set always equals the port’s line set and the mismatch arm is never taken. Defensive against a port line with no inbound edge (a malformed graph).
2284	if _bundle_reslot_collides(ctx, port_id, port_obj.section_id, inherited):	->L2285	needs-review — The level-convergence inherit is refused when carrying the feeders’ order along the bundle would seat a bundle line on the slot a section-local line already holds. No fixture in the sweep corpus (examples plus the top-level tests/fixtures) presents that collision; tests/fixtures/hash_seed_determinism/seed_77.mmd does, but the sweep does not descend into the nested seed directories, so closing the arm needs a corpus topology of its own.
2316	if entry.side not in (PortSide.LEFT, PortSide.RIGHT):	->L2317	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam exit/entry reconciliation to horizontal (LEFT/RIGHT) entry ports, whose per-line offsets are Y like the TB exit’s. A TOP/BOTTOM entry stores X-offsets, so copying across would be a category error. No corpus fixture routes a TB LEFT/RIGHT exit directly into a TOP/BOTTOM entry at the same Y, so the skip arm is never taken; defensive against that cross-axis seam.
2324	if len(shared) < 2:	->L2325	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam reconciliation to multi-line bundles, where a constant per-line offset delta means the lines share an order and only the bundle anchoring differs (the auto-folded serpentine case in #1198). A single shared line carries no bundle order to preserve and is left to the single-line corridor passes; no corpus fixture reaches the pass with fewer than two shared lines, so the skip arm is never taken.
2413	if edge.line_id not in lines:	->L2414
2470	for edge in graph.edges_from(port_id):	->L2479
2474	if tgt.is_port:	->L2475
2479	if target_id is None:	->L2480
2564	if not sec_stations:	->L2565	defensive — The parser calls _remove_empty_sections() (resolve.py:26) which deletes any section whose station_ids list is empty before port creation. Ports are only added to station_ids during _create_port_stations() (resolve.py:527), which runs AFTER _remove_empty_sections(). Therefore every section in graph.sections at layout time has at least one non-port station; sec_stations is never empty.
2609	if station.section_id is not None:	->L2601
2618	if port.section_id is None:	->L2619
2631	if section is None:	->L2632
2780	if tgt_port.side not in (PortSide.LEFT, PortSide.RIGHT):	->L2781
2782	if tgt_port.section_id in ctx.tb_sections:	->L2783
2787	if not _stores_reflected(ctx, tgt_port.section_id) and reversed_seam:	->L2788
2790	if off is not None:	->L2776
2810	if not any(	->L2813	defensive — The L920 check returns None when offsets are EXACTLY equal to expected (exact float ==). The L926 check returns None when differences are less than _OFFSET_EQ_TOLERANCE (0.001). Since all offsets are integer multiples of OFFSET_STEP (3.0px), any non-zero difference is exactly 3.0 or more, which is >> 0.001. So L920 catches exact matches and L926 can never catch a case L920 missed; the near-equal window (0,0.001) is unreachable with 3.0px discrete steps.
2828	if len(seed_lines) < 2:	->L2829
2834	if not fixed_here or not movable:	->L2835
2853	for lid in above:	->L2854
2857	if not any(	->L2860
2949	if not changed_lids:	->L2950
2968	if pending is None:	->L2969
3097	if max_steps <= 0:	->L3098	defensive — max_steps = n_sec_stations * len(graph.lines). The BFS visits each (station_id, line_id) pair at most once (the visited set at L1017 prevents revisits). The total distinct pairs is bounded by n_sec_stations * len(graph.lines) = max_steps. Since max_steps decrements by 1 per loop iteration and the loop exits when the queue is empty (naturally after at most max_steps unique visits), the condition max_steps <= 0 is never True; the while-loop guard already prevents the body from executing when the queue is empty.
3111	if sec_a is None and id_a in graph.ports:	->L3112	defensive — The true arm requires sec_a is None AND id_a in graph.ports simultaneously. Junction stations (section_id=None) are added only via graph.add_junction() which calls graph.add_station() but NOT graph.add_port(). graph.add_port() (model.py:483) requires a Port object with a non-None section_id (Port.section_id is typed str, not Optional[str], per model.py:218). Therefore no station with section_id=None can ever be in graph.ports; the conjunction sec_a is None AND id_a in graph.ports is unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
3113	if sec_b is None and id_b in graph.ports:	->L3114	defensive — Same argument as L1084: id_b in graph.ports requires the station to have been registered via graph.add_port(), which always supplies a non-None section_id for the created station. A station with section_id=None (sec_b is None) is a junction created by add_junction(), which never calls add_port(). The precondition sec_b is None AND id_b in graph.ports is therefore unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
3176	if (tgt_id, lid) not in ctx.offsets:	->L3177	defensive — The True branch (missing entry-port offset -> ok=False) is unreachable because phase 7 (_compute_entry_port_offsets) runs before this function (phase 7a) and assigns an offset for every (entry_port_id, line_id) pair in the graph. By the time _align_junction_to_entry_port runs, ctx.offsets is populated for all entry ports, so the guard never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
3196	if src_port and not src_port.is_entry:	->L3203	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its else arm (->1203) is additionally defensive: the sole feeder of a >=2-line fan-out junction is its exit port, a non-entry port.
3199	elif feeding_exit != edge.source:	->L3200	defensive — This arm (single_exit=False due to multiple distinct exit ports feeding one junction) requires one junction to receive edges from two different exit ports. But _rewrite_edges_with_junctions in resolve.py creates exactly one junction per exit port fan-out, wired exclusively from that exit port’s edges. A junction always has a single upstream exit port; the elif is structurally unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
3208	if single_exit and feeding_exit is not None:	->L3147	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its False arm (->1147) is additionally defensive: a >=2-line junction reaching this body is always a single-exit-port-fed fan-out junction (merge junctions carry one line and are skipped by len(j_lines)<2).
3210	if exit_lines == set(j_lines):	->L3147	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its lines-differ arm (->1147) is additionally defensive: a fan-out junction carries exactly its single exit port’s fanned lines, so exit_lines == j_lines always.
3212	if abs(exit_st.y - j_st.y) <= _SAME_Y_TOLERANCE:	->L3147	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its Y-differs arm (->1147) is additionally defensive: only a BOTTOM-exit junction is offset in Y from its exit, but such a junction sits below the consumer row and never meets the body’s all-entries-within-tolerance precondition.
3454	if pred is None:	->L3455
3550	if target_col is None:	->L3551	defensive — A registered LEFT entry port always has an owning section with a grid column after placement. The missing-target-column return protects a malformed or partially laid-out graph.
3558	if source_col is None:	->L3559	defensive — _convergence_feeders receives resolved sources feeding a registered LEFT entry port. Each source is a sectioned port or a junction resolvable through one, so the missing-column arm protects an incomplete graph.
3867	for _ in range(max_iterations):	->L3916	defensive — _reconcile_horizontal_offsets iterates at most 10 times and breaks early when no change occurs. The arc L1338->(-1310) represents loop exhaustion without early-break (all 10 iterations consumed). On any valid parsed graph, the reconciliation converges in at most a handful of iterations because each iteration resolves at least one edge conflict or reaches a fixed point. The 10-iteration ceiling is a backstop against hypothetical oscillating graphs; normal topologies stabilize in 1-3 passes.
4065	if _offsets_exchanged(	->L4062	needs-review — Whether the propagated swap really exchanged the pair’s slots at this exit port. Both arms are un-exercised because the guard above always continues today. the exit_lane_settlement_without_crossings variant described on the if was_arriving is None or was_holder is None entry reaches this gate and takes its True arm. The False arm needs an exit port the swap left alone: a section with a second exit port carrying the pair, or a port where the two lines already held equal offsets, neither of which that variant produces.
4095	if arriving is None or holding is None:	->L4096	needs-review — _exchange_pair_at’s own guard, reached only from the continuation walk. the exit_lane_settlement_without_crossings variant described on the if was_arriving is None or was_holder is None entry takes the False arm, both slots present. The True arm needs a station whose line set contains both lines, which the caller has already checked, while ctx.offsets lacks a key for one of them. Base offsets are computed for every station and line the graph carries, so the only candidate is a junction the propagation passes skip, and I could not confirm one exists. Left unsettled rather than called defensive.
4140	if target is None:	->L4141	defensive — Contract guard in the continuation walk: an edge whose target is absent from graph.stations. Measured over the whole corpus, zero edges have either endpoint missing from graph.stations, because the post-parse rewrites materialise every port and junction as a station. The gate’s other arm is un-exercised only because the walk is never entered, and the exit_lane_settlement_without_crossings variant described on the if was_arriving is None or was_holder is None entry takes it; the None arm itself no valid graph can reach.
4144	elif target.section_id in seen_sections:	->L4145	needs-review — Skips a section the walk already took whole. the exit_lane_settlement_without_crossings variant described on the if was_arriving is None or was_holder is None entry takes the else arm (a fresh section) but not the skip: there the pair’s two lines run into two different downstream sections. The skip arm wants a walk with two pair edges landing in one section, for instance both lines of the pair continuing into the same downstream box, or one box reached from two frontier stations.
4155	if _exchange_pair_at(ctx, station_id, first, second):	->L4149	needs-review — Extends the frontier only where the exchange actually applied. the exit_lane_settlement_without_crossings variant described on the if was_arriving is None or was_holder is None entry takes the True arm. The False arm needs _exchange_pair_at to decline, i.e. a station that carries both lines, since the check above passed, yet has no stored offset for one of them. Whether ctx.offsets can be that sparse at such a station is the same open question the if arriving is None or holding is None entry records; I could not settle it either way.
4167	if ctx.topology is None:	->L4168
4191	if key not in ctx.offsets:	->L4192
4227	if len(hubs) != 1:	->L4228	defensive — Guard in _is_flat_handover_hub admitting a linear entry frame whose cohort terminates at a hub. Refuses unless exactly one carrier originates the local bundle; a section with two independent origination points hands its trunk over in two places, not one. The one corpus section that reaches the relaxed path (continuation_lane_step’s Results hub) has a single hub, so the multi-hub refusal stays un-exercised. Defensive.
4242	if abs(consumer_perp - hub_perp) > COORD_TOLERANCE_FINE:	->L4243	defensive — Guard in _is_flat_handover_hub: the hub’s originating lines must run flat, so a consumer off the hub’s trunk row (a peel-off, drawing a real turn) is refused. The corpus’s one relaxed section hands over on a level row, so the off-row refusal stays un-exercised. Defensive.
4299	if len(set(lanes.values())) != len(lanes):	->L4300
4301	if _carrier_offset_gap(graph, station_id, lanes, offset_step) is not None:	->L4302
4375	len(levels) != len(continuing)	->L4378
4400	if any(line_id not in ctx.line_priority for line_id in present):	->L4401	defensive — ctx.line_priority is keyed on the declared line set (_build_offset_ctx enumerates graph.lines), while present collects the line ids carried by the section’s stations, which come from edge annotations. The two sets differ only for an edge naming a line no %%metro line: directive declares, and the parser rejects that map, so no parsed source can take the bail. The guard is kept because compute_layout is a public entry point that accepts a MetroGraph built in code: without it the priority_order sort two statements below raises KeyError on exactly this condition.
4456	if line_id not in assignments:	->L4457
4461	and abs(owned - assignments[line_id]) > _OFFSET_EQ_TOLERANCE	->L4463
4470	if not _frame_carriers_are_conflict_free(	->L4473
4495	for _iteration in range(len(ctx.graph.sections) + 1):	->L4520
4506	if line_id not in assignments:	->L4507
4513	if set(frames).difference(next_frames):	->L4514	defensive — This fixed-point transaction rollback handles an entry frame accepted in one iteration whose owner disappears in a later iteration. Valid settled graphs converge monotonically; only deliberately transient planner state reaches this arm. test_linear_entry_frame_settlement_restores_offsets_if_owner_disappears exercises the rollback through controlled planner output.
4554	if any(	->L4558	defensive — This post-acceptance marker-cache guard rejects a continuing cohort whose inherited offsets are not one contiguous step sequence. _linear_entry_frame only accepts and materializes contiguous inherited levels, so authored topology cannot reach this reject arm. It protects corrupted or hand-built state.
4560	if local_offset is None or not (	->L4566	defensive — This post-acceptance marker-cache guard requires the sole local line to occupy exactly the adjacent lane above or below the continuing cohort. The accepted frame allocator always creates one such adjacent assignment. The missing or nonadjacent arm protects corrupted or incomplete offset maps.
4585	if abs(actual - expected) > _OFFSET_EQ_TOLERANCE:	->L4586
4596	if gap is not None:	->L4597
4651	if actual is None or abs(actual - assignment.offset) > _OFFSET_EQ_TOLERANCE:	->L4652
4854	if dag is not None:	->L4862
4858	if succ not in affected:	->L4857
4867	if not offs:	->L4868

orientation.py

3/4 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
56	if axis is DemandAxis.Y:	->L58

perp.py

11/14 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
122	if not feeders:	->L123	defensive — No-feeder guard in _perp_entry_crossing_x: the helper is called only from _route_perp_entry when a multi-line bundle shares the port with a per-line stagger, and a TOP/BOTTOM entry port in that case is always reached by a bundled inter-section feeder (dy!=0, so compute_bundle_info indexes it). The empty-feeders return-None arm is a contract guard, never taken across the corpus.
165	if entry_port is None or not entry_port.is_entry:	->L166	defensive — _aligned_horizontal_drop_entry only fires for a TOP/BOTTOM exit on a horizontal-flow section (the rest of _perp_riser_lateral’s callers are caught earlier). The return-None arm is taken when such an exit feeds a junction or several targets rather than one entry port; corpus instrumentation across every examples/ fixture finds no horizontal-flow perp exit feeding a non-single-entry, so the arm is never taken and the riser falls back to the perp reflection.
172	if needs_perp_approach_fan(graph, entry_port.id):	->L173	defensive — _aligned_horizontal_drop_entry exempts a distinct-line approach fan, whose intra drop fans onto per-line channels (_perp_approach_fan_x) rather than the entry’s single per-line offset. Reaching it needs a horizontal-flow perp exit dropping straight into a single approach-fan entry; corpus instrumentation finds none, so the arm is never taken and the riser keeps the perp reflection.

planning.py

5/12 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
93	if plan.curve_radii is None or ctx.exit_turns is None:	->L94
98	if membership is None:	->L99
101	if corner_offsets is None:	->L102
213	if scaffold is None:	->L214
315	if station_offsets is not None:	->L318
360	if not pending_plan_ids and member_geometry.settled_exit_turns:	->L361	defensive — Boundary settlement is adopted only after every pending exit-turn plan has resolved. A settled cohort with pending owners would mix planning generations and is defensively withheld.
383	if station_offsets is not None:	->L384, ->L386	defensive — Production observed routing supplies a mutable station-offset map before replaying settled turns. The null arm supports the offsetless observation probe and requires no cache refresh.

postprocess.py

96/112 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
211	if abs(dx_diag) <= COORD_TOLERANCE_FINE:	->L212	defensive — Defensive guard: a near-vertical baked diagonal (dx_diag ~ 0) already separates near-fully along the baked X axis, so it needs no Y spread and the divide-by-dx_diag is skipped. No corpus fixture bakes a near-vertical diagonal, so the guard arm is never taken.
443	if not is_fork_join and (	->L452	defensive — Enters the multi_diag block, which needs a non-fork-join station (<=1 distinct predecessor and successor) carrying both a 4-point diagonal and a 2-point flat incoming route. Raw route shape is a pure function of endpoint coordinates, so all lines on one edge share one shape: n_unique_in and n_unique_flat_in can never both be >=1 for a single-predecessor station, and n_unique_in/out are <=1 when not fork-join. multi_diag is unsatisfiable (0 of 6173 corpus calls). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
493	if multi_diag:	->L494	defensive — multi_diag branch of _flat_connects_to_internal_chain; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate at the same line text), so the function is only ever called with multi_diag False. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
494	if any(_is_chain_predecessor(graph, ctx, r.edge.source) for r in flat_in):	->L495, ->L496	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, which is never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
496	if any(_is_internal_station(graph, r.edge.target) for r in flat_out):	->L497, ->L498	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
537	if abs(v) < COORD_TOLERANCE_FINE:	->L538
646	if multi_diag:	->L647	defensive — multi_diag branch selecting the flat-segment X extent in _centering_candidate; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
659	if not multi_diag:	->L666	defensive — The skip-this-block arm fires only when multi_diag is True, which is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
669	if abs(in_flat) < 1 or abs(out_flat) < 1:	->L670
777	if abs(other.y - station.y) > 1:	->L767	defensive — The loop-back arm (skip appending a column companion) fires only when another non-port station in the same section shares the moving station’s x (within 1px) and its y (within 1px) - two near-coincident distinct stations, forbidden by the no-overlap invariant.
820	if ox is None:	->L821	defensive — Null guard in _align_uncentered_siblings. The loop iterates visible non-port stations and original_x is built from every non-port station, so ox is always present; the guard never fires.
847	if max(moved_xs) - min(moved_xs) <= 1.0:	->L848	defensive — Early-exit for the agree case: all movers land within 1px of each other. Unreachable for natural pipelines because the engine always seats one fan branch on the hub’s trunk row, vetoing companion consensus for the whole column, so moved is empty and the outer guard fires first.
853	if majority_count <= len(moved) / 2:	->L854	defensive — The no-clear-majority arm. Movers in a column either converge to one consensus x or sit off it only via hub/exit-port collinearity at a fixed >=20px quantum; the consensus cluster is always the strict majority, so majority_count is never <= half (0 of corpus, no probe topology reproduces a split). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
860	if not outliers:	->L861	defensive — The no-outliers arm in the movers-disagree branch. Disagreement only arises from hub/exit-port collinearity at a >=20px quantum, never sub-pixel, so whenever spread exceeds 1px at least one mover rounds >1px from the majority x. outliers is never empty here. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
869	if abs(rp.points[0][0] - old_x) < STATION_MOVE_TOLERANCE:	->L868	defensive — Per-route anchor guard: only an outgoing route whose start sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station (e.g. an L-shape or bypass leg not snapped by _apply_station_moves); dragged stations in the corpus only carry position-anchored routes, so it never fires.
872	if abs(rp.points[-1][0] - old_x) < STATION_MOVE_TOLERANCE:	->L871	defensive — Per-route anchor guard: only an incoming route whose end sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station; dragged stations in the corpus only carry position-anchored routes, so it never fires.

rail.py

17/23 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
56	if st is None:	->L57	defensive — _line_rail_y is only ever called with a real station id (on_rail.id, edge.source/target, or a sibling edge endpoint), all of which exist in graph.stations - the route loop pre-filters None endpoints at the src/tgt guard. The None arm is a contract guard no render-path call reaches.
64	if line_id in section_rails:	->L67	defensive — The whole-graph rail connector routes port-to-port edges through _line_rail_y, exercising the in-rails arm. The fall-through (a port carrying a line absent from its own section’s rail map) cannot occur: a port carries only lines its section’s stations carry, all present in per_line_y. Defensive fallback.
75	if line_id in served and len(st.rail_used_ys) == len(served):	->L77	defensive — Reached only for a non-port spanning station, whose rail_used_ys is station_lines_ordered filtered to the section’s per_line_y - itself built from the same _section_lines_in_order. So a served line is always in per_line_y (lengths match) and _line_rail_y is only called with a line the touching edge carries (always served). The fall-through return st.y is a defensive fallback no render-path call reaches.
131	if sib_rails:	->L136	defensive — _off_track_drop_order is only called for an off-track elbow edge that exists in graph.edges, so the feeder<->consumer set it scans always contains at least that edge; the empty-sib_rails arm (skip the mirror-corner reversal) is a contract guard no render-path call reaches.
259	if exit_port.side is not PortSide.RIGHT or entry_port.side is not PortSide.LEFT:	->L260	defensive — Whole-graph rail mode stacks sections vertically and resolve.py always sides an inter-section edge as a RIGHT exit feeding a LEFT entry, so the early-return arm (an unmodelled side pairing) is a structural fallback no rail topology reaches.
358	if conn is not None:	->L354	defensive — Skips the straight-rail fallback when _route_inter_section_connector handled a port-to-port bundle. The connector returns a route for every whole-graph rail inter-section edge (always a RIGHT exit feeding a LEFT entry), so the None arm (fall through to straight-rail routing) is a structural fallback no rail topology reaches.

reserved_bands.py

14/22 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
62	if self.hi < self.lo - COORD_TOLERANCE:	->L63	defensive — The invariant the router relies on: a band handed to _center_inter_row_channel or centre_inter_column_channel always holds a channel, so the narrow-gap fallback cannot be reached for a claimed corridor. build_reserved_corridors filters an empty intersection out before constructing a band, so the raise guards direct construction only.
64	if self.allocation is not None and not math.isfinite(self.allocation):	->L65	defensive — Published allocations originate from finite observed route coordinates plus finite reservation translations. A non-finite value can only reach ReservedBand through malformed direct construction; the guard keeps invalid coordinates out of planner seating.
186	if band is None or band.hi < band.lo - COORD_TOLERANCE:	->L187
203	if boundary is None:	->L204	defensive — Optional-boundary convenience for callers carrying an unresolved grid index (_left_exit_wrap_over_top_y takes tgt_row: int | None). Such a caller returns before it needs a band — with no target row there is no gap above it to measure, so the wrap is rejected first — leaving this arm a type-level accommodation no topology reaches.
308	if lower > upper + COORD_TOLERANCE:	->L309
411	if realised is None:	->L412	defensive — realise_reservation returns None only for a canvas-side corridor measured without canvas bounds; this loop has already narrowed to row-gap or column-gap claims, which always measure. The arm satisfies the optional return type rather than a reachable state.
544	if band is None:	->L545	defensive — Every record for one edge and segment rank observes the same physical route segment. Disjoint clearance intervals for that key therefore require a fabricated or inconsistent reservation ledger; the raise protects the published claim view from contradictory corridor bounds.
548	if allocation_range[1] - allocation_range[0] > COORD_TOLERANCE:	->L549	defensive — Repeated observations of one route-segment claim project the same declared gap coordinate through the same member translation. A wider allocation range therefore requires a fabricated or inconsistent reservation ledger; the raise protects the published claim view from contradictory exact allocations.

reversal.py

42/52 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
200	if not src.is_port:	->L201
220	if receiver not in reversed_secs:	->L219	defensive — BFS dedup guard in _detect_tb_bottom_top_entries: the False arm fires when a TB section is queued as a vertical receiver via two different positive_fan paths. The detection only registers a receiver when a BOTTOM exit PORT directly feeds a TOP entry port (edge.source is the exit port). A TB section reached by two upstream sections is fed through a fork/merge junction, so the edges into its TOP entry originate at the junction, not a port — the detection skips them and the receiver is never queued twice. A diamond renders (examples/topologies/tb_bottom_exit_fork_diamond.mmd) but does not drive this arm. The guard is correct and necessary to prevent double-queueing and ensure BFS termination should a direct double-feed ever arise.
257	if jid in seen:	->L258	defensive — Cycle guard in _entry_ports_through_junctions’ junction walk. The True arm fires only if a junction is reached twice while walking out from one exit-port-fed junction (a junction reachable by two paths). Resolved peel-off fans are trees, so no junction is revisited and the arm is unreached; the guard keeps the walk terminating should chained junctions ever form a cycle.
265	if port and port.is_entry:	->L260	defensive — _entry_ports_through_junctions collects the entry ports a peel-off junction fan lands on. Each junction out-edge targets either another junction (consumed by the prior edge.target in junction_ids continue) or an entry port; no junction fans directly to a station or exit port across the corpus. The non-entry arm is therefore a structural-contract guard never reached.
314	if entry and entry.section_id and entry.section_id != src.section_id:	->L310	defensive — _build_section_adjacency records a section successor reached through a peel-off junction. entry_id comes from _entry_ports_through_junctions, which returns only registered entry-port stations, so graph.stations.get(entry_id) is always present and carries a section_id. The only un-exercised arm is entry.section_id == src.section_id — a junction fanning back into its own source section — which a resolved peel-off fan never produces. Defensive structural-contract guard.
340	if not section:	->L341	defensive — _propagate_reversal_along_rows iterates sec_id values drawn from reversed_secs, which only ever holds real section ids added from graph.sections. graph.sections.get(sec_id) is never None; the continue is a defensive null guard.
351	if not succ:	->L352	defensive — succ_id comes from sec_successors, built only from real tgt.section_id values, so graph.sections.get(succ_id) is never None and the continue (->187) is a defensive null guard. The fall-through static arm (->188) is phantom: control falls into the following multi-line if (, whose first operand line carries the real arc L186->189.
355	or (sec_id, succ_id) in horizontal_succ_pairs	->L347
411	if not s2.is_port:	->L412
418	elif src.is_port:	->L405	defensive — Edge feeding a LEFT/RIGHT entry port whose source is not a junction; src is then always an exit port (is_port=True), because resolved chains feed entry ports only from exit ports or junctions. The elif is always true, so the implicit fall-through to the loop (->223) is a structural-contract guard no valid topology reaches.

seam.py

6/6 gates fully exercised.

All gates have every arm exercised by the corpus.

system_emission.py

23/50 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
68	if compatible != bool(self.compatibility_reasons):	->L69
70	if not isinstance(self.geometry_owner, RouteSystemGeometryOwner):	->L71
303	if geometry_failure is not None:	->L304	defensive — _system_decider’s first precedence step. A member holding no geometry decision at all settles the system before any later owner is consulted, and every corpus system has one, so the true arm is un-taken. Reachable through any member whose canonical family declines to build a complete template.
341	if prior != ownership.covered_by_member_id:	->L342
361	if declined and require_member_geometry:	->L362
454	if system.disposition is not RouteSystemDisposition.PLANNED:	->L455
468	if owners != 1:	->L469
477	if len(by_edge) != sum(len(system.members) for system in frozen):	->L478
505	for covered_edge_key, carrier_edge_key in covered_routes:	->L506
508	if covered_member is None or carrier_member is None:	->L509, ->L510
513	if prior != carrier_member.member_id:	->L505, ->L514
522	route.route_system_id is not None	->L525
523	or route.emission_member_id is not None	->L525
529	if member is None:	->L530
540	route.route_system_id != str(system.system_id)	->L546
541	or route.emission_member_id != str(member.member_id)	->L546
542	or route.route_system_disposition != system.disposition.value	->L546
543	or route.route_plan_ids != system.plan_ids	->L546
544	or route.route_reservation_ids != member.reservation_ids	->L546
558	if count:	->L559
564	if covering_binding is None:	->L565
570	if covering_system.system_id != system.system_id:	->L571
576	if emitted.get(covering_member_id, 0) != 1:	->L577
582	if count != 1:	->L583
600	if system is None:	->L601
609	if member is None or member.system_id != system.id:	->L610
617	if route.route_reservation_ids != expected:	->L618

tb_handlers.py

16/20 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
156	if diag_end < diag_start:	->L157	defensive — Degenerate-collapse clamp for an ascending diagonal: fires only when the run is shorter than 2*MIN_STRAIGHT_EDGE (20px). Every caller feeds grid-placed station coordinates whose run-axis separation is at least one grid pitch (Y_SPACING=40 / X_SPACING=60); _route_entry_runway additionally pre-guards with room < src_min + diagonal_run. The 20px collapse threshold is never reached.
162	if diag_end > diag_start:	->L163	defensive — Descending-run mirror of the ascending collapse clamp (#1 of if diag_end < diag_start:): fires only when |run| < 2*MIN_STRAIGHT_EDGE (20px), but connected diagonal endpoints are always >= one grid pitch (40/60px) apart on the run axis. Unreachable degenerate-geometry guard.
372	if tgt_sec is not None and tgt_sec.direction not in ("TB", "BT"):	->L376	defensive — Perp-entry drop crossing-X override: the edge’s target is always a sectioned station, so tgt_sec resolves and the tgt_sec is None short-circuit to the plain drop is never taken; the direction in (TB, BT) arm (a drop continuing into a vertical-flow trunk) and the horizontal-target arm are both exercised.
374	if crossing_x is not None:	->L376	defensive — Pair of context.py::if not indices: - the helper returns None only when no bundled feeder reaches the port, but a horizontal-flow section taking a perpendicular entry is always fed by a bundled inter-section edge, so crossing_x resolves. The crossing_x-is-None fall-through is a defensive guard, never taken across the corpus.