Routing gate coverage matrix

Routing gate coverage matrix

Auto-generated by scripts/routing_gate_coverage.py under CPython 3.11 with PYTHONHASHSEED=0 (the arc model is interpreter-specific and operand-level coverage is hash-seed sensitive). Do not edit by hand; run the script to regenerate.

Each row is a branch point (a gate) in a layout/routing/ dispatch handler or post-pass. A gate has two or more arms; the cells list how many corpus fixtures exercise each arm. An arm reached by 0 fixtures is an un-exercised gate arm: either no shipped topology takes that path (author a fixture, or confirm it is defensive/dead).

895/1221 gates fully exercised (both/all arms hit by some fixture); 326 gates have at least one un-exercised arm.

Modules scoped to routing decision gates; invariants.py (the validate=True checker) and __init__.py are excluded.

The Triage column carries a curated verdict for gaps no fixture can close: defensive (a guard arm a valid topology never violates), candidate-dead (no constructible topology reaches it; left in place pending a separate deletion review), or needs-review (not yet classified). A blank cell means the gap is still open for a fixture. 247 gaps carry a triage verdict.

arranger.py

1/1 gates fully exercised.

All gates have every arm exercised by the corpus.

bundle.py

5/10 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
51	if abs(dx) > COORD_TOLERANCE and abs(dy) > COORD_TOLERANCE:	->L52
111	if n_legs < 1:	->L112	defensive — Defensive guard: build_concentric_bundle rejects a centreline of fewer than two vertices. Every caller (route_along / route_straight and the handler centrelines) builds a >=2-vertex polyline, so the raise arm is never taken.
181	if n_legs < 1:	->L182	defensive — Defensive guard: build_tapered_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken.
183	if not 0 <= transition_leg <= n_legs:	->L184	defensive — Defensive guard: build_tapered_bundle rejects a transition_leg outside [0, n_legs]. Handlers pass a literal 1 against a 3- or 4-vertex centreline, so the raise arm is never taken.
245	if n_legs < 1:	->L246	defensive — Defensive guard: build_offset_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle and build_tapered_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken.

centrelines.py

5/5 gates fully exercised.

All gates have every arm exercised by the corpus.

common.py

88/124 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
219	if not secs:	->L220	defensive — row_bottom_edge empty-result guard: every caller passes a grid row (optionally col-filtered) that contains the routed source/target section after layout, so the section list is never empty; the default-return arm is a guard valid layouts never take.
245	if top is None or bottom is None:	->L246	defensive — Defensive in iter_inter_row_gaps (consumed by inter_row_gap_upper_row and _inter_row_gap_band): adjacent rows in the sorted section-row set both contain sections, so row_bottom_edge / row_top_edge resolve; the None skip arm guards a row with no sections that the iteration never yields.
379	if not facing:	->L380
391	if s.bbox_h <= 0:	->L392	defensive — Degenerate-bbox guard in _grid_row_bands: a laid-out section always has bbox_h > 0, so the skip arm only protects against a zero/negative-height section that the layout never produces.
438	if right > left and left - tol <= x <= right + tol:	->L439
490	if n == 0:	->L491	defensive — Empty-bundle guard: all callers (normalize.py 291/1648, inter_section_handlers.py 783/796/2132) derive bundle_widths from a non-empty bundle line count, so n is always >=1; the empty-list arm is never taken.
492	if bundle_index < 0 or bundle_index >= n:	->L493	defensive — Contract guard raising IndexError on an out-of-range bundle_index. Callers always pass an in-range index (0<=i<n); the raise arm fires only on a caller-contract violation no valid call produces.
731	if abs(pts[k - 1][0] - x0) > COORD_TOLERANCE:	->L732	defensive — Interior horizontal segments only occur in 6-point bypass U-shapes whose flanking legs are always vertical (same x on each side); routes with non-vertical flanks are normalize_exempt and filtered out. The prev-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
733	if abs(pts[k + 2][0] - x1) > COORD_TOLERANCE:	->L734	defensive — Mirror of the prev-flank guard: a bypass trunk’s trailing flank is always vertical, so the next-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
764	if abs(y4 - y3) > COORD_TOLERANCE or abs(x4 - x3) <= COORD_TOLERANCE:	->L765	defensive — Trunk-not-horizontal guard in port_peeloff_tail, reached only after the earlier port-lead and riser checks returned early. In an orthogonal route segments alternate H/V, so the segment preceding a vertical riser is always horizontal; instrumenting the corpus the guard is reached but the non-horizontal-trunk arm never fires. Defensive against a degenerate collinear tail the router does not produce.
838	if trunk_ys[-1] - trunk_ys[0] <= COORD_TOLERANCE:	->L839	needs-review — Degenerate single-Y trunk band in iter_port_peeloff_bundles: a peel-off bundle is yielded only when its members ride trunks at distinct depths, so the equal-depth arm guards a same-Y bundle the trunk-slot materialization never leaves; render-diff confirms no visual change.
843	if len(signs) != 1:	->L844	defensive — Mixed-peel-end guard in iter_port_peeloff_bundles: a concentric peel-off bundle into a LEFT entry port is always fed from the left, so every member’s trunk traverses toward the peel corner with the same trunk_sign. Lines approaching from the right of the port form an entry-wrap route, not a peel-off tail (verified: a right-side source produces zero peel tails), so the bundle never mixes signs. Belt-and-suspenders beyond the contiguity check.
946	if not src or not tgt:	->L947	defensive — Null-endpoint guard: the parser creates a Station for every edge endpoint, so graph.stations.get() never returns None for a real edge; the continue arm only guards a malformed graph.
1008	elif tgt_sec:	->L1016	defensive — The else (col_key=round(sx)) needs an L-shaped (dx!=0,dy!=0) inter edge whose target resolves to no section. Only exit_port->junction edges lack a target section, and junction positioning makes those axis-aligned (same-X RIGHT exit or same-Y BOTTOM exit), never L-shaped, so the else is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1103	if dx > 0:	->L1106	defensive — Leftward (dx<=0) near-source fallback: the symmetric mirror of the rightward fallback. Reached only when section info is unavailable AND no adjacent column resolves; valid layouts take the rightward fallback, but the leftward mirror is kept for robustness.
1114	if st is not None and st.is_port:	->L1112	defensive — Null/non-port guard: after _resolve_sections both endpoints of an inter-section edge are ports/junctions and graph.stations.get() resolves them, so the False (None or non-port) arm only guards a malformed pre-resolve graph.
1156	if sec.bbox_w <= 0:	->L1157	defensive — Zero-width-section guard: the loop scans all graph.sections, but after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts don’t produce.
1206	if src and not src.is_port:	->L1204	defensive — Null/port-source guard: edges to an exit port always originate at an internal (non-port) station after _resolve_sections, so the continue arm (None or port source) only guards a malformed pre-resolve graph.
1222	for i in range(len(pts) - 1):	->L1223, ->L1239	defensive — point_on_polyline is used only by the —animate renderer (render/animate.py); the matrix’s render-path coverage sweep calls render_svg without animation, so none of its branches are reached. Exercised instead by test_animation.py / test_routing.py.
1227	if seg_len2 == 0:	->L1228, ->L1231	defensive — point_on_polyline degenerate-segment branch, reached only via the —animate renderer (render/animate.py); the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py, not the corpus.
1228	if abs(point[0] - ax) <= tol and abs(point[1] - ay) <= tol:	->L1229, ->L1230	defensive — point_on_polyline zero-length-segment hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1232	if t < -0.01 or t > 1.01:	->L1233, ->L1234	defensive — point_on_polyline parameter-range branch, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1237	if abs(point[0] - proj_x) <= tol and abs(point[1] - proj_y) <= tol:	->L1222, ->L1238	defensive — point_on_polyline projection hit test, reached only via the —animate renderer; the render-path coverage sweep doesn’t animate. Exercised by test_animation.py / test_routing.py.
1299	if all_in_range:	->L1301	defensive — cross_row bypass guard: the False arm (no sections in the column range -> return clearance) needs an empty [lo,hi] column span, which a valid multi-section pipeline routing cross_row never has; a degenerate-range guard.
1324	if endpoints:	->L1327	defensive — Non-cross_row bypass guard: the endpoints list always includes the source and target sections (both in src_row), so it is never empty; the default-clearance arm only guards a degenerate empty endpoint set.
1337	if src_row is not None:	->L1349	defensive — Header-clamp guard: the False arm (src_row is None) needs an unresolvable source section, but inter-section bypass sources always resolve to a grid row after layout; a guard against an unresolved source that doesn’t occur.
1419	if station is None:	->L1420	defensive — None-station guard: every production caller passes a concrete Station (grep-verified); the None arm only guards the typed Station|None parameter.
1425	for e in graph.edges_to(station.id):	->L1447	defensive — Upstream edges_to loop-exit: every fan-out junction is emitted with an exit_port->junction edge whose source carries the source section id, so the upstream loop always returns; the fall-through to the type-contract return None is the never-taken no-upstream fallback.
1427	if other and other.section_id:	->L1425	defensive — edges_to upstream guard: a junction’s incoming neighbour is always an exit_port with section_id set, so the False (continue) arm only guards a junction-to-junction edge that valid construction never produces.
1429	if sec:	->L1425	defensive — edges_to section-lookup guard: graph.sections.get(section_id) returning None requires a section_id absent from graph.sections, a corrupted state no valid parse produces; null-guard.
1435	for e in graph.edges:	->L1447	defensive — No-preference graph.edges scan loop-exit: a fan-out junction always has a sectioned incident port (its exit/entry ports carry a section_id), so the loop always returns and never exhausts graph.edges; the fall-through to the type-contract return None is the never-taken no-neighbour fallback.
1437	if e.source == station.id:	->L1438	defensive — Junction-as-source arm of the no-preference scan: fan-out junctions are emitted exit_port->junction before junction->entry_port, so graph.edges encounters the junction as a target (elif arm) first and returns; the source arm is a cheap structural guard whose deadness rests on emit order, not a hard type invariant.
1443	if other and other.section_id:	->L1435	defensive — prefer_upstream=False neighbour guard: a junction’s neighbours are always sectioned ports, so the False (continue) arm only guards a junction-to-junction edge valid construction never produces.
1445	if sec:	->L1435	defensive — prefer_upstream=False section-lookup guard: graph.sections.get(section_id) returning None requires a missing section_id (corrupted state); null-guard.
1510	if dy > 0:	->L1515	defensive — Multi-row upward-crossing arm: grid rows are assigned topologically and upward inter-section routes take other handlers (a same-row/around-section path), never reaching inter_row_channel_y’s multi-row branch with dy<=0; verified by an upward multi-row fixture that bypasses this code.
1520	if dy > 0:	->L1521	defensive — Near-target fallback block, gated behind the L801 resolve guard: since every call resolves to different-row sections (see that entry), the fallback is never reached, so neither dy arm fires.

context.py

66/106 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
127	if succ_port and succ_port.is_entry:	->L121	defensive — A merge junction is defined as one whose single successor is the section entry port it was inserted before, so succ_port is always a present entry port; the reject arm (successor absent or non-entry) never fires.
136	if st is None:	->L137	defensive — _col_for_id looks up junction and predecessor IDs that are always present in graph.stations; the missing-station early-return never fires.
142	if not mst:	->L143	defensive — mjid ranges over junctions, a subset of junction_ids all present in graph.stations; the missing-station continue never fires.
145	if tgt_col is None:	->L146	defensive — A merge junction always resolves to a grid column (it sits adjacent to its entry-port section); the unresolved-column continue never fires.
149	for e in graph.edges_from(mjid):	->L163	defensive — The entry-port search finds the merge junction’s sole entry-port successor on the first edge and breaks (real exit arc 139->147), so the loop never runs to exhaustion and the for-completion arm never fires.
151	if ep and ep.is_entry:	->L149	defensive — The merge junction’s only outgoing edge targets its entry port, so the first iteration matches and breaks; the loop-back arm (a non-entry edge before the entry port) never fires.
168	if not pred:	->L169	defensive — edge.source for an edge into the junction is always a present station; the missing-predecessor continue never fires.
212	if m_col is not None:	->L222	defensive — Reached only for junctions in trunk_source, which by construction resolved a column, so m_col is never None and the no-column skip arm never fires.
225	if ep and ep.is_entry:	->L223	defensive — Same merge-junction invariant in the skip-edge pass: the junction’s lone successor is its entry port, so the loop-back over a non-entry edge never fires.
229	if m_col is not None:	->L204	defensive — As the first occurrence, in the index-exclude pass: a trunk-source junction always has a resolved column, so the no-column skip arm never fires.
339	for e in graph.edges:	->L340, ->L342	defensive — In the public compute_junction_fan_info, called only from _guard_fan_bundles_coincide_or_separate (a validate=True guard). The coverage sweep renders with validate=False, so this function never runs on the render path; it is exercised by the layout-invariant test surface instead.
367	if port_st is None:	->L368	defensive — Ports listed in a section’s entry_ports/exit_ports always have a backing station; the missing-station continue never fires.
380	if ctx.station_offsets:	->L382	defensive — compute_station_offsets returns a 0.0 entry for every (station, line) of any graph with edges, so the render path always passes a non-empty dict; the falsy-return arm guards only the route_edges(station_offsets=None) call path used by tests, which the sweep never exercises.
387	if not ctx.station_offsets:	->L388	defensive — Pairs with _get_offset’s guard: compute_station_offsets is never empty on the render path, so _max_offset_at’s early-return arm guards only the route_edges(station_offsets=None) call path used by tests.
435	if port.section_id is None:	->L436, ->L437
467	for pid in section.entry_ports:	->L468, ->L470
468	if line_id in graph.station_lines(pid):	->L467, ->L469
496	if port is not None:	->L497, ->L500
501	for sid in section.station_ids:	->L502, ->L506
503	if not station.is_port:	->L501, ->L504
525	if section is None:	->L526
534	if sec and sec.grid_col >= 0:	->L536	defensive — After section placement every resolved section carries a non-negative grid_col, so the None-return for an unplaced/missing column never fires.
542	if sec and sec.grid_row >= 0:	->L544	defensive — After section placement every resolved section carries a non-negative grid_row, so the None-return for an unplaced/missing row never fires.
556	if sec is None:	->L557	defensive — _resolve_section_colrow is called for ports/junctions that always resolve to a section; the None-section early-return never fires (mirrors the grid-sentinel guards at L395/L403).
596	if psec is None:	->L597
608	if _has_intervening_sections(	->L598
641	if psec is None or pst is None:	->L642
692	if len(sources) != 1:	->L693
695	if jst is None:	->L696
698	if src_col is None or src_row is None:	->L699
706	if tgt is None or not (tgt.is_port or edge.target in graph.junction_ids):	->L707
712	if tcol is None or trow is None:	->L713
722	if len(reach) < 2:	->L723
736	if len({d > 0 for d in drow.values()}) != 1:	->L737
782	if not src or not tgt:	->L783	defensive — Edge endpoints are always present stations; the missing-endpoint continue never fires.
876	if not jst:	->L877	defensive — jid ranges over junction_ids, all present in graph.stations; the missing-station continue never fires.
879	if src_col is None:	->L880	defensive — A fan-out junction always resolves to a grid column; the unresolved-column continue never fires.
917	if not tgt or not (tgt.is_port or edge.target in junction_ids):	->L918	defensive — A junction’s outgoing inter-section edges always target a port or another junction (junctions are synthesised only on exit-port -> entry-port chains); the skip arm for a plain-station target never fires.
920	if tgt_col is None:	->L921	defensive — A junction’s port/junction target always resolves to a grid column; the unresolved-column continue never fires.
1023	if edge.line_id in line_pos:	->L1022	defensive — line_pos is built from the line IDs of the very all_outgoing list this loop iterates, so the membership test is always true: the reject/loop-back arm (L684) is an unreachable tautology and the enter-body static arc (L686) is a phantom of the real 685->687. Vestigial tautological guard. The deliberate gap is pinned by test_genuine_dead_arm_not_masked_as_covered (arc normalization must not merge the never-taken branch onto the live one). Reclassified defensive (#762).

core.py

12/14 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
178	if not src or not tgt:	->L179	defensive — Main edge-loop guard against a missing endpoint station. After section resolution every edge endpoint exists in graph.stations (parse _ensure_station’s all referenced nodes; resolved chains insert their own ports/junctions), so the guard never fires and only the proceed-to-routing arm is reachable.
191	if result is not None:	->L170	defensive — Append-guard after the priority-ordered handler chain. The final handler _route_intra_section is total: its three early returns and its _route_diagonal fallback (annotated -> RoutedPath, single return statement) always yield a RoutedPath, so result is never None and every edge appends. The None arm is unreachable.

corners.py

10/10 gates fully exercised.

All gates have every arm exercised by the corpus.

inter_section.py

0/4 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
98	if pair not in _CW_TURNS and pair not in _CCW_TURNS:	->L-96, ->L99	defensive — Corner.post_init turn-validity check. inter_section.py is the descriptor/documentation module (distinct from inter_section_handlers.py); no src module imports it, so it never loads during the render-corpus sweep (confirmed absent from sys.modules after rendering the whole corpus) and both arms show 0 hits. Corner instances are module-level constants built from valid right-angle turns, so the raise can only fire on a source edit. Exercised by test_inter_section_descriptor.py.
107	if (self.in_tangent, self.out_tangent) in _CW_TURNS:	->L108, ->L109	defensive — Corner.handedness property. Same module-load story: inter_section.py is never imported on the render path, so neither the CW nor the CCW arm is reachable by any render topology. Both branches are exercised by test_inter_section_descriptor.py.
155	for prev, curr in zip(self.corners, self.corners[1:]):	->L156, ->L158	defensive — TurnSequence.parity loop over consecutive corners. parity is descriptor-level documentation (runtime wrap handlers preserve bundle ordering via per-corner offset propagation regardless of this value); nothing on the render path reads it, and the module is never imported during the sweep. Exercised by test_inter_section_descriptor.py.
156	if prev.handedness != curr.handedness:	->L155, ->L157	defensive — Handedness-change counter inside TurnSequence.parity. Off the render path for the same reason (inter_section.py never loaded during rendering); both arms are exercised by test_inter_section_descriptor.py’s parity-contract tests.

inter_section_handlers.py

85/139 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
438	if f.horizontal is Direction.L:	->L441	defensive — Near-vertical same-column junction channel push: the junction always sits right of its same-column LEFT entry, so horizontal is always Direction.L; the Direction.R arm never fires (#762). Defensive.
477	and f.src_row is not None	->L490	defensive — LEFT-entry inter-row L-shape guard. Every LEFT-entry inter-section edge reaching this condition has a resolved source grid row (f.src_col/f.tgt_col are asserted non-None just above and the row resolves alongside), so the f.src_row is None short-circuit out of the L-shape branch is never taken.
478	and f.tgt_row is not None	->L490	defensive — Companion guard to f.src_row in the same LEFT-entry inter-row L-shape condition: the target grid row is likewise always resolved here, so the f.tgt_row is None short-circuit out of the branch is never taken.
500	if section and section.bbox_w > 0:	->L502
508	if section and section.bbox_w > 0:	->L510
534	if _v_segment_crosses_other_section(graph, corner_x, src.y, ey, exclude):	->L535	defensive — Drop-in viability test in _right_entry_drop_in_is_clear (#889). The cross-row RIGHT-entry rule fires only when the earlier bypass / plough rules ceded the edge, i.e. no section sits between source and port, so the outward-side descent runs clear; the not-clear arm covers only an exotic descent blocked by a wide same-column sibling no corpus fixture builds. Defensive.
640	if min(drop_xs) < _section_right_edge(graph, tgt) - COORD_TOLERANCE:	->L641
643	if _v_segment_crosses_other_section(graph, dx, src.y, tgt.y, exclude):	->L644
684	if route is not None:	->L686
732	if src_col is not None and src_col > 0:	->L736
769	if route is not None:	->L772
840	if _corridor_is_viable(ctx, src, tgt):	->L841	needs-review — Reachable only via a defective render (inter-row corridor grazes the source section); see #722.
866	if abs(ep.y - f.sy) < ctx.curve_radius:	->L867	defensive — Merge entry-port Y tracks the source/junction Y, so a sub-curve_radius exit->entry gap never arises (the same-Y rule already handles dy<tol); corpus instrumentation across the fixtures (#762) confirms the arm is never taken. Defensive.
869	if ep_port and ep_port.side == PortSide.LEFT:	->L875	defensive — Contract guard in _route_inter_section: a merge entry port always resolves to a Port on the LEFT side here, so the non-LEFT/None arm (fall through to _route_l_shape at L344) is never taken (0/128). The earlier ‘multiline phantom’ note was inaccurate — this is a recorded gate whose arm is never taken. Defensive guard. Reclassified defensive (#762).
872	if _corridor_is_viable(ctx, src, ep):	->L874	needs-review — Reachable only via a defective render (route skirts/crosses section boundary); see #724.
1322	if ctx.station_offsets:	->L1324	defensive — _run_pass_c_guards always populates ctx.station_offsets before route_edges, and RAILS mode returns earlier; the empty-offsets arm never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1370	if sx >= (left_edge + right_edge) / 2:	->L1373	defensive — Defensive symmetry: a merge feeder junction sits in the inter-column gap downstream of its fork, i.e. right of its source section’s centre, so the exit-right arm always fires in the corpus. The exit-left arm mirrors it for a junction sitting left of centre; no fixture places a merge feeder there.
1411	if src is None or tgt is None:	->L1412	defensive — Endpoint lookup guard in _would_route_around_section_below; every edge endpoint is a registered station after parse+resolve, so graph.stations.get never returns None here. Defensive.
1448	if _would_route_around_section_below(other, ctx):	->L1449	defensive — Competing-sibling detection in _has_around_section_sibling, routed through the dispatch table (#813). A non-bypass sibling feeding the same merge junction sits in an adjacent column or a gap with no same-row intervening section, so it dispatches to an L-shape, not the around-below loop; corpus instrumentation across the fixtures confirms the arm is never taken. Defensive.
1754	if trunk_v_up_pull_away:	->L1763	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
1793	this_xmin - gap_left >= SECTION_ROUTE_CLEARANCE	->L1794, ->L1797
1794	and gap_right - around_xmax >= SECTION_ROUTE_CLEARANCE	->L1796, ->L1797
1873	if src_sec is not None and src_sec.bbox_w > 0:	->L1921	defensive — A bypass source section always resolves and has bbox_w>0 (the parser never emits an empty section); the None/zero-width arm never fires.
1981	if route is None:	->L1982
2009	if route is None:	->L2010	defensive — Defensive in _declare_trunk: _route_inter_section only reaches the declaration after a matched rule (or the L-shape fall-through) produced a route, so the None guard never fires on the corpus; it mirrors _declare_channel’s same guard for a handler that returns None.
2178	while cur is not None and cur not in seen:	->L2194
2184	if port.side == PortSide.LEFT:	->L2185
2187	if cur in graph.junctions:	->L2193
2235	if (	->L2241
2478	and src_sec is not None	->L2497	defensive — Inter-row exit mid-Y clearance bump (the n>1 multi-line branch). When more than one line shares the exit the source section always resolves, so the src_sec is None short-circuit past the clearance bump is never taken.
2479	and tgt_sec is not None	->L2497	defensive — Companion to src_sec in the same n>1 mid-Y clearance branch: the target section always resolves there, so the tgt_sec is None short-circuit past the bump is never taken.
2501	elif abs(dx) > ctx.curve_radius:	->L2502
2505	if src.id in ctx.graph.junctions:	->L2515	needs-review — Reachable only via a defective render (LR->TB TOP-entry routing); see #720.
2506	for je in ctx.graph.edges_to(src.id):	->L2515
2508	if js and js.is_port:	->L2506	needs-review — Reachable only via a defective render (LR->TB TOP-entry routing); see #720.
2509	if abs(js.x - src.x) <= COORD_TOLERANCE:	->L2512
2793	if tgt_col is not None:	->L2798	defensive — tgt_col from _resolve_section_col on a valid LEFT entry port is always non-None (sections get grid_col>=0 after auto-layout).
2795	if shared_vx is not None:	->L2798	defensive — _fan_left_entry_descent_x returns None only when col_left<=0; col_left_edge for the target’s own column is always >0.
2828	if entry_port is None:	->L2829	defensive — _route_around_section_below is always called with a non-None entry_port (both dispatch sites pass a checked station).
2839	if trunk_src is None or trunk_src == edge.source:	->L2841	needs-review — Reachable only via a defective render (merge-junction tangle); see #721.
2858	if gap_right <= gap_left:	->L2859	defensive — The column-gap enforcer keeps inter-column gaps positive, so gap_right>gap_left always holds at the target row.
2885	if col_left <= 0.0:	->L2886	defensive — col_left_edge’s 0.0 default only fires for a column with no sections; the target’s own column always holds its section.
2901	if tgt is None:	->L2902	defensive — Edge targets are always registered stations after resolve; the None arm never fires.
2924	if entry_port is None:	->L2925	defensive — Every caller of _corridor_is_viable passes a non-None entry_port.
2927	if ep_port is None or ep_port.side != PortSide.LEFT:	->L2928	needs-review — Reachable only via a defective render (route skirts/crosses section boundary); see #724.
2931	if src_row is None or ep_row is None or src_col is None or ep_col is None:	->L2932	defensive — _resolve_section_colrow returns (None,None) only for a station with no section; valid entry ports always have a section with non-negative grid coords.
3018	if fan is not None:	->L3026	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3026	elif gap_bottom > gap_top:	->L3027, ->L3029	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3034	if fan is None and gap_bottom > gap_top:	->L3035	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3045	if fan is not None and ep_col is not None:	->L3047	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3047	if vx is None:	->L3048	needs-review — Reachable only via a defective render (inter-row corridor on a <78px gap); see #722.
3160	if ep_section and ep_section.bbox_w > 0:	->L3163	defensive — entry_port.section_id is always set and the section has bbox_w>0 after layout; the else arm never fires.
3402	if not _inter_row_band_fits(gap_top, gap_bottom):	->L3403	defensive — Band-fit test in _right_entry_gap_above_is_clear (#889), reached only when the cross-row RIGHT-entry drop-in is not clear (the exotic blocked-descent case above). The corpus always takes the drop-in, so neither arm of the gap-above fallback is exercised. Defensive.
3482	if not normalize_exempt:	->L3486

intra_handlers.py

32/42 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
77	if not section:	->L78	defensive — _route_entry_runway only runs on an entry-port -> internal-station edge; the target of such an edge always carries a section_id that resolves, so the guard’s return-None arm protects against a malformed graph rather than a topology.
84	if section.direction == "RL" and port.side != PortSide.RIGHT:	->L85
86	if section.direction not in ("LR", "RL"):	->L87	defensive — No TB/BT entry reaches _route_entry_runway: TB LEFT/RIGHT entries are consumed by _route_tb_lr_entry and TB/BT TOP/BOTTOM entries by _route_perp_entry (both earlier in the dispatch chain), and a BT section is never produced (the direction directive accepts only LR/RL/TB; 0/391 corpus sections are BT). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
103	if not st or st.is_port:	->L104	defensive — The loop already skips edge.target and every id in section.port_ids, so a surviving id resolves to a non-port internal station; the not-st / is_port re-check is belt-and-suspenders against a port absent from port_ids.
108	elif section.direction == "RL" and tx < st.x < sx:	->L109
109	if first_x is None or st.x > first_x:	->L99, ->L110
122	if room < src_min + ctx.diagonal_run:	->L123	defensive — The entry-runway ‘too tight’ return cannot fire: room = |first_x - entry_port_x| is floored at SECTION_X_PADDING (50px, the entry port sits at section.bbox_x = min(internal_station_x) - SECTION_X_PADDING), while the threshold src_min + diagonal_run = CURVE_RADIUS(10) + MIN_STRAIGHT_PORT(5) + DIAGONAL_RUN(30) = 45px. Since 50 >= 45 the guard is always False; SECTION_X_PADDING is not exposed as a directive. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
157	if not (tgt.x - src.x <= 0 and abs(dy) > CROSS_ROW_THRESHOLD and not same_section):	->L159	defensive — _route_fold_edge: the not-same_section precondition is never satisfied at the intra-section handlers, so the fold (False) arm is never taken: cross-section edges are consumed by _route_inter_section upstream (0/391 corpus fixtures reach this branch with differing sections), and a sectionless flat graph’s serpentine fold is routed before this handler too (verified: a flat fold over the threshold does not reach the arm). The cross-row fold branch is shadowed. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
312	if abs(tgt.x - src.x) >= COORD_TOLERANCE:	->L314	defensive — _route_near_zero_gap_straight: a same-section, non-TB intra edge with |tgt.x - src.x| < COORD_TOLERANCE (1px) and non-zero dy is not constructible, so the straight-return (False) arm is never taken: layering assigns increasing X along edges so the minimum |dx| at _route_intra_section across the corpus is 50px (port spacing / off-track output lead). TB same-track edges that could reach |dx|=0 are intercepted by _route_tb_internal before this handler. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
380	if not (same_sec or is_exit_port):	->L381	defensive — _is_side_branch_ascent reaches this classification (44/391 corpus fixtures) but no fixture takes the reject arm: a target sitting within offset_step*2 of the source section’s trunk Y is always a same-section internal station or that section’s exit port. The arm needs a target at the source’s trunk Y that belongs to a different section or is a non-exit port, which the trunk-alignment geometry does not produce. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.

normalize.py

133/183 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
103	if s.bbox_w <= 0:	->L104	defensive — Degenerate-bbox guard in _section_intrudes: a laid-out section always has bbox_w > 0; the skip arm guards a zero/negative-width section the layout never produces.
187	if right <= left:	->L188
190	for k, x, y_lo, y_hi, seg_down in iter_vertical_segments(rp):	->L193
222	if ch is not None:	->L220
228	if gap_right <= gap_left:	->L229
345	go is not None	->L351
346	and gt is not None	->L351
383	if len(pts) < 2:	->L384
401	if abs(x3 - x2) > COORD_TOLERANCE or abs(y3 - y2) <= COORD_TOLERANCE:	->L402	defensive — Every non-exempt inter-section route ends with a vertical descent into the target Y then a short horizontal port lead (V->H tail); routes with non-V tails are normalize_exempt. The second-to-last-not-vertical reject in _final_port_approach is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
579	if rp.curve_radii is None:	->L580	defensive — curve_radii is always a concrete list for inter-section routes (every inter-section handler sets it); the None arm in _set_vchannel_x is a belt-and-suspenders guard.
582	if 0 <= radius_idx < len(rp.curve_radii):	->L581	defensive — Bounds guard in _set_vchannel_x: radius_idx in (k-1, k) for a real channel stays in range; the out-of-range skip arm is defensive.
672	if rp is None:	->L673	defensive — Defensive guard: every merge feeder edge is routed, so the by-key lookup in _merge_feeder_groups always resolves; the skip arm is never taken.
679	if trunk_rp is None or trunk_src_st is None:	->L680	defensive — Defensive guard in _merge_feeder_groups: a merge with a trunk_source always has a routed trunk edge and a resolvable trunk station, so the skip arm is never taken.
682	if trunk_ch is None:	->L683	defensive — Defensive guard: the merge trunk route opens horizontal-then-vertical (lead into the gap, then descend), so its initial fan-out descent is always found; the skip arm is never taken.
691	if ch is None:	->L692	defensive — Defensive guard: a merge branch route opens horizontal-then-vertical (lead, then descent onto the trunk channel), so its initial fan-out descent is always found; the skip arm is never taken.
806	elif far_y < t.y - COORD_TOLERANCE:	->L800	defensive — Degenerate-leg guard in _trunk_slot_features: a trunk’s flanking legs are genuine vertical legs (far_y differs from the trunk y), so neither the below nor the above classification is skipped; the fall-through arm needs a zero-height leg the layout never produces.
836	if feats is None:	->L837	defensive — Unused default-arg branch: all three callers of _band_order_crossings pass feats explicitly, so the feats-is-None compute-it arm is never taken.
995	if len(trunks) < 2:	->L996, ->L997	defensive — Early-return in _suboptimal_trunk_bands, called only from the guard* validator (phases/guards.py) and a unit test, never on the production render path. The coverage sweep renders with validate=False, so neither arm registers. Defensive (exercised via the validate=True guard / test surface; cf. #728 validate-only precedent).
999	for grp in groups:	->L1000, ->L1018	defensive — _suboptimal_trunk_bands diagnostic loop: validate-only, not reached by the render-path coverage sweep (see the len(trunks)<2 note).
1000	if len({id(t.route) for t in grp}) < 2:	->L1001, ->L1002	defensive — Single-route-group skip in _suboptimal_trunk_bands, validate-only: called from the guard* validator and a unit test, not the production render path the validate=False sweep exercises. Defensive.
1002	if not any(not t.route.normalize_exempt for t in grp):	->L1003, ->L1004	defensive — _suboptimal_trunk_bands diagnostic guard: validate-only, not on the render path.
1004	for sign in (1, -1):	->L999, ->L1005	defensive — _suboptimal_trunk_bands direction loop: validate-only, not on the render path.
1007	if len(slots) < 2 or len(slots) > _MAX_BAND_PERMUTE:	->L1008, ->L1009	defensive — _suboptimal_trunk_bands slot-count guard: validate-only, not on the render path.
1016	if best < cur:	->L1004, ->L1017	defensive — _suboptimal_trunk_bands crossing-comparison: validate-only, not on the render path.
1150	if band is not None:	->L1156	defensive — Same-line dogleg: the band-found arm is exercised by dogleg_exempt_sameline; the band-is-None arm is defensive (both colliding trunks route through _center_inter_row_channel, so the trunk Y always resolves to a gap band).
1171	if down_ok and up_ok and (cross_down is None) != (cross_up is None):	->L1173	defensive — Same-line dogleg side selection. The crossing-decided true arm (->1297, pick the side whose riser does not pierce the exempt run) is exercised by dogleg_exempt_sameline. The false fall-through (->1298) needs either an out-of-band side or a crossing-equal tie, neither reachable by a clean topology: the reachable dogleg regime rigidly fixes the inter-row band so down_room/up_room stay >= min_sep=6 (observed 14/26 across the corpus and every constructed variant; perturbing the grid loses the regime), and the only realizable tie is both-cross (a crossing-free tie needs degenerate zero-length exempt risers) which co-occurs with section-crossing / dogleg-crosses-exempt guard failures and is never a shippable render.
1173	elif down_ok and (not up_ok or prefer_down):	->L1174, ->L1175	defensive — Same-line dogleg tie / out-of-band fallback, reached only after the L1296 if is false, which a clean topology never produces (see that gate): the true arm (->1299, lean down on a tie) needs a crossing-free tie that requires degenerate risers, and the false arm (->1300) needs down_ok False, which the regime’s fixed inter-row band (down_room >= min_sep) never yields.
1175	elif up_ok:	->L1176, ->L1178	defensive — Same-line dogleg move-up / give-up fallback, reached only when both L1296 and L1298 are false. The true arm (->1301, move up because the lower gap is too tight) needs down_ok False and the else arm (->1303, leave fused) needs both rooms below min_sep; the reachable regime’s inter-row band is auto-widened so both rooms stay >= min_sep=6 (observed 14/26), so neither is reached by a valid topology.
1201	if band is not None:	->L1206	defensive — Distinct-line dogleg: the band-found arm (->1327) is exercised by dogleg_exempt_distinct (#702). The remaining band-is-None arm (->1331) is defensive: a trunk reaching this second loop collides with an exempt bypass obstacle that lives in an inter-row gap, so _inter_row_gap_band(ctx, t.y) always resolves to a band - the same mechanism already accepted for the sibling ‘if band is not None:::#1’.
1216	if below_ok and above_ok and (cross_below is None) != (cross_above is None):	->L1218	defensive — Distinct-line dogleg side selection. The crossing-decided true arm (->1342) is exercised by dogleg_exempt_distinct. The false fall-through (->1343) needs a crossing-equal tie; a crossing-free tie requires degenerate zero-length exempt risers and the only realizable tie is both-cross, which trips _guard_no_dogleg_crosses_exempt_trunk plus the section-crossing guards and is never a shippable render.
1218	elif below_ok and (not above_ok or prefer_below):	->L1219, ->L1220	defensive — Distinct-line dogleg tie fallback, reached only after L1341 is false (a tie), which a clean topology never produces (see that gate). The true arm (->1344, lean below) would fire on such a tie; the false arm (->1345) is unreachable because below_ok always holds and prefer_below is always true (t.y == hit.y in this regime).
1220	elif above_ok:	->L1221, ->L1223	defensive — Distinct-line dogleg move-up/skip branch: unreachable because the below branch is always taken (t.y == hit.y, below_ok true); covers both the move-up and the gap-too-tight continue.
1243	if sg[0].sign_x != t.sign_x:	->L1244	defensive — Both callers of _coincident_trunk_slots pre-filter input to a single traversal direction (band = [t for t in grp if t.sign_x == sign]), so within the function sg[0].sign_x != t.sign_x is always False; the opposing-direction continue is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1274	if rp.curve_radii is None:	->L1275	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_htrunk is a defensive guard.
1286	if 0 <= k - 1 < len(rp.curve_radii):	->L1288	defensive — Bounds guard in _restack_htrunk: trunk index k >= 1 so k-1 >= 0 is always in range; the skip arm is defensive.
1288	if k < len(rp.curve_radii) and k + 2 < len(pts):	->L-1253	defensive — Bounds guard in _restack_htrunk: for a real interior trunk k and k+2 are in range; the skip arm is defensive.
1349	if down is None or len(up.points) < 2:	->L1350	defensive — Every line entering a fan-out junction also exits it to an entry port, so _fanout_route_maps always pairs a downstream route for each (jid, line_id) upstream; all handlers emit >=2-point routes. The skip arm in _join_fanout_upstream_tails is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1396	if col is None:	->L1397	defensive — Defensive guard in _convergence_line_order: a peel-off riser channel always resolves to a source-section column, so the unresolved-column early return is never taken on the corpus.
1437	if not 0 <= far < len(pts):	->L1438
1440	if abs(dx) > COORD_TOLERANCE:	->L1434
1442	if not votes:	->L1443
1548	if rep_x[a] != rep_x[b]:	->L1550	defensive — The routing system assigns distinct x offsets to every line sharing a column gap, so two distinct lines in one gap-bundle corridor never share a representative x; the equal-rep_x tiebreak fall-through in _distinct_line_order is unreachable (exhaustive corpus scan confirms). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1585	if rp.curve_radii is None:	->L1586	defensive — curve_radii is always set for inter-section routes; the None arm in _restack_channel is a defensive guard.
1596	if 0 <= k - 1 < len(rp.curve_radii):	->L1598	defensive — Bounds guard in _restack_channel: the skip arm fires only for k==0 (channel at the route start), which the restacked gap channels (interior verticals after a horizontal lead-in) never are.
1598	if k < len(rp.curve_radii) and k + 2 < len(pts):	->L1608	defensive — Bounds guard in _restack_channel: the skip arm guards k or k+2 out of range for a real interior channel; defensive.
1610	if abs(ly - pts[1][1]) < COORD_TOLERANCE:	->L-1555	defensive — A re-stacked gap channel at points-index 1 always has a horizontal lead-in (L-shape and bypass routes open with a horizontal segment); routes opening non-horizontally are normalize_exempt and skipped by the materialization. The non-horizontal-lead return in _restack_channel is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1672	for _ in range(8):	->L1697	defensive — The 8-iteration exhaustion arm of _clear_channel_x_in_band requires 9+ sections chained across a single column band to shift the channel x eight times without resolving, which no constructible topology produces. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1693	elif right_ok:	->L1696	defensive — The both-bounds-fail return of _clear_channel_x_in_band requires a blocking section spanning the entire inter-column gap (so neither cleared edge fits within bound_left/bound_right); a cross-row section cannot span a gap defined as the space between same-row sections. Unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1721	if s.bbox_w <= 0:	->L1722	defensive — Degenerate-bbox guard in _h_segment_crosses_other_section: mirror of the bbox_w<=0 guard; sections always have positive width.
1754	if s.bbox_w <= 0:	->L1755	defensive — Degenerate-bbox guard in _v_segment_crosses_other_section: mirror of the _h_segment_crosses_other_section guard; sections always have positive width.

offsets.py

282/362 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
81	if edge.target in inbound:	->L83	defensive — inbound is pre-built as {sid: set() for sid in graph.stations}, so every station id in the graph is a key. All edge endpoints are guaranteed to be in graph.stations after parsing (regular nodes via register_station, ports via add_port->add_station, junctions via add_station), so edge.target is always found in inbound and the False branch (54->56) is never taken.
83	if edge.source in outbound:	->L80	defensive — outbound is pre-built from graph.stations keys identically to inbound. All edge sources are registered stations by construction (regular nodes, ports, junctions), so edge.source is always found in outbound and the False branch (56->53) is never taken.
120	if not src or not tgt:	->L121	defensive — _build_same_y_adj calls graph.stations.get(edge.source/target). All edge endpoints are registered stations after _resolve_sections (regular nodes, ports, junctions all go through add_station), so both .get() calls always return non-None Station objects and the if not src or not tgt branch is never taken.
322	if ordered != expected:	->L323	defensive — The raise arm of _assert_sections_anchored_on_trunk, a backstop on the postcondition of _reindex_section_local: an independent section (no flat-frame neighbour) always lands on the contiguous top-anchored levels 0,step,…,(m-1)*step by construction, so the mismatch arm never fires across the corpus. It guards against a future change that stops re-anchoring such a section.
365	while cur is not None and cur not in seen:	->L374
400	if slot is None:	->L401
413	if neighbour is None:	->L414
505	if not src:	->L506	defensive — _section_line_feeders calls graph.stations.get(edge.source) for edges feeding an entry port. All edge sources are registered stations after _resolve_sections (exit ports, junctions, and merge junctions are all added via add_station), so .get() always returns a non-None Station and if not src is never True.
539	if reverse:	->L540	needs-review — Reachable only on a reconvergence section that is also a serpentine fold, where the fold corner crosses lines mid-curve and the return-row bundle sits one offset too low (#705). Exercise with a clean fixture once #705 is fixed.
570	if section is None:	->L571
594	if not all(lid in feeder_off for lid in continuing):	->L595
602	if lid in new_off:	->L601
624	if section is not None:	->L622
626	if len(set(feeder_row.values())) < 2:	->L627
644	for pid in section.entry_ports:	->L654
646	if entry_port is None:	->L647
648	for edge in graph.edges_to(pid):	->L644
689	if seam is None:	->L690
711	if not all(lid in feeder_off for lid in primary_lines):	->L712
760	if new_order is None:	->L763
839	while stack:	->L853	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
841	if cur in seen:	->L842	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
845	if e.line_id != lid:	->L846
851	if src and not src.is_port and src.section_id == sec_id:	->L844	defensive — The false arm fires when an edge source is an internal station (not a port) whose section_id differs from sec_id. After _resolve_sections(), all inter-section edges run through port stations; no direct edge from an internal station of section A to an internal station of section B exists. DFS back-walk via edges_to() from within a section can only reach: (a) entry ports (return True), (b) same-section internal stations (pushed), or (c) other-section ports (is_port=True, skipped by port and port.is_entry check). Cross-section internal stations are structurally unreachable via direct edges after resolution.
937	if not target_id:	->L938	defensive — An exit-only line at station sid is identified by being present in station_lines(sid) but absent from ctx.inbound[sid]. station_lines() returns lines appearing in any edge whose source or target is sid. For a line to be exit-only at sid, it must appear in at least one outbound edge from sid; otherwise it would not appear in station_lines(sid) at all. If an outbound edge exists, outbound_target[(sid, lid)] is always set, so target_id is never None when execution reaches L422. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
940	if not target_st:	->L941	defensive — After parse and layout, every edge target ID in a MetroGraph maps to a station in graph.stations. The guard protects against a structurally malformed graph where an edge references a nonexistent station ID, which cannot occur with valid .mmd input processed through the parser and _resolve_sections().
957	for other in lines:	->L965	defensive — In _reorder_one_exit_line, the loop over lines always finds the swap partner: desired_off is the min or max of all_offs, which by construction is held by another line, so the loop-exhausted-without-match arm is never taken (0/128). Defensive. Reclassified defensive (#762).
965	if swap_lid is None:	->L966	defensive — In _reorder_one_exit_line, swap_lid is None only if the loop over lines exhausts without a match, but desired_off (min or max of all_offs) is always held by another line, so the early-return guard never fires (0/128). Defensive. Reclassified defensive (#762).
1010	if (cur_sid, cur_lid) in visited:	->L1011	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1022	if abs(nbr_cur - new_off) < _OFFSET_EQ_TOLERANCE:	->L1023	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1029	if len(nbr_lines) < 2:	->L1033	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1033	for other_lid in nbr_lines:	->L1015, ->L1034	needs-review — In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed.
1034	if other_lid == cur_lid:	->L1035, ->L1036	defensive — Inside _propagate_offset_swap’s same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the loop body (incl. this self-skip guard) never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762).
1036	if (	->L1033, ->L1040	defensive — Inside _propagate_offset_swap’s same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the inner collision check never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762).
1044	if max_steps <= 0:	->L1045	defensive — max_steps = len(graph.stations) * len(graph.lines). Each BFS iteration dequeues one (station, line) pair and marks it visited; visited pairs are skipped on re-encounter. The number of distinct (station, line) pairs is bounded by |stations| * |lines|, so the BFS can perform at most that many productive steps before the queue empties. The while queue and max_steps > 0 condition therefore always exits via the queue-empty branch; max_steps reaches zero only if more productive steps occur than unique pairs, which is impossible in a finite graph.
1072	if lid not in seen:	->L1069	defensive — The iterator at L554 is sorted(set(sec_entry_lines), ...). The outer set() deduplicates the list before iteration, so each lid appears exactly once and seen never contains it when processed. The false arm (lid already in seen) is logically unreachable — the dedup happens at set construction, making the seen guard dead code. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1163	if src_st and not src_st.is_port:	->L1161	defensive — In _rewrite_edges_with_junctions (resolve.py L594), edges to exit ports are always created as Edge(source=edge.source, target=exit_port_id) where edge.source is the original inter-section edge’s source — an internal section station, not a port. So src_st is never None and src_st.is_port is always False. The false arm cannot be taken by any valid parsed graph.
1167	if internal_offs:	->L1155	defensive — Exit ports are only created when inter-section edges exist (resolve.py _create_port_stations iterates exit_group_edges which is populated only from actual edges). Every TB LEFT/RIGHT exit port therefore has at least one edge from an internal station, so internal_offs is never empty when the loop is entered. The false arm is a defensive guard against an impossible empty-feeder state.
1201	if src_st and not src_st.is_port:	->L1199	defensive — Same invariant as L602: edges to LR/RL exit ports are always from internal (non-port) stations, created by _rewrite_edges_with_junctions (resolve.py L594-595). The false arm (src_st is None or src_st.is_port) cannot be taken by any valid parsed graph.
1245	if trunk_feeder_id is not None:	->L1254	defensive — len(unique_ys) < 2 means every port line’s feeder stations average to a single Y. Under track-per-line layout, distinct lines occupy distinct tracks, so a shared Y across >=2 lines implies one trunk feeder carrying all of them (trunk_feeder_id set); the no-trunk arm is therefore not reached by a track-separated topology.
1279	if anchor_feeders:	->L1282
1304	if port_off is not None:	->L1302	defensive — _compute_base_offsets runs before _propagate_to_junctions and sets ctx.offsets[(sid, lid)] for every station-line pair in the graph; exit ports are stations, so ctx.offsets.get((exit_port_id, lid)) is never None for any lid in graph.station_lines(jid). The loop-back arm (714->712) requires a junction line with no exit-port offset, which base-offset initialization makes structurally impossible.
1320	if port_st is None:	->L1321
1322	for edge in graph.edges_from(port_id):	->L1326
1324	if consumer is not None and not consumer.is_port:	->L1322
1396	if entry_section is None:	->L1397	defensive — Defensive null guard: every port in graph.ports is created by the resolver with a valid section_id, so graph.sections.get(port_obj.section_id) is never None at routing time. The continue branch is a safety net against a malformed port that no valid graph produces.
1400	if not src or not src.is_port:	->L1401	defensive — In the resolved graph, all edges to entry ports come from either exit ports or junctions, both of which are is_port=True stations. A direct internal-station-to-entry-port edge does not exist after _resolve_sections rewrites inter-section edges into port-chain form. There is no valid topology where an edge to a TOP entry port has a source that is not a port.
1448	if not src or not src.is_port:	->L1449	defensive — _propagate_lr_rl_exit_to_entry iterates edges_to(port_id) for LEFT/RIGHT entry ports. In the resolved graph, all edges to entry ports originate from exit ports or junctions, which are always is_port=True stations. A direct internal-station-to-entry-port edge does not exist after resolution. The true arm (775->776) requires a source that is not a station or not a port, which no valid resolved topology produces.
1475	if paired_off is not None:	->L1473	defensive — _compute_base_offsets sets ctx.offsets[(sid, lid)] for every station-line pair before _propagate_lr_rl_exit_to_entry runs. Exit ports are stations. The for-loop at L791 iterates graph.station_lines(port_id) which equals graph.station_lines(exit_port_id) (enforced by the exit_lines != entry_lines guard at L788). For each lid, ctx.offsets.get((exit_port_id, lid)) is therefore never None. The loop-back arc (793,791) for the paired_off-is-None case is structurally unreachable.
1481	if tgt_st and not tgt_st.is_port:	->L1479	defensive — edges_from(port_id) for an entry port yields edges to internal section stations. In the resolved graph, entry ports are connected directly to internal (non-port) stations; there are no entry-port-to-entry-port or entry-port-to-exit-port edges. So tgt_st is always a valid non-port station, and the loop-back arm (799->797) where tgt_st is None or is_port is unreachable for any valid resolved graph.
1516	if entry.side not in (PortSide.LEFT, PortSide.RIGHT):	->L1517	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam exit/entry reconciliation to horizontal (LEFT/RIGHT) entry ports, whose per-line offsets are Y like the TB exit’s. A TOP/BOTTOM entry stores X-offsets, so copying across would be a category error. No corpus fixture routes a TB LEFT/RIGHT exit directly into a TOP/BOTTOM entry at the same Y, so the skip arm is never taken; defensive against that cross-axis seam.
1524	if len(shared) < 2:	->L1525	defensive — In _align_flat_tb_exit_to_entry: scopes the flat-seam reconciliation to multi-line bundles, where a constant per-line offset delta means the lines share an order and only the bundle anchoring differs (the auto-folded serpentine case in #1198). A single shared line carries no bundle order to preserve and is left to the single-line corridor passes; no corpus fixture reaches the pass with fewer than two shared lines, so the skip arm is never taken.
1628	if not sec_stations:	->L1629	defensive — The parser calls _remove_empty_sections() (resolve.py:26) which deletes any section whose station_ids list is empty before port creation. Ports are only added to station_ids during _create_port_stations() (resolve.py:527), which runs AFTER _remove_empty_sections(). Therefore every section in graph.sections at layout time has at least one non-port station; sec_stations is never empty.
1659	if not any(	->L1662	defensive — The L920 check returns None when offsets are EXACTLY equal to expected (exact float ==). The L926 check returns None when differences are less than _OFFSET_EQ_TOLERANCE (0.001). Since all offsets are integer multiples of OFFSET_STEP (3.0px), any non-zero difference is exactly 3.0 or more, which is >> 0.001. So L920 catches exact matches and L926 can never catch a case L920 missed; the near-equal window (0,0.001) is unreachable with 3.0px discrete steps.
1722	if graph.stations[peer_sid].is_hidden:	->L1723	defensive — For this arm to fire, the compaction BFS must arrive at a neighbor N whose same-layer peers include a hidden station (bypass-V or converge). Bypass-V stations get their layer from the predecessor P (P.layer+1), so a bypass-V at N.layer requires P at N.layer-1. But P must carry the bypassed line (not in the gap), while the gap seed must NOT carry that line. These constraints force P and the gap seed to be at the same layer (seed.layer = P.layer = N.layer-1) but connected through independent chains to N, a topologically exotic arrangement no standard mmd pattern produces. In all tested bypass+gap topologies, the bypass-V ends up co-layer with the gap seed, not with the BFS neighbor.
1803	if max_steps <= 0:	->L1804	defensive — max_steps = n_sec_stations * len(graph.lines). The BFS visits each (station_id, line_id) pair at most once (the visited set at L1017 prevents revisits). The total distinct pairs is bounded by n_sec_stations * len(graph.lines) = max_steps. Since max_steps decrements by 1 per loop iteration and the loop exits when the queue is empty (naturally after at most max_steps unique visits), the condition max_steps <= 0 is never True; the while-loop guard already prevents the body from executing when the queue is empty.
1817	if sec_a is None and id_a in graph.ports:	->L1818	defensive — The true arm requires sec_a is None AND id_a in graph.ports simultaneously. Junction stations (section_id=None) are added only via graph.add_junction() which calls graph.add_station() but NOT graph.add_port(). graph.add_port() (model.py:483) requires a Port object with a non-None section_id (Port.section_id is typed str, not Optional[str], per model.py:218). Therefore no station with section_id=None can ever be in graph.ports; the conjunction sec_a is None AND id_a in graph.ports is unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1819	if sec_b is None and id_b in graph.ports:	->L1820	defensive — Same argument as L1084: id_b in graph.ports requires the station to have been registered via graph.add_port(), which always supplies a non-None section_id for the created station. A station with section_id=None (sec_b is None) is a junction created by add_junction(), which never calls add_port(). The precondition sec_b is None AND id_b in graph.ports is therefore unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1882	if (tgt_id, lid) not in ctx.offsets:	->L1883	defensive — The True branch (missing entry-port offset -> ok=False) is unreachable because phase 7 (_compute_entry_port_offsets) runs before this function (phase 8a) and assigns an offset for every (entry_port_id, line_id) pair in the graph. By the time _align_junction_to_entry_port runs, ctx.offsets is populated for all entry ports, so the guard never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1893	if all(	->L1898	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. The already-aligned arm (->1190) is exercised by the corpus; the body arm (->1192) is the reachable-but-defective one.
1900	for edge in graph.edges_to(jid):	->L1901, ->L1912	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1902	if src_port and not src_port.is_entry:	->L1903, ->L1909	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its else arm (->1203) is additionally defensive: the sole feeder of a >=2-line fan-out junction is its exit port, a non-entry port.
1903	if feeding_exit is None:	->L1904, ->L1905	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1905	elif feeding_exit != edge.source:	->L1900, ->L1906	defensive — This arm (single_exit=False due to multiple distinct exit ports feeding one junction) requires one junction to receive edges from two different exit ports. But _rewrite_edges_with_junctions in resolve.py creates exactly one junction per exit port fan-out, wired exclusively from that exit port’s edges. A junction always has a single upstream exit port; the elif is structurally unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
1912	for lid, off in desired.items():	->L1913, ->L1914	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
1914	if single_exit and feeding_exit is not None:	->L1853, ->L1915	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its False arm (->1147) is additionally defensive: a >=2-line junction reaching this body is always a single-exit-port-fed fan-out junction (merge junctions carry one line and are skipped by len(j_lines)<2).
1916	if exit_lines == set(j_lines):	->L1853, ->L1917	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its lines-differ arm (->1147) is additionally defensive: a fan-out junction carries exactly its single exit port’s fanned lines, so exit_lines == j_lines always.
1918	if abs(exit_st.y - j_st.y) <= _SAME_Y_TOLERANCE:	->L1853, ->L1919	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its Y-differs arm (->1147) is additionally defensive: only a BOTTOM-exit junction is offset in Y from its exit, but such a junction sits below the consumer row and never meets the body’s all-entries-within-tolerance precondition.
1919	for lid, off in desired.items():	->L1853, ->L1920	defensive — Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive.
2079	if tgt_col is None:	->L2080	defensive — Defensive guard in _convergence_feeders: a LEFT entry port section always has a grid column after placement, so the unresolved-target-column early return is never taken.
2085	if src is None:	->L2086	defensive — Defensive guard in _convergence_feeders: every edge feeding an entry port has a source station, so the missing-source early return is never taken.
2088	if col is None:	->L2089	defensive — Defensive guard in _convergence_feeders: every edge feeding a LEFT entry port has a source whose section resolves to a grid column after placement, so the unresolved-source-column early return is never taken.
2119	if feeders is None:	->L2120, ->L2121
2136	sec is None	->L2140	defensive — Bypass-convergence LEFT-entry feeder scan: the loop only inspects existing LEFT entry ports, whose section always resolves, so the leading sec is None short-circuit that skips the port is never taken.
2208	if src is None:	->L2209
2294	for _ in range(max_iterations):	->L-2266	defensive — _reconcile_horizontal_offsets iterates at most 10 times and breaks early when no change occurs. The arc L1338->(-1310) represents loop exhaustion without early-break (all 10 iterations consumed). On any valid parsed graph, the reconciliation converges in at most a handful of iterations because each iteration resolves at least one edge conflict or reaches a fixed point. The 10-iteration ceiling is a backstop against hypothetical oscillating graphs; normal topologies stabilize in 1-3 passes.
2450	if dag is not None:	->L2458
2453	for succ in dag.successors.get(stack.pop(), ()):	->L2454
2454	if succ not in affected:	->L2453, ->L2455
2463	if not offs:	->L2464

perp.py

9/12 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
122	if not feeders:	->L123	defensive — No-feeder guard in _perp_entry_crossing_x: the helper is called only from _route_perp_entry when a multi-line bundle shares the port with a per-line stagger, and a TOP/BOTTOM entry port in that case is always reached by a bundled inter-section feeder (dy!=0, so compute_bundle_info indexes it). The empty-feeders return-None arm is a contract guard, never taken across the corpus.
154	if entry_port is None or not entry_port.is_entry:	->L155	defensive — _aligned_horizontal_drop_entry only fires for a TOP/BOTTOM exit on a horizontal-flow section (the rest of _perp_riser_lateral’s callers are caught earlier). The return-None arm is taken when such an exit feeds a junction or several targets rather than one entry port; corpus instrumentation across every examples/ fixture finds no horizontal-flow perp exit feeding a non-single-entry, so the arm is never taken and the riser falls back to the perp reflection.
161	if needs_perp_approach_fan(graph, entry_port.id):	->L162	defensive — _aligned_horizontal_drop_entry exempts a distinct-line approach fan, whose intra drop fans onto per-line channels (_perp_approach_fan_x) rather than the entry’s single per-line offset. Reaching it needs a horizontal-flow perp exit dropping straight into a single approach-fan entry; corpus instrumentation finds none, so the arm is never taken and the riser keeps the perp reflection.

postprocess.py

85/102 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
65	if ctx.station_offsets is None:	->L66	defensive — Null guard in _spread_diagonal_bundles. compute_station_offsets returns a non-Optional dict and every render-path route_edges call passes it; the only caller leaving station_offsets at its None default is the validate-only _ensure_routes (guards.py), which the render sweep does not run. The early return never fires on a rendered topology, mirroring the matching assert in _apply_diagonal_spread.
203	if abs(dx_diag) <= COORD_TOLERANCE_FINE:	->L204	defensive — Defensive guard: a near-vertical baked diagonal (dx_diag ~ 0) already separates near-fully along the baked X axis, so it needs no Y spread and the divide-by-dx_diag is skipped. No corpus fixture bakes a near-vertical diagonal, so the guard arm is never taken.
422	if not is_fork_join and (	->L431	defensive — Enters the multi_diag block, which needs a non-fork-join station (<=1 distinct predecessor and successor) carrying both a 4-point diagonal and a 2-point flat incoming route. Raw route shape is a pure function of endpoint coordinates, so all lines on one edge share one shape: n_unique_in and n_unique_flat_in can never both be >=1 for a single-predecessor station, and n_unique_in/out are <=1 when not fork-join. multi_diag is unsatisfiable (0 of 6173 corpus calls). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
472	if multi_diag:	->L473	defensive — multi_diag branch of _flat_connects_to_internal_chain; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate at the same line text), so the function is only ever called with multi_diag False. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
473	if any(_is_chain_predecessor(graph, ctx, r.edge.source) for r in flat_in):	->L474, ->L475	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, which is never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
475	if any(_is_internal_station(graph, r.edge.target) for r in flat_out):	->L476, ->L477	defensive — Inside the multi_diag block of _flat_connects_to_internal_chain, never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
518	if multi_diag:	->L519	defensive — multi_diag branch selecting the flat-segment X extent in _centering_candidate; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
530	if not multi_diag:	->L537	defensive — The skip-this-block arm fires only when multi_diag is True, which is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
567	if in_rp and len(ctx.diag_out_targets.get(in_rp.edge.source, set())) > 1:	->L568
638	if not other or other.is_port or other.is_hidden:	->L639	defensive — Companion scan in _apply_station_moves iterates original_x, which holds only non-port stations, so other is never None and never a port (both operands unreachable); other.is_hidden is a coincidence guard skipping a hidden station that happens to share a moving station’s column, which no corpus topology produces.
642	if abs(other.y - station.y) > 1:	->L632	defensive — The loop-back arm (skip appending a column companion) fires only when another non-port station in the same section shares the moving station’s x (within 1px) and its y (within 1px) - two near-coincident distinct stations, forbidden by the no-overlap invariant.
685	if ox is None:	->L686	defensive — Null guard in _align_uncentered_siblings. The loop iterates visible non-port stations and original_x is built from every non-port station, so ox is always present; the guard never fires.
712	if max(moved_xs) - min(moved_xs) <= 1.0:	->L713	defensive — Early-exit for the agree case: all movers land within 1px of each other. Unreachable for natural pipelines because the engine always seats one fan branch on the hub’s trunk row, vetoing companion consensus for the whole column, so moved is empty and the outer guard fires first.
718	if majority_count <= len(moved) / 2:	->L719	defensive — The no-clear-majority arm. Movers in a column either converge to one consensus x or sit off it only via hub/exit-port collinearity at a fixed >=20px quantum; the consensus cluster is always the strict majority, so majority_count is never <= half (0 of corpus, no probe topology reproduces a split). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
725	if not outliers:	->L726	defensive — The no-outliers arm in the movers-disagree branch. Disagreement only arises from hub/exit-port collinearity at a >=20px quantum, never sub-pixel, so whenever spread exceeds 1px at least one mover rounds >1px from the majority x. outliers is never empty here. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken.
734	if abs(rp.points[0][0] - old_x) < STATION_MOVE_TOLERANCE:	->L733	defensive — Per-route anchor guard: only an outgoing route whose start sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station (e.g. an L-shape or bypass leg not snapped by _apply_station_moves); dragged stations in the corpus only carry position-anchored routes, so it never fires.
737	if abs(rp.points[-1][0] - old_x) < STATION_MOVE_TOLERANCE:	->L736	defensive — Per-route anchor guard: only an incoming route whose end sits at the dragged station’s old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station; dragged stations in the corpus only carry position-anchored routes, so it never fires.

rail.py

16/24 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
49	if st is None:	->L50	defensive — _line_rail_y is only ever called with a real station id (on_rail.id, edge.source/target, or a sibling edge endpoint), all of which exist in graph.stations - the route loop pre-filters None endpoints at the src/tgt guard. The None arm is a contract guard no render-path call reaches.
57	if line_id in section_rails:	->L60	defensive — The whole-graph rail connector routes port-to-port edges through _line_rail_y, exercising the in-rails arm. The fall-through (a port carrying a line absent from its own section’s rail map) cannot occur: a port carries only lines its section’s stations carry, all present in per_line_y. Defensive fallback.
68	if line_id in served and len(st.rail_used_ys) == len(served):	->L70	defensive — Reached only for a non-port spanning station, whose rail_used_ys is station_lines_ordered filtered to the section’s per_line_y - itself built from the same _section_lines_in_order. So a served line is always in per_line_y (lengths match) and _line_rail_y is only called with a line the touching edge carries (always served). The fall-through return st.y is a defensive fallback no render-path call reaches.
99	if sib_rails:	->L104	defensive — _off_track_drop_order is only called for an off-track elbow edge that exists in graph.edges, so the feeder<->consumer set it scans always contains at least that edge; the empty-sib_rails arm (skip the mirror-corner reversal) is a contract guard no render-path call reaches.
227	if exit_port.side is not PortSide.RIGHT or entry_port.side is not PortSide.LEFT:	->L228	defensive — Whole-graph rail mode stacks sections vertically and resolve.py always sides an inter-section edge as a RIGHT exit feeding a LEFT entry, so the early-return arm (an unmodelled side pairing) is a structural fallback no rail topology reaches.
231	if up is None or down is None:	->L232	defensive — Null guard over the two ports’ sections in the rail inter-section connector; a boundary port’s section_id always resolves in graph.sections, so the early-return arm is a contract guard no render-path call reaches.
325	if conn is not None:	->L321	defensive — Skips the straight-rail fallback when _route_inter_section_connector handled a port-to-port bundle. The connector returns a route for every whole-graph rail inter-section edge (always a RIGHT exit feeding a LEFT entry), so the None arm (fall through to straight-rail routing) is a structural fallback no rail topology reaches.
334	if src is None or tgt is None:	->L335	defensive — Null guard over an edge’s endpoints; every graph.edges endpoint exists in graph.stations, so the continue arm is a contract guard no render-path call reaches.

reversal.py

45/57 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
172	if not src or not src.is_port:	->L173	defensive — Phase 1a (_detect_tb_bottom_top_entries) iterates edges feeding a TOP entry port. Entry ports are synthetic nodes created by section resolution; the only edges targeting them are the resolved chain’s exit_port->entry_port and junction->entry_port links, so edge.source is always a registered port or junction station (both is_port=True). The continue (missing or non-port source) is a structural-contract guard no valid topology reaches.
200	if receiver not in reversed_secs:	->L199	defensive — BFS dedup guard in _detect_tb_bottom_top_entries: the False arm fires when a TB section is queued as a vertical receiver via two different positive_fan paths. The detection only registers a receiver when a BOTTOM exit PORT directly feeds a TOP entry port (edge.source is the exit port). A TB section reached by two upstream sections is fed through a fork/merge junction, so the edges into its TOP entry originate at the junction, not a port — the detection skips them and the receiver is never queued twice. A diamond renders (examples/topologies/tb_bottom_exit_fork_diamond.mmd) but does not drive this arm. The guard is correct and necessary to prevent double-queueing and ensure BFS termination should a direct double-feed ever arise.
237	if jid in seen:	->L238	defensive — Cycle guard in _entry_ports_through_junctions’ junction walk. The True arm fires only if a junction is reached twice while walking out from one exit-port-fed junction (a junction reachable by two paths). Resolved peel-off fans are trees, so no junction is revisited and the arm is unreached; the guard keeps the walk terminating should chained junctions ever form a cycle.
245	if port and port.is_entry:	->L240	defensive — _entry_ports_through_junctions collects the entry ports a peel-off junction fan lands on. Each junction out-edge targets either another junction (consumed by the prior edge.target in junction_ids continue) or an entry port; no junction fans directly to a station or exit port across the corpus. The non-entry arm is therefore a structural-contract guard never reached.
283	if not src or not tgt:	->L284	defensive — _build_section_adjacency iterates graph.edges; every edge endpoint is a registered station, so graph.stations.get never returns None for edge.source or edge.target. The continue is a defensive null guard no valid graph reaches.
297	if entry and entry.section_id and entry.section_id != src.section_id:	->L293	defensive — _build_section_adjacency records a section successor reached through a peel-off junction. entry_id comes from _entry_ports_through_junctions, which returns only registered entry-port stations, so graph.stations.get(entry_id) is always present and carries a section_id. The only un-exercised arm is entry.section_id == src.section_id — a junction fanning back into its own source section — which a resolved peel-off fan never produces. Defensive structural-contract guard.
323	if not section:	->L324	defensive — _propagate_reversal_along_rows iterates sec_id values drawn from reversed_secs, which only ever holds real section ids added from graph.sections. graph.sections.get(sec_id) is never None; the continue is a defensive null guard.
334	if not succ:	->L335	defensive — succ_id comes from sec_successors, built only from real tgt.section_id values, so graph.sections.get(succ_id) is never None and the continue (->187) is a defensive null guard. The fall-through static arm (->188) is phantom: control falls into the following multi-line if (, whose first operand line carries the real arc L186->189.
338	or (sec_id, succ_id) in horizontal_succ_pairs	->L330
390	if not src:	->L391	defensive — _section_fed_by_tb_lr_exit iterates edges feeding a LEFT/RIGHT entry port; edge.source is always a registered station, so graph.stations.get is never None. Defensive null guard.
396	if not s2 or not s2.is_port:	->L397	defensive — Junction look-through: s2 is the source of an edge feeding a fold junction. Junctions are synthetic resolution nodes fed only by exit ports or upstream junctions (both is_port=True), so s2 is always present and port-like. The continue is a structural-contract guard no valid topology reaches.
403	elif src.is_port:	->L388	defensive — Edge feeding a LEFT/RIGHT entry port whose source is not a junction; src is then always an exit port (is_port=True), because resolved chains feed entry ports only from exit ports or junctions. The elif is always true, so the implicit fall-through to the loop (->223) is a structural-contract guard no valid topology reaches.

seam.py

5/6 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
75	if feeder is None or consumer is None:	->L76

tb_handlers.py

16/20 gates fully exercised.

Gates with an un-exercised arm:

Line	Gate	Un-exercised arm(s)	Triage
156	if diag_end < diag_start:	->L157	defensive — Degenerate-collapse clamp for an ascending diagonal: fires only when the run is shorter than 2*MIN_STRAIGHT_EDGE (20px). Every caller feeds grid-placed station coordinates whose run-axis separation is at least one grid pitch (Y_SPACING=40 / X_SPACING=60); _route_entry_runway additionally pre-guards with room < src_min + diagonal_run. The 20px collapse threshold is never reached.
162	if diag_end > diag_start:	->L163	defensive — Descending-run mirror of the ascending collapse clamp (#1 of if diag_end < diag_start:): fires only when |run| < 2*MIN_STRAIGHT_EDGE (20px), but connected diagonal endpoints are always >= one grid pitch (40/60px) apart on the run axis. Unreachable degenerate-geometry guard.
372	if tgt_sec is not None and tgt_sec.direction not in ("TB", "BT"):	->L376	defensive — Perp-entry drop crossing-X override: the edge’s target is always a sectioned station, so tgt_sec resolves and the tgt_sec is None short-circuit to the plain drop is never taken; the direction in (TB, BT) arm (a drop continuing into a vertical-flow trunk) and the horizontal-target arm are both exercised.
374	if crossing_x is not None:	->L376	defensive — Pair of context.py::if not indices: - the helper returns None only when no bundled feeder reaches the port, but a horizontal-flow section taking a perpendicular entry is always fed by a bundled inter-section edge, so crossing_x resolves. The crossing_x-is-None fall-through is a defensive guard, never taken across the corpus.