---
title: "Routing gate coverage matrix"
description: Coverage matrix tracking which routing families have invariant gate-arm tests and their current pass/fail status.
sidebar:
  label: "Routing gate coverage"
  order: 5
---

# Routing gate coverage matrix

Auto-generated by `scripts/routing_gate_coverage.py` under CPython 3.11 with `PYTHONHASHSEED=0` (the arc model is interpreter-specific and operand-level coverage is hash-seed sensitive). Do not edit by hand; run the script to regenerate.

Each row is a branch point (a *gate*) in a `layout/routing/` dispatch handler or post-pass. A gate has two or more arms; the cells list how many corpus fixtures exercise each arm. An arm reached by **0 fixtures** is an un-exercised gate arm: either no shipped topology takes that path (author a fixture, or confirm it is defensive/dead).

**895/1221** gates fully exercised (both/all arms hit by some fixture); **326** gates have at least one un-exercised arm.

Modules scoped to routing decision gates; `invariants.py` (the `validate=True` checker) and `__init__.py` are excluded.

The Triage column carries a curated verdict for gaps no fixture can close: **defensive** (a guard arm a valid topology never violates), **candidate-dead** (no constructible topology reaches it; left in place pending a separate deletion review), or **needs-review** (not yet classified). A blank cell means the gap is still open for a fixture. **247** gaps carry a triage verdict.

## `arranger.py`

1/1 gates fully exercised.

All gates have every arm exercised by the corpus.

## `bundle.py`

5/10 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 51 | `if abs(dx) > COORD_TOLERANCE and abs(dy) > COORD_TOLERANCE:` | `->L52` |  |
| 111 | `if n_legs < 1:` | `->L112` | **defensive** -- Defensive guard: build_concentric_bundle rejects a centreline of fewer than two vertices. Every caller (route_along / route_straight and the handler centrelines) builds a >=2-vertex polyline, so the raise arm is never taken. |
| 181 | `if n_legs < 1:` | `->L182` | **defensive** -- Defensive guard: build_tapered_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken. |
| 183 | `if not 0 <= transition_leg <= n_legs:` | `->L184` | **defensive** -- Defensive guard: build_tapered_bundle rejects a transition_leg outside [0, n_legs]. Handlers pass a literal 1 against a 3- or 4-vertex centreline, so the raise arm is never taken. |
| 245 | `if n_legs < 1:` | `->L246` | **defensive** -- Defensive guard: build_offset_bundle rejects a centreline of fewer than two vertices, mirroring build_concentric_bundle and build_tapered_bundle. Every caller passes a >=2-vertex centreline, so the raise arm is never taken. |

## `centrelines.py`

5/5 gates fully exercised.

All gates have every arm exercised by the corpus.

## `common.py`

88/124 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 219 | `if not secs:` | `->L220` | **defensive** -- row_bottom_edge empty-result guard: every caller passes a grid row (optionally col-filtered) that contains the routed source/target section after layout, so the section list is never empty; the default-return arm is a guard valid layouts never take. |
| 245 | `if top is None or bottom is None:` | `->L246` | **defensive** -- Defensive in iter_inter_row_gaps (consumed by inter_row_gap_upper_row and _inter_row_gap_band): adjacent rows in the sorted section-row set both contain sections, so row_bottom_edge / row_top_edge resolve; the None skip arm guards a row with no sections that the iteration never yields. |
| 379 | `if not facing:` | `->L380` |  |
| 391 | `if s.bbox_h <= 0:` | `->L392` | **defensive** -- Degenerate-bbox guard in _grid_row_bands: a laid-out section always has bbox_h > 0, so the skip arm only protects against a zero/negative-height section that the layout never produces. |
| 438 | `if right > left and left - tol <= x <= right + tol:` | `->L439` |  |
| 490 | `if n == 0:` | `->L491` | **defensive** -- Empty-bundle guard: all callers (normalize.py 291/1648, inter_section_handlers.py 783/796/2132) derive bundle_widths from a non-empty bundle line count, so n is always >=1; the empty-list arm is never taken. |
| 492 | `if bundle_index < 0 or bundle_index >= n:` | `->L493` | **defensive** -- Contract guard raising IndexError on an out-of-range bundle_index. Callers always pass an in-range index (0<=i<n); the raise arm fires only on a caller-contract violation no valid call produces. |
| 731 | `if abs(pts[k - 1][0] - x0) > COORD_TOLERANCE:` | `->L732` | **defensive** -- Interior horizontal segments only occur in 6-point bypass U-shapes whose flanking legs are always vertical (same x on each side); routes with non-vertical flanks are normalize_exempt and filtered out. The prev-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 733 | `if abs(pts[k + 2][0] - x1) > COORD_TOLERANCE:` | `->L734` | **defensive** -- Mirror of the prev-flank guard: a bypass trunk's trailing flank is always vertical, so the next-flank-non-vertical reject in iter_horizontal_trunks is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 764 | `if abs(y4 - y3) > COORD_TOLERANCE or abs(x4 - x3) <= COORD_TOLERANCE:` | `->L765` | **defensive** -- Trunk-not-horizontal guard in port_peeloff_tail, reached only after the earlier port-lead and riser checks returned early. In an orthogonal route segments alternate H/V, so the segment preceding a vertical riser is always horizontal; instrumenting the corpus the guard is reached but the non-horizontal-trunk arm never fires. Defensive against a degenerate collinear tail the router does not produce. |
| 838 | `if trunk_ys[-1] - trunk_ys[0] <= COORD_TOLERANCE:` | `->L839` | **needs-review** -- Degenerate single-Y trunk band in iter_port_peeloff_bundles: a peel-off bundle is yielded only when its members ride trunks at distinct depths, so the equal-depth arm guards a same-Y bundle the trunk-slot materialization never leaves; render-diff confirms no visual change. |
| 843 | `if len(signs) != 1:` | `->L844` | **defensive** -- Mixed-peel-end guard in iter_port_peeloff_bundles: a concentric peel-off bundle into a LEFT entry port is always fed from the left, so every member's trunk traverses toward the peel corner with the same trunk_sign. Lines approaching from the right of the port form an entry-wrap route, not a peel-off tail (verified: a right-side source produces zero peel tails), so the bundle never mixes signs. Belt-and-suspenders beyond the contiguity check. |
| 946 | `if not src or not tgt:` | `->L947` | **defensive** -- Null-endpoint guard: the parser creates a Station for every edge endpoint, so graph.stations.get() never returns None for a real edge; the continue arm only guards a malformed graph. |
| 1008 | `elif tgt_sec:` | `->L1016` | **defensive** -- The else (col_key=round(sx)) needs an L-shaped (dx!=0,dy!=0) inter edge whose target resolves to no section. Only exit_port->junction edges lack a target section, and junction positioning makes those axis-aligned (same-X RIGHT exit or same-Y BOTTOM exit), never L-shaped, so the else is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1103 | `if dx > 0:` | `->L1106` | **defensive** -- Leftward (dx<=0) near-source fallback: the symmetric mirror of the rightward fallback. Reached only when section info is unavailable AND no adjacent column resolves; valid layouts take the rightward fallback, but the leftward mirror is kept for robustness. |
| 1114 | `if st is not None and st.is_port:` | `->L1112` | **defensive** -- Null/non-port guard: after _resolve_sections both endpoints of an inter-section edge are ports/junctions and graph.stations.get() resolves them, so the False (None or non-port) arm only guards a malformed pre-resolve graph. |
| 1156 | `if sec.bbox_w <= 0:` | `->L1157` | **defensive** -- Zero-width-section guard: the loop scans all graph.sections, but after compute_layout every placed section has bbox_w>0, so the skip arm only guards an empty/unplaced section that valid layouts don't produce. |
| 1206 | `if src and not src.is_port:` | `->L1204` | **defensive** -- Null/port-source guard: edges to an exit port always originate at an internal (non-port) station after _resolve_sections, so the continue arm (None or port source) only guards a malformed pre-resolve graph. |
| 1222 | `for i in range(len(pts) - 1):` | `->L1223`, `->L1239` | **defensive** -- point_on_polyline is used only by the --animate renderer (render/animate.py); the matrix's render-path coverage sweep calls render_svg without animation, so none of its branches are reached. Exercised instead by test_animation.py / test_routing.py. |
| 1227 | `if seg_len2 == 0:` | `->L1228`, `->L1231` | **defensive** -- point_on_polyline degenerate-segment branch, reached only via the --animate renderer (render/animate.py); the render-path coverage sweep doesn't animate. Exercised by test_animation.py / test_routing.py, not the corpus. |
| 1228 | `if abs(point[0] - ax) <= tol and abs(point[1] - ay) <= tol:` | `->L1229`, `->L1230` | **defensive** -- point_on_polyline zero-length-segment hit test, reached only via the --animate renderer; the render-path coverage sweep doesn't animate. Exercised by test_animation.py / test_routing.py. |
| 1232 | `if t < -0.01 or t > 1.01:` | `->L1233`, `->L1234` | **defensive** -- point_on_polyline parameter-range branch, reached only via the --animate renderer; the render-path coverage sweep doesn't animate. Exercised by test_animation.py / test_routing.py. |
| 1237 | `if abs(point[0] - proj_x) <= tol and abs(point[1] - proj_y) <= tol:` | `->L1222`, `->L1238` | **defensive** -- point_on_polyline projection hit test, reached only via the --animate renderer; the render-path coverage sweep doesn't animate. Exercised by test_animation.py / test_routing.py. |
| 1299 | `if all_in_range:` | `->L1301` | **defensive** -- cross_row bypass guard: the False arm (no sections in the column range -> return clearance) needs an empty [lo,hi] column span, which a valid multi-section pipeline routing cross_row never has; a degenerate-range guard. |
| 1324 | `if endpoints:` | `->L1327` | **defensive** -- Non-cross_row bypass guard: the endpoints list always includes the source and target sections (both in src_row), so it is never empty; the default-clearance arm only guards a degenerate empty endpoint set. |
| 1337 | `if src_row is not None:` | `->L1349` | **defensive** -- Header-clamp guard: the False arm (src_row is None) needs an unresolvable source section, but inter-section bypass sources always resolve to a grid row after layout; a guard against an unresolved source that doesn't occur. |
| 1419 | `if station is None:` | `->L1420` | **defensive** -- None-station guard: every production caller passes a concrete Station (grep-verified); the None arm only guards the typed Station\|None parameter. |
| 1425 | `for e in graph.edges_to(station.id):` | `->L1447` | **defensive** -- Upstream edges_to loop-exit: every fan-out junction is emitted with an exit_port->junction edge whose source carries the source section id, so the upstream loop always returns; the fall-through to the type-contract return None is the never-taken no-upstream fallback. |
| 1427 | `if other and other.section_id:` | `->L1425` | **defensive** -- edges_to upstream guard: a junction's incoming neighbour is always an exit_port with section_id set, so the False (continue) arm only guards a junction-to-junction edge that valid construction never produces. |
| 1429 | `if sec:` | `->L1425` | **defensive** -- edges_to section-lookup guard: graph.sections.get(section_id) returning None requires a section_id absent from graph.sections, a corrupted state no valid parse produces; null-guard. |
| 1435 | `for e in graph.edges:` | `->L1447` | **defensive** -- No-preference graph.edges scan loop-exit: a fan-out junction always has a sectioned incident port (its exit/entry ports carry a section_id), so the loop always returns and never exhausts graph.edges; the fall-through to the type-contract return None is the never-taken no-neighbour fallback. |
| 1437 | `if e.source == station.id:` | `->L1438` | **defensive** -- Junction-as-source arm of the no-preference scan: fan-out junctions are emitted exit_port->junction before junction->entry_port, so graph.edges encounters the junction as a target (elif arm) first and returns; the source arm is a cheap structural guard whose deadness rests on emit order, not a hard type invariant. |
| 1443 | `if other and other.section_id:` | `->L1435` | **defensive** -- prefer_upstream=False neighbour guard: a junction's neighbours are always sectioned ports, so the False (continue) arm only guards a junction-to-junction edge valid construction never produces. |
| 1445 | `if sec:` | `->L1435` | **defensive** -- prefer_upstream=False section-lookup guard: graph.sections.get(section_id) returning None requires a missing section_id (corrupted state); null-guard. |
| 1510 | `if dy > 0:` | `->L1515` | **defensive** -- Multi-row upward-crossing arm: grid rows are assigned topologically and upward inter-section routes take other handlers (a same-row/around-section path), never reaching inter_row_channel_y's multi-row branch with dy<=0; verified by an upward multi-row fixture that bypasses this code. |
| 1520 | `if dy > 0:` | `->L1521` | **defensive** -- Near-target fallback block, gated behind the L801 resolve guard: since every call resolves to different-row sections (see that entry), the fallback is never reached, so neither dy arm fires. |

## `context.py`

66/106 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 127 | `if succ_port and succ_port.is_entry:` | `->L121` | **defensive** -- A merge junction is defined as one whose single successor is the section entry port it was inserted before, so succ_port is always a present entry port; the reject arm (successor absent or non-entry) never fires. |
| 136 | `if st is None:` | `->L137` | **defensive** -- _col_for_id looks up junction and predecessor IDs that are always present in graph.stations; the missing-station early-return never fires. |
| 142 | `if not mst:` | `->L143` | **defensive** -- mjid ranges over junctions, a subset of junction_ids all present in graph.stations; the missing-station continue never fires. |
| 145 | `if tgt_col is None:` | `->L146` | **defensive** -- A merge junction always resolves to a grid column (it sits adjacent to its entry-port section); the unresolved-column continue never fires. |
| 149 | `for e in graph.edges_from(mjid):` | `->L163` | **defensive** -- The entry-port search finds the merge junction's sole entry-port successor on the first edge and breaks (real exit arc 139->147), so the loop never runs to exhaustion and the for-completion arm never fires. |
| 151 | `if ep and ep.is_entry:` | `->L149` | **defensive** -- The merge junction's only outgoing edge targets its entry port, so the first iteration matches and breaks; the loop-back arm (a non-entry edge before the entry port) never fires. |
| 168 | `if not pred:` | `->L169` | **defensive** -- edge.source for an edge into the junction is always a present station; the missing-predecessor continue never fires. |
| 212 | `if m_col is not None:` | `->L222` | **defensive** -- Reached only for junctions in trunk_source, which by construction resolved a column, so m_col is never None and the no-column skip arm never fires. |
| 225 | `if ep and ep.is_entry:` | `->L223` | **defensive** -- Same merge-junction invariant in the skip-edge pass: the junction's lone successor is its entry port, so the loop-back over a non-entry edge never fires. |
| 229 | `if m_col is not None:` | `->L204` | **defensive** -- As the first occurrence, in the index-exclude pass: a trunk-source junction always has a resolved column, so the no-column skip arm never fires. |
| 339 | `for e in graph.edges:` | `->L340`, `->L342` | **defensive** -- In the public compute_junction_fan_info, called only from _guard_fan_bundles_coincide_or_separate (a validate=True guard). The coverage sweep renders with validate=False, so this function never runs on the render path; it is exercised by the layout-invariant test surface instead. |
| 367 | `if port_st is None:` | `->L368` | **defensive** -- Ports listed in a section's entry_ports/exit_ports always have a backing station; the missing-station continue never fires. |
| 380 | `if ctx.station_offsets:` | `->L382` | **defensive** -- compute_station_offsets returns a 0.0 entry for every (station, line) of any graph with edges, so the render path always passes a non-empty dict; the falsy-return arm guards only the route_edges(station_offsets=None) call path used by tests, which the sweep never exercises. |
| 387 | `if not ctx.station_offsets:` | `->L388` | **defensive** -- Pairs with _get_offset's guard: compute_station_offsets is never empty on the render path, so _max_offset_at's early-return arm guards only the route_edges(station_offsets=None) call path used by tests. |
| 435 | `if port.section_id is None:` | `->L436`, `->L437` |  |
| 467 | `for pid in section.entry_ports:` | `->L468`, `->L470` |  |
| 468 | `if line_id in graph.station_lines(pid):` | `->L467`, `->L469` |  |
| 496 | `if port is not None:` | `->L497`, `->L500` |  |
| 501 | `for sid in section.station_ids:` | `->L502`, `->L506` |  |
| 503 | `if not station.is_port:` | `->L501`, `->L504` |  |
| 525 | `if section is None:` | `->L526` |  |
| 534 | `if sec and sec.grid_col >= 0:` | `->L536` | **defensive** -- After section placement every resolved section carries a non-negative grid_col, so the None-return for an unplaced/missing column never fires. |
| 542 | `if sec and sec.grid_row >= 0:` | `->L544` | **defensive** -- After section placement every resolved section carries a non-negative grid_row, so the None-return for an unplaced/missing row never fires. |
| 556 | `if sec is None:` | `->L557` | **defensive** -- _resolve_section_colrow is called for ports/junctions that always resolve to a section; the None-section early-return never fires (mirrors the grid-sentinel guards at L395/L403). |
| 596 | `if psec is None:` | `->L597` |  |
| 608 | `if _has_intervening_sections(` | `->L598` |  |
| 641 | `if psec is None or pst is None:` | `->L642` |  |
| 692 | `if len(sources) != 1:` | `->L693` |  |
| 695 | `if jst is None:` | `->L696` |  |
| 698 | `if src_col is None or src_row is None:` | `->L699` |  |
| 706 | `if tgt is None or not (tgt.is_port or edge.target in graph.junction_ids):` | `->L707` |  |
| 712 | `if tcol is None or trow is None:` | `->L713` |  |
| 722 | `if len(reach) < 2:` | `->L723` |  |
| 736 | `if len({d > 0 for d in drow.values()}) != 1:` | `->L737` |  |
| 782 | `if not src or not tgt:` | `->L783` | **defensive** -- Edge endpoints are always present stations; the missing-endpoint continue never fires. |
| 876 | `if not jst:` | `->L877` | **defensive** -- jid ranges over junction_ids, all present in graph.stations; the missing-station continue never fires. |
| 879 | `if src_col is None:` | `->L880` | **defensive** -- A fan-out junction always resolves to a grid column; the unresolved-column continue never fires. |
| 917 | `if not tgt or not (tgt.is_port or edge.target in junction_ids):` | `->L918` | **defensive** -- A junction's outgoing inter-section edges always target a port or another junction (junctions are synthesised only on exit-port -> entry-port chains); the skip arm for a plain-station target never fires. |
| 920 | `if tgt_col is None:` | `->L921` | **defensive** -- A junction's port/junction target always resolves to a grid column; the unresolved-column continue never fires. |
| 1023 | `if edge.line_id in line_pos:` | `->L1022` | **defensive** -- line_pos is built from the line IDs of the very all_outgoing list this loop iterates, so the membership test is always true: the reject/loop-back arm (L684) is an unreachable tautology and the enter-body static arc (L686) is a phantom of the real 685->687. Vestigial tautological guard. The deliberate gap is pinned by test_genuine_dead_arm_not_masked_as_covered (arc normalization must not merge the never-taken branch onto the live one). Reclassified defensive (#762). |

## `core.py`

12/14 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 178 | `if not src or not tgt:` | `->L179` | **defensive** -- Main edge-loop guard against a missing endpoint station. After section resolution every edge endpoint exists in graph.stations (parse _ensure_station's all referenced nodes; resolved chains insert their own ports/junctions), so the guard never fires and only the proceed-to-routing arm is reachable. |
| 191 | `if result is not None:` | `->L170` | **defensive** -- Append-guard after the priority-ordered handler chain. The final handler _route_intra_section is total: its three early returns and its _route_diagonal fallback (annotated -> RoutedPath, single return statement) always yield a RoutedPath, so result is never None and every edge appends. The None arm is unreachable. |

## `corners.py`

10/10 gates fully exercised.

All gates have every arm exercised by the corpus.

## `inter_section.py`

0/4 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 98 | `if pair not in _CW_TURNS and pair not in _CCW_TURNS:` | `->L-96`, `->L99` | **defensive** -- Corner.__post_init__ turn-validity check. inter_section.py is the descriptor/documentation module (distinct from inter_section_handlers.py); no src module imports it, so it never loads during the render-corpus sweep (confirmed absent from sys.modules after rendering the whole corpus) and both arms show 0 hits. Corner instances are module-level constants built from valid right-angle turns, so the raise can only fire on a source edit. Exercised by test_inter_section_descriptor.py. |
| 107 | `if (self.in_tangent, self.out_tangent) in _CW_TURNS:` | `->L108`, `->L109` | **defensive** -- Corner.handedness property. Same module-load story: inter_section.py is never imported on the render path, so neither the CW nor the CCW arm is reachable by any render topology. Both branches are exercised by test_inter_section_descriptor.py. |
| 155 | `for prev, curr in zip(self.corners, self.corners[1:]):` | `->L156`, `->L158` | **defensive** -- TurnSequence.parity loop over consecutive corners. parity is descriptor-level documentation (runtime wrap handlers preserve bundle ordering via per-corner offset propagation regardless of this value); nothing on the render path reads it, and the module is never imported during the sweep. Exercised by test_inter_section_descriptor.py. |
| 156 | `if prev.handedness != curr.handedness:` | `->L155`, `->L157` | **defensive** -- Handedness-change counter inside TurnSequence.parity. Off the render path for the same reason (inter_section.py never loaded during rendering); both arms are exercised by test_inter_section_descriptor.py's parity-contract tests. |

## `inter_section_handlers.py`

85/139 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 438 | `if f.horizontal is Direction.L:` | `->L441` | **defensive** -- Near-vertical same-column junction channel push: the junction always sits right of its same-column LEFT entry, so horizontal is always Direction.L; the Direction.R arm never fires (#762). Defensive. |
| 477 | `and f.src_row is not None` | `->L490` | **defensive** -- LEFT-entry inter-row L-shape guard. Every LEFT-entry inter-section edge reaching this condition has a resolved source grid row (f.src_col/f.tgt_col are asserted non-None just above and the row resolves alongside), so the `f.src_row is None` short-circuit out of the L-shape branch is never taken. |
| 478 | `and f.tgt_row is not None` | `->L490` | **defensive** -- Companion guard to f.src_row in the same LEFT-entry inter-row L-shape condition: the target grid row is likewise always resolved here, so the `f.tgt_row is None` short-circuit out of the branch is never taken. |
| 500 | `if section and section.bbox_w > 0:` | `->L502` |  |
| 508 | `if section and section.bbox_w > 0:` | `->L510` |  |
| 534 | `if _v_segment_crosses_other_section(graph, corner_x, src.y, ey, exclude):` | `->L535` | **defensive** -- Drop-in viability test in _right_entry_drop_in_is_clear (#889). The cross-row RIGHT-entry rule fires only when the earlier bypass / plough rules ceded the edge, i.e. no section sits between source and port, so the outward-side descent runs clear; the not-clear arm covers only an exotic descent blocked by a wide same-column sibling no corpus fixture builds. Defensive. |
| 640 | `if min(drop_xs) < _section_right_edge(graph, tgt) - COORD_TOLERANCE:` | `->L641` |  |
| 643 | `if _v_segment_crosses_other_section(graph, dx, src.y, tgt.y, exclude):` | `->L644` |  |
| 684 | `if route is not None:` | `->L686` |  |
| 732 | `if src_col is not None and src_col > 0:` | `->L736` |  |
| 769 | `if route is not None:` | `->L772` |  |
| 840 | `if _corridor_is_viable(ctx, src, tgt):` | `->L841` | **needs-review** -- Reachable only via a defective render (inter-row corridor grazes the source section); see #722. |
| 866 | `if abs(ep.y - f.sy) < ctx.curve_radius:` | `->L867` | **defensive** -- Merge entry-port Y tracks the source/junction Y, so a sub-curve_radius exit->entry gap never arises (the same-Y rule already handles dy<tol); corpus instrumentation across the fixtures (#762) confirms the arm is never taken. Defensive. |
| 869 | `if ep_port and ep_port.side == PortSide.LEFT:` | `->L875` | **defensive** -- Contract guard in _route_inter_section: a merge entry port always resolves to a Port on the LEFT side here, so the non-LEFT/None arm (fall through to _route_l_shape at L344) is never taken (0/128). The earlier 'multiline phantom' note was inaccurate -- this is a recorded gate whose arm is never taken. Defensive guard. Reclassified defensive (#762). |
| 872 | `if _corridor_is_viable(ctx, src, ep):` | `->L874` | **needs-review** -- Reachable only via a defective render (route skirts/crosses section boundary); see #724. |
| 1322 | `if ctx.station_offsets:` | `->L1324` | **defensive** -- _run_pass_c_guards always populates ctx.station_offsets before route_edges, and RAILS mode returns earlier; the empty-offsets arm never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1370 | `if sx >= (left_edge + right_edge) / 2:` | `->L1373` | **defensive** -- Defensive symmetry: a merge feeder junction sits in the inter-column gap downstream of its fork, i.e. right of its source section's centre, so the exit-right arm always fires in the corpus. The exit-left arm mirrors it for a junction sitting left of centre; no fixture places a merge feeder there. |
| 1411 | `if src is None or tgt is None:` | `->L1412` | **defensive** -- Endpoint lookup guard in _would_route_around_section_below; every edge endpoint is a registered station after parse+resolve, so graph.stations.get never returns None here. Defensive. |
| 1448 | `if _would_route_around_section_below(other, ctx):` | `->L1449` | **defensive** -- Competing-sibling detection in _has_around_section_sibling, routed through the dispatch table (#813). A non-bypass sibling feeding the same merge junction sits in an adjacent column or a gap with no same-row intervening section, so it dispatches to an L-shape, not the around-below loop; corpus instrumentation across the fixtures confirms the arm is never taken. Defensive. |
| 1754 | `if trunk_v_up_pull_away:` | `->L1763` | **needs-review** -- Reachable only via a defective render (merge-junction tangle); see #721. |
| 1793 | `this_xmin - gap_left >= SECTION_ROUTE_CLEARANCE` | `->L1794`, `->L1797` |  |
| 1794 | `and gap_right - around_xmax >= SECTION_ROUTE_CLEARANCE` | `->L1796`, `->L1797` |  |
| 1873 | `if src_sec is not None and src_sec.bbox_w > 0:` | `->L1921` | **defensive** -- A bypass source section always resolves and has bbox_w>0 (the parser never emits an empty section); the None/zero-width arm never fires. |
| 1981 | `if route is None:` | `->L1982` |  |
| 2009 | `if route is None:` | `->L2010` | **defensive** -- Defensive in _declare_trunk: _route_inter_section only reaches the declaration after a matched rule (or the L-shape fall-through) produced a route, so the None guard never fires on the corpus; it mirrors _declare_channel's same guard for a handler that returns None. |
| 2178 | `while cur is not None and cur not in seen:` | `->L2194` |  |
| 2184 | `if port.side == PortSide.LEFT:` | `->L2185` |  |
| 2187 | `if cur in graph.junctions:` | `->L2193` |  |
| 2235 | `if (` | `->L2241` |  |
| 2478 | `and src_sec is not None` | `->L2497` | **defensive** -- Inter-row exit mid-Y clearance bump (the n>1 multi-line branch). When more than one line shares the exit the source section always resolves, so the `src_sec is None` short-circuit past the clearance bump is never taken. |
| 2479 | `and tgt_sec is not None` | `->L2497` | **defensive** -- Companion to src_sec in the same n>1 mid-Y clearance branch: the target section always resolves there, so the `tgt_sec is None` short-circuit past the bump is never taken. |
| 2501 | `elif abs(dx) > ctx.curve_radius:` | `->L2502` |  |
| 2505 | `if src.id in ctx.graph.junctions:` | `->L2515` | **needs-review** -- Reachable only via a defective render (LR->TB TOP-entry routing); see #720. |
| 2506 | `for je in ctx.graph.edges_to(src.id):` | `->L2515` |  |
| 2508 | `if js and js.is_port:` | `->L2506` | **needs-review** -- Reachable only via a defective render (LR->TB TOP-entry routing); see #720. |
| 2509 | `if abs(js.x - src.x) <= COORD_TOLERANCE:` | `->L2512` |  |
| 2793 | `if tgt_col is not None:` | `->L2798` | **defensive** -- tgt_col from _resolve_section_col on a valid LEFT entry port is always non-None (sections get grid_col>=0 after auto-layout). |
| 2795 | `if shared_vx is not None:` | `->L2798` | **defensive** -- _fan_left_entry_descent_x returns None only when col_left<=0; col_left_edge for the target's own column is always >0. |
| 2828 | `if entry_port is None:` | `->L2829` | **defensive** -- _route_around_section_below is always called with a non-None entry_port (both dispatch sites pass a checked station). |
| 2839 | `if trunk_src is None or trunk_src == edge.source:` | `->L2841` | **needs-review** -- Reachable only via a defective render (merge-junction tangle); see #721. |
| 2858 | `if gap_right <= gap_left:` | `->L2859` | **defensive** -- The column-gap enforcer keeps inter-column gaps positive, so gap_right>gap_left always holds at the target row. |
| 2885 | `if col_left <= 0.0:` | `->L2886` | **defensive** -- col_left_edge's 0.0 default only fires for a column with no sections; the target's own column always holds its section. |
| 2901 | `if tgt is None:` | `->L2902` | **defensive** -- Edge targets are always registered stations after resolve; the None arm never fires. |
| 2924 | `if entry_port is None:` | `->L2925` | **defensive** -- Every caller of _corridor_is_viable passes a non-None entry_port. |
| 2927 | `if ep_port is None or ep_port.side != PortSide.LEFT:` | `->L2928` | **needs-review** -- Reachable only via a defective render (route skirts/crosses section boundary); see #724. |
| 2931 | `if src_row is None or ep_row is None or src_col is None or ep_col is None:` | `->L2932` | **defensive** -- _resolve_section_colrow returns (None,None) only for a station with no section; valid entry ports always have a section with non-negative grid coords. |
| 3018 | `if fan is not None:` | `->L3026` | **needs-review** -- Reachable only via a defective render (inter-row corridor on a <78px gap); see #722. |
| 3026 | `elif gap_bottom > gap_top:` | `->L3027`, `->L3029` | **needs-review** -- Reachable only via a defective render (inter-row corridor on a <78px gap); see #722. |
| 3034 | `if fan is None and gap_bottom > gap_top:` | `->L3035` | **needs-review** -- Reachable only via a defective render (inter-row corridor on a <78px gap); see #722. |
| 3045 | `if fan is not None and ep_col is not None:` | `->L3047` | **needs-review** -- Reachable only via a defective render (inter-row corridor on a <78px gap); see #722. |
| 3047 | `if vx is None:` | `->L3048` | **needs-review** -- Reachable only via a defective render (inter-row corridor on a <78px gap); see #722. |
| 3160 | `if ep_section and ep_section.bbox_w > 0:` | `->L3163` | **defensive** -- entry_port.section_id is always set and the section has bbox_w>0 after layout; the else arm never fires. |
| 3402 | `if not _inter_row_band_fits(gap_top, gap_bottom):` | `->L3403` | **defensive** -- Band-fit test in _right_entry_gap_above_is_clear (#889), reached only when the cross-row RIGHT-entry drop-in is not clear (the exotic blocked-descent case above). The corpus always takes the drop-in, so neither arm of the gap-above fallback is exercised. Defensive. |
| 3482 | `if not normalize_exempt:` | `->L3486` |  |

## `intra_handlers.py`

32/42 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 77 | `if not section:` | `->L78` | **defensive** -- _route_entry_runway only runs on an entry-port -> internal-station edge; the target of such an edge always carries a section_id that resolves, so the guard's return-None arm protects against a malformed graph rather than a topology. |
| 84 | `if section.direction == "RL" and port.side != PortSide.RIGHT:` | `->L85` |  |
| 86 | `if section.direction not in ("LR", "RL"):` | `->L87` | **defensive** -- No TB/BT entry reaches _route_entry_runway: TB LEFT/RIGHT entries are consumed by _route_tb_lr_entry and TB/BT TOP/BOTTOM entries by _route_perp_entry (both earlier in the dispatch chain), and a BT section is never produced (the direction directive accepts only LR/RL/TB; 0/391 corpus sections are BT). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 103 | `if not st or st.is_port:` | `->L104` | **defensive** -- The loop already skips edge.target and every id in section.port_ids, so a surviving id resolves to a non-port internal station; the not-st / is_port re-check is belt-and-suspenders against a port absent from port_ids. |
| 108 | `elif section.direction == "RL" and tx < st.x < sx:` | `->L109` |  |
| 109 | `if first_x is None or st.x > first_x:` | `->L99`, `->L110` |  |
| 122 | `if room < src_min + ctx.diagonal_run:` | `->L123` | **defensive** -- The entry-runway 'too tight' return cannot fire: room = \|first_x - entry_port_x\| is floored at SECTION_X_PADDING (50px, the entry port sits at section.bbox_x = min(internal_station_x) - SECTION_X_PADDING), while the threshold src_min + diagonal_run = CURVE_RADIUS(10) + MIN_STRAIGHT_PORT(5) + DIAGONAL_RUN(30) = 45px. Since 50 >= 45 the guard is always False; SECTION_X_PADDING is not exposed as a directive. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 157 | `if not (tgt.x - src.x <= 0 and abs(dy) > CROSS_ROW_THRESHOLD and not same_section):` | `->L159` | **defensive** -- _route_fold_edge: the not-same_section precondition is never satisfied at the intra-section handlers, so the fold (False) arm is never taken: cross-section edges are consumed by _route_inter_section upstream (0/391 corpus fixtures reach this branch with differing sections), and a sectionless flat graph's serpentine fold is routed before this handler too (verified: a flat fold over the threshold does not reach the arm). The cross-row fold branch is shadowed. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 312 | `if abs(tgt.x - src.x) >= COORD_TOLERANCE:` | `->L314` | **defensive** -- _route_near_zero_gap_straight: a same-section, non-TB intra edge with \|tgt.x - src.x\| < COORD_TOLERANCE (1px) and non-zero dy is not constructible, so the straight-return (False) arm is never taken: layering assigns increasing X along edges so the minimum \|dx\| at _route_intra_section across the corpus is 50px (port spacing / off-track output lead). TB same-track edges that could reach \|dx\|=0 are intercepted by _route_tb_internal before this handler. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 380 | `if not (same_sec or is_exit_port):` | `->L381` | **defensive** -- _is_side_branch_ascent reaches this classification (44/391 corpus fixtures) but no fixture takes the reject arm: a target sitting within offset_step*2 of the source section's trunk Y is always a same-section internal station or that section's exit port. The arm needs a target at the source's trunk Y that belongs to a different section or is a non-exit port, which the trunk-alignment geometry does not produce. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |

## `normalize.py`

133/183 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 103 | `if s.bbox_w <= 0:` | `->L104` | **defensive** -- Degenerate-bbox guard in _section_intrudes: a laid-out section always has bbox_w > 0; the skip arm guards a zero/negative-width section the layout never produces. |
| 187 | `if right <= left:` | `->L188` |  |
| 190 | `for k, x, y_lo, y_hi, seg_down in iter_vertical_segments(rp):` | `->L193` |  |
| 222 | `if ch is not None:` | `->L220` |  |
| 228 | `if gap_right <= gap_left:` | `->L229` |  |
| 345 | `go is not None` | `->L351` |  |
| 346 | `and gt is not None` | `->L351` |  |
| 383 | `if len(pts) < 2:` | `->L384` |  |
| 401 | `if abs(x3 - x2) > COORD_TOLERANCE or abs(y3 - y2) <= COORD_TOLERANCE:` | `->L402` | **defensive** -- Every non-exempt inter-section route ends with a vertical descent into the target Y then a short horizontal port lead (V->H tail); routes with non-V tails are normalize_exempt. The second-to-last-not-vertical reject in _final_port_approach is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 579 | `if rp.curve_radii is None:` | `->L580` | **defensive** -- curve_radii is always a concrete list for inter-section routes (every inter-section handler sets it); the None arm in _set_vchannel_x is a belt-and-suspenders guard. |
| 582 | `if 0 <= radius_idx < len(rp.curve_radii):` | `->L581` | **defensive** -- Bounds guard in _set_vchannel_x: radius_idx in (k-1, k) for a real channel stays in range; the out-of-range skip arm is defensive. |
| 672 | `if rp is None:` | `->L673` | **defensive** -- Defensive guard: every merge feeder edge is routed, so the by-key lookup in _merge_feeder_groups always resolves; the skip arm is never taken. |
| 679 | `if trunk_rp is None or trunk_src_st is None:` | `->L680` | **defensive** -- Defensive guard in _merge_feeder_groups: a merge with a trunk_source always has a routed trunk edge and a resolvable trunk station, so the skip arm is never taken. |
| 682 | `if trunk_ch is None:` | `->L683` | **defensive** -- Defensive guard: the merge trunk route opens horizontal-then-vertical (lead into the gap, then descend), so its initial fan-out descent is always found; the skip arm is never taken. |
| 691 | `if ch is None:` | `->L692` | **defensive** -- Defensive guard: a merge branch route opens horizontal-then-vertical (lead, then descent onto the trunk channel), so its initial fan-out descent is always found; the skip arm is never taken. |
| 806 | `elif far_y < t.y - COORD_TOLERANCE:` | `->L800` | **defensive** -- Degenerate-leg guard in _trunk_slot_features: a trunk's flanking legs are genuine vertical legs (far_y differs from the trunk y), so neither the below nor the above classification is skipped; the fall-through arm needs a zero-height leg the layout never produces. |
| 836 | `if feats is None:` | `->L837` | **defensive** -- Unused default-arg branch: all three callers of _band_order_crossings pass feats explicitly, so the feats-is-None compute-it arm is never taken. |
| 995 | `if len(trunks) < 2:` | `->L996`, `->L997` | **defensive** -- Early-return in _suboptimal_trunk_bands, called only from the _guard_* validator (phases/guards.py) and a unit test, never on the production render path. The coverage sweep renders with validate=False, so neither arm registers. Defensive (exercised via the validate=True guard / test surface; cf. #728 validate-only precedent). |
| 999 | `for grp in groups:` | `->L1000`, `->L1018` | **defensive** -- _suboptimal_trunk_bands diagnostic loop: validate-only, not reached by the render-path coverage sweep (see the len(trunks)<2 note). |
| 1000 | `if len({id(t.route) for t in grp}) < 2:` | `->L1001`, `->L1002` | **defensive** -- Single-route-group skip in _suboptimal_trunk_bands, validate-only: called from the _guard_* validator and a unit test, not the production render path the validate=False sweep exercises. Defensive. |
| 1002 | `if not any(not t.route.normalize_exempt for t in grp):` | `->L1003`, `->L1004` | **defensive** -- _suboptimal_trunk_bands diagnostic guard: validate-only, not on the render path. |
| 1004 | `for sign in (1, -1):` | `->L999`, `->L1005` | **defensive** -- _suboptimal_trunk_bands direction loop: validate-only, not on the render path. |
| 1007 | `if len(slots) < 2 or len(slots) > _MAX_BAND_PERMUTE:` | `->L1008`, `->L1009` | **defensive** -- _suboptimal_trunk_bands slot-count guard: validate-only, not on the render path. |
| 1016 | `if best < cur:` | `->L1004`, `->L1017` | **defensive** -- _suboptimal_trunk_bands crossing-comparison: validate-only, not on the render path. |
| 1150 | `if band is not None:` | `->L1156` | **defensive** -- Same-line dogleg: the band-found arm is exercised by dogleg_exempt_sameline; the band-is-None arm is defensive (both colliding trunks route through _center_inter_row_channel, so the trunk Y always resolves to a gap band). |
| 1171 | `if down_ok and up_ok and (cross_down is None) != (cross_up is None):` | `->L1173` | **defensive** -- Same-line dogleg side selection. The crossing-decided true arm (->1297, pick the side whose riser does not pierce the exempt run) is exercised by dogleg_exempt_sameline. The false fall-through (->1298) needs either an out-of-band side or a crossing-equal tie, neither reachable by a clean topology: the reachable dogleg regime rigidly fixes the inter-row band so down_room/up_room stay >= min_sep=6 (observed 14/26 across the corpus and every constructed variant; perturbing the grid loses the regime), and the only realizable tie is both-cross (a crossing-free tie needs degenerate zero-length exempt risers) which co-occurs with section-crossing / dogleg-crosses-exempt guard failures and is never a shippable render. |
| 1173 | `elif down_ok and (not up_ok or prefer_down):` | `->L1174`, `->L1175` | **defensive** -- Same-line dogleg tie / out-of-band fallback, reached only after the L1296 if is false, which a clean topology never produces (see that gate): the true arm (->1299, lean down on a tie) needs a crossing-free tie that requires degenerate risers, and the false arm (->1300) needs down_ok False, which the regime's fixed inter-row band (down_room >= min_sep) never yields. |
| 1175 | `elif up_ok:` | `->L1176`, `->L1178` | **defensive** -- Same-line dogleg move-up / give-up fallback, reached only when both L1296 and L1298 are false. The true arm (->1301, move up because the lower gap is too tight) needs down_ok False and the else arm (->1303, leave fused) needs both rooms below min_sep; the reachable regime's inter-row band is auto-widened so both rooms stay >= min_sep=6 (observed 14/26), so neither is reached by a valid topology. |
| 1201 | `if band is not None:` | `->L1206` | **defensive** -- Distinct-line dogleg: the band-found arm (->1327) is exercised by dogleg_exempt_distinct (#702). The remaining band-is-None arm (->1331) is defensive: a trunk reaching this second loop collides with an exempt bypass obstacle that lives in an inter-row gap, so _inter_row_gap_band(ctx, t.y) always resolves to a band - the same mechanism already accepted for the sibling 'if band is not None:::#1'. |
| 1216 | `if below_ok and above_ok and (cross_below is None) != (cross_above is None):` | `->L1218` | **defensive** -- Distinct-line dogleg side selection. The crossing-decided true arm (->1342) is exercised by dogleg_exempt_distinct. The false fall-through (->1343) needs a crossing-equal tie; a crossing-free tie requires degenerate zero-length exempt risers and the only realizable tie is both-cross, which trips _guard_no_dogleg_crosses_exempt_trunk plus the section-crossing guards and is never a shippable render. |
| 1218 | `elif below_ok and (not above_ok or prefer_below):` | `->L1219`, `->L1220` | **defensive** -- Distinct-line dogleg tie fallback, reached only after L1341 is false (a tie), which a clean topology never produces (see that gate). The true arm (->1344, lean below) would fire on such a tie; the false arm (->1345) is unreachable because below_ok always holds and prefer_below is always true (t.y == hit.y in this regime). |
| 1220 | `elif above_ok:` | `->L1221`, `->L1223` | **defensive** -- Distinct-line dogleg move-up/skip branch: unreachable because the below branch is always taken (t.y == hit.y, below_ok true); covers both the move-up and the gap-too-tight continue. |
| 1243 | `if sg[0].sign_x != t.sign_x:` | `->L1244` | **defensive** -- Both callers of _coincident_trunk_slots pre-filter input to a single traversal direction (band = [t for t in grp if t.sign_x == sign]), so within the function sg[0].sign_x != t.sign_x is always False; the opposing-direction continue is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1274 | `if rp.curve_radii is None:` | `->L1275` | **defensive** -- curve_radii is always set for inter-section routes; the None arm in _restack_htrunk is a defensive guard. |
| 1286 | `if 0 <= k - 1 < len(rp.curve_radii):` | `->L1288` | **defensive** -- Bounds guard in _restack_htrunk: trunk index k >= 1 so k-1 >= 0 is always in range; the skip arm is defensive. |
| 1288 | `if k < len(rp.curve_radii) and k + 2 < len(pts):` | `->L-1253` | **defensive** -- Bounds guard in _restack_htrunk: for a real interior trunk k and k+2 are in range; the skip arm is defensive. |
| 1349 | `if down is None or len(up.points) < 2:` | `->L1350` | **defensive** -- Every line entering a fan-out junction also exits it to an entry port, so _fanout_route_maps always pairs a downstream route for each (jid, line_id) upstream; all handlers emit >=2-point routes. The skip arm in _join_fanout_upstream_tails is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1396 | `if col is None:` | `->L1397` | **defensive** -- Defensive guard in _convergence_line_order: a peel-off riser channel always resolves to a source-section column, so the unresolved-column early return is never taken on the corpus. |
| 1437 | `if not 0 <= far < len(pts):` | `->L1438` |  |
| 1440 | `if abs(dx) > COORD_TOLERANCE:` | `->L1434` |  |
| 1442 | `if not votes:` | `->L1443` |  |
| 1548 | `if rep_x[a] != rep_x[b]:` | `->L1550` | **defensive** -- The routing system assigns distinct x offsets to every line sharing a column gap, so two distinct lines in one gap-bundle corridor never share a representative x; the equal-rep_x tiebreak fall-through in _distinct_line_order is unreachable (exhaustive corpus scan confirms). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1585 | `if rp.curve_radii is None:` | `->L1586` | **defensive** -- curve_radii is always set for inter-section routes; the None arm in _restack_channel is a defensive guard. |
| 1596 | `if 0 <= k - 1 < len(rp.curve_radii):` | `->L1598` | **defensive** -- Bounds guard in _restack_channel: the skip arm fires only for k==0 (channel at the route start), which the restacked gap channels (interior verticals after a horizontal lead-in) never are. |
| 1598 | `if k < len(rp.curve_radii) and k + 2 < len(pts):` | `->L1608` | **defensive** -- Bounds guard in _restack_channel: the skip arm guards k or k+2 out of range for a real interior channel; defensive. |
| 1610 | `if abs(ly - pts[1][1]) < COORD_TOLERANCE:` | `->L-1555` | **defensive** -- A re-stacked gap channel at points-index 1 always has a horizontal lead-in (L-shape and bypass routes open with a horizontal segment); routes opening non-horizontally are normalize_exempt and skipped by the materialization. The non-horizontal-lead return in _restack_channel is unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1672 | `for _ in range(8):` | `->L1697` | **defensive** -- The 8-iteration exhaustion arm of _clear_channel_x_in_band requires 9+ sections chained across a single column band to shift the channel x eight times without resolving, which no constructible topology produces. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1693 | `elif right_ok:` | `->L1696` | **defensive** -- The both-bounds-fail return of _clear_channel_x_in_band requires a blocking section spanning the entire inter-column gap (so neither cleared edge fits within bound_left/bound_right); a cross-row section cannot span a gap defined as the space between same-row sections. Unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1721 | `if s.bbox_w <= 0:` | `->L1722` | **defensive** -- Degenerate-bbox guard in _h_segment_crosses_other_section: mirror of the bbox_w<=0 guard; sections always have positive width. |
| 1754 | `if s.bbox_w <= 0:` | `->L1755` | **defensive** -- Degenerate-bbox guard in _v_segment_crosses_other_section: mirror of the _h_segment_crosses_other_section guard; sections always have positive width. |

## `offsets.py`

282/362 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 81 | `if edge.target in inbound:` | `->L83` | **defensive** -- inbound is pre-built as {sid: set() for sid in graph.stations}, so every station id in the graph is a key. All edge endpoints are guaranteed to be in graph.stations after parsing (regular nodes via register_station, ports via add_port->add_station, junctions via add_station), so edge.target is always found in inbound and the False branch (54->56) is never taken. |
| 83 | `if edge.source in outbound:` | `->L80` | **defensive** -- outbound is pre-built from graph.stations keys identically to inbound. All edge sources are registered stations by construction (regular nodes, ports, junctions), so edge.source is always found in outbound and the False branch (56->53) is never taken. |
| 120 | `if not src or not tgt:` | `->L121` | **defensive** -- _build_same_y_adj calls graph.stations.get(edge.source/target). All edge endpoints are registered stations after _resolve_sections (regular nodes, ports, junctions all go through add_station), so both .get() calls always return non-None Station objects and the `if not src or not tgt` branch is never taken. |
| 322 | `if ordered != expected:` | `->L323` | **defensive** -- The raise arm of _assert_sections_anchored_on_trunk, a backstop on the postcondition of _reindex_section_local: an independent section (no flat-frame neighbour) always lands on the contiguous top-anchored levels 0,step,...,(m-1)*step by construction, so the mismatch arm never fires across the corpus. It guards against a future change that stops re-anchoring such a section. |
| 365 | `while cur is not None and cur not in seen:` | `->L374` |  |
| 400 | `if slot is None:` | `->L401` |  |
| 413 | `if neighbour is None:` | `->L414` |  |
| 505 | `if not src:` | `->L506` | **defensive** -- _section_line_feeders calls graph.stations.get(edge.source) for edges feeding an entry port. All edge sources are registered stations after _resolve_sections (exit ports, junctions, and merge junctions are all added via add_station), so .get() always returns a non-None Station and `if not src` is never True. |
| 539 | `if reverse:` | `->L540` | **needs-review** -- Reachable only on a reconvergence section that is also a serpentine fold, where the fold corner crosses lines mid-curve and the return-row bundle sits one offset too low (#705). Exercise with a clean fixture once #705 is fixed. |
| 570 | `if section is None:` | `->L571` |  |
| 594 | `if not all(lid in feeder_off for lid in continuing):` | `->L595` |  |
| 602 | `if lid in new_off:` | `->L601` |  |
| 624 | `if section is not None:` | `->L622` |  |
| 626 | `if len(set(feeder_row.values())) < 2:` | `->L627` |  |
| 644 | `for pid in section.entry_ports:` | `->L654` |  |
| 646 | `if entry_port is None:` | `->L647` |  |
| 648 | `for edge in graph.edges_to(pid):` | `->L644` |  |
| 689 | `if seam is None:` | `->L690` |  |
| 711 | `if not all(lid in feeder_off for lid in primary_lines):` | `->L712` |  |
| 760 | `if new_order is None:` | `->L763` |  |
| 839 | `while stack:` | `->L853` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 841 | `if cur in seen:` | `->L842` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 845 | `if e.line_id != lid:` | `->L846` |  |
| 851 | `if src and not src.is_port and src.section_id == sec_id:` | `->L844` | **defensive** -- The false arm fires when an edge source is an internal station (not a port) whose section_id differs from sec_id. After _resolve_sections(), all inter-section edges run through port stations; no direct edge from an internal station of section A to an internal station of section B exists. DFS back-walk via edges_to() from within a section can only reach: (a) entry ports (return True), (b) same-section internal stations (pushed), or (c) other-section ports (is_port=True, skipped by `port and port.is_entry` check). Cross-section internal stations are structurally unreachable via direct edges after resolution. |
| 937 | `if not target_id:` | `->L938` | **defensive** -- An exit-only line at station sid is identified by being present in station_lines(sid) but absent from ctx.inbound[sid]. station_lines() returns lines appearing in any edge whose source or target is sid. For a line to be exit-only at sid, it must appear in at least one outbound edge from sid; otherwise it would not appear in station_lines(sid) at all. If an outbound edge exists, outbound_target[(sid, lid)] is always set, so target_id is never None when execution reaches L422. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 940 | `if not target_st:` | `->L941` | **defensive** -- After parse and layout, every edge target ID in a MetroGraph maps to a station in graph.stations. The guard protects against a structurally malformed graph where an edge references a nonexistent station ID, which cannot occur with valid .mmd input processed through the parser and _resolve_sections(). |
| 957 | `for other in lines:` | `->L965` | **defensive** -- In _reorder_one_exit_line, the loop over `lines` always finds the swap partner: desired_off is the min or max of all_offs, which by construction is held by another line, so the loop-exhausted-without-match arm is never taken (0/128). Defensive. Reclassified defensive (#762). |
| 965 | `if swap_lid is None:` | `->L966` | **defensive** -- In _reorder_one_exit_line, swap_lid is None only if the loop over `lines` exhausts without a match, but desired_off (min or max of all_offs) is always held by another line, so the early-return guard never fires (0/128). Defensive. Reclassified defensive (#762). |
| 1010 | `if (cur_sid, cur_lid) in visited:` | `->L1011` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 1022 | `if abs(nbr_cur - new_off) < _OFFSET_EQ_TOLERANCE:` | `->L1023` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 1029 | `if len(nbr_lines) < 2:` | `->L1033` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 1033 | `for other_lid in nbr_lines:` | `->L1015`, `->L1034` | **needs-review** -- In the exit-only-line reorder / same-Y offset propagation; reachable only via a multi-line LR/RL section with a perpendicular (TOP/BOTTOM) exit port, which the engine lays out as a station-as-elbow + collinear overlay PhaseInvariantError (#706). Exercise with a clean fixture once #706 is fixed. |
| 1034 | `if other_lid == cur_lid:` | `->L1035`, `->L1036` | **defensive** -- Inside _propagate_offset_swap's same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the loop body (incl. this self-skip guard) never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762). |
| 1036 | `if (` | `->L1033`, `->L1040` | **defensive** -- Inside _propagate_offset_swap's same-Y collision-swap block: across the corpus no same-Y adjacent multi-line neighbour needs an offset swap, so the inner collision check never executes (0/128). Defensive guard for a same-Y multi-line offset collision absent from current topologies. Reclassified defensive (#762). |
| 1044 | `if max_steps <= 0:` | `->L1045` | **defensive** -- max_steps = len(graph.stations) * len(graph.lines). Each BFS iteration dequeues one (station, line) pair and marks it visited; visited pairs are skipped on re-encounter. The number of distinct (station, line) pairs is bounded by \|stations\| * \|lines\|, so the BFS can perform at most that many productive steps before the queue empties. The `while queue and max_steps > 0` condition therefore always exits via the queue-empty branch; max_steps reaches zero only if more productive steps occur than unique pairs, which is impossible in a finite graph. |
| 1072 | `if lid not in seen:` | `->L1069` | **defensive** -- The iterator at L554 is `sorted(set(sec_entry_lines), ...)`. The outer `set()` deduplicates the list before iteration, so each `lid` appears exactly once and `seen` never contains it when processed. The false arm (lid already in seen) is logically unreachable — the dedup happens at set construction, making the `seen` guard dead code. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1163 | `if src_st and not src_st.is_port:` | `->L1161` | **defensive** -- In `_rewrite_edges_with_junctions` (resolve.py L594), edges to exit ports are always created as `Edge(source=edge.source, target=exit_port_id)` where `edge.source` is the original inter-section edge's source — an internal section station, not a port. So `src_st` is never None and `src_st.is_port` is always False. The false arm cannot be taken by any valid parsed graph. |
| 1167 | `if internal_offs:` | `->L1155` | **defensive** -- Exit ports are only created when inter-section edges exist (resolve.py `_create_port_stations` iterates `exit_group_edges` which is populated only from actual edges). Every TB LEFT/RIGHT exit port therefore has at least one edge from an internal station, so `internal_offs` is never empty when the loop is entered. The false arm is a defensive guard against an impossible empty-feeder state. |
| 1201 | `if src_st and not src_st.is_port:` | `->L1199` | **defensive** -- Same invariant as L602: edges to LR/RL exit ports are always from internal (non-port) stations, created by `_rewrite_edges_with_junctions` (resolve.py L594-595). The false arm (`src_st` is None or `src_st.is_port`) cannot be taken by any valid parsed graph. |
| 1245 | `if trunk_feeder_id is not None:` | `->L1254` | **defensive** -- len(unique_ys) < 2 means every port line's feeder stations average to a single Y. Under track-per-line layout, distinct lines occupy distinct tracks, so a shared Y across >=2 lines implies one trunk feeder carrying all of them (trunk_feeder_id set); the no-trunk arm is therefore not reached by a track-separated topology. |
| 1279 | `if anchor_feeders:` | `->L1282` |  |
| 1304 | `if port_off is not None:` | `->L1302` | **defensive** -- _compute_base_offsets runs before _propagate_to_junctions and sets ctx.offsets[(sid, lid)] for every station-line pair in the graph; exit ports are stations, so ctx.offsets.get((exit_port_id, lid)) is never None for any lid in graph.station_lines(jid). The loop-back arm (714->712) requires a junction line with no exit-port offset, which base-offset initialization makes structurally impossible. |
| 1320 | `if port_st is None:` | `->L1321` |  |
| 1322 | `for edge in graph.edges_from(port_id):` | `->L1326` |  |
| 1324 | `if consumer is not None and not consumer.is_port:` | `->L1322` |  |
| 1396 | `if entry_section is None:` | `->L1397` | **defensive** -- Defensive null guard: every port in graph.ports is created by the resolver with a valid section_id, so graph.sections.get(port_obj.section_id) is never None at routing time. The continue branch is a safety net against a malformed port that no valid graph produces. |
| 1400 | `if not src or not src.is_port:` | `->L1401` | **defensive** -- In the resolved graph, all edges to entry ports come from either exit ports or junctions, both of which are is_port=True stations. A direct internal-station-to-entry-port edge does not exist after _resolve_sections rewrites inter-section edges into port-chain form. There is no valid topology where an edge to a TOP entry port has a source that is not a port. |
| 1448 | `if not src or not src.is_port:` | `->L1449` | **defensive** -- _propagate_lr_rl_exit_to_entry iterates edges_to(port_id) for LEFT/RIGHT entry ports. In the resolved graph, all edges to entry ports originate from exit ports or junctions, which are always is_port=True stations. A direct internal-station-to-entry-port edge does not exist after resolution. The true arm (775->776) requires a source that is not a station or not a port, which no valid resolved topology produces. |
| 1475 | `if paired_off is not None:` | `->L1473` | **defensive** -- _compute_base_offsets sets ctx.offsets[(sid, lid)] for every station-line pair before _propagate_lr_rl_exit_to_entry runs. Exit ports are stations. The for-loop at L791 iterates graph.station_lines(port_id) which equals graph.station_lines(exit_port_id) (enforced by the exit_lines != entry_lines guard at L788). For each lid, ctx.offsets.get((exit_port_id, lid)) is therefore never None. The loop-back arc (793,791) for the paired_off-is-None case is structurally unreachable. |
| 1481 | `if tgt_st and not tgt_st.is_port:` | `->L1479` | **defensive** -- edges_from(port_id) for an entry port yields edges to internal section stations. In the resolved graph, entry ports are connected directly to internal (non-port) stations; there are no entry-port-to-entry-port or entry-port-to-exit-port edges. So tgt_st is always a valid non-port station, and the loop-back arm (799->797) where tgt_st is None or is_port is unreachable for any valid resolved graph. |
| 1516 | `if entry.side not in (PortSide.LEFT, PortSide.RIGHT):` | `->L1517` | **defensive** -- In _align_flat_tb_exit_to_entry: scopes the flat-seam exit/entry reconciliation to horizontal (LEFT/RIGHT) entry ports, whose per-line offsets are Y like the TB exit's. A TOP/BOTTOM entry stores X-offsets, so copying across would be a category error. No corpus fixture routes a TB LEFT/RIGHT exit directly into a TOP/BOTTOM entry at the same Y, so the skip arm is never taken; defensive against that cross-axis seam. |
| 1524 | `if len(shared) < 2:` | `->L1525` | **defensive** -- In _align_flat_tb_exit_to_entry: scopes the flat-seam reconciliation to multi-line bundles, where a constant per-line offset delta means the lines share an order and only the bundle anchoring differs (the auto-folded serpentine case in #1198). A single shared line carries no bundle order to preserve and is left to the single-line corridor passes; no corpus fixture reaches the pass with fewer than two shared lines, so the skip arm is never taken. |
| 1628 | `if not sec_stations:` | `->L1629` | **defensive** -- The parser calls _remove_empty_sections() (resolve.py:26) which deletes any section whose station_ids list is empty before port creation. Ports are only added to station_ids during _create_port_stations() (resolve.py:527), which runs AFTER _remove_empty_sections(). Therefore every section in graph.sections at layout time has at least one non-port station; sec_stations is never empty. |
| 1659 | `if not any(` | `->L1662` | **defensive** -- The L920 check returns None when offsets are EXACTLY equal to expected (exact float ==). The L926 check returns None when differences are less than _OFFSET_EQ_TOLERANCE (0.001). Since all offsets are integer multiples of OFFSET_STEP (3.0px), any non-zero difference is exactly 3.0 or more, which is >> 0.001. So L920 catches exact matches and L926 can never catch a case L920 missed; the near-equal window (0,0.001) is unreachable with 3.0px discrete steps. |
| 1722 | `if graph.stations[peer_sid].is_hidden:` | `->L1723` | **defensive** -- For this arm to fire, the compaction BFS must arrive at a neighbor N whose same-layer peers include a hidden station (bypass-V or converge). Bypass-V stations get their layer from the predecessor P (P.layer+1), so a bypass-V at N.layer requires P at N.layer-1. But P must carry the bypassed line (not in the gap), while the gap seed must NOT carry that line. These constraints force P and the gap seed to be at the same layer (seed.layer = P.layer = N.layer-1) but connected through independent chains to N, a topologically exotic arrangement no standard mmd pattern produces. In all tested bypass+gap topologies, the bypass-V ends up co-layer with the gap seed, not with the BFS neighbor. |
| 1803 | `if max_steps <= 0:` | `->L1804` | **defensive** -- max_steps = n_sec_stations * len(graph.lines). The BFS visits each (station_id, line_id) pair at most once (the visited set at L1017 prevents revisits). The total distinct pairs is bounded by n_sec_stations * len(graph.lines) = max_steps. Since max_steps decrements by 1 per loop iteration and the loop exits when the queue is empty (naturally after at most max_steps unique visits), the condition max_steps <= 0 is never True; the while-loop guard already prevents the body from executing when the queue is empty. |
| 1817 | `if sec_a is None and id_a in graph.ports:` | `->L1818` | **defensive** -- The true arm requires sec_a is None AND id_a in graph.ports simultaneously. Junction stations (section_id=None) are added only via graph.add_junction() which calls graph.add_station() but NOT graph.add_port(). graph.add_port() (model.py:483) requires a Port object with a non-None section_id (Port.section_id is typed str, not Optional[str], per model.py:218). Therefore no station with section_id=None can ever be in graph.ports; the conjunction sec_a is None AND id_a in graph.ports is unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1819 | `if sec_b is None and id_b in graph.ports:` | `->L1820` | **defensive** -- Same argument as L1084: id_b in graph.ports requires the station to have been registered via graph.add_port(), which always supplies a non-None section_id for the created station. A station with section_id=None (sec_b is None) is a junction created by add_junction(), which never calls add_port(). The precondition sec_b is None AND id_b in graph.ports is therefore unsatisfiable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1882 | `if (tgt_id, lid) not in ctx.offsets:` | `->L1883` | **defensive** -- The True branch (missing entry-port offset -> ok=False) is unreachable because phase 7 (_compute_entry_port_offsets) runs before this function (phase 8a) and assigns an offset for every (entry_port_id, line_id) pair in the graph. By the time _align_junction_to_entry_port runs, ctx.offsets is populated for all entry ports, so the guard never fires. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1893 | `if all(` | `->L1898` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. The already-aligned arm (->1190) is exercised by the corpus; the body arm (->1192) is the reachable-but-defective one. |
| 1900 | `for edge in graph.edges_to(jid):` | `->L1901`, `->L1912` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. |
| 1902 | `if src_port and not src_port.is_entry:` | `->L1903`, `->L1909` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its else arm (->1203) is additionally defensive: the sole feeder of a >=2-line fan-out junction is its exit port, a non-entry port. |
| 1903 | `if feeding_exit is None:` | `->L1904`, `->L1905` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. |
| 1905 | `elif feeding_exit != edge.source:` | `->L1900`, `->L1906` | **defensive** -- This arm (single_exit=False due to multiple distinct exit ports feeding one junction) requires one junction to receive edges from two different exit ports. But _rewrite_edges_with_junctions in resolve.py creates exactly one junction per exit port fan-out, wired exclusively from that exit port's edges. A junction always has a single upstream exit port; the elif is structurally unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 1912 | `for lid, off in desired.items():` | `->L1913`, `->L1914` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. |
| 1914 | `if single_exit and feeding_exit is not None:` | `->L1853`, `->L1915` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its False arm (->1147) is additionally defensive: a >=2-line junction reaching this body is always a single-exit-port-fed fan-out junction (merge junctions carry one line and are skipped by len(j_lines)<2). |
| 1916 | `if exit_lines == set(j_lines):` | `->L1853`, `->L1917` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its lines-differ arm (->1147) is additionally defensive: a fan-out junction carries exactly its single exit port's fanned lines, so exit_lines == j_lines always. |
| 1918 | `if abs(exit_st.y - j_st.y) <= _SAME_Y_TOLERANCE:` | `->L1853`, `->L1919` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. Its Y-differs arm (->1147) is additionally defensive: only a BOTTOM-exit junction is offset in Y from its exit, but such a junction sits below the consumer row and never meets the body's all-entries-within-tolerance precondition. |
| 1919 | `for lid, off in desired.items():` | `->L1853`, `->L1920` | **defensive** -- Reaches the realignment body of _align_junction_to_entry_port only via a TB-reversed two-line bundle fanning into a junction (the #704 boundary fix is in, so this body is now provably reachable). The junction_entry_reversed_fold fixture now ships that topology; with the bundle order carried concentrically through the reversal corners the junction offsets already match their entry ports, so the realignment body short-circuits before its offset-writing arms and they stay un-exercised corpus-wide. Defensive. |
| 2079 | `if tgt_col is None:` | `->L2080` | **defensive** -- Defensive guard in _convergence_feeders: a LEFT entry port section always has a grid column after placement, so the unresolved-target-column early return is never taken. |
| 2085 | `if src is None:` | `->L2086` | **defensive** -- Defensive guard in _convergence_feeders: every edge feeding an entry port has a source station, so the missing-source early return is never taken. |
| 2088 | `if col is None:` | `->L2089` | **defensive** -- Defensive guard in _convergence_feeders: every edge feeding a LEFT entry port has a source whose section resolves to a grid column after placement, so the unresolved-source-column early return is never taken. |
| 2119 | `if feeders is None:` | `->L2120`, `->L2121` |  |
| 2136 | `sec is None` | `->L2140` | **defensive** -- Bypass-convergence LEFT-entry feeder scan: the loop only inspects existing LEFT entry ports, whose section always resolves, so the leading `sec is None` short-circuit that skips the port is never taken. |
| 2208 | `if src is None:` | `->L2209` |  |
| 2294 | `for _ in range(max_iterations):` | `->L-2266` | **defensive** -- _reconcile_horizontal_offsets iterates at most 10 times and breaks early when no change occurs. The arc L1338->(-1310) represents loop exhaustion without early-break (all 10 iterations consumed). On any valid parsed graph, the reconciliation converges in at most a handful of iterations because each iteration resolves at least one edge conflict or reaches a fixed point. The 10-iteration ceiling is a backstop against hypothetical oscillating graphs; normal topologies stabilize in 1-3 passes. |
| 2450 | `if dag is not None:` | `->L2458` |  |
| 2453 | `for succ in dag.successors.get(stack.pop(), ()):` | `->L2454` |  |
| 2454 | `if succ not in affected:` | `->L2453`, `->L2455` |  |
| 2463 | `if not offs:` | `->L2464` |  |

## `perp.py`

9/12 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 122 | `if not feeders:` | `->L123` | **defensive** -- No-feeder guard in _perp_entry_crossing_x: the helper is called only from _route_perp_entry when a multi-line bundle shares the port with a per-line stagger, and a TOP/BOTTOM entry port in that case is always reached by a bundled inter-section feeder (dy!=0, so compute_bundle_info indexes it).  The empty-feeders return-None arm is a contract guard, never taken across the corpus. |
| 154 | `if entry_port is None or not entry_port.is_entry:` | `->L155` | **defensive** -- _aligned_horizontal_drop_entry only fires for a TOP/BOTTOM exit on a horizontal-flow section (the rest of _perp_riser_lateral's callers are caught earlier).  The return-None arm is taken when such an exit feeds a junction or several targets rather than one entry port; corpus instrumentation across every examples/ fixture finds no horizontal-flow perp exit feeding a non-single-entry, so the arm is never taken and the riser falls back to the perp reflection. |
| 161 | `if needs_perp_approach_fan(graph, entry_port.id):` | `->L162` | **defensive** -- _aligned_horizontal_drop_entry exempts a distinct-line approach fan, whose intra drop fans onto per-line channels (_perp_approach_fan_x) rather than the entry's single per-line offset.  Reaching it needs a horizontal-flow perp exit dropping straight into a single approach-fan entry; corpus instrumentation finds none, so the arm is never taken and the riser keeps the perp reflection. |

## `postprocess.py`

85/102 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 65 | `if ctx.station_offsets is None:` | `->L66` | **defensive** -- Null guard in _spread_diagonal_bundles. compute_station_offsets returns a non-Optional dict and every render-path route_edges call passes it; the only caller leaving station_offsets at its None default is the validate-only _ensure_routes (guards.py), which the render sweep does not run. The early return never fires on a rendered topology, mirroring the matching assert in _apply_diagonal_spread. |
| 203 | `if abs(dx_diag) <= COORD_TOLERANCE_FINE:` | `->L204` | **defensive** -- Defensive guard: a near-vertical baked diagonal (dx_diag ~ 0) already separates near-fully along the baked X axis, so it needs no Y spread and the divide-by-dx_diag is skipped. No corpus fixture bakes a near-vertical diagonal, so the guard arm is never taken. |
| 422 | `if not is_fork_join and (` | `->L431` | **defensive** -- Enters the multi_diag block, which needs a non-fork-join station (<=1 distinct predecessor and successor) carrying both a 4-point diagonal and a 2-point flat incoming route. Raw route shape is a pure function of endpoint coordinates, so all lines on one edge share one shape: n_unique_in and n_unique_flat_in can never both be >=1 for a single-predecessor station, and n_unique_in/out are <=1 when not fork-join. multi_diag is unsatisfiable (0 of 6173 corpus calls). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 472 | `if multi_diag:` | `->L473` | **defensive** -- multi_diag branch of _flat_connects_to_internal_chain; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate at the same line text), so the function is only ever called with multi_diag False. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 473 | `if any(_is_chain_predecessor(graph, ctx, r.edge.source) for r in flat_in):` | `->L474`, `->L475` | **defensive** -- Inside the multi_diag block of _flat_connects_to_internal_chain, which is never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 475 | `if any(_is_internal_station(graph, r.edge.target) for r in flat_out):` | `->L476`, `->L477` | **defensive** -- Inside the multi_diag block of _flat_connects_to_internal_chain, never entered because multi_diag is structurally unsatisfiable. Both arms unreachable. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 518 | `if multi_diag:` | `->L519` | **defensive** -- multi_diag branch selecting the flat-segment X extent in _centering_candidate; multi_diag is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 530 | `if not multi_diag:` | `->L537` | **defensive** -- The skip-this-block arm fires only when multi_diag is True, which is structurally unsatisfiable (see the _classify_centering_routes gate). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 567 | `if in_rp and len(ctx.diag_out_targets.get(in_rp.edge.source, set())) > 1:` | `->L568` |  |
| 638 | `if not other or other.is_port or other.is_hidden:` | `->L639` | **defensive** -- Companion scan in _apply_station_moves iterates original_x, which holds only non-port stations, so `other` is never None and never a port (both operands unreachable); `other.is_hidden` is a coincidence guard skipping a hidden station that happens to share a moving station's column, which no corpus topology produces. |
| 642 | `if abs(other.y - station.y) > 1:` | `->L632` | **defensive** -- The loop-back arm (skip appending a column companion) fires only when another non-port station in the same section shares the moving station's x (within 1px) and its y (within 1px) - two near-coincident distinct stations, forbidden by the no-overlap invariant. |
| 685 | `if ox is None:` | `->L686` | **defensive** -- Null guard in _align_uncentered_siblings. The loop iterates visible non-port stations and original_x is built from every non-port station, so ox is always present; the guard never fires. |
| 712 | `if max(moved_xs) - min(moved_xs) <= 1.0:` | `->L713` | **defensive** -- Early-exit for the agree case: all movers land within 1px of each other. Unreachable for natural pipelines because the engine always seats one fan branch on the hub's trunk row, vetoing companion consensus for the whole column, so moved is empty and the outer guard fires first. |
| 718 | `if majority_count <= len(moved) / 2:` | `->L719` | **defensive** -- The no-clear-majority arm. Movers in a column either converge to one consensus x or sit off it only via hub/exit-port collinearity at a fixed >=20px quantum; the consensus cluster is always the strict majority, so majority_count is never <= half (0 of corpus, no probe topology reproduces a split). Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 725 | `if not outliers:` | `->L726` | **defensive** -- The no-outliers arm in the movers-disagree branch. Disagreement only arises from hub/exit-port collinearity at a >=20px quantum, never sub-pixel, so whenever spread exceeds 1px at least one mover rounds >1px from the majority x. outliers is never empty here. Reclassified candidate-dead -> defensive (#762): corpus instrumentation across 128 fixtures confirms the un-exercised arm is never taken. |
| 734 | `if abs(rp.points[0][0] - old_x) < STATION_MOVE_TOLERANCE:` | `->L733` | **defensive** -- Per-route anchor guard: only an outgoing route whose start sits at the dragged station's old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station (e.g. an L-shape or bypass leg not snapped by _apply_station_moves); dragged stations in the corpus only carry position-anchored routes, so it never fires. |
| 737 | `if abs(rp.points[-1][0] - old_x) < STATION_MOVE_TOLERANCE:` | `->L736` | **defensive** -- Per-route anchor guard: only an incoming route whose end sits at the dragged station's old x is re-pointed to the new x. The skip arm protects against re-pointing a route not anchored at the station; dragged stations in the corpus only carry position-anchored routes, so it never fires. |

## `rail.py`

16/24 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 49 | `if st is None:` | `->L50` | **defensive** -- _line_rail_y is only ever called with a real station id (on_rail.id, edge.source/target, or a sibling edge endpoint), all of which exist in graph.stations - the route loop pre-filters None endpoints at the src/tgt guard. The None arm is a contract guard no render-path call reaches. |
| 57 | `if line_id in section_rails:` | `->L60` | **defensive** -- The whole-graph rail connector routes port-to-port edges through _line_rail_y, exercising the in-rails arm. The fall-through (a port carrying a line absent from its own section's rail map) cannot occur: a port carries only lines its section's stations carry, all present in per_line_y. Defensive fallback. |
| 68 | `if line_id in served and len(st.rail_used_ys) == len(served):` | `->L70` | **defensive** -- Reached only for a non-port spanning station, whose rail_used_ys is station_lines_ordered filtered to the section's per_line_y - itself built from the same _section_lines_in_order. So a served line is always in per_line_y (lengths match) and _line_rail_y is only called with a line the touching edge carries (always served). The fall-through return st.y is a defensive fallback no render-path call reaches. |
| 99 | `if sib_rails:` | `->L104` | **defensive** -- _off_track_drop_order is only called for an off-track elbow edge that exists in graph.edges, so the feeder<->consumer set it scans always contains at least that edge; the empty-sib_rails arm (skip the mirror-corner reversal) is a contract guard no render-path call reaches. |
| 227 | `if exit_port.side is not PortSide.RIGHT or entry_port.side is not PortSide.LEFT:` | `->L228` | **defensive** -- Whole-graph rail mode stacks sections vertically and resolve.py always sides an inter-section edge as a RIGHT exit feeding a LEFT entry, so the early-return arm (an unmodelled side pairing) is a structural fallback no rail topology reaches. |
| 231 | `if up is None or down is None:` | `->L232` | **defensive** -- Null guard over the two ports' sections in the rail inter-section connector; a boundary port's section_id always resolves in graph.sections, so the early-return arm is a contract guard no render-path call reaches. |
| 325 | `if conn is not None:` | `->L321` | **defensive** -- Skips the straight-rail fallback when _route_inter_section_connector handled a port-to-port bundle. The connector returns a route for every whole-graph rail inter-section edge (always a RIGHT exit feeding a LEFT entry), so the None arm (fall through to straight-rail routing) is a structural fallback no rail topology reaches. |
| 334 | `if src is None or tgt is None:` | `->L335` | **defensive** -- Null guard over an edge's endpoints; every graph.edges endpoint exists in graph.stations, so the continue arm is a contract guard no render-path call reaches. |

## `reversal.py`

45/57 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 172 | `if not src or not src.is_port:` | `->L173` | **defensive** -- Phase 1a (_detect_tb_bottom_top_entries) iterates edges feeding a TOP entry port. Entry ports are synthetic nodes created by section resolution; the only edges targeting them are the resolved chain's exit_port->entry_port and junction->entry_port links, so edge.source is always a registered port or junction station (both is_port=True). The continue (missing or non-port source) is a structural-contract guard no valid topology reaches. |
| 200 | `if receiver not in reversed_secs:` | `->L199` | **defensive** -- BFS dedup guard in _detect_tb_bottom_top_entries: the False arm fires when a TB section is queued as a vertical receiver via two different positive_fan paths. The detection only registers a receiver when a BOTTOM exit PORT directly feeds a TOP entry port (edge.source is the exit port). A TB section reached by two upstream sections is fed through a fork/merge junction, so the edges into its TOP entry originate at the junction, not a port -- the detection skips them and the receiver is never queued twice. A diamond renders (examples/topologies/tb_bottom_exit_fork_diamond.mmd) but does not drive this arm. The guard is correct and necessary to prevent double-queueing and ensure BFS termination should a direct double-feed ever arise. |
| 237 | `if jid in seen:` | `->L238` | **defensive** -- Cycle guard in _entry_ports_through_junctions' junction walk. The True arm fires only if a junction is reached twice while walking out from one exit-port-fed junction (a junction reachable by two paths). Resolved peel-off fans are trees, so no junction is revisited and the arm is unreached; the guard keeps the walk terminating should chained junctions ever form a cycle. |
| 245 | `if port and port.is_entry:` | `->L240` | **defensive** -- _entry_ports_through_junctions collects the entry ports a peel-off junction fan lands on. Each junction out-edge targets either another junction (consumed by the prior `edge.target in junction_ids` continue) or an entry port; no junction fans directly to a station or exit port across the corpus. The non-entry arm is therefore a structural-contract guard never reached. |
| 283 | `if not src or not tgt:` | `->L284` | **defensive** -- _build_section_adjacency iterates graph.edges; every edge endpoint is a registered station, so graph.stations.get never returns None for edge.source or edge.target. The continue is a defensive null guard no valid graph reaches. |
| 297 | `if entry and entry.section_id and entry.section_id != src.section_id:` | `->L293` | **defensive** -- _build_section_adjacency records a section successor reached through a peel-off junction. entry_id comes from _entry_ports_through_junctions, which returns only registered entry-port stations, so graph.stations.get(entry_id) is always present and carries a section_id. The only un-exercised arm is entry.section_id == src.section_id -- a junction fanning back into its own source section -- which a resolved peel-off fan never produces. Defensive structural-contract guard. |
| 323 | `if not section:` | `->L324` | **defensive** -- _propagate_reversal_along_rows iterates sec_id values drawn from reversed_secs, which only ever holds real section ids added from graph.sections. graph.sections.get(sec_id) is never None; the continue is a defensive null guard. |
| 334 | `if not succ:` | `->L335` | **defensive** -- succ_id comes from sec_successors, built only from real tgt.section_id values, so graph.sections.get(succ_id) is never None and the continue (->187) is a defensive null guard. The fall-through static arm (->188) is phantom: control falls into the following multi-line `if (`, whose first operand line carries the real arc L186->189. |
| 338 | `or (sec_id, succ_id) in horizontal_succ_pairs` | `->L330` |  |
| 390 | `if not src:` | `->L391` | **defensive** -- _section_fed_by_tb_lr_exit iterates edges feeding a LEFT/RIGHT entry port; edge.source is always a registered station, so graph.stations.get is never None. Defensive null guard. |
| 396 | `if not s2 or not s2.is_port:` | `->L397` | **defensive** -- Junction look-through: s2 is the source of an edge feeding a fold junction. Junctions are synthetic resolution nodes fed only by exit ports or upstream junctions (both is_port=True), so s2 is always present and port-like. The continue is a structural-contract guard no valid topology reaches. |
| 403 | `elif src.is_port:` | `->L388` | **defensive** -- Edge feeding a LEFT/RIGHT entry port whose source is not a junction; src is then always an exit port (is_port=True), because resolved chains feed entry ports only from exit ports or junctions. The elif is always true, so the implicit fall-through to the loop (->223) is a structural-contract guard no valid topology reaches. |

## `seam.py`

5/6 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 75 | `if feeder is None or consumer is None:` | `->L76` |  |

## `tb_handlers.py`

16/20 gates fully exercised.

Gates with an un-exercised arm:

| Line | Gate | Un-exercised arm(s) | Triage |
| ---: | --- | --- | --- |
| 156 | `if diag_end < diag_start:` | `->L157` | **defensive** -- Degenerate-collapse clamp for an ascending diagonal: fires only when the run is shorter than 2*MIN_STRAIGHT_EDGE (20px). Every caller feeds grid-placed station coordinates whose run-axis separation is at least one grid pitch (Y_SPACING=40 / X_SPACING=60); _route_entry_runway additionally pre-guards with `room < src_min + diagonal_run`. The 20px collapse threshold is never reached. |
| 162 | `if diag_end > diag_start:` | `->L163` | **defensive** -- Descending-run mirror of the ascending collapse clamp (#1 of `if diag_end < diag_start:`): fires only when \|run\| < 2*MIN_STRAIGHT_EDGE (20px), but connected diagonal endpoints are always >= one grid pitch (40/60px) apart on the run axis. Unreachable degenerate-geometry guard. |
| 372 | `if tgt_sec is not None and tgt_sec.direction not in ("TB", "BT"):` | `->L376` | **defensive** -- Perp-entry drop crossing-X override: the edge's target is always a sectioned station, so tgt_sec resolves and the `tgt_sec is None` short-circuit to the plain drop is never taken; the `direction in (TB, BT)` arm (a drop continuing into a vertical-flow trunk) and the horizontal-target arm are both exercised. |
| 374 | `if crossing_x is not None:` | `->L376` | **defensive** -- Pair of context.py::if not indices: - the helper returns None only when no bundled feeder reaches the port, but a horizontal-flow section taking a perpendicular entry is always fed by a bundled inter-section edge, so crossing_x resolves.  The crossing_x-is-None fall-through is a defensive guard, never taken across the corpus. |
