SOTA 0.7: track `# pragma: no branch` exclusions for genuinely-unreachable defensive arcs

[anulum]

Context — SOTA 0.7 branch-coverage grind

The SOTA 0.7 initiative drives partial branch coverage to zero so that
[tool.coverage.run] branch = true can be flipped as a capstone (statements are
already 100%). The overwhelming majority of the 227 baseline partial branches are
closed with targeted tests. A small residue are genuinely unreachable defensive
branches that cannot be exercised by any legitimate input — validated enums,
upstream raise guards, platform invariants, and local tautologies. Those are
declared with # pragma: no branch and tracked here so the exclusion is auditable.

Each arc below was verified at source; the "why unreachable" is the exclusion
rationale, mirrored in the inline pragma reason.

Arcs excluded with # pragma: no branch

File	Line	Arc	Why the missing side is unreachable
core/ballooning_solver.py	145	145->153	for _ in range(20) natural exhaustion. alpha_min is validated >= 0 (line 127); amax = amin + 0.1 grows +0.2/iteration, so amax > 3.0 triggers the line-151 break by iteration ~14 — the loop can never exhaust all 20 iterations without breaking.
core/jax_solvers.py	397	397->399	if i < n - 1: with i in range(1, n - 1) — i maxes at n - 2, so the guard is always True; the False side (skip the super-diagonal assignment) is dead.
control/pulsed_scenario_scheduler_v2.py	352	352->exit	match self.state over PulsedScenarioState (a StrEnum with exactly 8 members, all matched by explicit cases, no wildcard). The fall-through past the final case COOL_DOWN requires a 9th state that cannot exist.
core/vmec_lite.py	423	423->427	if idx_00 >= 0: — idx_00 < 0 already raises at line 408, so idx_00 >= 0 is guaranteed here; the False side is dead.
core/vmec_lite.py	442	442->444	Same guarantee as line 423 (guarded by the line-408 raise).
core/gk_scheduler.py	159	159->168	elif strategy == "critical_region" closes an exhaustive if/elif chain over {"periodic", "adaptive", "critical_region"}, validated at construction (line 59 raises otherwise). The chain fall-through requires an invalid strategy that cannot survive construction.
core/runtime_admission.py	34	34->exit	_ResourceModule Protocol method body (def getrlimit(...) -> ...: ...) — a structural type stub that is never invoked at runtime; the def executes at class evaluation but the body arc is never taken.
core/runtime_admission.py	309	309->314	if hasattr(os, "sched_getaffinity"): — on the Linux coverage-gate platform os.sched_getaffinity always exists, so the True side is always taken. The False side is a genuine non-Linux (macOS/Windows) fallback, unreachable where coverage is enforced.
control/spi_mitigation.py	105	105->119	elif self.state == MitigationState.ARMED fall-through requires state == FIRED at update() entry. FIRED is set (line 107) and immediately overwritten to COOLDOWN (line 110) within the same call, and no other assignment leaves state == FIRED; init is IDLE. So update() is never entered with state == FIRED.
scpn/z3_model_checking.py	245	245->240	if response_window: — the window spans range(step + 1, deadline + 1) and is only reached when deadline < max_depth (line 242 continue otherwise); with max_latency_steps validated >= 1, deadline > step, so the window is always non-empty. The empty-window False side is dead.
scpn/z3_model_checking.py	611	611->617	if firing_terms: — firing_terms is derived from self.transition_names; a net that compiled through StochasticPetriNet.compile() always has >= 1 transition (compile raises otherwise), so the list is never empty. The False side is dead.
core/gyrokinetic_transport.py	325	325->loop	elif mt == 3: closes the exhaustive mt ∈ {1, 2, 3} chain (mt == 0 is filtered by the continue at line 293). When the == 1 and == 2 arms both fail, mt == 3 is guaranteed True; the mode-loop back-edge (a 4th mode) cannot occur.
cli_evidence_validators.py	203	203->213	elif isinstance(data_manifests, dict): — the value is always a dict: the skip-branch sets {"status": "skipped"} and validate_manifest_directory is typed -> dict[str, Any]. The isinstance is a mypy narrowing guard on the loosely-typed result mapping; its False side is dead.
cli_evidence_validators.py	216	216->220	Same guarantee: skip-branch dict or validate_jax_gk_parity -> dict[str, Any].
cli_evidence_validators.py	223	223->234	Same guarantee: skip-branch dict or validate_physics_traceability -> dict[str, Any].
cli_evidence_validators.py	237	237->248	Same guarantee: skip-branch dict or validate_multi_shot_campaign_evidence(...).as_dict() -> dict[str, Any].
cli_evidence_validators.py	251	251->260	Same guarantee: skip-branch dict or validate_runtime_admission_evidence(...).as_dict() -> dict[str, Any].
cli_evidence_validators.py	263	263->275	Same guarantee: skip-branch dict or validate_native_formal_certificate_evidence(...).as_dict(), which returns a dict literal.
control/free_boundary_tracking.py	670	670->672	if update_state: inside the not-ready latency branch. The sole caller (_observe_snapshot, line 710) passes update_state == allow_compensation == apply_latency; reaching line 669 requires allow_compensation True (else the line-665 guard returns early), so update_state is always True here. Consistent with the existing # pragma: no cover on the line-673 if not update_state: sibling.
core/integrated_transport_solver.py	884	884->895	if ped_idx < len(self.Te): — _ensure_valid_radial_grid (line 763) restores the canonical grid so rho[-1] == 1.0, and EPED delta_ped is contractually > 0 (_finite_scalar(..., positive=True)), so ped_start = 1 - delta_ped < 1.0 and searchsorted(rho, ped_start) < nr == len(self.Te) always. The pedestal-at/beyond-edge False side is dead.
core/neural_equilibrium.py	644	644->649	if hasattr(eq, "qpsi") and eq.qpsi is not None and len(eq.qpsi) > 0: — read_geqdsk reads qpsi as nw >= 1 values for any legitimate equilibrium (a radial grid always exists), so all three conjuncts hold. An empty qpsi would require a malformed non-equilibrium file; the False side is dead.
phase/ws_phase_stream.py	380	380->382	if counter is not None: in _audit_security_event — every one of the eight call sites passes an event that is a key of the counter map (origin_rejected, authentication_failed, capacity_rejected, payload_rejected, rate_limit_rejected, frame_rejected, action_rejected), so .get(event) never returns None. The unmapped-event False side is dead.
phase/ws_phase_stream.py	472	472->428	elif action == "stop": closes the exhaustive if/elif over {set_psi, set_pac_gamma, reset, stop}. allowed_actions is validated a subset of _KNOWN_ACTIONS (those four) at construction and the line-454 gate rejects anything else, so reaching the final elif guarantees action == "stop". The loop-back False side is dead.
control/torax_hybrid_loop.py	260	260->204	if beta_ref_sq: per episode — steps_per_episode is validated >= 32, and the disruption break needs streak_high_risk >= 3 (so k >= 2, after the k=0,1 appends), so beta_ref_sq always holds >= 2 entries. The empty-parity False side (skip to the next episode) is dead.
core/integrated_scenario.py	1355	1355->1362	if self._phase_omega is not None: in the phase-bridge block — _phase_omega is only ever assigned at init (None), set together with _phase_K_nm (line 1347), and updated (1356); it is never reset to None. When the phase-bridge block runs, omega is always non-None. The False side is dead.
core/integrated_scenario.py	939	939->952	if self.ts_solver.neoclassical_params is not None: — line 932 calls set_neoclassical, which unconditionally assigns self.neoclassical_params = {...} (integrated_transport_solver.py:521) on success (validation raises otherwise, never reaching 939), and nothing clears it before line 939. The params dict is always non-None here; the skip-update False side is dead.
core/integrated_scenario.py	1389	1389->1399	if event.rho_mix > 0: in the sawtooth crash block — the scenario builds SawtoothCycler with the default trigger_model="shear", whose trigger fires only when find_q1_radius(q) is not None (sawtooth.py:294-296); the same q then yields rho_mix > rho_1 > 0 in kadomtsev_crash (the interpolation branch requires psi_star[i-1] > 0, giving a positive fraction). A fired event always has rho_mix > 0; the False side is dead.
core/integrated_scenario.py	1391	1391->1399	if idx_mix > 1: — idx_mix <= 1 needs rho_mix <= rho[1] ~= 0.0204 (a q=1 surface in the first grid cell). The scenario derives q via q_from_psi(psi), which forces q[0] >= 1 for any psi whose target q has a steep near-axis gradient (numerically verified: q[0] in [1.35, 1.67] for steep monotonic targets), so find_q1_radius returns None and no first-cell crossing can fire; the shear trigger also needs shear = (dq/drho)(rho/q) > 0.1 at rho_1, requiring dq/drho > 5 near the axis, unrepresentable via q_from_psi. So idx_mix >= 2 always; the False side is dead.
core/fusion_kernel.py	1320	1320->1323	if I_seed > 0: — I_seed = sum(exp(-dist_sq/2)) * dR * dZ with strictly-positive summands and positive grid spacings, so I_seed > 0 always. The skip-normalisation False side is dead.
core/fusion_kernel.py	2501	2501->2505	if x_point_flux_target is not None: inside the x_point_target is not None block — when the X-point objective is enabled, _resolve_x_point_flux_target returns non-None (explicit target, derived separatrix, or the self_flux_tracking fallback via _interp_psi), so the guard is always True. The False side is dead (same invariant as the 2590 fallback pragma).
core/fusion_kernel.py	2595	2595->2597	if x_point_flux_target_used is not None: — set non-None at line 2480 whenever the resolved X-point flux target is non-None (always, per the 2501 invariant), so the guard is always True. The False side is dead.
core/fusion_kernel.py	2612	2612->2620	if divertor_flux_target_used is not None: — set non-None at line 2489 whenever _resolve_divertor_flux_targets returns a target (always when divertor strike points are configured; the self_flux_tracking fallback samples the flux), so the guard is always True. The False side is dead (same invariant as the 2607 fallback pragma).

Testable siblings closed in the same commit (NOT pragma'd)

• core/fusion_kernel.py 281->284 / 294->301 / 1277->1281 / 1513->1516 / 1553->1557 / 1818->1822 /
  2571->2575 / 2597->2599 / 2599->2602 / 2616->2620 — the small-grid X-point search skips the
  interior-border clearing; Hessian-less X-point selection falls back to the gradient minimum; the elliptic
  solve falls back to the CPU relaxation path when the HPC accelerator returns None; external-profile mode
  skips the plasma-source recompute in the Newton warmup/phase and the SOR Picard loop; and first-outer-iteration
  convergence (no fresh coil-current update) leaves each objective's final block on the
  currents_updated or not history False side. Covered by targeted tests.

• core/gk_scheduler.py 146->145 — budget exhaustion inside the chi_change
  loop (adaptive strategy, small budget, several large-Δχ surfaces). Covered by a
  targeted test.

• control/spi_mitigation.py 113->119 — ARMED hold in the mid-band
  threshold_arm*0.8 <= p_disrupt <= threshold_fire. Covered by a targeted test.

• cli_evidence_validators.py 92->99 / 93->92 — the import-hygiene loop runs
  to completion when matplotlib/torch/streamlit are all absent from
  sys.modules. Covered by an in-process test (the pre-existing subprocess variant
  is not traced in-process).

• cli_evidence_validators.py 302->304 — the release-evidence text output skips
  the SHA line when the report is unparseable (report_sha256 is None). Covered by
  a targeted test.

• cli_evidence_validators.py 452->458 / 456->458 — validate-rmse skips the
  report echo without --json-out, and with --json-out but no written report.
  Covered by targeted tests.

• control/free_boundary_tracking.py 522->532 / 702->709 / 1054->1045 /
  1059->1061 / 1215->1218 — optional-field-absent objective assembly (X-point
  target without flux target), EKF update skipped when no X-point objective yields a
  measurement, evaluate_objectives rejecting an unknown objective block, tolerances
  without shape_rms, and the response-refresh interval skipping intermediate
  identification. Covered by targeted tests.

• core/integrated_transport_solver.py 492->496 / 1273->exit — grid restoration
  skips the momentum-solver sync when none is configured (fresh solver, broken grid, no
  set_neoclassical); and map_profiles_to_2d skips current normalisation when the total
  toroidal current is <= 1e-9 (zero-density degenerate state → J_phi == 0, avoiding a
  divide-by-zero). Covered by targeted tests.

• core/neural_equilibrium.py 641->644 / 580->582 — the boundary-shape block is
  skipped for a GEQDSK with no boundary trace (nbdry=0 → empty rbdry → default elongation),
  and a passing reference report clears the fine-tune admission gate (control then falls
  through to the empty-paths guard). Covered by targeted tests.

• phase/ws_phase_stream.py 498->506 — _send_frame_or_dead keeps the client when the
  transport write-buffer is at or below the limit (no backpressure). Covered by a targeted
  async test.

• control/nmpc_controller.py 959->962 — _solve_qp_acados reuses the cached acados OCP
  and solver on a second solve instead of rebuilding them. Covered by extending the acados
  backend test with a second step.

• core/integrated_scenario.py 441->443 / 1262->1285 / 1344->1349 / 1401->1399 / 1447->1457 /
  1182->1121 — the mhd_stability module lane and the per-step ballooning/Troyon block are skipped when
  include_stability is False; the phase-bridge K_nm coupling is built once and reused on the second step; a
  sawtooth crash does not shrink an NTM island already wider than its seed; an inter-ELM H-mode step (the
  peeling-ballooning cycler reports no crash) skips the pedestal crash; and a sub-grid-cell NTM island above
  the flatten threshold spans <=1 grid point so no averaging is applied. Covered by targeted tests.

Batch 52 — last native-interop / physics-invariant arcs (SOTA 0.7 residual close-out)

• core/rust_engine.py 713->715 / 715->717 — the runtime-admission problem-collection
  isinstance(raw_errors, (list, tuple)) / isinstance(raw_warnings, (list, tuple)) guards.
  collect_runtime_admission (runtime_admission.py) builds errors/warnings as list[str]
  unconditionally, so the report always carries list values and the false arc is unreachable.
• core/rust_engine.py 1077->1082 — the _execute_hybrid_loop finally block guards
  if self._bridge is not None, but the method assigns self._bridge = RustUdpTransportBridge(...)
  unconditionally before entering its try, so the bridge is never None when the finally runs.
  (The sibling guard in stop() at 1090 is reachable and is covered by a targeted test.)
• core/_rust_compat.py 836->838 — the SPI ThermalQuench if w_old > 0.0 guard. When w_th
  decrements to 0, te is rescaled to _SPI_TE_FLOOR (0.01 keV), which is below
  _SPI_TQ_THRESHOLD (0.1 keV), so the phase transitions to CurrentQuench before another
  ThermalQuench iteration; w_old (the pre-decrement w_th) is therefore always > 0. Verified:
  worst-case min(w_old) over a parameter sweep (w0 in 1..1000 MJ, te0 in 0.05..100 keV) is
  approximately 1.04e4 J.
• scpn/controller.py 828->834 — the delayed-spike-routing if self._delay_delayed_idx.size
  guard is reached only past the if self._max_delay_ticks <= 0: return guard (L818).
  _max_delay_ticks = max(_delay_ticks) > 0 implies some delay_ticks > 0, so
  _delay_delayed_idx = flatnonzero(_delay_ticks > 0) is non-empty whenever the line executes.
  (The sibling immediate-routing guard at 824 has both arcs reachable and is covered normally.)

Review / removal criterion

These pragmas are exclusion-of-unreachable, not coverage debt to be paid down.
Remove a pragma only if a future refactor makes its arc reachable (e.g. a new
enum member, dropping the upstream validation, or measuring coverage on a
non-Linux platform for the sched_getaffinity guard).

[anulum]

Batch 23 adds one more # pragma: no branch arc:

• core/gyrokinetic_transport.py line 325 (325->286): the elif mt == 3 (ETG) closes an exhaustive if/elif/elif chain over mode_type, which _validate_spectrum restricts to {0,1,2,3} and the loop filters mt == 0 at line 292. So when the ETG elif is evaluated mt is necessarily 3 — the fall-through to the loop head cannot be taken. Its three testable siblings (311->286, 322->286, 333->286, the R_L_* == 0 guards) are covered by test_unstable_spectrum_with_zero_gradients_yields_no_flux.

[anulum]

Batch 35 adds two more # pragma: no branch arcs in scpn/z3_model_checking.py:

• 245->240 (verify_trigger_response_latency): if response_window: — response_window has length max_latency_steps, which is validated >= 1 at line 230 (raises otherwise), so the window is never empty and the False branch is unreachable.
• 611->617 (build_symbiyosys_contract): if firing_terms: — firing_terms is one entry per transition, and a valid compiled net always has >= 1 transition (StochasticPetriNet.compile() rejects a transition-less net: 'Net must have at least one place and one transition'), so firing_terms is never empty and the False branch is unreachable.