Check reference
See which branches lemma translation reaches
A successful lemma corpus can describe only a small part of a package. lemma_branch_coverage exposes source branches that its recorded translations did not reach.
Translation coverage has its own denominator
proof verify-lemma --coverage records visits to production AST nodes and writes .proof/lemma-coverage.json. The coverage option implies no-cache translation so visits are actually observed. The audit check reads that persisted artifact and reports unreached nodes such as branches, cases, calls and loops. Without coverage data it skips; an authored lemma corpus gets a hint to generate it.
Illustrative example: a refund branch
The lemmas discuss successful payment capture, but the same package also has a refund path. A report can show thorough coverage of the translated capture logic while production reach remains small.
Production function Relevant claim
Capture charged amount equals approved amount
Refund no refund exceeds captured amount
Cancel cancelled operation cannot be captured
The example is a review inventory, not a measured report. A claim for Capture does not acquire the other functions' behavior merely because they share a package.
Refresh, then add the missing claim
Generate current coverage for the scope you intend to assess. Read the cited file, line and node kind. Add a lemma that constrains the meaningful behavior of an unreached function or branch; remove dead code only when it is actually unnecessary. A production-reach warning needs new production functions brought into scope, not more assertions over already translated ones.
proof verify-lemma --coverage ./internal/payments
proof audit --check lemma_branch_coverage --verbose
Reached is weaker than proved or executed
A translator visit is not a runtime branch observation and does not establish MC/DC condition independence. It also says nothing by itself about whether the assertion is useful or the solver decided it. Check verdicts and vacuity separately. Keep the package scope visible: narrowing a scan changes the denominator. The default audit warning should prompt review of the missing claim, not a lemma written merely to touch a node.
Follow the evidence
Pair each unreached production function with the behavior that needs a formal claim.
Review one unreached production branch. Bring the translation coverage and lemma corpus so we can identify the meaningful claim that is missing from the assessed scope.