Sadly, as far as I can see, it doesn't really get into the problem I'm trying to solve. Although it does describe how the current module goes about its work (custom run-core notes which ops are executed and then uses the B:: modules to go from that to source lines).

I guess it might be possible to intervene at that step, where we still have the op info, and note if we are invoking that particular sub, but I don't currently see a way of noting all the call sites of a particular function (other than 'grep' or similar).

The Devel::Cover module is beatifully written though. Really clear code.