test: constrain risk overlays to measured coverage

tests/test_test_risk_map.py

@@ -162,6 +162,12 @@ def test_risk_map_rejects_legacy_schema_and_invalid_inventory_roots(tmp_path):
     risk = json.loads((ROOT / "ci" / "test-risk-map.json").read_text())
     risk["schema_version"] = 1
     risk["source_inventory"]["roots"] = ["missing-source-root", "/absolute/source.py"]
+    risk["source_inventory"]["coverage_roots"] = [
+        "obliteratus",
+        "obliteratus",
+        "missing-coverage-root",
+        "/absolute/coverage",
+    ]
 
     errors = check_test_risk_map.validate(
         _write(tmp_path / "risk.json", risk),
@@ -172,6 +178,30 @@ def test_risk_map_rejects_legacy_schema_and_invalid_inventory_roots(tmp_path):
     assert "test risk map schema_version must be 2" in errors
     assert "source_inventory root does not exist: missing-source-root" in errors
     assert "source_inventory has invalid root: '/absolute/source.py'" in errors
+    assert "test risk map source_inventory has duplicate coverage_roots" in errors
+    assert "source_inventory coverage root does not exist: missing-coverage-root" in errors
+    assert "source_inventory has invalid coverage root: '/absolute/coverage'" in errors
+
+
+def test_targeted_risk_module_must_be_inside_measured_coverage_roots(tmp_path):
+    risk = json.loads((ROOT / "ci" / "test-risk-map.json").read_text())
+    risk["modules"].append(
+        {
+            "path": "app.py",
+            "risk_class": "conditional-runtime",
+            "risk": "optional application construction",
+            "required_tests": ["tests/conditional/test_operator_ui.py"],
+            "conditional_gates": [],
+        }
+    )
+
+    errors = check_test_risk_map.validate(
+        _write(tmp_path / "risk.json", risk),
+        ROOT / "ci" / "test-quality-policy.json",
+        ROOT / "ci" / "conditional-test-policy.json",
+    )
+
+    assert "risk module is outside measured coverage roots: app.py" in errors
 
 
 def test_loader_rejects_unreadable_and_nonobject_documents(tmp_path):