test(engine): cover RootFS branches of cross-file resolution

codecov/patch flagged uncovered lines in the new code: resolveTargetFile's
in-memory RootFS branch (the anchored-link path), resolveWorkspaceRelTarget's
empty/absolute-link guard, and schemaRootFS's nil-file branch. Add focused
unit tests so every new branch is exercised in its own package.

https://claude.ai/code/session_01RkZnJM1JYhhioZyzfvH3nt

Author: claude

internal/rules/crossfilereferenceintegrity/rule_test.go

@@ -707,6 +707,49 @@ func TestTargetExists_ParentTraversalViaRootFS(t *testing.T) {
 		"a link escaping the workspace root must not resolve here")
 }
 
+// TestResolveWorkspaceRelTarget covers every branch of the helper:
+// joining onto the source dir, collapsing "..", and the rejections for
+// empty, absolute, and root-escaping links.
+func TestResolveWorkspaceRelTarget(t *testing.T) {
+	rel, ok := resolveWorkspaceRelTarget("docs/background/linters.md", "../../internal/x.md")
+	require.True(t, ok)
+	assert.Equal(t, "internal/x.md", rel)
+
+	rel, ok = resolveWorkspaceRelTarget("docs/a.md", "b.md")
+	require.True(t, ok)
+	assert.Equal(t, "docs/b.md", rel)
+
+	_, ok = resolveWorkspaceRelTarget("docs/a.md", "")
+	assert.False(t, ok, "empty link is not a workspace target")
+	_, ok = resolveWorkspaceRelTarget("docs/a.md", "/etc/passwd")
+	assert.False(t, ok, "absolute link is not a workspace target")
+	_, ok = resolveWorkspaceRelTarget("docs/a.md", "../../escape.md")
+	assert.False(t, ok, "a link escaping the workspace root is rejected")
+}
+
+// TestResolveTargetFile_ParentTraversalViaRootFS exercises the in-memory
+// RootFS branch of resolveTargetFile (the anchored-link path), which the
+// Session/WASM engine takes for an up-and-over target.
+func TestResolveTargetFile_ParentTraversalViaRootFS(t *testing.T) {
+	root := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(root, "internal", "rules", "x"), 0o755))
+	writeFile(t, filepath.Join(root, "internal", "rules", "x", "README.md"), "# X\n")
+
+	f := &lint.File{
+		Path:   "docs/background/linters.md",
+		FS:     os.DirFS(root),
+		RootFS: os.DirFS(root),
+	}
+	tf, ok := resolveTargetFile(f, "../../internal/rules/x/README.md", "")
+	require.True(t, ok, "an existing up-and-over target must resolve via RootFS")
+	data, err := tf.read()
+	require.NoError(t, err)
+	assert.Equal(t, []byte("# X\n"), data)
+
+	_, ok = resolveTargetFile(f, "../../internal/rules/x/MISSING.md", "")
+	assert.False(t, ok, "a missing up-and-over target must not resolve")
+}
+
 // =====================================================================
 // Additional coverage: toStringSlice with []string type
 // =====================================================================

internal/rules/requiredstructure/runcache_wiring_test.go

@@ -237,6 +237,14 @@ func TestRule_SchemaIncludeViaRootFS(t *testing.T) {
 	}
 }
 
+// TestSchemaRootFS covers both branches of the RootFS accessor: a nil
+// file (the cache primitive's struct-literal test path) yields nil, and a
+// file with a RootFS yields it.
+func TestSchemaRootFS(t *testing.T) {
+	assert.Nil(t, schemaRootFS(nil))
+	assert.NotNil(t, schemaRootFS(&lint.File{RootFS: fstest.MapFS{}}))
+}
+
 // TestRule_FragmentInvalidationEvictsParsedSchema is the end-to-end
 // integration check for Copilot thread 1 on PR #377: after Rule.Check
 // reads a schema whose <?include?> reaches a fragment, calling