IsWitnessStandard has three policy rules for Taproot spends: annexes are nonstandard, tapscript stack items are limited to 80 bytes, and an empty control block is rejected. No test ties bad-witness-nonstandard to any of them. Every existing assertion of that reject reason is for another output type. feature_taproot.py does exercise annexes and oversized stack items, but it checks standardness with assert_raises_rpc_error(-26, None, ...), so it never asserts which rule rejected the spend.
This adds a case per rule to mempool_accept.py. The file already builds a P2TR script-path spend, so each case only mutates its witness stack; the oversized item is one byte over the limit.
To check that each case hits the rule it claims to cover, I disabled the three branches in policy.cpp one at a time: each case fails with its branch disabled and passes with it restored.