test(v2): harden protocol and clean-break contracts

tests/contract/test_no_v1.py

@@ -4,6 +4,8 @@ import subprocess
 import sys
 from pathlib import Path
 
+import pytest
+
 ROOT = Path(__file__).parents[2]
 
 
@@ -26,12 +28,42 @@ def test_v1_reference_tag_exists() -> None:
     assert result.stdout.strip() == "v1-reference-2026-07-27"
 
 
-def test_forbidden_v1_scanner_accepts_runtime_tree() -> None:
-    result = subprocess.run(
-        [sys.executable, "tools/forbidden_v1_scan.py", "."],
+def run_scanner(root: Path) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, str(ROOT / "tools/forbidden_v1_scan.py"), str(root)],
         cwd=ROOT,
         capture_output=True,
         check=False,
         text=True,
     )
+
+
+def test_forbidden_v1_scanner_accepts_runtime_tree() -> None:
+    result = run_scanner(ROOT)
     assert result.returncode == 0, result.stdout + result.stderr
+
+
+@pytest.mark.parametrize(
+    ("relative_path", "canary"),
+    [
+        ("backend/src/backup_tool/database.py", 'DB_PATH = "backup_tool.db"'),
+        ("backend/src/backup_tool/payload.py", "def read_legacy_payload(): ..."),
+        ("backend/src/backup_tool/importer.py", "class LegacyBackupImporter: ..."),
+        ("backend/src/backup_tool/converter.py", "def convert_v1_backup(): ..."),
+        ("backend/src/backup_tool/layout.py", 'FORMAT = "%Y-%m-%d_%H%M%S"'),
+        ("docker-compose.yml", "command: uvicorn app.main:app"),
+    ],
+)
+def test_forbidden_v1_scanner_rejects_runtime_and_config_canaries(
+    tmp_path: Path,
+    relative_path: str,
+    canary: str,
+) -> None:
+    path = tmp_path / relative_path
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(canary, encoding="utf-8")
+
+    result = run_scanner(tmp_path)
+
+    assert result.returncode == 1, relative_path
+    assert str(relative_path) in result.stderr