fix(v2): enforce hardened M0 contracts

docs/release/m0-evidence.md

@@ -0,0 +1,75 @@
+# M0 Protocol Foundation Evidence
+
+**Branch:** `feature/v2-reimplementation`
+**RED commit:** `92f2aaa`
+**GREEN commit:** commit containing this evidence file, immediately after `92f2aaa`
+
+## RED
+
+Command:
+
+```bash
+.venv/bin/python -m pytest \
+  tests/contract/test_repository_format.py \
+  tests/contract/test_no_v1.py -q
+```
+
+Exit: `1` (expected). Output summary:
+
+```text
+9 failed, 9 passed in 1.59s
+```
+
+The failures proved absent enforcement for UUIDv7/RFC3339, manifest signature and source-consistency shape, entry/blob/link rules, and runtime/config canaries for v1 database, payload, import, conversion, timestamp parsing, and old entry points.
+
+## GREEN
+
+Clean bootstrap command:
+
+```bash
+make setup
+```
+
+Exit: `0`. It created/reused `.venv`, installed `backend[dev]` through `.venv/bin/python`, installed the committed frontend lockfile with `npm ci`, and reported `0 vulnerabilities`.
+
+Whole-M0 check:
+
+```bash
+make check
+```
+
+Exit: `0`. Output summary:
+
+```text
+v1 compatibility scan: OK
+18 passed in 2.34s
+All checks passed!
+5 files already formatted
+Success: no issues found in 2 source files
+frontend TypeScript check: passed
+frontend Vite production build: passed
+```
+
+Exact milestone acceptance plus required frontend build:
+
+```bash
+.venv/bin/python tools/forbidden_v1_scan.py . && \
+.venv/bin/python -m pytest \
+  tests/contract/test_repository_format.py \
+  tests/contract/test_no_v1.py -q && \
+npm --prefix frontend run build
+```
+
+Exit: `0`. Output summary:
+
+```text
+v1 compatibility scan: OK
+18 passed in 2.24s
+vite v8.1.5 production build completed
+```
+
+## Scope Confirmation
+
+- No M1 runtime, database, UUID generator, API, or migration behavior was implemented.
+- Obsolete v1 backend container/Compose entry points were removed because the config-scope canary gate proved they still invoked v1 code. M14 owns replacement deployment packaging.
+- The v1 reference remains available at tag `v1-reference-2026-07-27`.

docs/superpowers/plans/2026-07-27-backup-tool-v2-implementation.md

@@ -78,7 +78,7 @@ M7-M11 MAY be developed on separate branches after M6, but merge in dependency o
 
 **Depends on:** approved design.  
 **Deliver:** lock Python/Node/tool versions; create package/test layout and `Makefile`; commit canonical repository/manifest JSON schemas, golden valid/invalid fixtures, normalized-path vectors, state-transition table, error-code catalog, capability schema, and deterministic fault-point names. Tag/archive v1, then remove `backend/app`, `backend/backup`, old tests, and handwritten `frontend/src/api/client.ts`.  
-**Verify:** `python tools/forbidden_v1_scan.py . && python -m pytest tests/contract/test_repository_format.py tests/contract/test_no_v1.py -q`  
+**Verify:** `.venv/bin/python tools/forbidden_v1_scan.py . && .venv/bin/python -m pytest tests/contract/test_repository_format.py tests/contract/test_no_v1.py -q` (run `make setup` first on a clean checkout)
 **Commit:** `chore(v2): establish protocol and test foundation`
 
 ### M1 — Runtime, UUIDv7, SQLite/WAL, and Alembic baseline