fix(api): pattern-constrain humiliations id; broaden canon log boundary tests

api/tests/test_canon_log_schema.py

@@ -1,4 +1,3 @@
-import copy
 import json
 from pathlib import Path
 
@@ -56,3 +55,16 @@ def test_empty_optional_arrays_are_allowed():
     doc["active_quests"] = []
     doc["humiliations"] = []
     assert validate_canon_log(doc) == []
+
+
+def test_root_level_stray_field_is_rejected():
+    # §2/§7: stats/HP/inventory must never enter the log — additionalProperties:false at root.
+    doc = _valid()
+    doc["hp"] = 10
+    assert validate_canon_log(doc) != []
+
+
+def test_negative_turn_is_rejected():
+    doc = _valid()
+    doc["humiliations"][0]["turn"] = -1
+    assert validate_canon_log(doc) != []