P7 r10: probes assert expected head + every outcome (nonzero exit on mismatch); phase-2 rejection-path cleanup guaranteed

dashcaddy-api/scripts/p7-live-curl2.js

@@ -12,6 +12,9 @@
 'use strict';
 
 const http = require('http');
+// Exact-head evidence: HEAD must descend from the pinned functional commit
+// (a commit cannot embed its own hash; the exact HEAD is printed at runtime).
+const PINNED_ANCESTOR = '51ba85fc69249f4db0e9cc1d17594882ca59aa57';
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -47,7 +50,9 @@ async function main() {
   let server = null;
   try {
     const head = execSync('git -C .. rev-parse HEAD', { encoding: 'utf8' }).trim();
-    console.log(`# git HEAD: ${head}`);
+    console.log(`# git HEAD: ${head} (must descend from ${PINNED_ANCESTOR.slice(0, 7)})`);
+    const anc = execSync(`git -C .. merge-base --is-ancestor ${PINNED_ANCESTOR} HEAD && echo yes`, { encoding: 'utf8' }).trim();
+    expect('head.on-p7-lineage', anc, (a) => a === 'yes');
     console.log(`# isolated DATA_DIR: ${TMP}`);
 
     const now = new Date().toISOString();
@@ -145,7 +150,11 @@ async function main() {
   process.exit(FAILURES === 0 ? 0 : 1);
 }
 
-main().catch(async (e) => {
+main().catch((e) => {
   console.error('FATAL', e && e.stack || e);
+  // Pre-finally failures (init, requires) can bypass main()'s finally:
+  // guarantee the isolated dir is gone on this path too.
+  try { fs.rmSync(TMP, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+  console.log(`# cleanup (rejection path): removed ${TMP}`);
   process.exit(1);
 });