diff --git a/functions/package.json b/functions/package.json
index cb3c92ec..f9011c1f 100644
--- a/functions/package.json
+++ b/functions/package.json
@@ -7,7 +7,7 @@
   },
   "main": "dist/index.js",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc && node ./stamp-build.js",
     "test": "jest",
     "serve": "npm run build && firebase emulators:start --only functions",
     "shell": "npm run build && firebase functions:shell",
@@ -26,4 +26,4 @@
     "ts-jest": "^29.4.11",
     "typescript": "^5.4.5"
   }
-}
+}
\ No newline at end of file
diff --git a/functions/stamp-build.js b/functions/stamp-build.js
new file mode 100644
index 00000000..39c5d486
--- /dev/null
+++ b/functions/stamp-build.js
@@ -0,0 +1,20 @@
+// Writes dist/buildInfo.json after tsc so every deployed build carries its provenance.
+// Why: "is commit X actually live?" was unanswerable except by behavior — functions:log's
+// lagging window caused a false outage alarm and a mis-attributed landmine cause, and a
+// stale committed dist shipped twice before anyone could tell (FUNCTIONS-DIST-STALE).
+// With this, one log line at cold start answers it.  Fail-safe: no git → "unknown".
+const { execSync } = require('node:child_process')
+const { writeFileSync, mkdirSync } = require('node:fs')
+
+function run(cmd) {
+  try { return execSync(cmd, { encoding: 'utf8' }).trim() } catch { return 'unknown' }
+}
+
+const info = {
+  sha: run('git rev-parse --short HEAD'),
+  branch: run('git rev-parse --abbrev-ref HEAD'),
+  builtAt: new Date().toISOString(),
+}
+mkdirSync('dist', { recursive: true })
+writeFileSync('dist/buildInfo.json', JSON.stringify(info, null, 2) + '\n')
+console.log(`[stamp-build] ${info.sha} (${info.branch}) built ${info.builtAt}`)