diff --git a/tools/deploy.sh b/tools/deploy.sh
index 7c44abc..71a7aba 100755
--- a/tools/deploy.sh
+++ b/tools/deploy.sh
@@ -43,9 +43,19 @@ bash "$ROOT/tools/qa.sh" > /tmp/gutsy_qa.log 2>&1 || { echo "      ✗ QA RED 
 echo "      ✓ QA green"
 
 echo "[2/4] Syncing web/ to VPS staging (excluding dev harnesses) ..."
+COMMIT="$(git -C "$ROOT" rev-parse --short HEAD)"
+if [ -n "$(git -C "$ROOT" status --porcelain -- web/)" ]; then
+  STAMP="$COMMIT-dirty"
+  echo "      ⚠ web/ has uncommitted changes — what ships will match NO commit in the repo"
+else
+  STAMP="$COMMIT"
+fi
 ssh "$VPS" "rm -rf '$STAGING' && mkdir -p '$STAGING'"
 rsync -az --delete --exclude='.DS_Store' --exclude='dev/' "$ROOT/web/" "$VPS:$STAGING/"
-echo "      $(ssh "$VPS" "du -sh $STAGING | cut -f1") staged"
+# Provenance, curl-able: `curl https://partly.party/gutsy/VERSION` answers "what is actually
+# live right now" without trusting anyone's memory of the last deploy.
+ssh "$VPS" "printf '%s\n' '$STAMP' > $STAGING/VERSION"
+echo "      $(ssh "$VPS" "du -sh $STAGING | cut -f1") staged @ $STAMP"
 
 echo "[3/4] Replacing container content ..."
 ssh "$VPS" "docker exec $CONTAINER sh -c 'rm -rf ${REMOTE_WEB_ROOT:?} && mkdir -p ${REMOTE_WEB_ROOT:?}' && docker cp $STAGING/. $CONTAINER:$REMOTE_WEB_ROOT"
@@ -71,6 +81,7 @@ check() {  # check <label> <url-suffix> <grep-pattern>
   echo "      ✓ $label"
 }
 
+check "VERSION stamp"     "/VERSION"                 "$STAMP"
 check "index.html"        "/"                        'id="game"'
 check "js/boot.js"        "/js/boot.js"              'Lane F'
 check "ui/hud.js"         "/js/ui/hud.js"            'createHUD'