diff --git a/openfut-redirector-host/redirector.sh b/openfut-redirector-host/redirector.sh
index 8f686cd..ee13ddd 100755
--- a/openfut-redirector-host/redirector.sh
+++ b/openfut-redirector-host/redirector.sh
@@ -17,6 +17,10 @@ ROOT="$(cd "$HERE/.." && pwd)"
 RUNDIR="${OPENFUT_REDIRECTOR_RUNDIR:-${TMPDIR:-/tmp}/openfut-redirector}"
 PIDFILE="$RUNDIR/redirector.pid"
 PORTFILE="$RUNDIR/redirector.port"
+# Commit the RUNNING process was started from. `verify` alone inspects the
+# on-disk binary, which a rebuild (even `cargo test`, which re-runs build.rs
+# when the branch ref moves) can silently advance past the live process.
+STAMPFILE="$RUNDIR/redirector.commit"
 LOGFILE="${OPENFUT_REDIRECTOR_LOG:-$RUNDIR/redirector.log}"
 BIN="$ROOT/target/debug/openfut-redirector-host"
 [[ -x "$BIN" ]] || BIN="$ROOT/target/release/openfut-redirector-host"
@@ -56,6 +60,7 @@ cmd_start() {
   cmd_verify || die "build identity check failed — refusing to start"
 
   mkdir -p "$RUNDIR"; echo "$OPENFUT_REDIRECTOR_HOST_PORT" > "$PORTFILE"
+  stamped_commit > "$STAMPFILE"
   "$BIN" >"$LOGFILE" 2>&1 &
   local pid=$!; echo "$pid" > "$PIDFILE"
   local w=0
@@ -102,10 +107,23 @@ cmd_status() {
   return 0
 }
 
+cmd_verify_running() {
+  [[ -f "$STAMPFILE" ]] || die "no running-process stamp — was it started by this script?"
+  local running head
+  running="$(cat "$STAMPFILE")"; head="$(git -C "$ROOT" rev-parse --short=7 HEAD 2>/dev/null)"
+  if [[ "$running" != "$head" ]]; then
+    echo "REFUSING: the RUNNING process was started from $running but HEAD is $head" >&2
+    echo "  Restart before treating this run as evidence." >&2
+    return 1
+  fi
+  echo "running-process identity OK: started from $running == HEAD"
+}
+
 case "${1:-}" in
   start)  cmd_start ;;
   stop)   cmd_stop ;;
   status) cmd_status ;;
   verify) cmd_verify ;;
+  verify-running) cmd_verify_running ;;
   *) sed -n '2,6p' "$0" | sed 's/^# \?//'; exit 2 ;;
 esac