Stamp the build into the output, not into a tracked file

The stamping scheme was wrong in a way worth recording. tools/stamp.js rewrote
src/build-info.js before every serve and build, so after each commit the
committed stamp named the *previous* commit — as it does right now, reading
76072ed+ while HEAD is 5c1784d — and the next serve rewrote it and dirtied the
tree again. A generated value does not belong in a tracked file if anything
routinely regenerates it.

src/build-info.js is now permanent and reads `commit: 'dev'`. tools/build.js
substitutes the real commit into the bundled output only, and fails loudly if
the substitution finds nothing to replace. So dist/theladder.html names the
commit that produced it, running from source honestly reads "0.3.0 · dev", and
the working tree never churns. tools/stamp.js is gone and `npm run serve` is a
plain static server again.

Also here, for picking this up later: a "Where things stand" section in the
README with the five open questions in the order they are likely to matter —
whether money stops mattering late, the negotiation gate that four early options
sit behind, the feedback widget nobody uses, how thin Dispatch is next to the
mailroom, and third-tier versus second-pack.

121 tests. docs/DECISIONS.md §25 corrected to describe what the code now does.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMSFHyVPitUoosW5wyEADj

tools/build.js

@@ -10,6 +10,7 @@
 // a silent mis-bundle would be far worse than a failed build.
 
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { execFileSync } from 'node:child_process';
 import { dirname, resolve, relative } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -89,6 +90,23 @@ async function collect(entryPath, seen = new Map()) {
   return seen;
 }
 
+/**
+ * The commit this build came from, marked `+` when the tree had uncommitted
+ * changes. Substituted into the output only — src/build-info.js stays as it is
+ * in the repository, so building never dirties the working tree.
+ */
+function buildIdentity() {
+  try {
+    const sha = execFileSync('git', ['rev-parse', '--short', 'HEAD'], { cwd: root, stdio: 'pipe' })
+      .toString().trim();
+    const dirty = execFileSync('git', ['status', '--porcelain'], { cwd: root, stdio: 'pipe' })
+      .toString().trim().length > 0;
+    return dirty ? `${sha}+` : sha;
+  } catch {
+    return 'unknown';
+  }
+}
+
 async function build() {
   const html = await readFile(entryHtml, 'utf8');
 
@@ -130,15 +148,21 @@ async function build() {
     '})();',
   ].join('\n');
 
+  const commit = buildIdentity();
+  const stamped = script
+    .replace("commit: 'dev'", `commit: '${commit}'`)
+    .replace('builtAt: null', `builtAt: '${new Date().toISOString().slice(0, 10)}'`);
+  if (stamped === script) throw new Error('could not stamp the build identity into the bundle');
+
   const output = html
     .replace(styleMatch[0], `<style>\n${css}\n  </style>`)
-    .replace(scriptMatch[0], `<script>\n${script}\n  </script>`);
+    .replace(scriptMatch[0], `<script>\n${stamped}\n  </script>`);
 
   await mkdir(outDir, { recursive: true });
   await writeFile(outFile, output, 'utf8');
 
   const kb = (Buffer.byteLength(output) / 1024).toFixed(1);
-  console.log(`built ${id(outFile)} — ${modules.size} modules, ${kb} kB`);
+  console.log(`built ${id(outFile)} — ${modules.size} modules, ${kb} kB, commit ${commit}`);
 }
 
 build().catch((error) => {