diff --git a/scripts/ci-deploy.sh b/scripts/ci-deploy.sh
index b77c8907..2ffdaa6d 100644
--- a/scripts/ci-deploy.sh
+++ b/scripts/ci-deploy.sh
@@ -69,6 +69,21 @@ trap 'exit 130' INT
 trap 'exit 143' TERM
 
 check_current
+# Read-only ownership evidence before any build or container cutover.
+if command -v ss >/dev/null 2>&1; then
+  listeners="$(ss -ltnp 'sport = :3002' 2>/dev/null || true)"
+  printf '%s\n' "$listeners"
+  while read -r listener_pid; do
+    [ -n "$listener_pid" ] || continue
+    printf 'Port owner PID=%s cwd=' "$listener_pid"
+    readlink "/proc/$listener_pid/cwd" || true
+    cat "/proc/$listener_pid/cgroup" 2>/dev/null || true
+    ps -o pid=,ppid=,user=,comm= -p "$listener_pid" || true
+  done < <(printf '%s' "$listeners" | grep -o 'pid=[0-9]*' | cut -d= -f2 | sort -u)
+fi
+for managed_name in epicnext-cms epicnext-cms-app; do
+  docker inspect --format '{{.Name}} running={{.State.Running}} pid={{.State.Pid}} image={{.Image}}' "$managed_name" 2>/dev/null || true
+done
 cp "$deploy_dir/.env" .env
 pnpm install --frozen-lockfile
 # Prepare browser before cutover so installation failures cannot interrupt the site.