diff --git a/.kiro/specs/build-time-versioning/tasks.md b/.kiro/specs/build-time-versioning/tasks.md
index 77e828d0..656556ea 100644
--- a/.kiro/specs/build-time-versioning/tasks.md
+++ b/.kiro/specs/build-time-versioning/tasks.md
@@ -49,8 +49,9 @@
   - _Depends: 3.1_
 
 - [ ] 4. Core: Go binary version display
-- [ ] 4.1 go_build script injects ldflags from environment
-  - `src/tools/go_build` reads `XCE_GIT_COMMIT`/`XCE_BUILD_TIME` from its environment (both optional, empty-safe) and appends `-ldflags "-X main.GitCommit=... -X main.BuildTime=..."` to its `go build` invocation, falling back to `unknown` for any unset value
+- [x] 4.1 go_build script injects ldflags from environment
+  - `src/tools/go_build` reads `XCE_GIT_COMMIT`/`XCE_BUILD_TIME` via `[ -z ... ]` (correctly empty-safe, not just unset-safe) and appends `-ldflags "-X main.GitCommit=... -X main.BuildTime=..."` to its `go build` invocation, falling back to `unknown`
+  - Confirmed (research finding, independently reproduced by review): `-X` on a `main` package var that doesn't exist yet is silently ignored by the Go linker, not a build error -- this task has no real ordering dependency on 4.4/4.5
   - Observable: invoking `go_build` with neither env var set still produces a working binary whose injected vars read `unknown`
   - _Requirements: 1.1, 1.2, 1.4, 4.1, 4.2_
   - _Boundary: go_build script_
diff --git a/src/tools/go_build b/src/tools/go_build
index c6c011b9..7edaaaed 100755
--- a/src/tools/go_build
+++ b/src/tools/go_build
@@ -99,4 +99,15 @@ done
 
 export GOPROXY=https://goproxy.cn
 
-(cd $_sdir; go build -gcflags "all=-N -l" -o "$_dfile" "$_sfile")
+_git_commit="$XCE_GIT_COMMIT"
+_build_time="$XCE_BUILD_TIME"
+
+if [ -z "$_git_commit" ]; then
+    _git_commit=unknown
+fi
+
+if [ -z "$_build_time" ]; then
+    _build_time=unknown
+fi
+
+(cd $_sdir; go build -gcflags "all=-N -l" -ldflags "-X main.GitCommit=$_git_commit -X main.BuildTime=$_build_time" -o "$_dfile" "$_sfile")