max / makenotwork

Guard companion binaries before the swap, not by their unit failing to start arch_guard_script and ldd_guard_script both took the primary binary alone. A node's [[companion]] binaries were checked by nothing: a companion of the wrong architecture, or one linking a symbol version the node lacks, was discovered by its unit failing during the install loop. That loop runs AFTER the symlink swap and restart, so the promote failed on the expensive side of the line these guards exist to stay on. mnw-cli ships to production exactly that way. Both guards now run against every companion before the swap, at FailureStage::BeforeSwap, and the refusal names which companion. Nothing has to wait for them: the companion bytes arrive in the same rsync and manifest_verify_script already covers the whole release directory, companions/ included. companion_src is one function because the guards and the installer must read the same path. A guard checking a path the installer does not use is a check of nothing, and looks exactly like a passing check; a test pins the two together. The glibc half of this was already closed in 0.2.12, earlier still, because check_bundle_fits_node walks the whole staged bundle. This is the architecture half and the full loader check, which that number comparison cannot reach.