max / makenotwork

Check every build a promote ships, not just the one the tier points at One pom version is two bundles with two digests, each built natively and accepted through its own intake. `unsatisfied_gates` took a single `build_id` — the source tier's `current_build_id` — so a two-architecture promote evaluated one architecture's gate rows and shipped both. The bytes were still covered, because `bundle_for_platform` only resolves a sibling whose own build settled green, but a green build row is not a green gate run: the build says the bytes compiled, the gate run says the tier vouched for them. The sibling shipped on evidence nobody read. It now takes the set of builds the promote will actually ship, and every one has to show its own passed row. Getting that set means resolving the per-node bundles BEFORE the gate check rather than after, which is also the better order independently: a version missing its x86_64 half now fails before any gate work instead of after it. `bundle_for_platform` returns the build id alongside the path, so the set is read off the same resolver that decides what ships. Deriving it separately would be a second implementation of "which bundle goes where", which is the class of gap this whole area keeps closing. Failures are reported qualified by platform — `cargo_test (linux/x86_64)` — only when there is more than one build to tell apart. A single-platform product's message is byte-for-byte what it was, because the qualifier exists to disambiguate and there is nothing to disambiguate. `burn_in` and `manual_confirm` are still evaluated once. Both key on the tier's own clock rather than on a build, so asking per build would ask the same question twice and answer it twice in the one message an operator reads under pressure. One quiet failure written out rather than left to an invariant: a provisioned tier with no nodes resolves no bundles, and an empty set would fall through to the version-string lookup — the pre-identity path, weaker than what the tier is owed. The `provisioned` guard makes it unreachable today. It falls back to the source build explicitly, because the alternative degrades in the direction of less evidence. Rollback is unchanged and passes no build id: it re-runs no gates, and the bytes are ones the tier already ran.