diff --git a/harness/udpstream/build-lance.sh b/harness/udpstream/build-lance.sh
index 72d769d..c68e366 100755
--- a/harness/udpstream/build-lance.sh
+++ b/harness/udpstream/build-lance.sh
@@ -87,6 +87,24 @@ done
 OUTNAME=${LANCE_OUT:-lance.coff}
 cp "$WORK/LANCE.OUT" "$OUT/$OUTNAME"
 sed 's/\r$//' "$WORK/LANCE.MAP" > "$OUT/lance.map"
+# Guard: the marker block (MARK in the source) must sit clear of .text, or the
+# payload overwrites its own code with cell() writes (an illegal-opcode crash).
+python3 - "$SRC" "$OUT/lance.map" <<'PYCHK'
+import re, sys
+src, mp = sys.argv[1], sys.argv[2]
+m = re.search(r'#define\s+MARK\s+(0x[0-9A-Fa-f]+)', open(src).read())
+if m:
+    mark = int(m.group(1), 16)
+    for ln in open(mp):
+        f = ln.split()
+        if len(f) >= 4 and f[0] == '.text':
+            start, size = int(f[2], 16), int(f[3], 16)
+            end = start + size
+            if end > mark:
+                sys.stderr.write("build: ERROR .text ends at 0x%X, past MARK 0x%X\n" % (end, mark))
+                sys.exit(1)
+            print("build: .text ends 0x%X, MARK 0x%X (%d bytes clear)" % (end, mark, (mark - end) // 8))
+PYCHK
 sed 's/\r$//' "$WORK/LANCE.LST" > "$OUT/lance.lst"
 sed 's/\r$//' "$WORK/ENTRY.LST" > "$OUT/entry.lst"
 echo "build.sh: $OUT/$OUTNAME ($(wc -c < "$OUT/lance.coff") bytes)"