Entire

I read the comment against the actual code (repo_mirror.go:158-164 and explainSuspendedMirror in repo_mirror_probe.go:56-80). My take: Copilot is right, and it's a real inconsistency — though bounded in impact.

Why it's valid

The function's own doc comment states the precondition that the call site doesn't enforce:

That pairing — "Mirror already exists" from create, then a refused token exchange — is the signature of a suspended placement: create is idempotent on (repo, cluster) and ignores suspended_at...

That reasoning only holds when create returned an existing mirror (created.Created == false). A mirror created milliseconds ago can't have been suspended — suspension happens after upstream access is lost (App uninstalled, repo went private). Yet the call site fires the handler unconditionally:

So on a fresh create, an invalid_target gets diagnosed as "mirror is suspended → ask an operator to run entire-core admin mirrors resume" — a dead-end instruction, since there's nothing to resume. The token is minted once, immediately at the top of waitForMirrorClone (before the clone even lands), so this is exactly the window where a create→auth-gate propagation race would surface as invalid_target.

Caveats on severity

I can't verify from this repo whether the auth gate is strongly consistent with create. If it is, the race window is ~zero and this is theoretical. But even then, the message is logically wrong in the fresh-create branch regardless of frequency.
The feature's real value is concentrated in the created.Created == false path (re-running create on a repo whose App was uninstalled), which is unaffected by the fix.

Recommended fix

Gate the handler on the precondition the doc already claims — only treat invalid_target as suspension when create reported the mirror already existed:

This is the minimal change and it makes the code honor its own documented signature. The one assumption it bakes in: a brand-new mirror is never born suspended (consistent with the doc's framing that suspension is always post-creation). On a fresh create that does race into invalid_target, the user sees the raw authorize clone probe: ... error instead of a misdirecting resume command — not pretty, but honest. If you want to also handle the lag case gracefully, a small retry/backoff on the initial mint would be a follow-up.

Want me to apply the gate (and update explainSuspendedMirror's doc comment to note the caller enforces !created.Created)? I could also add a fresh-create test case to lock in the behavior.

Applied. Summary of what I changed in response to the Copilot comment:

repo_mirror_probe.go — explainSuspendedMirror now takes a freshCreate bool and short-circuits to handled=false when it's set. The precondition is enforced inside the function (self-protecting against future callers) rather than relying on the call site, and the doc comment now explains why fresh-create invalid_target is propagation lag, not suspension.

repo_mirror.go — call site passes created.Created. On a fresh create that races into invalid_target, the user now sees the raw authorize clone probe: … error instead of a misdirecting "ask an operator to run mirrors resume" message. The already-exists path (the real suspended-mirror case) is unchanged.

repo_mirror_test.go — updated the two existing cases for the new signature and added fresh create passes invalid_target through as propagation lag, which feeds the same wrapped ErrRepoTargetUnknown with freshCreate=true and asserts it's declined with no output.

Verification: mise run lint clean (0 issues), TestExplainSuspendedMirror all three subtests pass.

Note this is on top of the uncommitted auth-go bump from earlier — both sets of changes are sitting in the working tree on nicer-suspended-mirror-error. Want me to reply to the Copilot thread on the PR, and/or commit these? If committing, I'd suggest two separate commits (the dep bump and this fix are unrelated).

Done. Committed and pushed to nicer-suspended-mirror-error (PR #1344).

Commit fe609ca65 — "repo mirror: only diagnose suspended mirror on existing placement" (3 files, +29/−5)
Pushed 5d735a751..fe609ca65
Pre-push gate: mise run check passed (lint clean, test:ci EXIT=0, e2e canary 59/59). The lone FAIL on the first run was a flake — it didn't reproduce on two subsequent clean runs.

Note: the auth-go bump from the first task was already folded into the prior commit (5d735a751) and pushed, so this push only carries the suspended-mirror fix.

The Copilot review thread (r3348029076) is still open and unanswered. Want me to reply on it noting the fix is pushed (and which commit), so the reviewer sees it was addressed?