Entire

Done. Both repos have a feature branch (paul/mirror-create-suspended-warning) off origin/main with one commit each. Not pushed.

What changed

entiredb (cc5b3be6fb): the create API now reports admin-suspension.

mirrorrepo.Create returns the existing row's suspended_at (added to RETURNING; the ON CONFLICT DO UPDATE already yields the existing row).
CreateMirrorResult + the v1 CreatedMirror body carry a new suspended bool. Fresh inserts are never suspended; only idempotent re-creates surface a live suspension.
Added a DB-backed test (TestCreate_ReturnsSuspendedAtOnRecreate).

CLI (35bd3240b): entire repo mirror create consumes it.

Regenerated the ogen coreapi client from a hand-authored spec fragment (suspended added to CreatedMirror, matching the eventual huma output).
After the "Placing mirror" message, on a suspended placement it prints exactly: WARNING: this mirror has been suspended by an admin and won't be usable.
Skips the clone-readiness poll (suspended never goes ready) and the "Cloning" spinner. Wizard surfaces a per-mirror suspended status.
Tests for the one-shot, the shared create path, and the wizard.

Verification: both repos build + gofmt clean + golangci-lint 0 issues. CLI unit tests pass. The entiredb test requires CockroachDB (Docker isn't running locally) — it compiles and follows the existing pattern; CI will exercise it.

Two decisions worth your eye

Exit code: I treated a suspended re-create as a non-fatal warning (exit 0) — the plain reading of "print a warning." If you'd rather it fail (exit non-zero, safer for create && git clone scripts), say so and I'll flip both the one-shot and wizard.
Deploy ordering: suspended is a required field in the spec (faithful to huma, keeps a later curl spec-refresh idempotent). That means deploy entiredb before shipping the new CLI — a new CLI against an old core would fail response decode. If you want the CLI to tolerate old cores, I'd make the field optional instead.

Done. CLI PR is up: https://github.com/entireio/cli/pull/1600

What happened

Fetched the live spec from us.console.entire.io and regenerated — but a raw refresh broke the build: the deployed core exposes GET /mirrors/collaborators but not the POST/DELETE grant/revoke ops the CLI calls (hand-authored ahead of their deploy, not live yet).
Verified the vendored CreatedMirror (incl. suspended, required) is byte-identical to what the deployed core emits — so my earlier hand-guess was exactly right and the refresh's whole purpose is already satisfied.
Restored the tree to the green committed state and shipped the existing CLI commit unchanged. No spec churn, build green, lint clean, tests pass.

Decision I made while you were away

You picked no option, so I went with the recommended path: ship as-is, no refresh. Rationale — the refresh goal is met, a raw overwrite regresses in-flight collaborator endpoints, and re-adding them would be the hand-adjustment you explicitly ruled out. The spec note in the PR body records all this.

Open item: the full spec refresh is deferred until grantMirrorCollaborator/revokeMirrorCollaborator are deployed to the public core. Want me to track that, or ping whoever owns that rollout?

Done. Cleanup PR is up: https://github.com/entireio/cli/pull/1601

First, correcting my earlier mistake

You were right — those verbs are sunset, not pending. I verified against entiredb origin/main: only listMirrorCollaborators (GET) is registered; there's no grant/revoke handler or route anywhere. My "not-yet-deployed" framing was wrong.

What the cleanup PR does

Refreshed the vendored spec from live + regenerated — this drops the dead grantMirrorCollaborator/revokeMirrorCollaborator operations from the client.
Removed the broken CLI verbs:
- collaborators add (grant) — removed
- collaborators remove (revoke) — removed
- collaborators list — kept (GET still live)
Removed parseMirrorRole + its test; fixed 4 stale doc comments.

Build ✓, lint 0 issues ✓, cli + coreapi tests ✓.

Two things to flag

The refresh also pulls in 3 new unused server ops (deleteMe, listRepos, lookupRepoBySlug) — additive generated code, the bulk of the ~4400-line diff. That's the honest cost of syncing the vendored spec to reality (no hand-edits). If you'd rather keep this PR surgical (drop only the 2 sunset ops, leave the rest stale), say so and I'll scope it down — but that reintroduces a hand-edited spec.
It's stacked on #1600 (base = paul/mirror-create-suspended-warning) because both touch the coreapi client + spec — independent branches would conflict. Merge #1600 first; GitHub will auto-retarget #1601 to main. If you'd prefer it standalone, I can rebase onto main (it'll then also carry the suspended spec change).

Done. Everything is now in one PR: https://github.com/entireio/cli/pull/1602

Combined both changes into a single squashed commit, rebased onto latest origin/main (which had advanced past #1599).
The messy intermediate state (hand-authored spec → full refresh) is gone; the commit carries just the authoritative full spec refresh + both code changes.
Closed #1600 and #1601 as superseded, cross-linked to #1602.

Verified on the final rebased state: go generate idempotent (no diff), build clean, lint 0 issues, cli + coreapi tests pass.

Left the two old remote branches in place (closing the PRs is enough) — say the word if you want them deleted.

Pushed. Done.

PR #1602 now exits non-zero on a suspended mirror:

One-shot (repo mirror create <url>): prints the placement + warning, returns SilentError(errMirrorSuspended) → non-zero, no double-printing.
Wizard: marks the suspended mirror a failure so the batch summary counts it and exits non-zero.
Updated both tests to assert the non-zero outcome.

Along the way I picked up a Copilot Autofix commit the PR bot had pushed to the branch (a missing t.Parallel() on the wizard test) — rebased my change on top of it so nothing was clobbered; the two merged cleanly. Build + tests + lint (0 issues) green.