Fix async mirror-create review findings

4 PRs merged in the last 12 hours (since 2026-09-01 20:30 UTC). Two clone-related, one mirror, one runner cleanup.

#2185 — entire repo clone /et/<project>/<repo> (toothbrush, 00:06 UTC, +228/-6)

New front door for cloning Entire-native repos; previously you had to hand-build the entire://<clusterHost>/et/<project>/<repo> URL. Resolves project → repo ULID → GetRepo, and clones from the server-minted clusterHost + path (never synthesized, no .git suffix). --cluster is rejected on native refs since a native repo has exactly one home cluster. The paul/dogbark shorthand works too. The top-level entire clone registration was split into #2208 (still open).

#2223 — clone ref parsing follow-up (toothbrush, 03:30 UTC, +101/-9)

Fixes two findings from #2185's trail that were missed before merge:

• entire repo clone git@github.com:foo/bar was parsed as the native <project>/<repo> shorthand and died with a control-plane lookup error. Native segments now must match the server's project/repo name charsets.
• Every mirror-parse failure collapsed into one generic "expected /et/… /gh/…" message. Now a ref matching no grammar gets a targeted error: GitHub URLs are pointed at their /gh/ form, malformed gh/ refs keep the parser's reason, everything else lists accepted shapes.

#2207 — async mirror creation (pfleidi, 2026-09-01 22:02 UTC, +3783/-168, 22 files)

The big one, mostly generated coreapi client + OpenAPI spec. Mirror creation can now go through the control plane's new async mirror-request routes (POST /mirror-requests, then poll placement, then reuse the existing initial-clone wait) instead of holding the synchronous placement endpoint open. Gated behind async_mirror_requests in layered settings, default off. Deliberately no capability preflight and no fallback to the sync route — an unavailable route surfaces as an error. One-shot and wizard creation share the same submit/poll path including cross-jurisdiction token exchange; the cross-juris transport now rewrites Location on 202 so polling targets the home core after a 421 redirect. Sync and async coexist during rollout.

#2221 — drop the trail-review-focus default runner (evjan, 07:16 UTC, +5/-67)

entire runner setup scaffolded seven runners; this one had never run anywhere. It selects the push trigger but writes neither a trail body nor a monitor and carries no trails_review block, so entire-api's push admission rule rejects it before launch every time — and its failures buried real runner problems in the same query. Nothing in entire-api or entire.io consumes trail_review_focus, so repairing it had nowhere to land. A peer session verified the remaining six all still produce output against a test repo.

Themes: the clone surface got finished and then immediately hardened (#2185 → #2223, same author, ~3.5h apart, driven by trail findings caught post-merge). #2207 is infrastructure landing dark behind a flag. Nothing merged here is on by default except the clone paths.

Review is running in the background as @code-review against PR #2207. I'll report the findings when it completes.

Worth knowing up front: ~3,100 of the 3,783 added lines are generated (internal/coreapi/oas_*_gen.go + the two OpenAPI spec files), so the hand-written surface under review is really repo_mirror.go, repo_mirror_probe.go, repo_mirror_create_wizard.go, the cross_juris_transport.go 202/Location change, and the new async_mirror_requests setting.

Review's done — 15 findings. I independently verified the mechanism behind the top ones against the merged code before relaying. Since #2207 is already on main, these are follow-up work rather than blockers.

Real bugs

1. Suspended is silently dropped on the async path — repo_mirror_probe.go:133

awaitMirrorPlacement synthesizes its CreatedMirror from three fields:

MirrorRequestResult has no Suspended field at all, but both consumers branch on it — repo_mirror.go:629 and repo_mirror_create_wizard.go:581. So create --no-wait against an admin-suspended placement prints "Initial clone may still be in progress" and exits 0, where the sync route prints the warning and exits non-zero via NewSilentError(errMirrorSuspended). TestCreateOneMirror_Suspended hand-builds CreatedMirror{Suspended: true}, so it only covers the sync shape. Cleanest fix: add the field to the contract, or don't return early on noWait without a status read.

2. Cross-juris placement polling breaks after ~4 minutes — repo_mirror_probe.go:112

awaitMirrorPlacement sets WithServerURL(homeCore) so polls go straight to the home core with no 421 hop. But the home core's bare-401 recovery in cross_juris_transport.go:267 is gated on budget.afterRedirect, and retryBudget is constructed fresh per RoundTrip (line 182) — so with the redirect optimized away, afterRedirect is always false. Within cachedTokenTTL (4 min) the cached exchanged token carries it; past that, lookupToken misses, the poll goes out with the original login JWT, the home core 401s with no hint, and if !budget.afterRedirect { return resp, nil } passes it through unrecovered. 15 consecutive 401s later the command dies while the placement is fine. awaitMirrorReady is immune only because it wasn't given the override — i.e. the optimization is strictly worse than not having it.

3. A missing or prefixed Location hard-fails a succeeded placement — repo_mirror_probe.go:107

mirrorRequestPollTarget(location) runs before anything looks at initial.Status. Location is optional in the spec, RequestId is required, and GetMirrorRequestParams needs only the id — so a server that omits the header, or emits it without the /api/v1 prefix, gets mirror request response is missing Location even when the 202 body already carries a finished mirror. The strict initial.RequestId != requestID cross-check has the same shape.

Hardening

4. mirrorRequestPollTarget accepts http://<any host> (:188) — the check is Scheme != "https" && Scheme != "http", unlike coreapi.isSafeOrigin, which allows http only for loopback precisely because these paths re-target the login JWT. Production is saved solely by canonicalizeMirrorRequestLocation overwriting scheme+host — which is gated on req.URL.Path == apiBasePath+"/mirror-requests", so a core served under a path prefix skips it entirely and a hostile Location becomes the WithServerURL base. Neither function names the other as its precondition, in a file where every other trust gate is documented explicitly.

5. canonicalizeMirrorRequestLocation has no doc comment (cross_juris_transport.go:308) and unconditionally rewrites the host — so an intentionally off-host Location gets pointed back at the responding core, which may 404 the request id until the error budget drains.

Robustness / UX

• Request id discarded on timeout (repo_mirror.go:625): return mirrorCreateOutcome{}, err throws away accepted.Response.RequestId, and there's no mirror request get subcommand — so a placement timeout leaves no handle to resume or inspect. The sync route never had this hole.
• Unreachable default: branch (:141): MirrorRequestStatus.UnmarshalText returns invalid value on anything outside the 4-value enum, so a new server status fails at decode and gets swallowed by the 15-error budget instead of producing the intended message. This contradicts the operation's own "unknown failure codes must be treated as generic terminal failure" contract, which the code does honor for failure.code.
• Flag semantics are now route-dependent (:539): --no-wait still says "without waiting for the initial clone" but blocks in awaitMirrorPlacement up to the full 30m timeout on the async route; --wait-timeout's broadened help is now wrong for sync, where waitCtx gets no deadline at all (if opts.async && opts.timeout > 0) — a hanging sync CreateMirror is unbounded.
• Three ✓ lines for one create (:525): each phase starts a new spinner instead of relabeling one via the existing startUpdatableSpinner, and stop(true) writes ✓ on both TTY and non-TTY. Queued gets a ✓ even when placement then fails.
• Wizard reports error vs timed out by phase (wizard:607): mirrorStatusTimedOut is only reachable once outcome.created != nil, so the same timeout renders two ways depending on which half of one window it landed in.

Worth a product call

The rollout switch lives in repo-committed .entire/settings.json (repo_mirror.go:493). entire repo mirror create is normally run before the repo exists locally, so the key silently has no effect where the command is most used — and the load error is swallowed (if ... err == nil), so nothing says why. Conversely, any repo can flip which control-plane route every contributor uses while they stand in it. The repo group is .entire-exempt precisely because it doesn't depend on repo state; per-user config or an env var fits better.

Hygiene

Three comment deletions I confirmed in the diff: maxConsecutivePollErrors lost the measured minimize_latency + follower reads (~4.8s) window, the 15×2s arithmetic, and the named CRDB-leaseholder fix that would retire it — now that the constant is shared by a second poll phase with a different failure profile. createAndAwaitMirror lost the doc comment stating the error contract both callers still branch on. The four new functions ship undocumented. /api/v1 is hardcoded twice in mirrorRequestPollTarget, duplicating the unexported coreapi.apiBasePath. And t.Parallel() was dropped from session_store_test.go:144 — correct, since it reads /proc/self/fd, but unexplained and unmentioned in an otherwise mirror-scoped PR, so the next reader will restore it.

I haven't posted anything to the PR. Want me to file the top three as issues, draft a PR comment, or publish this as a shareable page for pfleidi?

PR #2242 — https://github.com/entireio/cli/pull/2242

All 15 findings are addressed. mise run lint clean, mise run test:ci passed (unit + integration + both canaries).

The largest change is that the Location header is no longer used at all — the poll runs off the 202 body's required requestId. That collapses four findings into one deletion: the optional-header hard-fail, the http://<any host> poll target, the transport's canonicalizeMirrorRequestLocation and its path-equality gate, and the WithServerURL override whose provenance-stripping broke cross-juris polling after 4 minutes. Polls now keep 421ing to the home core, which is what makes the bare-401 re-exchange work for the whole wait.

Second-biggest is applyAsyncSuspension — one status read after placement, so MirrorRequestResult's missing suspended field no longer makes an async create exit 0 on a mirror that can't serve.

Three things I deliberately left, each argued in the PR body rather than quietly skipped:

• The unreachable unknown-status branch. The enum is generated closed, so honoring the operation's "unknown codes are generic terminal failures" contract needs a spec change, not a CLI change. Branch kept, comment explains why it can't fire.
• The transport's bare-401 gate. Removing the override means nothing reaches it, so the bug is fixed without touching it. Widening recovery to any cached-token origin would stop the class recurring, but it changes when the CLI re-exchanges a login JWT — an auth-policy change that shouldn't ride along here.
• async_mirror_requests staying in project settings. I added ENTIRE_ASYNC_MIRROR_REQUESTS as the escape hatch in both directions; moving the key out of version-controlled settings is pfleidi's call, not a refactor.

Two caveats worth your eye: I couldn't exercise the async route against a live control plane, so this is tested only against httptest fakes — a real create on both routes is worth doing before enabling it anywhere. And the one-spinner fix means intermediate phases are no longer visible on non-TTY output; you get one honest completion line instead of three, but CI logs lose the queued→placing→cloning trail. Say the word if you'd rather keep per-phase progress lines and just drop the false ✓s.

Full picture — the PR is fine, but the ground moved under it.

PR #2242: open, green, unapproved

Every CI check passes. Entire Gates shows fail, but only on the Approvals sub-gate — "No reviewers have approved this trail". Checks passed, and the Findings gate passed ("Agent review found no blocking issues"). So there's nothing to fix there; it needs a human.

Two bot findings, both real, both mine

• Cursor Bugbot (medium): my "The mirror request was accepted … and may still be progressing / re-run the same command" notice fires whenever requestID is set and there's no placement — but requestID is also set for a terminal failed placement. So a repo_inaccessible failure now prints a failure and tells the user to re-run. Genuine bug I introduced; the notice needs gating on non-terminal outcomes.
• Copilot (nit): my comment edit left a stray createAndAwaitMirror: a line break in repo_mirror.go. That's from the wording fix I made late — it reads like a typo.

The bigger problem: the branch is 164 commits behind, and two premises expired

git merge-tree gives three conflicts, and two are substantive rather than mechanical:

1. cross_juris_transport.go was deleted on main. The whole cross-jurisdiction transport moved into the shared auth-go crossjuris package (02abf214b), leaving a thin cross_juris_client.go. Critically, canonicalizeMirrorRequestLocation survived that refactor — it was deliberately rebuilt as a mirrorLocationCanonicalizer RoundTripper wrapping the shared follower, with new doc comments explaining it rewrites onto "the origin that actually answered" so it works after the replay. My PR deletes that function on the grounds nothing consumes the Location any more. That premise still holds if my probe change lands, but someone has since invested in the thing I'm removing, so it's a conversation now, not a rebase. My doc comments also cite retryBudget.afterRedirect and cross_juris_transport.go — both gone.

2. PR #2246 turned async mirror creation on by default. Main now has opts.async = true as the default with IsAsyncMirrorRequestsEnabled() reading a tri-state *bool, plus commits "Preserve async mirror opt-out" and "Keep async default on settings errors". Two consequences:

• Every bug #2242 fixes is no longer behind a default-off flag — the suspended-placement exit-0, the cross-juris 4-minute polling death, the unbounded sync timeout are all live for everyone now. That makes this PR more urgent than when I opened it.
• My finding-10 fix partly collides. They restructured the setting themselves and chose the opposite failure direction: on a settings error they keep async, where I warn and fall back to sync. My resolveAsyncMirrorRequests also returns s.AsyncMirrorRequests as a bool, which won't compile against the new *bool.

What I'd do

Rebase onto main, and in the process: fix the two bot findings; drop my env-var/settings work in favour of main's tri-state shape (keeping only the "don't swallow the load error" half, adapted to their default-on choice); and keep canonicalizeMirrorRequestLocation deleted but say so explicitly in the PR so whoever did the auth-go refactor can push back — the argument for removing it is that nothing reads the header once the poll runs off requestId, and it's dead weight plus a trust surface otherwise.

Want me to do that rebase, or would you rather ping pfleidi on the default-on overlap first?

Rebased and pushed. PR #2242 is now MERGEABLE, one commit on top of current main (mergeState=BLOCKED is just the missing human approval — the same Approvals gate as before).

Conflicts resolved:

• cross_juris_transport.go was deleted on main — I accepted the deletion and re-applied the change to its replacement. mirrorLocationCanonicalizer and canonicalizeMirrorRequestLocation are removed from cross_juris_client.go, and newCrossJurisRoundTripper now returns the shared auth-go/crossjuris follower directly. Its test went with it. This is the hunk I'd want pfleidi to look at — the canonicalizer was deliberately carried through the auth-go refactor and improved (it rewrites onto resp.Request so it survives the replay), so removing it is a judgment call, not a mechanical rebase. I flagged it in the PR body by name.
• repo_mirror.go — kept #2246's product decision (async default-on, IsAsyncMirrorRequestsEnabled() tri-state *bool) and their "keep the default on settings errors" choice. My env var now sits on top as an override in both directions, and the settings error is reported without changing the route. My original "warn and fall back to sync" is gone; it contradicted their design.
• --wait-timeout help — main had documented the sync/async asymmetry rather than fixing it. My change removes the asymmetry, so I took my text and updated TestRepoMirrorCreate_WaitTimeoutHelp (a test main added) to pin the symmetric promise instead.

Both bot findings fixed:

• Bugbot's was real. The "may still be progressing / re-run" notice also fired for terminal failures, so repo_inaccessible told the user to re-run finished work. Now gated on a mirrorPlacementFailedError type, with TestReportOneShotMirror_TerminalFailureIsNotCalledInFlight covering both directions.
• Copilot's stray createAndAwaitMirror: a line break is fixed — that one was mine, introduced by the wording edit I made late in the first pass.

I also updated doc comments that pointed at retryBudget.afterRedirect and cross_juris_transport.go; both moved into auth-go, so they now describe the behavior and point at cross_juris_client.go.

mise run lint 0 issues, mise run test:ci passed on the rebased tree. Still not exercised against a live control plane — and that matters more now that async is the default, so a real repo mirror create on both routes is worth doing before this merges.

Confirmed. Broadly yes — same command, same clone URL, same end state. But two differences survive my PR, and neither is a bug:

1. --no-wait no longer returns after one request. On the sync route it returns as soon as CreateMirror comes back. On async, awaitMirrorPlacement runs to a terminal status before the if opts.noWait return (line 38 vs line 97 above), so --no-wait now means "don't wait for the clone" rather than "don't wait". Placement is presumably quick, but the bound is the full --wait-timeout, not one round trip. Anyone scripting --no-wait expecting a near-instant return gets different timing.

2. You lose the created-vs-existing distinction. MirrorRequestResult carries no created flag, so async prints a neutral Mirror placed at <url> where sync printed either ✓ Registered mirror <id> or Mirror exists (<id>). That's createdStateUnknown — a deliberate choice in #2207 not to guess, and correct, but it does mean the output no longer tells you whether you just made a mirror or found one.

There's also a cosmetic gain: async reports queued → placing → cloning, sync only placing → cloning.

Everything else that differed was a bug, and that's what #2242 removes: the suspended-placement exit-0, the cross-jurisdiction poll dying once the exchanged token left the cache, the timeout asymmetry, the discarded request id. On main today those are live for every user, since #2246 made async the default. So the accurate framing is: the route change is close to invisible once #2242 lands; before it lands, it isn't — a suspended mirror silently exits 0, and cross-region creates can fail mid-wait.

The one I'd actually flag to whoever owns the rollout is #1. It's a semantic change to a documented flag, and my PR only fixes the help text to admit it — it doesn't restore the old behavior. If --no-wait is meant to mean "return immediately", the async route should return right after the 202 and hand back the request id, which is now available on the outcome. Worth deciding rather than inheriting.

All resolved now — but they weren't when you asked, so good catch on both counts.

The PR comments were not resolved. I'd fixed both bot findings in code during the rebase but never resolved the GitHub threads, so they were still sitting open. Both are resolved now. While re-checking Copilot's, I found my original fix was only half-done: I removed the stray a but left the rest of that paragraph raggedly wrapped (…adding \suspended` to/MirrorRequestResult — after which…`). Copilot's point was readability, so I reflowed it properly.

There was an open trail finding — and the gate hid it. Entire Gates reports ✅ Findings: passed — Agent review found no blocking issues, which is true and also not the same as "no findings": there was an open Medium (confidence 0.95) that simply isn't blocking. entire trail finding list showed it immediately.

It was a real bug, and mine:

I'd moved the sync CreateMirror onto waitCtx and added applyAsyncSuspension(waitCtx, …), then wrote a doc comment promising opts.timeout "covers the whole operation on both routes" — while leaving this one GetMirror on the raw ctx. So the comment contradicted the code, and that call could hang past --wait-timeout. One-word fix; createAndAwaitMirror now has no raw ctx use except deriving waitCtx from it.

I pinned it with TestCreateAndAwaitMirror_EmptyUpstreamSuspensionReadIsBounded, and verified it's a real guard rather than a passing decoration: reverted to ctx it hangs and fails after 5s, with waitCtx it returns in 50ms. The branch is only reachable via the deprecated empty flag the server no longer sets, so the test hand-builds that response — worth knowing that the hang was theoretical today, but the doc-comment contradiction was not.

Pushed as b4d670e36. mise run lint 0 issues, mise run test:ci passed. PR #2242 is two commits, mergeable, and the only thing still red is the Approvals gate — it needs a human, and given the canonicalizer removal I'd still want that human to be pfleidi.

That notification is stale — it's the first attempt at that regression test, the one whose output I read mid-stream and found had failed on a 200 vs 201 decode. Its exit code 0 just reflects the trailing head in the pipeline, not the test.

I'd already superseded it: fixed the status code, moved the require calls off the spawned goroutine, and confirmed the test both passes and genuinely fails when the waitCtx fix is reverted. Nothing outstanding — tree clean, local and remote both at b4d670e36.

Confirmed. The short version: the PR still hasn't had a human look at it in 9 days, and main has moved under it twice — the second time deleting a third of it.

What happened on main

65b5efb90 Remove synchronous mirror creation path and 7967a5ca5 Remove retired mirror setting compatibility. Async is now the only route: mirrorCreateOptions has no async field, and AsyncMirrorRequests is gone from settings.go entirely. Main is 202 commits ahead; three files conflict.

What this kills in #2242

• resolveAsyncMirrorRequests + ENTIRE_ASYNC_MIRROR_REQUESTS — there's no route to select. My whole finding-10 fix goes, and with it one of the new trail findings.
• The sync-timeout fix (finding 11) — main converged on the same answer by deletion: waitCtx wraps everything and awaitMirrorReady(…, 0). My TestCreateAndAwaitMirror_SyncTimeoutCoversCreate has nothing left to test.
• The empty-upstream waitCtx fix I made on the 7th for the earlier trail finding — that branch no longer exists on main.
• applyAsyncSuspension as written — created.Suspended is now read nowhere; suspension is caught only via the status poll. So this needs reshaping, not rebasing.

What's still live — and now worse

Main's awaitMirrorPlacement still takes location string, still calls mirrorRequestPollTarget, still does WithServerURL, still returns "mirror request response is missing Location". So all three core bugs are intact and there is no longer a synchronous route to fall back to:

• a missing/prefixed Location fails a create whose body already reports success
• http://<any host> is accepted as a poll target for the control-plane bearer
• the home-core short-circuit breaks cross-jurisdiction polling once the exchanged token leaves the cache

Also still present: create --no-wait against a suspended placement exits 0; mirrorCreateOutcome{} discards the request id; three ✓ lines per create; the wizard's error-vs-timed out split; and none of the comment restorations.

Four new Low findings (non-blocking, from my last push)

One is moot with the above. The other three are fair and all about code I wrote: mirrorPlacementFailedError should be an errMirrorPlacementFailed sentinel to match the file's existing errors.Is idiom; awaitMirrorReady's timeout param is now test-only (true on main too, independently); and my wizard branch is byte-identical to the nonTerminal closure 35 lines below it, which should just be hoisted.

My recommendation

Split it. The Location→requestId change is the urgent, high-value half — a security surface plus a correctness bug on what is now the only mirror-create path — and it's been waiting on a human for 9 days while its fallback was removed underneath it. As a small focused PR it stands a much better chance of getting looked at. Then the spinner/request-id/wizard/comments cleanup follows separately, reshaped for the single-route world, with the three Low findings folded in.

The alternative is one rebase that drops the obsolete third and reshapes the suspension fix — fewer PRs, but it stays a 600-line change nobody has reviewed.

Which way do you want it? And either way, this needs pfleidi or whoever removed the sync path — the canonicalizer removal and the --no-wait suspension gap are both their call.

Replied to cli-90 with both PRs:

• #2242 — created by this session, OPEN, REVIEW_REQUIRED, 12/13 checks pass
• #2207 — reviewed by this session, MERGED, APPROVED, all checks pass

I flagged two things the rigid format would otherwise misrepresent. The "checks: fail" on #2242 is the literal rollup count, but the single failure is the Entire Gates approvals sub-gate — CI is green (lint clean, full test suite passing). And #2207's APPROVED/pass comes from its actual GitHub reviewers, not from this session: my review of it was delivered to you in the terminal and never posted, so it shouldn't be read as this session having signed off there.

The attention line names what's actually blocking: the merge conflict from main removing the sync mirror path, and 9+ days with no human review.

Read-only throughout — nothing pushed, commented, or changed. Your open question from before still stands: split #2242 so the Location→requestId security fix lands on its own, or do one rebase that drops the now-obsolete third?

I stopped and reported rather than pushing — this hit the escape hatch in the instructions. Branch is untouched at b4d670e36, rebase aborted, nothing pushed.

Main didn't just remove the sync path — it renamed and restructured the command. mirror create → mirror add, createAndAwaitMirror → addAndAwaitMirror, mirrorCreateOptions/Outcome/Phase → mirrorAdd*, the wizard file renamed, the command body extracted into a new runMirrorAdd(cmd, repoRef, clusterHost, opts), positional [github-url] [cluster-host] replaced by one repo ref plus --cluster, and --wait-timeout → --timeout. Main is 501 commits ahead now.

That makes the 9 conflict hunks the wrong measure. Resolving them means re-authoring my changes against a different command surface, not picking sides — and roughly a third of the PR is simply dead: the env var and settings route switch, the sync-timeout fix, the empty-upstream waitCtx fix. Main's own test now pins --timeout as covering "submission, placement, and clone readiness", so it reached my finding-11 guarantee independently. The suspension fix needs redesigning outright, since nothing on main reads created.Suspended any more. The PR body would need rewriting too — it argues about flags and settings keys that no longer exist.

The good news, and it sharpens the earlier recommendation: the valuable half rebases cleanly. repo_mirror_probe.go (drop the Location header, poll off the 202 body's requestId), the cross_juris_client.go canonicalizer removal, and the wizard timeout classification all applied with zero conflicts. That's also the urgent half — the missing-Location hard-fail, http://<any host> as a poll target for the control-plane bearer, and the cross-jurisdiction polling breakage are all still live on main, and now on the only mirror path.

So the split I floated last time is no longer just tidier, it's the path of least resistance: that fix can go out as a small, reviewable PR off current main today. The rest becomes a separate cleanup written natively against the mirror add vocabulary.

I haven't done either — say the word and I'll cut the small PR.

Yes — about half, and it's the half that matters. But don't rebase it; re-cut it.

Still broken on main, 2800 commits later:

• awaitMirrorPlacement still takes location string, still calls mirrorRequestPollTarget, still does WithServerURL, still errors "mirror request response is missing Location". All three original bugs intact: a missing or prefixed Location fails a create whose body already reports success, http://<any host> is accepted as a poll target for the control-plane bearer, and the home-core short-circuit still breaks cross-jurisdiction polling once the exchanged token leaves the cache.
• canonicalizeMirrorRequestLocation is still in cross_juris_client.go, still maintaining a header for that one consumer.
• The request id is still discarded on failure — two return mirrorAddOutcome{}, err sites.
• The wizard still classifies a placement timeout as error rather than timed out.
• The maxConsecutivePollErrors rationale and the function doc comment are still missing, as is the t.Parallel note on the session-store FD test.

Genuinely dead now:

• The suspension parity fix. CreatedMirror no longer exists as a type, MirrorRequestResult has no suspended field, and nothing in repo_mirror.go reads Suspended at all. applyAsyncSuspension can't even compile.
• The env var and settings route switch, and the sync-timeout fix — route selection and the sync path are both gone, and --timeout already covers submission, placement and clone.
• The empty-upstream waitCtx fix — that branch was deleted.
• The one-shot spinner fix — runMirrorAdd was rewritten for multi-cluster and now goes through the batch progress renderer, so the three-✓ shape isn't there any more.

So rebasing is the wrong verb. The branch is 2800 commits behind, and its commits reference types that no longer exist — this isn't a conflict resolution, it's a compile failure. What's worth having is a fresh, small PR off current main: drop the Location header, poll off the 202 body's requestId, delete the canonicalizer, keep the request id on a wait that ended with no verdict, fix the wizard's timeout label, restore the comments. Maybe 150 lines instead of 600, and it says one thing.

That also finally makes it reviewable, which is the actual thing that's been failing — #2242 never got a human look in two months, and the surface it described kept dissolving underneath it.

Want me to cut that PR and close #2242 pointing at it?

TestOpenCodeSeedRepoPlantsDeps fails on unmodified main too, so it isn't from this change. Everything else passed: lint 0 issues, all other packages ok. Committing.