From ba7f2f243c43c6e8b521dd50555a94c590537b1d Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Fri, 26 Jun 2026 18:19:41 +0000
Subject: [PATCH] fix(web-probe): probe sentinel mirror before source sync skip

---
 scripts/src/hwlab-node-web-sentinel-cicd.ts | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index dbc12dc6..e6bc61c5 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -648,8 +648,9 @@ function probeImageRegistry(state: SentinelCicdState, timeoutSeconds: number): R
 function runSentinelImageBuildConfirmed(state: SentinelCicdState, options: Extract<WebProbeSentinelOptions, { kind: "image" }>): RenderedCliResult {
   const startedAt = Date.now();
   const command = "web-probe sentinel image build";
-  const sourceMirrorSync = state.sourceHead.ok === true ? sentinelSourceMirrorAlreadyPresentResult(state) : runSentinelSourceMirrorSyncJob(state, options.timeoutSeconds);
-  const sourceMirrorReady = sourceMirrorSync.ok === true || state.sourceHead.ok === true;
+  const sourceMirrorProbe = probeSourceMirror(state, Math.min(options.timeoutSeconds, 20));
+  const sourceMirrorSync = record(sourceMirrorProbe).ok === true ? sentinelSourceMirrorAlreadyPresentResult(state, sourceMirrorProbe) : runSentinelSourceMirrorSyncJob(state, options.timeoutSeconds);
+  const sourceMirrorReady = sourceMirrorSync.ok === true;
   const publish = sourceMirrorReady
     ? runSentinelPublishJob(state, false, options.timeoutSeconds)
     : sentinelBlockedRemoteResult("source-mirror-sync-blocked", "sentinel source mirror sync failed; publish job was not started");
@@ -701,8 +702,9 @@ function runSentinelControlPlaneConfirmed(state: SentinelCicdState, options: Ext
   const cicdWaitWarningSeconds = controlPlaneWaitWarningSeconds(state);
   const deadline = startedAt + cicdWaitWarningSeconds * 1000;
   const remainingCicdWaitSeconds = () => remainingSeconds(deadline, Math.min(options.timeoutSeconds, cicdWaitWarningSeconds));
-  const sourceMirrorSync = applyOnly ? null : state.sourceHead.ok === true ? sentinelSourceMirrorAlreadyPresentResult(state) : runSentinelSourceMirrorSyncJob(state, remainingCicdWaitSeconds());
-  const sourceMirrorReady = applyOnly || record(sourceMirrorSync).ok === true || state.sourceHead.ok === true;
+  const sourceMirrorProbe = applyOnly ? null : probeSourceMirror(state, Math.min(remainingCicdWaitSeconds(), 20));
+  const sourceMirrorSync = applyOnly ? null : record(sourceMirrorProbe).ok === true ? sentinelSourceMirrorAlreadyPresentResult(state, sourceMirrorProbe) : runSentinelSourceMirrorSyncJob(state, remainingCicdWaitSeconds());
+  const sourceMirrorReady = applyOnly || record(sourceMirrorSync).ok === true;
   const publish = applyOnly
     ? null
     : sourceMirrorReady
@@ -1563,11 +1565,12 @@ function sourceMirrorAlreadyReadyWarnings(state: SentinelCicdState, sourceMirror
   return [`sentinel source mirror sync did not complete, but internal git mirror already contains ${short(state.sourceHead.commit)}; continuing publish from the YAML-declared read URL and treating the sync failure as a non-blocking egress warning.`];
 }
 
-function sentinelSourceMirrorAlreadyPresentResult(state: SentinelCicdState): Record<string, unknown> {
+function sentinelSourceMirrorAlreadyPresentResult(state: SentinelCicdState, probe: unknown): Record<string, unknown> {
   return {
     ok: true,
     phase: "already-present",
     jobName: null,
+    probe: record(probe),
     payload: {
       ok: true,
       status: "already-present",