diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index 9f7de1d6..ef77da98 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -1118,15 +1118,28 @@ function probeSourceMirror(state: SentinelCicdState, timeoutSeconds: number): Re
     "commit=$(kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" rev-parse \\\"refs/heads/$branch\\\" 2>/dev/null\" 2>/dev/null)",
     "rc=$?",
     "object_rc=1",
+    "expected_object_rc=1",
+    "contains_rc=1",
     "if [ \"$rc\" -eq 0 ]; then",
     "  kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" cat-file -e \\\"$commit^{commit}\\\" 2>/dev/null\" >/dev/null 2>&1",
     "  object_rc=$?",
     "fi",
-    "node - \"$rc\" \"$object_rc\" \"$commit\" \"$expected\" \"$repo_path\" \"$branch\" <<'NODE'",
-    "const [rc, objectRc, commit, expected, repoPath, branch] = process.argv.slice(2);",
+    "if [ -n \"$expected\" ]; then",
+    "  kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" cat-file -e \\\"$expected^{commit}\\\" 2>/dev/null\" >/dev/null 2>&1",
+    "  expected_object_rc=$?",
+    "fi",
+    "if [ \"$rc\" -eq 0 ] && [ \"$expected_object_rc\" -eq 0 ]; then",
+    "  kubectl -n " + shellQuote(namespace) + " exec deploy/git-mirror-http -- sh -lc \"git --git-dir=\\\"$repo_path\\\" merge-base --is-ancestor \\\"$expected\\\" \\\"$commit\\\" 2>/dev/null\" >/dev/null 2>&1",
+    "  contains_rc=$?",
+    "fi",
+    "node - \"$rc\" \"$object_rc\" \"$expected_object_rc\" \"$contains_rc\" \"$commit\" \"$expected\" \"$repo_path\" \"$branch\" <<'NODE'",
+    "const [rc, objectRc, expectedObjectRc, containsRc, commit, expected, repoPath, branch] = process.argv.slice(2);",
     "const present = Number(rc) === 0 && /^[0-9a-f]{40}$/i.test(commit || '');",
     "const objectPresent = present && Number(objectRc) === 0;",
-    "console.log(JSON.stringify({ ok: objectPresent && (!expected || commit === expected), mode: 'internal-git-mirror', present, objectPresent, commit: present ? commit : null, expectedCommit: expected || null, branch, repoPath, persistentMirrorPresent: objectPresent, readUrl: process.env.SOURCE_GIT_MIRROR_READ_URL || null, valuesRedacted: true }));",
+    "const expectedObjectPresent = !expected || Number(expectedObjectRc) === 0;",
+    "const containsExpected = !expected || commit === expected || Number(containsRc) === 0;",
+    "const relation = !expected ? 'unconstrained' : commit === expected ? 'equal' : containsExpected ? 'mirror-ahead' : expectedObjectPresent ? 'diverged-or-behind' : 'expected-object-missing';",
+    "console.log(JSON.stringify({ ok: objectPresent && expectedObjectPresent && containsExpected, mode: 'internal-git-mirror', present, objectPresent, expectedObjectPresent, containsExpected, relation, commit: present ? commit : null, expectedCommit: expected || null, branch, repoPath, persistentMirrorPresent: objectPresent && expectedObjectPresent, readUrl: process.env.SOURCE_GIT_MIRROR_READ_URL || null, valuesRedacted: true }));",
     "NODE",
   ].join("\n");
   const result = runCommand(["trans", stringAt(state.controlPlaneNode, "kubeRoute"), "sh", "--", `export SOURCE_GIT_MIRROR_READ_URL=${shellQuote(stringAt(state.cicd, "source.gitMirrorReadUrl"))}\n${script}`], repoRoot, { timeoutMs: Math.min(timeoutSeconds, 60) * 1000 });