the readings the release produced, and the two defects the top-up had

[Sunrisepeak]

Two things the release produced: the readings it was supposed to, and a pair of defects in the tool that mirrors it.

Sandbox verification

SubOS v920, CN mirror, both legs against published artefacts:

section	2026.9.21.2	2026.9.21.3
A identity and mirror	ok	ok
B / C / D (the previous wave's CHANGE sections)	ok	ok
E / F (GUARD)	ok	ok
G builtins = "iso" emits -fno-builtin	FAIL	ok
H mcpp test --no-run	FAIL	ok
	fails=2	fails=0, nothing skipped

B, C and D passing on both is correct rather than a hole: they are the previous wave's changes and become guards once their own release has shipped. Only G and H are CHANGE sections for this one, and both are red on the older engine.

mirror_res.sh: two defects, one measurement

A local top-up exited 0 and printed all assets mirrored + verified on 1 host(s) with this one line above it:

[mirror] no GITCODE_TOKEN/gtc; skipping gitcode mirror

Nothing had reached GitCode. A GET against gitcode.com returned 404, which is how it was found.

The gate asked the wrong question. gtc resolves its own credentials — GITCODE_TOKEN first, then the config file its --help documents — exactly as gh does, and the github leg has always accepted either:

if [[ -n "${XLINGS_RES_TOKEN:-}" ]] || gh auth status >/dev/null 2>&1; then   # either
if [[ -n "${GITCODE_TOKEN:-}"    ]] && command -v gtc >/dev/null 2>&1; then   # both

So a machine with a working, configured gtc was told it had none — and that is the machine this script is run on by hand, which is the whole reason it can be: the cross-border upload from a GitHub runner is the shaped path that has cost four releases their aarch64 asset.

The check that should have caught it could not. verify iterates the hosts that turned out to be *_ENABLED, so its denominator came from the same enumeration as its numerator. It cannot distinguish "both hosts serve every asset" from "one host was skipped and the other serves every asset". The skip was invisible to the only thing that could have reported it.

MIRROR_HOSTS states the required set before anything is probed, default both. Wanting one leg stays possible — topping GitCode up by hand is legitimate — but it has to be asked for rather than being what happened. Missing credentials for a required host exit 2 and name both places a token can live.

Measured, four paths:

case	before	after
local, gtc configured, no env var	skipped silently, exit 0	both hosts mirrored and verified
MIRROR_HOSTS=gtc	n/a	GitHub deliberately excluded, exit 0
gtc present with no token	skipped silently, exit 0	exit 2, naming both token locations
CI (both tokens in the environment)	2 hosts	unchanged, 2 hosts

The third case had to be isolated with a config home carrying gh and not gtc: emptying the whole config home fails the upstream download instead and never reaches the gate, which is a test that would have passed for the wrong reason.

The publish chain

Squash tree byte-identical to the PR head, so the 39 green checks transfer. Six release jobs green. Eight GitCode assets serving 200 with sizes equal to upstream. All four archives downloaded from the CN mirror and their sha256 recomputed: equal to their sidecars and to the four values in openxlings/xim-pkgindex#868.