diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs
index 2d87cc01..35b69808 100644
--- a/hive-c0re/src/forge.rs
+++ b/hive-c0re/src/forge.rs
@@ -991,8 +991,12 @@ async fn ensure_mirror_repo(
             tracing::info!(%owner, %repo, %upstream, "forge: created pull-mirror");
             Ok(())
         }
-        409 | 422 => {
-            tracing::debug!(%owner, %repo, "forge: pull-mirror already exists");
+        // 409 = a race created it between our GET check and here (the GET
+        // is the real idempotency guard). NOT 422: for the migrate endpoint
+        // 422 is a validation error (bad clone_addr / service), so it must
+        // surface via the bail arm, not be swallowed as "already exists".
+        409 => {
+            tracing::debug!(%owner, %repo, "forge: pull-mirror already exists (race)");
             Ok(())
         }
         other => {