fix: divergence alerting — alert suppression bug + stale ref detection

Bug: echo "alerted" ran regardless of curl success, permanently suppressing
alerts on delivery failure. Fix: if/then/else wraps the state write.

Warning: stale tracking refs after push steps caused false divergence.
Fix: re-fetch both remotes before comparing.

Both findings from Ganymede review of Step 6.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

deploy/sync-mirror.sh

@@ -191,10 +191,11 @@ print('no')
                 else
                     PR_TITLE=$(echo "$branch" | sed 's|/|: |;s/-/ /g')
                 fi
+                PAYLOAD=$(python3 -c "import sys,json; print(json.dumps({'title':sys.argv[1],'head':sys.argv[2],'base':'main'}))" "$PR_TITLE" "$branch")
                 RESULT=$(curl -sf -X POST "http://localhost:3000/api/v1/repos/teleo/teleo-codex/pulls" \
                     -H "Authorization: token $FORGEJO_TOKEN" \
                     -H "Content-Type: application/json" \
-                    -d "{\"title\":\"$PR_TITLE\",\"head\":\"$branch\",\"base\":\"main\"}" 2>/dev/null || echo "")
+                    -d "$PAYLOAD" 2>/dev/null || echo "")
                 PR_NUM=$(echo "$RESULT" | grep -o '"number":[0-9]*' | head -1 | grep -o "[0-9]*" || true)
                 if [ -n "$PR_NUM" ]; then
                     log "Auto-created PR #$PR_NUM on Forgejo for $branch"
@@ -210,7 +211,7 @@ print('no')
                                 python3 -c "import sys,json; prs=json.load(sys.stdin); print(prs[0]['number'] if prs else '')" 2>/dev/null || true)
                         fi
                     fi
-                    if [ -n "$GH_PR_NUM" ]; then
+                    if [[ "$GH_PR_NUM" =~ ^[0-9]+$ ]] && [[ "$PR_NUM" =~ ^[0-9]+$ ]]; then
                         sqlite3 "$PIPELINE_DB" "UPDATE prs SET github_pr = $GH_PR_NUM WHERE number = $PR_NUM;" 2>/dev/null && \
                             log "Linked GitHub PR #$GH_PR_NUM -> Forgejo PR #$PR_NUM" || \
                             log "WARN: Failed to link GitHub PR #$GH_PR_NUM to Forgejo PR #$PR_NUM in DB"
@@ -225,4 +226,57 @@ else
     log "No new GitHub-only branches"
 fi
 
+# Step 6: Divergence alerting
+# After all sync steps, check if GitHub and Forgejo main still differ.
+# 2 consecutive divergent cycles (4 min) triggers a one-shot Telegram alert.
+DIVERGENCE_FILE="/opt/teleo-eval/logs/.divergence-count"
+git fetch forgejo main --quiet 2>/dev/null || true
+git fetch origin main --quiet 2>/dev/null || true
+GH_MAIN_FINAL=$(git rev-parse refs/remotes/origin/main 2>/dev/null || true)
+FG_MAIN_FINAL=$(git rev-parse refs/remotes/forgejo/main 2>/dev/null || true)
+
+if [ -n "$GH_MAIN_FINAL" ] && [ -n "$FG_MAIN_FINAL" ] && [ "$GH_MAIN_FINAL" != "$FG_MAIN_FINAL" ]; then
+    PREV=$(cat "$DIVERGENCE_FILE" 2>/dev/null || echo "0")
+    if [ "$PREV" = "alerted" ]; then
+        log "DIVERGENCE: still diverged (already alerted)"
+    else
+        COUNT=$((PREV + 1))
+        echo "$COUNT" > "$DIVERGENCE_FILE"
+        log "DIVERGENCE: cycle $COUNT — GitHub=$GH_MAIN_FINAL Forgejo=$FG_MAIN_FINAL"
+        if [ "$COUNT" -ge 2 ]; then
+            BOT_TOKEN=$(cat /opt/teleo-eval/secrets/telegram-bot-token 2>/dev/null || true)
+            ADMIN_CHAT=$(cat /opt/teleo-eval/secrets/admin-chat-id 2>/dev/null || true)
+            if [ -n "$BOT_TOKEN" ] && [ -n "$ADMIN_CHAT" ]; then
+                ALERT_MSG=$(python3 -c "
+import json, sys
+msg = '⚠️ Mirror divergence detected\\n\\n'
+msg += f'GitHub main: {sys.argv[1][:8]}\\n'
+msg += f'Forgejo main: {sys.argv[2][:8]}\\n'
+msg += f'Diverged for {sys.argv[3]} consecutive cycles ({int(sys.argv[3])*2} min)\\n\\n'
+msg += 'Check sync-mirror.sh logs: /opt/teleo-eval/logs/sync.log'
+print(json.dumps({'chat_id': sys.argv[4], 'text': msg, 'parse_mode': 'HTML'}))
+" "$GH_MAIN_FINAL" "$FG_MAIN_FINAL" "$COUNT" "$ADMIN_CHAT")
+                if curl -sf -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \
+                    -H "Content-Type: application/json" \
+                    -d "$ALERT_MSG" >> "$LOG" 2>&1; then
+                    log "DIVERGENCE: alert sent to admin"
+                    echo "alerted" > "$DIVERGENCE_FILE"
+                else
+                    log "WARN: Failed to send divergence alert (will retry next cycle)"
+                fi
+            else
+                log "WARN: Cannot send divergence alert — missing bot token or admin chat ID"
+            fi
+        fi
+    fi
+else
+    if [ -f "$DIVERGENCE_FILE" ]; then
+        PREV=$(cat "$DIVERGENCE_FILE" 2>/dev/null || echo "0")
+        if [ "$PREV" != "0" ]; then
+            log "DIVERGENCE: resolved — repos back in sync"
+        fi
+        rm -f "$DIVERGENCE_FILE"
+    fi
+fi
+
 log "Sync complete"