Until now mirror only answered a copy the store already held, so mesh-build-image had nothing to call for an upstream base (design 51: an upstream image is copied by mirror with its pinned digest). The copy takes an anonymous pull token, checks every manifest's and blob's bytes against its digest, copies an index's every platform first, and fetches only the blobs the store lacks. tags was already served. Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig