If you launch a new mirror and tried a clone, the mirror passes health check but returns an error to the client.

The mirror shouldn't consider itself "healthy" to return an error when it obviously knows it cannot handle clone requests associated with repos it hasn't finished syncing. Can you make the mirror perform a just-in-time fetch from the primary or mark itself unhealthy so no traffic is routed to it?