diff --git a/cc-ci-plan/upstream/bluesky-pds.md b/cc-ci-plan/upstream/bluesky-pds.md
index 4fb49dd..917f486 100644
--- a/cc-ci-plan/upstream/bluesky-pds.md
+++ b/cc-ci-plan/upstream/bluesky-pds.md
@@ -15,13 +15,20 @@
   plus a bundled `goat` CLI at /usr/local/bin/goat. This matches the current `main`
   Dockerfile (`FROM node:24.15-alpine3.23`, `COPY ./service`, CMD index.ts).
   Any recipe override that assumes `/app/index.js` crash-loops MODULE_NOT_FOUND on it.
-- **Exact-version tags keep the classic layout through v0.4.219** (newest exact tag as of
-  2026-06-11; ghcr digest `sha256:e0b756701c92…`): `FROM node:20.20-alpine3.23`,
-  WORKDIR `/app`, `/app/index.js` present, `dumb-init` at /usr/bin/dumb-init,
-  `CMD ["node", "--enable-source-maps", "index.js"]`, `@atproto/pds: 0.4.219`
-  (verified by running the image: Node v20.20.2). Exact tags published:
-  …0.4.135, 0.4.136, 0.4.138, 0.4.158, 0.4.169, 0.4.182, 0.4.188, 0.4.193, 0.4.204,
-  0.4.208, 0.4.219 — plus an anomalous `0.4.5001` (avoid; looks like a mis-tag).
+- **Exact-version tags — two eras:**
+  - **Through `0.4.219`** (old scheme, `FROM node:20.20`, CMD `index.js`): `@atproto/pds: 0.4.219`,
+    WORKDIR `/app`, `/app/index.js` present, `dumb-init` at /usr/bin/dumb-init,
+    `CMD ["node", "--enable-source-maps", "index.js"]`. Exact tags in this era:
+    …0.4.135, 0.4.136, 0.4.138, 0.4.158, 0.4.169, 0.4.182, 0.4.188, 0.4.193, 0.4.204,
+    0.4.208, 0.4.219.
+  - **`0.4.5001` onward** (new scheme, `FROM node:24`, CMD `index.ts`): The unusual tag is the new
+    PDS versioning format (`<base 0.4>.<minor><patch padded to 3>` = 50.01 → `5001`). This is
+    `@atproto/pds` 0.5.1, Node v24, service restructured to run TypeScript directly (`index.ts`).
+    Image built 2026-05-30, revision `eb46a2e`. Validated GREEN by cc-ci tests
+    (health_check, goat_account, subdomain_tls) in upgrade PR #3 (2026-06-17).
+    **The recipe's `entrypoint.sh.tmpl` must exec `index.ts` (not `index.js`) for this tag.**
+    Note: (earlier versions of this file flagged `0.4.5001` as "anomalous/mis-tag" — that was
+    incorrect; it is the new versioning scheme.)
 - **Env interface stable across 0.4.x:** the recipe's env (PDS_HOSTNAME,
   PDS_DATA_DIRECTORY, PDS_BLOBSTORE_DISK_LOCATION, PDS_BLOB_UPLOAD_LIMIT,
   PDS_EMAIL_SMTP_URL, PDS_EMAIL_FROM_ADDRESS, PDS_INVITE_REQUIRED, LOG_ENABLED) and