journal(redfix): M2 bluesky — abra drops compose net aliases (proven); pivot to service rename app->pds + coupled cc-ci exec-ref update

machine-docs/JOURNAL-redfix.md

@@ -311,3 +311,26 @@ keycloak (collision-free canonical_domain + enroll). Starting with mattermost #1
 
 Remaining M2: bluesky promote-verify, gitea recipe PR (app.ini writable), keycloak harness
 (collision-free canonical_domain + enroll), mumble harness (handshake stabilization).
+
+## 2026-06-18T02:10Z — M2 bluesky: alias fix blocked by abra; pivoting to service RENAME
+
+Verified the bluesky `pds` network-alias fix end-to-end and found a blocker:
+- `docker stack deploy` HONORS compose network aliases (throwaway test: app got `Aliases:["pds","app"]`).
+- `docker compose config` PRESERVES the alias in its render.
+- BUT the harness/abra promote deploy produced an app service with `Aliases:["app"]` only — the `pds`
+  alias was DROPPED. The fixed Caddyfile (pds:3000) DID deploy (same per-run tree), so abra read my
+  recipe tree; by elimination, **abra's own compose→swarm translation drops service network aliases**
+  (it's not docker, not the tree). Also confirmed: the bluesky promote is a non-chaos pinned deploy.
+  (Two stale-config gotchas also hit + fixed: docker configs are immutable+versioned — a stale
+  `warm-bluesky..._caddyfile_v1` was reused until I removed it; lesson for gitea = bump config versions.)
+
+→ Pivot to the ROBUST fix: RENAME the PDS service `app`→`pds`. Docker auto-adds the service short-name
+as a network alias (abra can't drop that — the deployed `app` proved the service-name alias is always
+applied), so caddy's `reverse_proxy pds:3000` resolves THIS stack's PDS (unique on internal; no `pds`
+on the shared proxy). Coupled cc-ci change: 2 `exec_in_app(...)` calls default `service="app"`
+(`tests/bluesky-pds/_p4.py:40`, `custom/test_account_and_post.py:49`) → must become `service="pds"`
+(NOT a weakening — same assertion, correct service). The warm-routing PROOF (warm-bluesky-pds→200) is
+the promote path (custom exec tests not involved); cold !testme-green needs the cc-ci ref update.
+
+Need to determine how cc-ci-side code reaches a !testme run (also required for keycloak + mumble
+harness fixes) — investigating CCCI_REPO/Drone checkout next.