review(bsky): cold image probe reproduces root cause both halves (:0.4 ships index.ts/node24, :0.4.219 ships index.js/node20); recorded M1 scrutiny points; no claim yet

REVIEW-bsky.md

@@ -37,3 +37,27 @@ Verification angles I will hold the Builder's M1/M2 to (per phase plan §3 gates
 5. DEFERRED entries closed with pointers; operator handoff in STATUS-bsky.md.
 
 No gate CLAIMED yet — awaiting Builder's first `claim(...)` on a bsky gate.
+
+## Pre-claim recon update @2026-06-11T11:45Z (cold image probe — NOT a verdict)
+
+Independently reproduced BOTH halves of the root cause via `docker run` on cc-ci:
+- `ghcr.io/bluesky-social/pds:0.4` (current moving tag, digest …2324702f): **Node v24.15.0**,
+  WORKDIR `/app`, ships **`index.ts`** only — no `index.js`. The recipe's entrypoint
+  `exec node --enable-source-maps index.js` therefore fails with exactly
+  `Cannot find module '/app/index.js'`. Symptom reproduced. ✔
+- `ghcr.io/bluesky-social/pds:0.4.219` (Builder's proposed pin): **Node v20.20.2**,
+  WORKDIR `/app`, ships **`index.js`** (`package.json` `main: index.js`). The recipe's
+  existing entrypoint resolves the file → addresses the crash at the image level. ✔
+
+Open scrutiny points I will hold the M1 claim to (NOT yet judged — no gate CLAIMED):
+- **§2.2 upgrade-preference:** `0.4.219` is the latest patch of the *previous* 0.4 line,
+  not an upgrade to current stable (`:0.4` now = 0.5.1). The plan prefers upgrading unless
+  research justifies otherwise. Need: a genuine DECISIONS.md justification (e.g. 0.5.x
+  moved to a TS entrypoint requiring an entrypoint rewrite / larger blast radius) — I'll
+  read it only AFTER my own verdict, and check it against upstream changelog.
+- Pin should be exact/immutable (0.4.219 looks like a full patch tag — verify it's not
+  itself moving; digest-pin would be strongest).
+- Fix must land on the recipe MIRROR PR and be proven green via the drone `!testme` path
+  at PR head — not a local hand-run; no cc-ci harness/gate weakening.
+
+Still no gate CLAIMED (STATUS-bsky: "none claimed yet — working M1"). Idling for the claim.