status(bsky): bootstrap phase — root cause proven (:0.4 moving tag now ships 0.5.1/node24/index.ts; recipe entrypoint execs index.js), fix = exact-pin 0.4.219; decisions + upstream registry

machine-docs/DECISIONS.md

@@ -1353,3 +1353,17 @@ recipe"); pass iff the table rendered clean; anything else unver + loud log. Har
 (observed ~0.7s); executor runs before the tiers (tree at tested ref), double-wrapped, R7
 verdict-neutral. Full output → run artifact `lint.txt` (dashboard-served); status + failing
 rule ids → results.json `lint`.
+
+**bluesky-pds re-pin decision (phase bsky, 2026-06-11).** The recipe pinned the moving tag
+`ghcr.io/bluesky-social/pds:0.4`, which upstream now republishes with main-branch builds
+(currently @atproto/pds 0.5.1, Node 24, `/app/index.ts` — no `index.js`), breaking the
+recipe's entrypoint override (`exec node --enable-source-maps index.js`). Fix: pin the
+newest RELEASED exact tag `0.4.219` (Node 20.20, `/app/index.js`, CMD identical to the
+recipe's exec line — entrypoint stays valid unchanged) and bump the version label
+`0.2.0+v0.4` → `0.3.0+v0.4.219` (minor bump for an upstream pin change, immich-PR#2
+precedent). REJECTED: tracking 0.5.1 (only exists as moving/sha- tags built from main —
+no release tag; would also require entrypoint `index.ts` migration against an unreleased
+version); digest-suffix pinning (abra survey/upgrade tooling chokes on tag@digest — see
+immich standing note). When upstream cuts real 0.5.x release tags, upgrade properly
+(entrypoint will then need the index.ts/Node-24 migration — recorded in
+cc-ci-plan/upstream/bluesky-pds.md). Never re-pin to `:0.4`/`latest`/minor tags.