tagOf and retag both split on the last colon, and in `postgres@sha256:2a1f…`
that colon belongs to `sha256:`. So tagOf reported the hex as the current tag
and retag built `postgres@sha256:16.4` — a reference no registry can serve.
fetchRemoteDigest then answered "no such image in the registry", which is true
of the string we built and says nothing about the operator's actual problem.

Both pin routes now decline by name. The container route checks before taking
the job slot, since there is nothing to hold the project for; the stack route
checks inside the loop and goes out through the same restore path as the other
per-service refusals.

Tests cover both the recognition and the mangle it prevents, so the reason the
guard exists stays visible if someone tries to make retag handle digests.

@@ -104,3 +148,2 @@
-    if (!res.ok) return { digest: null, error: `registry HTTP ${res.status}` };
     return {
-      digest: res.headers.get("docker-content-digest"),
+      digest: await digestOfBytes(await got.arrayBuffer()),

@@ -46,3 +61,1 @@
-  const rel = link?.split(",").find((p) => p.includes('rel="next"'));
-  const url = rel?.match(/<([^>]+)>/)?.[1];
-  return url ? new URL(url, base).toString() : null;
+  const rel = link?.split(",").find((p) => /;\s*rel\s*=\s*"?next"?/i.test(p));

@@ -58,0 +31,4 @@
+export type ParsedTag = ParsedVersion;
+
+/** kept under this module's own name, since every caller here uses it */
+export const parseTag = parseVersionTag;

@@ -118,3 +79,3 @@
       const body = await res.json();
       tags.push(...(body.tags ?? []));
-      url = nextLink(res, url);
+      url = nextPage(res.headers.get("link"), url);

@@ -335,0 +331,4 @@
+      // treat the digest's own colon as the separator — producing
+      // `postgres@sha256:16.4`, which the registry then reports as a missing
+      // image. Refused by name before anything is fetched or written.
+      if (digestRef(target.image)) {

@@ -198,3 +197,4 @@
       }
+      url = hop.status === "next" ? hop.url : null;
     }
     return { tags, error: null };

@@ -0,0 +149,4 @@
+  for (const part of link.split(",")) {
+    if (!isNextRel(part)) continue;
+    const raw = /<([^>]+)>/.exec(part)?.[1];
+    if (!raw) continue;

@@ -198,0 +200,4 @@
+        return {
+          tags: [],
+          error:
+            "pagination left the registry's origin; the tag list is partial",

@@ -0,0 +118,4 @@
+export type NextPage =
+  /** fetch this */
+  | { status: "next"; url: string }
+  /** one was offered and refused for leaving the origin; answer with an error */