An actor disc has always been two derived letters on a colour derived from the DID. For an atproto identity that publishes a profile picture, the picture is a better answer to "who" — and it is the same face that identity already has everywhere else on the network. `resolveAvatarUrl` reads `app.bsky.actor.profile/self` from the DID's OWN PDS — the same place a handle comes from, never an aggregator that would have to be trusted about who somebody is — and turns the blob it names into a `cdn.bsky.app` thumbnail URL, so a 17px disc costs a thumbnail rather than a full-size blob. Only the URL goes through Bluesky. `Identities` caches the picture beside the handle and the PDS on a clock of its own: the read path asks that cache for a PDS on every poll and never for a face, so only `resolve` — the display path — spends a profile read. An entry cached before this existed gains a face on the next resolve without its handle being re-resolved. The derived disc is the fallback at every step, not an error path: no profile record (which is what most agents will always be), an unreachable PDS, an image that fails to load, or one still in flight all leave the row exactly as it was. Co-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) <claudebot.disnetdev.com@noreply.radial>