Seems like they have some good ideas for how to deal with quote posts/tweets. But I don't understand how decisions like this are compatible with their hopes to eventually make the network decentralized. Surely you can't trust individual servers to obey this anti harassment feature? Are they no longer planning to make it decentralized?
The part that's decentralized is users' storage of data — anyone can host it themselves (we provide both a Docker image of a server that can do that, and the source code for the server, and a spec in case you want to write your own).
However, applications (such as Bluesky) are centralized in the sense that there's just one instance of each application and it can make choices about how to aggregate the decentralized data from the network. A useful analogy is how Google crawls the web into its index but can present stuff from its index according to its own rules.
In this case, quote posts removals don't remove anything from the user repositories (you can't remove data from someone else's repository just like you can't remove data from someone else's website). Rather, when you detach someone's quote, you're putting a record into your repository (declaring the intent to detach it). Our app (both server and client) respects that intent and displays it accordingly.
Indeed, other clients could choose to not respect that, but the default behavior for most users matters a lot — and in general good faith clients try to be well-behaved and align with users' expectations.
How does an application decide whose repos to index?
EDIT: to answer your question - this means the relay tends to decide what gets indexed.
It's not about being perfect, it's about cutting off wide masses from abusive behavior.
Different applications using the AT Protocol can publish records that have no relation to Bluesky posts, Bluesky follows, or other Bluesky concepts. For example, https://smokesignal.events/ is an AT protocol app that produces and aggregates its own record types ("events" and "RSVP"s).
So yes, there can't be any meaningful "official protocol client" (because the protocol isn't tied to a specific app).
However, realistically for each app (such as Bluesky or Smoke Signal) there'll usually be the most popular client (and the one we're developing is "official" in the sense that it's one we put on the app store under the Bluesky brand).
People can build other clients for Bluesky, but more importantly, they can build other apps on the protocol which have no relation to Bluesky (but can still ingest Bluesky data if they want to).
Additionally, these apps can benefit from the distribution, moderation, and data hosting portability. ATProto allows for shared infrastructure across apps.
The utter majority of people aren't nerds. They go on the App Store, type in "bluesky" and install the first hit, and that assumes they've heard of it in the first place.
Reddit, even before the Great API Crackdown, was just the same. The utter majority used the official client/website no matter how horrible they are/were to use - I'm honestly surprised old.reddit.com (the one with barely any JS) is still alive and kicking, new.reddit.com (the inbetween) for me keeps alternating between "it works" and "it redirects or shows the new UI that fails all the time with graphql errors"...
So if you as the OP detach your post from the QRT, all you are doing is posting a certificate (akin to a revocation cert) that declares the intent that you don't want their QRT to be connected to your post.
An app can still show it. Or it can show it behind a warning prompt. Or it can hide it entirely.
It's an intent and even if it was controlled entirely, a determined third party could still work around it so there's not much point in trying to stop them. Instead you operate on "Don't be a dick" principles.
The rest is PR.
Email is distributed but either you pay Google/Microsoft to host it for you or you host it somewhere else..that carefully and proactively follows their rules.
First they allowed DID federation (i.e. you can host your own DID by tying it to your domain name). Then feed curation. Then data storage. Then moderation features. And so on. There's really only a few things left and those are systems that are designed in a decentralised manner but for the sake of a smooth transition have yet to be handed over fully to the community.