Wraps the whole local run — start the streamplace e2e harness, install the
app, prep the device (pre-grant notifications + erase a clean sim on iOS,
disable the stylus dialog on Android), run the flows, tear the harness down.

hack/e2e-local.sh android # emulator running
hack/e2e-local.sh ios # macOS

Verified 5/5 on both platforms.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Homebrew 5.x refuses to install from an untrusted third-party tap, so
the ios-e2e job failed at 'brew install applesimutils'. Trust the tap
explicitly. The flows themselves pass 5/5 on a fresh simulator locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Debugged locally on a macOS simulator (the CI loop was too slow):

- The flaky 'Settings not visible' on iOS was the first-launch
'would like to send you notifications' permission dialog, which dims
the whole screen and blocks every tap. It only appeared on CI's fresh
simulators (a used sim has already answered it). Pre-grant the
permission with applesimutils before the run so the dialog never
shows, and drop clearState from 00-server-setup — clearState reinstalls
the app and resets that grant, re-showing the dialog (the app is
freshly installed on a fresh device anyway).

- 03-go-live: iOS collapses the entire login modal into one
accessibility element whose text is a concatenation
('Sign Up, Log In, Log in, ...'), so an exact 'Log [Ii]n' match never
hit. Match it as a substring.

Full suite now passes 5/5 on a fresh iOS simulator, twice in a row.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

iOS reached 4/5 with the card-testID fix; 03-go-live failed asserting
'Log In' — that's the modal's submit button, whose text is inside a
Pressable that collapses on iOS. Match the modal's plain-text title
'Log in' instead (case-insensitive covers the button too). Validated on
Android locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The generic build destination fixed the compile step, but creating the
simulator failed: tail -1 selected iPhone-6s-Plus, which iOS 26 rejects
as 'Incompatible device'. Select the highest-numbered iPhone model
instead, which is compatible with the newest runtime. Also drop the
maestro --device flag and rely on auto-selecting the single booted sim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ios-e2e regressed to 'build for simulator: Unable to find a device
matching the destination' — this run's macos-26 image had no concrete
iPhone simulators (only placeholders), where earlier runs did. Runner
provisioning is non-deterministic.

- build for the simulator SDK with 'generic/platform=iOS Simulator', so
compilation needs no concrete device
- create a fresh iPhone simulator from the newest available device type +
iOS runtime instead of assuming one is pre-created, and target it by
UDID everywhere (launch, maestro --device, diagnostics)

Card-testID iOS fix from the prior commit is unchanged and still pending
its first real run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

iOS reached the feed (branding, '1 person live now', and an
'e2e test stream' card all render) but the final assertion failed:
the card's AQLink Pressable collapses its subtree on iOS, so Maestro
can't match the title text — the same accessibility-collapse pattern as
the settings toggle.

- thread a testID through AQLink to its Pressable (a11y-neutral, unlike
accessible={false})
- tag the home stream card 'home-stream-card'
- 00-server-setup asserts the card by id (proof the app switched to the
isolated e2e node); 04-stream taps it by id and waits for the
'Now streaming - e2e test stream' chat message

Re-validated locally on Android: 5/5.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

On iOS the software keyboard stays up after inputText and covers the
bottom Home tab, so tapOn Home never navigated and the final
'e2e test stream' assertion ran on the still-open settings screen.
(The URL was entered/saved fine — the app was already querying the e2e
node.) Dismiss the keyboard after entering the URL. Re-validated on
Android locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

android-e2e install failed with INSTALL_FAILED_UPDATE_INCOMPATIBLE: the
make target generates a fresh random keystore per build when none is
persisted, so an APK copy left in the cached AVD snapshot is signed with
a different cert and 'install -r' can't update it. Uninstall first.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ios-e2e now launches and navigates (startup crash fixed) but couldn't
tap 'Use Custom Node': accessibilityRole=switch collapses the toggle's
subtree on iOS, hiding the label from Maestro's text matcher (Android's
hierarchy still exposed it, hence android-e2e already passing). The
wrapped Input/Button are similarly unreliable to match by placeholder/
label text on iOS.

- add stable testIDs to the toggle, URL input, and Save button
(settings-use-custom-node / -custom-node-url / -save-node), plus an
accessibilityLabel on the toggle
- tap those three by id in 00-server-setup
- drop the optional 'Wait' ANR taps now that the emulator resource bump
prevents the launcher ANR (they just burned lookup timeout)

Re-validated locally on Android: 5/5 flows pass with id-based taps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The iOS release bundle is built without NODE_ENV=production (unlike the
android APK, which gradle re-bundles with it), so .env.production never
loads and EXPO_PUBLIC_STREAMPLACE_URL is empty. DEFAULT_URL was then
undefined, and usePossiblyUnauthedPDSAgent constructed
new StreamplaceAgent(undefined) during render — atproto's Agent reads
.service off it and throws, taking down the whole app before the home
screen (RCTFatalException, uncaught in BrandingFetcher).

- DEFAULT_URL falls back to the public production node when no build-time
URL is injected. This is the correct default and fixes the crash on
any build regardless of env-file loading.
- usePossiblyUnauthedPDSAgent degrades to null on a falsy URL instead of
throwing synchronously; callers already handle a null agent. Also add
the missing nodeUrl dependency to the memo.

Caught by the ios-e2e job, which now reaches the app for the first time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hide_error_dialogs=1 did not suppress the 'Pixel Launcher isn't
responding' dialog; it still floated over the app and blocked the
Settings tap. Attack the root cause (emulator starved on a
software-rendered runner) by giving it 4 cores / 6GB RAM / 576MB heap,
and add optional 'Wait' taps in the flow as a fallback dismissal.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

android: the round-2 failure screenshot shows a 'Pixel Launcher isn't
responding' ANR dialog floating over the (successfully launched) app,
eating maestro's taps. Suppress error dialogs system-wide via
hide_error_dialogs=1 and drop the keyevent 82/4 dance that pokes the
launcher right after boot. Also wait up to 60s for the UI before the
first tap — first render on a cold software-rendered emulator is slow.

ios: the simulator destination fix worked (build/boot/install/harness
all green, maestro ran for the first time), but the app now crashes a
few seconds into startup: 00-01-launched shows the loading screen, the
failure screenshot shows the home screen. No crash data reaches the
artifact, so add a console-attached smoke launch before maestro plus
.ips crash report + sim log collection after.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Both e2e jobs failed for infrastructure reasons, with everything
underneath finally working:

- android: reactivecircus/android-emulator-runner executes each line of
script: in a separate shell, so the sourced SERVER_URL/ACCOUNT_HANDLE
never reached maestro — the app got no custom node URL and the flows
ran against production until the feed assertion caught it. Move the
whole sequence into hack/ci-android-e2e.sh, invoked as one line, and
fail fast if SERVER_URL is empty.

- ios: the macos-26 runner image no longer ships an 'iPhone Air' OS
26.1 simulator (only iPhone 16e/17/... on OS 26.2+), so xcodebuild
died with 'unable to find a device matching the provided destination'.
Target iPhone 17 with no OS pin and resolve the boot UDID via simctl
so runner image updates don't break this again.

- upload the per-step flow screenshots with the maestro artifacts;
they're the main debugging tool when a flow fails.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- bundletool build-apks now passes --overwrite; rebuilding
android-release locally previously failed on the stale .apks file.

- ci: disable the Android stylus handwriting tutorial before maestro
runs. On Android 16 emulator images it pops over the keyboard mid-
inputText and steals the tap that was headed for the Save button.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- appId: ${APP_ID} in every flow — locally-built APKs are
tv.aquareum.dev (only CI builds get tv.aquareum), so the hardcoded id
made every flow fail with 'Unable to launch app' on dev machines.

- config.yaml: enforce execution order. Maestro was running flows in
arbitrary order, so everything could run before 00-server-setup
pointed the app at the e2e node — flows silently 'passed' against
production. 03-go-live runs last because it ends with the Log In
modal open. continueOnFailure=false since nothing is meaningful after
a setup failure.

- 00-server-setup now waits for the e2e test stream to appear in the
home feed — proof the app is talking to the custom node and not
production.

- 04-stream now opens the test stream from the feed and asserts on its
title instead of blind-tapping coordinates. The title (rather than
the handle) is asserted because .test handles currently index as
handle.invalid — the node can't do DNS/well-known verification for
local PDS accounts; follow-up material.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- SettingToggle: make the whole row pressable instead of just the
Switch. Tapping the 'Use Custom Node' label previously did nothing —
which is also why Maestro's tapOn couldn't enable it.

- Advanced settings: keyboardShouldPersistTaps=handled on the
ScrollView. With the keyboard open, the first tap on Save only
dismissed the keyboard and never reached the button, so the custom
node URL was silently never saved (humans had to tap Save twice).

- android: add a network security config permitting cleartext http to
10.0.2.2 / localhost / 127.0.0.1 only. Release builds block cleartext
entirely by default, so the app could never talk to a local e2e node.
Everything else stays HTTPS-only, so this is safe to ship.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Livestream records are normally created by the app via
place.stream.live.startLivestream when a logged-in user goes live;
nothing creates one for a key-based WHIP stream, so the harness's
stream never showed up in getLiveUsers and the node logged
'ManifestBuilder: no livestream found' forever. Create the record
directly on the test account's PDS; the node keeps lastSeenAt fresh
on our behalf via SP_DEV_ACCOUNT_CREDS.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The android-e2e job never ran pnpm install, so js/dev-env/dist (built
by its prepare script) didn't exist and the dev environment crashed on
startup. Worse, the 'start e2e environment' step still exited 0 with an
empty env file, so Maestro ran against an empty SERVER_URL.

- android-e2e: set up node 22 + pnpm and install dependencies
- both jobs: fail the step if the env file is still empty after 120s,
capture server stderr to /tmp/e2e-server.log, and upload it alongside
the maestro recordings

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Two fixes for the e2e harness's forked server node:

- Inherit the parent environment (stripping SP_* vars) instead of
replacing it wholesale, so dev builds keep LD_LIBRARY_PATH and can
actually exec libstreamplace.

- Add SP_TRUST_PRIVATE_NETWORK=true, a new aqhttp toggle that disables
SSRF protection, so the node can resolve DIDs against the localhost
PLC. Without this every WHIP publish 401s ('all resolved IPs for
localhost are private/invalid') and the test stream never goes live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vod drafts

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Most users with VOD access want their streams kept, so recording defaults on
(opposite of debugRecording): a missing settings record or unset flag records,
and only an explicit livestreamRecording=false opts out. Lookup/decode errors
still fail closed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Only record a livestream into a VOD when both hold:
- the streamer is in the VOD beta (an indexed place.stream.beta.invite
with feature=vod from the trusted issuer), mirroring the upload gate;
- the streamer opted in via a new livestreamRecording server setting.

shouldRecordLivestream runs once at stream start (like debugRecording) and
fails closed on lookup errors; when ineligible the uploader is never created,
so the existing s3Upload/s3Cutover/s3Close no-op on nil.

Adds the livestreamRecording boolean to place.stream.server.settings (Go
types + cbor hand-edited to match the generator) and a VOD-beta-only toggle
in privacy settings. createServerSettingsRecord now merges a partial patch so
toggling one flag no longer clobbers the others.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

place.stream.media.track records were published at processing time (in
publishRecords), which leaked half-published content: the tracks went live
immediately while the video record wasn't created until the user published the
draft. With drafts, that gap can be long. Defer track creation to publishDraft.

- publishRecords stops calling publishTrack. It still publishes
place.stream.media.origin (server-repo blob availability attestation) and
now stores the track-publishing inputs on the Upload row: signing_key,
probe_json (video/audio codec/dims/fps/rate/channels), and blob_size.
SetUploadProcessed signature updated accordingly.
- markDraftReadyFromUpload: the draft reaches 'ready' with source=nil (no
track refs exist yet) and durationMs set (known at processing time).
- PublishDraft publishes the tracks at publish time via the new
publishTracksFromUpload: reads the probe+signingKey+size+CID from the tied
Upload row, calls publishTrack per A/V stream, and builds the video's
source from the fresh strongRefs. Falls back to a carried-over source if
the draft has no tied upload (legacy).
- Upload row gains SigningKey, ProbeJSON, BlobSize columns. TrackURIs is
vestigial (left for the legacy publishVideo path).

Tests updated: the lifecycle test now asserts source is nil at ready time and
the Upload row carries the deferred inputs. build + tests + lint clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

startUpload now creates an empty draft up front (place.stream.vod.createDraft),
passes its draftUri to createUpload, and navigates to /upload/video/<tid>
immediately — so the user lands on the metadata editor while the TUS upload
runs in the background. The draft is the durable anchor: a failed upload
leaves it intact, so re-upload against the same draft is possible.

The UploadVideo editor now polls getDraft every 3s while the draft is still
'processing', so the processing → ready (or error) transition is reflected
without a manual reload. Only the status (and source/durationMs once ready)
is refreshed — never the editable metadata the user may be mid-edit on.

tsc + prettier clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Make the draft the durable anchor for an upload: the client creates an empty
draft up front, then passes its URI to createUpload so processing fills that
draft. Lets the user edit metadata while the upload runs, and supports
re-upload (a failed upload leaves the draft intact; a new createUpload with the
same draftUri re-points it).

- New XRPC place.stream.vod.createDraft (procedure, no input -> {uri}):
creates an empty 'processing' draft (title 'Untitled') and returns its
ats:// URI. Banned accounts rejected.
- createUpload lexicon gains optional draftUri param. When supplied, the
handler calls SetDraftOriginUpload(draftUri, did, uploadID) to re-point
the draft's origin_upload_id at this upload. A missing/stale draft is
non-fatal (logged) — the upload proceeds and the legacy auto-create path
runs.
- pkg/upload/upload.go TUS completion: only auto-create a draft when no draft
is already associated with the upload (GetDraftByUpload returns nil). So
legacy clients without draftUri still get a draft; the modern flow's
pre-created draft is reused, not duplicated.
- statedb.SetDraftOriginUpload: re-points a draft at a (new) uploadID,
ownership-scoped (user_did must match). Returns ErrRecordNotFound if absent.

markDraftReadyFromUpload(uploadID) is unchanged — it already finds the draft
by origin_upload_id, so the pre-created draft (now re-pointed) is filled on
completion. build + tests + lint clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Replace the 1900-line single-component upload screen (internal managerMode
state) with 5 real react-navigation routes, all under /upload/...:

- /upload (Upload) — bare upload box only. No metadata chrome, no tabs. On
completion shows "Upload complete" + a link to the Drafts tab (the upload
flow can't return the draft tid, so it can't deep-link; finalize can).
- /upload/video/:tid (UploadVideo) — the unified editor. Given a tid, tries
getDraft (ats://) first; on NotFound falls back to getRecord (at://).
Drafts and published VODs share a tid (just shipped server-side), so one
route renders either. Editable metadata saves via updateDraft (drafts) or
putRecord (published). Ready drafts show a Publish button (publishDraft →
Video player route).
- /upload/drafts (UploadDrafts) — drafts list w/ status badges, Edit
(navigates to /upload/video/<tid>), Publish, Delete.
- /upload/livestreams (UploadLivestreams) — livestream list + finalize.
Finalize deep-links to /upload/video/<tid> (tid from draftUri).
- /upload/videos (UploadVideos) — My Videos list; select → /upload/video/<tid>.

Shared MetadataEditor (title/desc/tags/activity/content-warnings/license/
thumb) extracted for both draft and published-video editing. UploadTabNav is
now route-based navigation.navigate. The existing Video player route
(:user/video/:tid, root stack) is untouched.

navigation-types.ts: +UploadVideo{tid}, +UploadDrafts/Livestreams/Videos.
linking-config.ts: SCREEN_PATHS + HomeTab.screens for the 5 routes.
navigation-helper.tsx: HOME_TAB_SCREENS for AQLink routing.
shell.tsx: register the 4 new named exports in HomeNavigator (web-only).

tsc --noEmit -p js/app clean (0 errors); prettier clean; go build clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Previously the draft minted its own tid (CreateDraft) and PublishDraft minted
a separate new tid for the published place.stream.video — so a draft and its
published VOD had different tids. Reuse the draft's tid (extracted from the
ats:// URI rkey) as the published video's rkey instead.

The draft is deleted after a successful publish, so there's no collision, and
sharing the tid lets a single /upload/video/<tid> route render either a draft
(ats://) or its published VOD (at://) by the same key — the foundation for the
upcoming unified draft-or-video frontend route.

New draftTID helper + test. build + tests + lint clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

The @atproto/api client validator rejects a ref to a record-type lexicon
("Unexpected lexicon type: record"), so listDrafts threw
XRPCInvalidResponseError and the Drafts tab rendered nothing despite the
server returning valid drafts. Every existing view that carries a record
body (commentView, livestreamView, videoView) uses "type": "unknown" for
the record field; do the same for draftView#record.

- lexicons: draftDefs#draftView.record -> { "type": "unknown" }.
- Go: the generated DraftView.Record becomes *lexutil.LexiconTypeDecoder, so
ToDraftView wraps the decoded record in &LexiconTypeDecoder{Val: rec}
(matching commentView/livestreamView), setting if absent.
- TS: DraftView.record is now an index-signature object; the Drafts tab
casts draft.record to PlaceStreamVodDraftVideo.Main at the use site.

go build + tests + lint clean; tsc clean; ci-lexicons clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Address the implementation review's M1 + two low findings.

M1 (TOCTOU lost-update race, Postgres): UpdateDraftMetadata and
SetDraftReady/SetDraftError both do read-modify-write of the draft CBOR body.
Without a row lock, a user metadata edit landing at the instant processing
completes could clobber the server's ready transition (re-marshaling the
stale 'processing' body), leaving the draft stuck. Add clause.Locking
{Strength:"UPDATE"} (FOR UPDATE on Postgres, no-op on sqlite) to both
read-modify-write paths so concurrent writers serialize on the row.

L1: PublishDraft set Video.Description twice (struct-literal + redundant if);
drop the dead if block.

L5: stale finalizeLivestream handler doc comment still described the old
client poll+publish flow; update it.

build + statedb/vod/spxrpc tests + golangci-lint (0 issues) all clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

golangci-lint flagged an S1021 (merge var declaration) on the generated
deleteDraft stub because its lexicon had no output block, producing a bare
'var handleErr error' unlike every other procedure stub. Adding an empty
output object (matching deleteBlock/deletePin/deleteGate/deleteVodGate)
makes the generated stub follow the standard 'var out *...Output' pattern,
and the handler now returns a *VodDeleteDraft_Output. Regenerated Go stubs/
types, TS client, and docs. lint clean (0 issues).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Phase 5 UI. The client no longer polls getUploadStatus or calls publishVideo in
either flow — both produce a draft server-side that the user publishes later
from a new Drafts tab.

Finalize flow: finalizeLivestreamRow now just kicks off finalize and tells the
user to find the draft in the Drafts tab (no poll, no publishVideo). Records
draftUri for an optional deep-link.

Upload flow: removed pollStatus + the publish callback. When the TUS upload
completes, transition straight to a 'done' phase pointing to the Drafts tab
(the server creates the draft on upload completion). Removed isPublishing/
canPublish and the Publish button.

Drafts tab (4th tab): lists the user's drafts via place.stream.vod.listDrafts
with status badges (Processing/Ready/Error). Ready drafts offer Edit (loads
fields into the existing metadata editor, saves via updateDraft), Publish
(publishDraft, then removes the draft + shows a View VOD link), and Delete
(deleteDraft). Processing/error drafts offer Delete/Discard. Fetches on tab
select, mirroring the videos/livestreams pattern.

tsc --noEmit -p js/app clean (zero errors); prettier clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Phase 4: both entrypoints now create a 'processing' draft at kickoff, and the
queue processors flip the draft to 'ready'/'error' on completion.

Kickoff:
- finalizeLivestream handler: after enqueuing the task, creates a draft that
inherits the livestream's title/activity/tags and links back to the
livestream via connections. Returns draftUri (additive, alongside uploadId)
so the client can navigate straight to the draft.
- upload TUS completion (pkg/upload/upload.go): creates a placeholder draft
(filename or 'Uploaded video' as the title) when the VODProcessTask is
enqueued. A failed create is non-fatal — the upload still processes.

Completion (pkg/statedb/queue_processor.go):
- processVODProcessTask + processFinalizeLivestreamVODTask: after the
processor returns its cid, re-read the Upload row (the processor calls
SetUploadProcessed internally, so the row now carries the finished
TrackURIs/DurationMS/ContentCID) and flip the tied draft to 'ready' via
markDraftReadyFromUpload — fills source/durationMs in the CBOR body and
content_cid on the SQL row. On failure, flip the draft to 'error' so the
user isn't stuck looking at 'processing'.

pkg/statedb/draft_video.go: markDraftReadyFromUpload + draftSourceFromTrackURIs
(the {uri,cid} JSON -> sourceTracks union conversion, replicated here because
pkg/statedb can't import pkg/vod). SetDraft* remain no-ops when no draft row
exists for the upload.

Tests: the gating lifecycle test asserts a fake processor returning only a cid
still produces a 'ready' draft carrying the upload's source/durationMs/
content_cid (proving the re-read data flow), plus the error-flip path. Full
statedb/vod/spxrpc suites pass.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Phase 3 + the publish engine from Phase 4.

pkg/spxrpc/place_stream_vod_drafts.go — the 5 draft XRPC handlers:
- listDrafts: ownership-scoped list, time-cursor pagination, returns
draftView slice + cursor.
- getDraft: load + verify ownership, return draftView. Missing/foreign
drafts both 404 (no URI probing).
- updateDraft: verify ownership, then apply a partial update of editable
fields only (title/description/facets/tags/thumb/activity/contentWarnings/
contentRights). source/durationMs/status are never touched. nil vs empty-
slice distinguishes 'not provided' from 'clear'. CID recomputed on save.
- deleteDraft: verify ownership, then delete.
- publishDraft: verify ownership + (via PublishDraft) status==ready, then
promote to place.stream.video. Maps ErrDraftNotFound->404,
ErrDraftNotReady->409. Banned accounts are rejected.

pkg/vod/publish_draft.go — PublishDraft promotes a ready draft to a public
place.stream.video record, mirroring PublishVideo's tail: carries over the
draft's editable fields + source/durationMs from the CBOR body, sets
createdAt server-side, backfills a thumbnail from the content blob (via the
draft row's ContentCID) when the draft has none, putRecords the video, then
deletes the draft. ErrDraftNotFound/ErrDraftNotReady sentinels. A failed
post-publish draft delete is logged, not fatal (the video was published).

Tests: PublishDraft error paths (missing/foreign/processing/error drafts
-> ErrDraftNotFound/ErrDraftNotReady) + pure connection/activity mappers.
statedb + vod suites pass clean.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

New pkg/statedb/draft_video.go: DraftVideo GORM model storing a draft VOD as
permissioned-data-style record (CBOR body + denormalized query columns).

- Model: URI (ats://, primaryKey), UserDID, Data (CBOR bytes), CID
(sha256-of-CBOR CIDv1 via spid.GetCIDFromBytes), ContentCID + OriginUploadID
(server-internal, not in the CBOR body). Explicit TableName() override
matching Upload's pattern. Registered in StatefulDBModels.
- ats:// URI: ats://{did}/place.stream.vod.drafts/self/{did}/
place.stream.vod.draftVideo/{tid} — personal space (spaceDid==authorDid,
skey=self), spaceType as NSID string only (no space lexicon).
- CBOR marshal/unmarshal of the generated VodDraftVideo struct via its
whyrusleeping/cbor-gen MarshalCBOR/UnmarshalCBOR methods directly; CID
recomputed on every write.
- CRUD: CreateDraft, GetDraft, GetDraftByUpload, ListDrafts (time-cursor
paginated, ownership-scoped), UpdateDraftMetadata (editable fields only,
preserves source/durationMs/status), SetDraftReady (fills source/
durationMs + content_cid, status ready), SetDraftError (status error),
DeleteDraft. SetDraft* are no-ops when no draft row exists for the upload
(pre-drafts-era uploads, deleted drafts).

Tests (draft_video_test.go): CRUD round-trip + CBOR fidelity, CID recomputed
on metadata update, status preserved across metadata update, ownership
scoping in ListDrafts, ready/error lifecycle, no-op on missing upload.
All pass on sqlite.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Add the Phase 1 lexicons for draft VODs, modeled as permissioned-data-style
records (per bluesky-social/proposals PR #94, the 0016-permissioned-data
proposal) — lexicon-typed, CBOR-serialized, addressed by ats:// URIs —
stored in statedb until the real spec ships.

Lexicons (all in lexicons/place/stream/vod/):
- draftVideo.json: the record. Mirrors place.stream.video's editable fields
plus a status/error pair for processing state. source/durationMs present
(filled at status 'ready') so the draft is self-contained at publish.
- draftDefs.json: holds #draftView (uri/cid/record) as a shared view type,
referenced by the XRPCs. Split into its own defs lexicon because indigo's
lexgen panics on a #main self-ref from #draftView inside the same record
lexicon (FixRecordReferences defMap scope) — matches the existing
place.stream.vod.defs#commentView convention.
- listDrafts/getDraft/updateDraft/deleteDraft/publishDraft: the 5 XRPCs.
updateDraft is a partial update of editable fields only (source/
durationMs/status are server-authoritative). publishDraft promotes a
ready draft to a public place.stream.video and deletes the draft.

Also:
- finalizeLivestream.json: add draftUri to the output (additive), so the
client can navigate straight to the new draft. uploadId retained for
backwards compatibility but the draft flow no longer requires polling.
- pkg/gen/gen.go: register VodDraftVideo{} with the cbor-gen pass so it
gets MarshalCBOR/UnmarshalCBOR.
- Generated Go types (pkg/streamplace/voddraft*.go), server stubs
(pkg/spxrpc/stubs.go + place_stream_vod.go), JS lexicon types, and docs.
- pkg/spxrpc/place_stream_vod_drafts_stubs.go: placeholder handlers
returning 501 until Phase 3 implements them, so the tree compiles.

make lexicons + go build clean. Verified the cross-lexicon union ref
(place.stream.video#connection) generates cleanly.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

getVideoList (the AppView index) lags the publishVideo write, so the row
briefly fell back to "Finalize" until a page reload. Record the new VOD URI
optimistically from publishVideo's response and merge it into the lookup so
the row flips to "View VOD" right away.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

S3 recording ran before the published gate, so segments arriving after a
livestream ended (or before it started) kept appending to the same rolling
object, tagged with the just-ended livestream URI, and that object wasn't
completed until the cutoverEvery timer or stream teardown. That produced
either "no recorded S3 segments" (finalize counts only completed objects)
or an over-long VOD (the post-stop tail got absorbed into the recording).

Gate s3Upload on notif.Metadata.Published (an un-ended place.stream.livestream
record), and on unpublished segments call the new S3Uploader.Cutover to
complete the current object immediately so it's finalize-able right away.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>