@growth-labs/cms 0.8.7 → 0.8.14

package/src/engine/fronts-publish.ts

@@ -41,7 +41,7 @@ import {
 	PublicationCurrentSnapshotError,
 	snapshotRecord,
 } from './publication-current-guard.js'
-import { getContentSnapshot } from './publisher.js'
+import { getContentSnapshot, PublishContentValidationError } from './publisher.js'
 import { getRevision } from './revisions.js'
 
 /** The five lifecycle states foundryd reports for a Fronts publish intent. */
@@ -297,6 +297,10 @@ export async function applyFrontsPublishCallback(
 	let published = item.status === 'published'
 	let attemptId: string | null = null
 	let ledgerError: string | null = null
+	// A body that fails pre-publish validation will fail again on every retry
+	// until an editor changes it. Recording that distinctly lets the marker say
+	// `failed` instead of leaving the intent to be re-admitted forever.
+	let publishRejectedDeterministically = false
 	let committedDekFailureReason: FrontsPublishCallbackResult['dekFailureReason'] = null
 	let committedPublishedItem: FrontsPublishCallbackResult['publishedItem'] = null
 	const shouldPublish = input.status === 'live' && hasReceipt(input.receipt)
@@ -561,7 +565,19 @@ export async function applyFrontsPublishCallback(
 						'Scheduled content or media changed before publication.',
 					)
 				}
-				ledgerError = error instanceof Error ? error.message : String(error)
+				publishRejectedDeterministically = error instanceof PublishContentValidationError
+				// `error.message` is the same generic sentence for every body
+				// rejection ("Article body failed pre-publish validation"), which
+				// tells an operator that something is wrong but never what. The
+				// guard already computed the violated codes; carrying its summary
+				// onto the event row is the difference between reading the answer
+				// and re-running the validator by hand against the stored body.
+				ledgerError =
+					error instanceof PublishContentValidationError
+						? error.summary
+						: error instanceof Error
+							? error.message
+							: String(error)
 			}
 		}
 	}
@@ -578,13 +594,20 @@ export async function applyFrontsPublishCallback(
 		)
 		.bind(input.contentId, input.version ?? null, input.version ?? null)
 		.first<{ latest: number | null }>()
+	// A `live` whose publication was refused for a reason no retry can change
+	// records `failed`, not `live`: the editor has to act, and `failed` is what
+	// makes that visible in Masthead and to foundryd's late evaluator.
+	const markerStatus: FrontsPublishStatus =
+		publishRejectedDeterministically && input.status === 'live' ? 'failed' : input.status
 	if (
+		publishRejectedDeterministically ||
 		shouldApplyFrontsMarker(
 			item.status,
 			item.fronts_publish_status,
 			input.status,
 			incomingOccurredAt,
 			latestSeenRow?.latest ?? null,
+			published,
 		)
 	) {
 		const marker = await db
@@ -593,7 +616,7 @@ export async function applyFrontsPublishCallback(
 				WHERE id = ? AND canonical_version = ? AND status = ? AND publish_at IS ? AND deleted_at IS NULL`,
 			)
 			.bind(
-				input.status,
+				markerStatus,
 				input.contentId,
 				item.canonical_version,
 				published ? 'published' : item.status,
@@ -752,8 +775,23 @@ async function readStoredOutcome(
 
 /**
  * Whether an incoming callback may overwrite `content_items.fronts_publish_status`.
- * `live` is the authoritative terminal-success marker (always reflected, never
- * downgraded); older-by-occurred_at callbacks may not regress a newer marker.
+ * `live` is the authoritative terminal-success marker (never downgraded once
+ * earned); older-by-occurred_at callbacks may not regress a newer marker.
+ *
+ * `live` is only EARNED by a committed publication. A `live` callback whose
+ * publish did not commit -- `publishOne` threw and left `ledgerError` set, or
+ * the callback carried no usable receipt so the publish block never ran --
+ * must not stamp success onto a row that is still `scheduled`. Doing so cost a
+ * missed publish on 2026-09-15 (`can-minilateralism-solve-europes-defense-crisis`):
+ * the marker read `live` while the item had zero revisions and zero publication
+ * attempts, and both foundryd's admission (anything past `queued` is the
+ * executor's) and its unadmitted-late evaluator (`live` means done) then treated
+ * the item as finished, so it was never retried and never paged.
+ *
+ * Leaving the marker alone is what keeps the item recoverable: it stays
+ * `queued`/`publishing`, so the next reconciler tick re-admits it and the late
+ * evaluator still sees an unfinished intent. The failure itself is not lost --
+ * it is recorded on the `fronts_publish_events` row with its `ledgerError`.
  */
 function shouldApplyFrontsMarker(
 	itemStatus: string,
@@ -761,8 +799,9 @@ function shouldApplyFrontsMarker(
 	incomingStatus: FrontsPublishStatus,
 	incomingOccurredAt: number | null,
 	latestSeenOccurredAt: number | null,
+	published: boolean,
 ): boolean {
-	if (incomingStatus === 'live') return true
+	if (incomingStatus === 'live') return published
 	if (itemStatus === 'published' || currentMarker === 'live') return false
 	if (
 		incomingOccurredAt !== null &&

package/src/engine/publisher.ts

@@ -799,7 +799,7 @@ export async function updateContentItem(
 		const current = await db
 			.prepare(
 				`SELECT script, video_id, duration_seconds, thumbnail_image_id,
-					processing_source_url, processing_source_kind
+					processing_source_url, processing_source_kind, processing_trigger_token
 				 FROM video_content
 				 WHERE content_id = ?
 				 LIMIT 1`,
@@ -812,6 +812,7 @@ export async function updateContentItem(
 				thumbnail_image_id: string | null
 				processing_source_url: string | null
 				processing_source_kind: string | null
+				processing_trigger_token: string | null
 			}>()
 
 		if (current) {
@@ -836,14 +837,26 @@ export async function updateContentItem(
 						sourceUrl,
 						durationProvided ? videoContent.durationSeconds : undefined,
 					)
+			const mediaChanged =
+				sourceChanged ||
+				resolvedDuration !== current.duration_seconds ||
+				(input.slug !== undefined && input.slug !== existing.slug) ||
+				(input.visibility !== undefined && input.visibility !== existing.visibility)
+			const requestedVideoId = hasOwn(videoContent, 'videoId')
+				? (videoContent.videoId ?? current.video_id)
+				: current.video_id
+			// A captured source pins its media identity. The editor form re-derives
+			// videoId from the title on every save of a new video, so a title edit
+			// alone used to reset the capture; nothing re-captured it, and the video
+			// stayed scheduled but was never prepared (Fronts, 2026-09-15..17).
+			const videoId =
+				current.processing_trigger_token && !mediaChanged ? current.video_id : requestedVideoId
 
 			videoUpdatePlan = {
 				script: hasOwn(videoContent, 'script')
 					? (videoContent.script ?? current.script)
 					: current.script,
-				videoId: hasOwn(videoContent, 'videoId')
-					? (videoContent.videoId ?? current.video_id)
-					: current.video_id,
+				videoId,
 				durationSeconds:
 					durationProvided || sourceChanged
 						? resolvedDuration
@@ -853,12 +866,7 @@ export async function updateContentItem(
 					: current.thumbnail_image_id,
 				sourceUrl,
 				sourceKind,
-				sourceChanged:
-					sourceChanged ||
-					resolvedDuration !== current.duration_seconds ||
-					(input.slug !== undefined && input.slug !== existing.slug) ||
-					(input.visibility !== undefined && input.visibility !== existing.visibility) ||
-					(hasOwn(videoContent, 'videoId') && videoContent.videoId !== current.video_id),
+				sourceChanged: mediaChanged || videoId !== current.video_id,
 			}
 		} else {
 			videoUpdatePlan = null
@@ -1458,6 +1466,7 @@ export async function evaluateContentBodyForPublish(
 	db: D1Database,
 	id: string,
 	source: string,
+	options?: { requireBody?: boolean },
 ): Promise<PublishGuardOutcome | null> {
 	const row = await db
 		.prepare(
@@ -1489,7 +1498,11 @@ export async function evaluateContentBodyForPublish(
 		{
 			source,
 			contentId: id,
-			requireBody: true,
+			// Absence and corruption are different failures. Publishing requires
+			// a body; SCHEDULING does not -- an editor may legitimately claim a
+			// slot before the piece is finished -- but neither may carry a body
+			// that is already broken.
+			requireBody: options?.requireBody ?? true,
 			// #329: source-section defects block at publish, warn on save.
 			blockSourceSectionDefects: true,
 		},

package/src/migration-vendor.ts

@@ -119,26 +119,149 @@ function sequencePrefix(sequence: number): string {
 	return String(sequence).padStart(4, '0')
 }
 
+function targetSequence(target: string): number {
+	return Number.parseInt(target.slice(0, 4), 10)
+}
+
+function managedSuffix(source: string): string {
+	return `_growth_labs_cms_${source.replace(/^\d{4}_/, '')}`
+}
+
+/**
+ * Sequences already spoken for in the consumer's migrations directory.
+ *
+ * Wrangler accepts one `migrations_dir`, so a consumer's own analytics, SEO or
+ * product migrations are interleaved with the vendored package ones. Those
+ * numbers are not ours to take.
+ */
+async function occupiedSequences(migrationsDir: string): Promise<Set<number>> {
+	const names = await readdir(migrationsDir)
+	const taken = new Set<number>()
+	for (const name of names) {
+		if (!name.endsWith('.sql')) continue
+		const sequence = targetSequence(name)
+		if (Number.isSafeInteger(sequence)) taken.add(sequence)
+	}
+	return taken
+}
+
+interface PlanContext {
+	/** Recorded source -> target, the authority for anything already vendored. */
+	recorded: Map<string, CmsMigrationManifestEntry>
+	/** Existing consumer files, for sequence avoidance and hash adoption. */
+	migrationsDir?: string
+}
+
+/**
+ * Resolve each package migration to the consumer filename it must occupy.
+ *
+ * The hard invariant: a migration this consumer has ALREADY vendored keeps its
+ * exact filename forever. D1's `d1_migrations` ledger keys off that name, so
+ * renumbering an applied migration would re-run it. Every branch below either
+ * reuses a name or allocates an unused one; none ever rewrites an assigned one.
+ *
+ * Resolution order per source:
+ *   1. recorded in the receipt  -> reuse that target verbatim;
+ *   2. an on-disk file with our managed suffix whose bytes hash identical
+ *      -> adopt it (reconciles migrations vendored by hand before the receipt
+ *      existed, without creating a duplicate that would apply the same SQL
+ *      twice);
+ *   3. otherwise -> the next sequence above everything already assigned or
+ *      occupied, skipping consumer-owned numbers.
+ */
 async function planMigrations(
 	sourceDir: string,
 	startSequence: number,
+	context: PlanContext = { recorded: new Map() },
 ): Promise<PlannedMigration[]> {
 	assertStartSequence(startSequence)
 	const sourceNames = (await readdir(sourceDir)).filter((name) => MIGRATION_FILE.test(name)).sort()
 	if (sourceNames.length === 0) throw new Error('installed CMS package has no migration SQL')
-	if (startSequence + sourceNames.length - 1 > 9999) {
-		throw new Error('reserved CMS migration sequence exceeds 9999')
+
+	const occupied = context.migrationsDir
+		? await occupiedSequences(context.migrationsDir)
+		: new Set<number>()
+	const existingNames = context.migrationsDir ? await readdir(context.migrationsDir) : []
+	const assigned = new Set<number>()
+	let highWater = startSequence - 1
+	for (const sequence of occupied) {
+		if (sequence > highWater) highWater = sequence
 	}
 
-	return Promise.all(
-		sourceNames.map(async (source, index) => {
-			const sequence = startSequence + index
-			const suffix = source.replace(/^\d{4}_/, '')
-			const target = `${sequencePrefix(sequence)}_growth_labs_cms_${suffix}`
-			const bytes = new Uint8Array(await readFile(join(sourceDir, source)))
-			return { source, target, sequence, sha256: await sha256(bytes), bytes }
-		}),
-	)
+	const planned: PlannedMigration[] = []
+	for (const source of sourceNames) {
+		const bytes = new Uint8Array(await readFile(join(sourceDir, source)))
+		const hash = await sha256(bytes)
+		const suffix = managedSuffix(source)
+
+		const recorded = context.recorded.get(source)
+		if (recorded) {
+			const sequence = targetSequence(recorded.target)
+			assigned.add(sequence)
+			if (sequence > highWater) highWater = sequence
+			planned.push({ source, target: recorded.target, sequence, sha256: hash, bytes })
+			continue
+		}
+
+		const adopted = await findAdoptableTarget(
+			context.migrationsDir,
+			existingNames,
+			suffix,
+			hash,
+			assigned,
+		)
+		if (adopted) {
+			const sequence = targetSequence(adopted)
+			assigned.add(sequence)
+			if (sequence > highWater) highWater = sequence
+			planned.push({ source, target: adopted, sequence, sha256: hash, bytes })
+			continue
+		}
+
+		let sequence = Math.max(startSequence, highWater + 1)
+		while (occupied.has(sequence) || assigned.has(sequence)) sequence += 1
+		if (sequence > 9999) throw new Error('reserved CMS migration sequence exceeds 9999')
+		assigned.add(sequence)
+		highWater = sequence
+		planned.push({
+			source,
+			target: `${sequencePrefix(sequence)}${suffix}`,
+			sequence,
+			sha256: hash,
+			bytes,
+		})
+	}
+
+	return planned
+}
+
+/**
+ * An existing consumer file that IS this package migration, byte for byte.
+ *
+ * Content-addressed on purpose: adopting by filename alone would let an
+ * unrelated file with a colliding suffix be claimed as ours.
+ */
+async function findAdoptableTarget(
+	migrationsDir: string | undefined,
+	existingNames: string[],
+	suffix: string,
+	hash: string,
+	assigned: Set<number>,
+): Promise<string | null> {
+	if (!migrationsDir) return null
+	for (const name of existingNames.slice().sort()) {
+		if (!name.endsWith('.sql') || !name.endsWith(`${suffix}`)) continue
+		const sequence = targetSequence(name)
+		if (!Number.isSafeInteger(sequence) || assigned.has(sequence)) continue
+		let existingHash: string
+		try {
+			existingHash = await sha256(new Uint8Array(await readFile(join(migrationsDir, name))))
+		} catch {
+			continue
+		}
+		if (existingHash === hash) return name
+	}
+	return null
 }
 
 function manifestFor(
@@ -365,9 +488,15 @@ export async function syncCmsMigrations(
 	const manifestPath = await resolveManifestPath(migrationsDir, options.manifestPath)
 	return withManifestLock(manifestPath, async () => {
 		const contract = await packageContract()
-		const plan = await planMigrations(contract.sourceDir, options.startSequence)
-		const nextManifest = manifestFor(contract.packageVersion, options.startSequence, plan)
 		const currentManifest = await readManifest(manifestPath)
+		// The receipt is the authority for anything already vendored: plan with it
+		// so recorded migrations keep their exact filenames and only genuinely new
+		// ones are allocated a sequence.
+		const plan = await planMigrations(contract.sourceDir, options.startSequence, {
+			recorded: new Map((currentManifest?.files ?? []).map((entry) => [entry.source, entry])),
+			migrationsDir,
+		})
+		const nextManifest = manifestFor(contract.packageVersion, options.startSequence, plan)
 		assertManifestCanAdvance(currentManifest, nextManifest)
 		await assertNoSequenceCollisions(migrationsDir, plan)
 		const preflight = await verifyTargets(migrationsDir, plan, true)
@@ -424,7 +553,10 @@ export async function verifyCmsMigrations(
 				`CMS migration manifest version ${manifest.packageVersion} does not match installed ${contract.packageVersion}`,
 			)
 		}
-		const plan = await planMigrations(contract.sourceDir, manifest.startSequence)
+		const plan = await planMigrations(contract.sourceDir, manifest.startSequence, {
+			recorded: new Map(manifest.files.map((entry) => [entry.source, entry])),
+			migrationsDir,
+		})
 		const expected = manifestFor(contract.packageVersion, manifest.startSequence, plan)
 		if (
 			expected.files.length !== manifest.files.length ||

package/src/routes/content.ts

@@ -391,23 +391,49 @@ const ContentMetadataSchema = z
 	})
 	.transform((metadata) => metadata as ContentMetadata)
 
-// Known Nextcloud share pages are HTML, never ingestable media. The editor
-// must save the direct-download URL so the existing provider validates bytes.
-const MediaSourceUrlSchema = z
-	.string()
-	.url()
-	.refine(
-		(value) => {
-			let url: URL
-			try {
-				url = new URL(value)
-			} catch {
-				return false
-			}
-			return !(url.hostname === 'drive.fulcrum-portal.com' && /^\/s\/[^/]+\/?$/.test(url.pathname))
-		},
-		{ message: 'Use the Nextcloud direct-download URL ending in /download, not its share page.' },
-	)
+// A Nextcloud share PAGE is HTML, never ingestable media, so the stored source
+// must be the direct-download URL. Editors paste the share link -- that is what
+// Nextcloud's "Copy link" button yields -- so normalise it here instead of
+// refusing the save. Refusing it stranded every video upload from the 0.8.5
+// deploy until 0.8.8, because the masthead only rendered the top-level
+// 'Invalid request' and never the field message telling them what to change.
+//
+// Only the onboarded share host is claimed, and only the share-link shape:
+// https, no credentials, default port, /s/<token> with an optional /download.
+// Nextcloud's folder-listing "Copy link" appends ?dir=/ to a single-file share;
+// it carries nothing the download route needs, so it is dropped. Anything else
+// -- another host, another path, a non-URL -- is returned untouched for the
+// normal URL validation to accept or reject on its own terms.
+const NEXTCLOUD_SHARE_HOSTS = ['drive.fulcrum-portal.com']
+const NEXTCLOUD_SHARE_PATH_RE = /^\/s\/[A-Za-z0-9_-]+(?:\/download)?\/?$/
+
+export function normaliseNextcloudShareUrl(value: string): string {
+	let url: URL
+	try {
+		url = new URL(value)
+	} catch {
+		return value
+	}
+	if (
+		url.protocol !== 'https:' ||
+		url.username ||
+		url.password ||
+		(url.port && url.port !== '443') ||
+		!NEXTCLOUD_SHARE_HOSTS.includes(url.hostname.toLowerCase().replace(/\.$/, '')) ||
+		!NEXTCLOUD_SHARE_PATH_RE.test(url.pathname)
+	) {
+		return value
+	}
+	if (url.searchParams.get('dir') !== null && url.searchParams.size === 1) {
+		url.search = ''
+	}
+	if (!/\/download\/?$/.test(url.pathname)) {
+		url.pathname = `${url.pathname.replace(/\/$/, '')}/download`
+	}
+	return url.toString()
+}
+
+const MediaSourceUrlSchema = z.string().url().transform(normaliseNextcloudShareUrl)
 
 function buildSchemas(resolved: ReturnType<typeof resolveConfig>) {
 	const category = slugEnum(resolved.primaryCategorySlugs)
@@ -1114,6 +1140,72 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 		}
 	}
 
+	/**
+	 * The video sibling of maybeDispatchPodcastToFoundry: capture a sourced video
+	 * that holds no capture. A row with no trigger token is invisible to the
+	 * producer whatever its state says (trash and restore clears the token and
+	 * leaves `queued`), so only `ready` media and `failed` — the editor's Re-run
+	 * decision — are left alone. An archived item is inactive to the dispatcher;
+	 * it is captured once scheduling has made it active again.
+	 * The editor form captures after a save too, but it de-dupes on local state; a
+	 * later save that reset the capture left the video scheduled and never
+	 * prepared, with nothing to notice (Fronts, 2026-09-15..17).
+	 */
+	async function maybeCaptureVideoSource(
+		ctx: RouteContext,
+		contentId: string,
+	): Promise<DispatchResult | null> {
+		const hook = resolved.hooks.foundryVideo
+		if (!hook) return null
+		const readCapture = () =>
+			ctx.db
+				.prepare(
+					`SELECT vc.processing_source_url, vc.processing_trigger_token, vc.processing_state,
+						vc.hls_ready, ci.status
+					FROM video_content vc JOIN content_items ci ON ci.id = vc.content_id
+					WHERE vc.content_id = ?
+					LIMIT 1`,
+				)
+				.bind(contentId)
+				.first<{
+					processing_source_url: string | null
+					processing_trigger_token: string | null
+					processing_state: string | null
+					hls_ready: number | null
+					status: string
+				}>()
+		const row = await readCapture()
+		if (!row?.processing_source_url?.trim()) return null
+		if (row.processing_trigger_token?.trim()) return null
+		if (row.status === 'archived') return null
+		if (row.hls_ready === 1) return null
+		if (row.processing_state === 'ready' || row.processing_state === 'failed') return null
+		try {
+			return await dispatchToFoundry(ctx.db, contentId, hook, { ifUncaptured: true })
+		} catch (error) {
+			// The editor form fires its own capture after every save. Losing that
+			// race fails this call's compare-and-set, and the capture exists.
+			const raced = await readCapture()
+			if (raced?.processing_trigger_token?.trim()) return null
+			throw error
+		}
+	}
+
+	async function captureScheduledVideoAfterSave(
+		ctx: RouteContext,
+		contentId: string,
+	): Promise<PodcastFoundryAttempt> {
+		try {
+			return { result: await maybeCaptureVideoSource(ctx, contentId), reason: null }
+		} catch (error) {
+			if (error instanceof FoundryDispatchPrerequisiteError) {
+				return { result: null, reason: 'missing_duration' }
+			}
+			console.error('Scheduled video source capture failed after content save', error)
+			return { result: null, reason: 'dispatch_failed' }
+		}
+	}
+
 	function missingDurationResponse(): Response {
 		return json(
 			{
@@ -1396,6 +1488,33 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				const publishAtSeconds = Math.floor(publishAtMs / 1000)
 				const expectedTargets = new Map<string, ScheduleFrontsChannelTargets | undefined>()
 				for (const id of ids) {
+					// Same gate as the single-item path: no item in a bulk schedule
+					// may take a slot with a body publish will refuse.
+					const bulkGuard = await evaluateContentBodyForPublish(ctx.db, id, 'cms.schedule', {
+						requireBody: false,
+					})
+					if (bulkGuard && !bulkGuard.ok) {
+						return json(
+							{
+								error: 'Article body failed pre-publish validation',
+								source: 'cms.schedule',
+								contentId: id,
+								errors: bulkGuard.errors,
+							},
+							422,
+						)
+					}
+					// And the same capture guarantee: no sourced video in a bulk
+					// schedule may take a slot the producer cannot see.
+					try {
+						await maybeCaptureVideoSource(ctx, id)
+					} catch (error) {
+						if (error instanceof FoundryDispatchPrerequisiteError) {
+							return missingDurationResponse()
+						}
+						console.error('Video source capture failed before bulk schedule', error)
+						return json({ error: 'Foundry dispatch failed', contentId: id }, 502)
+					}
 					const prepared = await prepareScheduleTargets(ctx, id)
 					if ('error' in prepared) return prepared.error
 					expectedTargets.set(id, prepared.targets)
@@ -1407,6 +1526,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 					if (targets !== undefined && !changed) {
 						return json({ error: 'schedule_targets_changed', contentId: id, scheduled }, 409)
 					}
+					// Covers an item that was archived above, now active again.
+					await captureScheduledVideoAfterSave(ctx, id)
 					scheduled.push(id)
 				}
 				return json({ scheduled })
@@ -1712,6 +1833,12 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				existing.type === 'podcast'
 					? await dispatchPodcastAfterSave(ctx, id)
 					: { result: null, reason: null }
+			// A scheduled video is committed to a slot: a save that reset its capture
+			// must not leave it unprepared until someone notices the missed publish.
+			const videoAttempt: PodcastFoundryAttempt =
+				existing.type === 'video' && existing.status === 'scheduled'
+					? await captureScheduledVideoAfterSave(ctx, id)
+					: { result: null, reason: null }
 
 			// If the slug changed, record the old slug as a redirect (spec §8)
 			// and drop any stale redirect row for the now-live slug — atomically,
@@ -1726,6 +1853,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				podcastFoundryQueued: Boolean(podcastAttempt.result),
 				podcastFoundryCorrelationId: podcastAttempt.result?.correlationId ?? null,
 				podcastFoundryReason: podcastAttempt.reason,
+				videoFoundryQueued: Boolean(videoAttempt.result && !videoAttempt.result.skipped),
+				videoFoundryReason: videoAttempt.reason,
 				...(mediaSourceReadiness ? { mediaSourceReadiness } : {}),
 				// Present and empty when the body linted clean, so a client can
 				// distinguish "no warnings" from "this build does not report them".
@@ -1782,6 +1911,41 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 					return json({ error: 'Missing publish time' }, 400)
 				}
 
+				// A body the publish guard will refuse must not be allowed to take a
+				// slot. Scheduling was the one write in this lane that never ran
+				// the guard, so a defect an editor could not see at save time
+				// surfaced only when foundryd tried to publish — at 16:30 on a
+				// Monday, as a missed premium article (2026-09-15).
+				const scheduleGuard = await evaluateContentBodyForPublish(ctx.db, id, 'cms.schedule', {
+					// Claiming a slot before the piece is written stays allowed;
+					// claiming one with an already-broken body does not.
+					requireBody: false,
+				})
+				if (scheduleGuard && !scheduleGuard.ok) {
+					return json(
+						{
+							error: 'Article body failed pre-publish validation',
+							source: 'cms.schedule',
+							errors: scheduleGuard.errors,
+						},
+						422,
+					)
+				}
+				// A sourced video that holds no capture is invisible to the producer:
+				// it would take the slot and never publish. Capture it here, and refuse
+				// the slot if that cannot be done. A video with no source yet may still
+				// claim a slot early.
+				if (existing.type === 'video') {
+					try {
+						await maybeCaptureVideoSource(ctx, id)
+					} catch (error) {
+						if (error instanceof FoundryDispatchPrerequisiteError) {
+							return missingDurationResponse()
+						}
+						console.error('Video source capture failed before schedule', error)
+						return json({ error: 'Foundry dispatch failed' }, 502)
+					}
+				}
 				const prepared = await prepareScheduleTargets(ctx, id)
 				if ('error' in prepared) return prepared.error
 				const changed = await scheduleContent(
@@ -1794,6 +1958,8 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 				if (prepared.targets !== undefined && !changed) {
 					return json({ error: 'schedule_targets_changed', contentId: id }, 409)
 				}
+				// Covers an item that was archived above, now active again.
+				if (existing.type === 'video') await captureScheduledVideoAfterSave(ctx, id)
 
 				// Fire content.scheduled webhook.
 				await fireWebhook(ctx, 'content.scheduled', {
@@ -1809,6 +1975,10 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 			if (action === 'publish') {
 				const now = Math.floor(Date.now() / 1000)
 				const wasDraft = existing.status === 'draft'
+				const publishedAt =
+					existing.status === 'published' && existing.published_at !== null
+						? existing.published_at
+						: now
 				let podcastDispatch: DispatchResult | null = null
 				if (existing.type === 'podcast') {
 					try {
@@ -1903,7 +2073,7 @@ export function createContentRoutes(config: ContentRouteConfig): ContentRouteHan
 					throw error
 				}
 				try {
-					await publishContent(ctx.db, id, now)
+					await publishContent(ctx.db, id, publishedAt, now)
 					await createRevision(ctx.db, id, ctx.userId || null)
 				} catch (error) {
 					if (error instanceof TagInputError) return tagInputErrorResponse(error)