Documentation cleanup and file renaming.

added new implementation plan for image upload and labeling.

docs/img-labeler/BLUESKY_LABELING_IMPLEMENTATION_PLAN.md

···
+# AT Protocol Image Labeling Implementation Plan
+
+**Project:** Plaquetournante-dev Event Management System  
+**Feature:** Event Image Upload Moderation & Labeling with AT Protocol Integration  
+**Date:** 18 juin 2025  
+**Status:** Planning Phase - Updated with Current AT Protocol Specifications  
+**Scope:** Event Image Uploads Only
+
+## Executive Summary
+
+This document outlines the implementation plan for integrating AT Protocol's labeling system specifically for event image uploads in our ATProto-based event management platform. The implementation will use proper AT Protocol blob upload, labeler subscription mechanisms, and the com.atproto.label namespace for content moderation, providing automated image analysis, real-time content labeling, and user-controlled moderation preferences while maintaining seamless user experience.
+
+**Key Updates for Current AT Protocol Specifications:**
+- Proper implementation of `com.atproto.repo.uploadBlob` for image storage  
+- Integration with labeler services via HTTP headers (`atproto-accept-labelers`)
+- Compliance with `com.atproto.label.defs` label structure specifications
+- Self-labeling support using AT Protocol standard label values
+- User preference management aligned with `app.bsky.actor.defs` preferences schema
+
+## Table of Contents
+
+1. [Project Context](#project-context)
+2. [Technical Architecture](#technical-architecture)
+3. [Implementation Phases](#implementation-phases)
+4. [Component Specifications](#component-specifications)
+5. [Database Schema Design](#database-schema-design)
+6. [API Integration Points](#api-integration-points)
+7. [User Experience Design](#user-experience-design)
+8. [Performance Considerations](#performance-considerations)
+9. [Testing Strategy](#testing-strategy)
+10. [Deployment Strategy](#deployment-strategy)
+11. [Timeline & Milestones](#timeline--milestones)
+
+## Project Context
+
+### Current System Analysis
+
+Our event management system built on ATProto includes:
+- OAuth authentication with Bluesky PDS (`/src/atproto/atrium_auth.rs`)
+- Event creation and management system
+- PostgreSQL database with migration system
+- Image upload handling for events
+- Bilingual support (English/French Canadian)
+- Admin interface for content management
+
+### Integration Goals
+
+1. **AT Protocol Compliance**: Full compliance with AT Protocol blob upload and labeling specifications
+2. **Image Content Safety**: Detect inappropriate content using moderation.bsky.app as primary labeler
+3. **Real-time Feedback**: Immediate labeling during upload process via `atproto-accept-labelers` headers
+4. **User Autonomy**: User-controlled moderation preferences and labeler subscriptions
+5. **Self-Labeling Support**: Allow event creators to self-label their image content
+6. **Event Quality**: Maintain high-quality event imagery standards through transparent moderation
+7. **Performance**: Target 2-5 second image analysis response times with proper caching
+8. **Metadata Security**: Strip sensitive image metadata before blob upload as per AT Protocol recommendations
+9. **Custom Lexicon**: Create community.lexicon.calendar.event.image lexicon via RFC process
+10. **Data Consistency**: Implement transaction compensation patterns for AT Protocol + PostgreSQL consistency
+
+## Technical Architecture
+
+### Core Components Overview
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│                Event Creation UI                            │
+├─────────────────────────────────────────────────────────────┤
+│           Image Upload Component                            │
+├─────────────────────────────────────────────────────────────┤
+│                 HTTP Handler Layer                          │
+├─────────────────────────────────────────────────────────────┤
+│       Image Upload Handler with Moderation                  │
+├─────────────────────────────────────────────────────────────┤
+│               Image Labeling Service                        │
+├─────────────────────────────────────────────────────────────┤
+│ Bluesky Client │ Image Cache │ Rate Limiter │ Label Parser  │
+├─────────────────────────────────────────────────────────────┤
+│              Database & Storage Layer                       │
+├─────────────────────────────────────────────────────────────┤
+│   Event Data   │ Image Labels │ Upload Queue │ Cache Store  │
+└─────────────────────────────────────────────────────────────┘
+```
+
+### Integration Points
+
+1. **Event Image Upload**: Integrate labeling during image upload
+2. **Real-time Feedback**: Show labeling results immediately
+3. **Event Display**: Display appropriate labels on event images
+4. **Admin Review**: Allow admin override for borderline cases
+5. **Background Processing**: Handle batch labeling for existing images
+
+## Implementation Phases
+
+### Phase 1: AT Protocol Labeling Service Integration (Weeks 1-2)
+
+**Deliverables:**
+- AT Protocol labeler client with proper header-based subscription
+- Implementation of `com.atproto.label.defs` label structure
+- Labeler service discovery and subscription management
+- Database schema for AT Protocol-compliant label storage
+- Rate limiting and caching for labeler API calls
+- Integration with existing OAuth client for AT Protocol authentication
+
+**Key Files:**
+```
+/src/services/atproto_labeling/mod.rs
+/src/services/atproto_labeling/labeler_client.rs
+/src/services/atproto_labeling/label_types.rs
+/src/services/atproto_labeling/subscription_manager.rs
+/migrations/20250618000001_atproto_labels.sql
+```
+
+### Phase 2: Blob Upload & Record Creation Integration (Weeks 3-4)
+
+**Deliverables:**
+- Proper `com.atproto.repo.uploadBlob` implementation with metadata stripping
+- Image record creation using structured lexicons
+- Real-time label retrieval during upload using subscribed labelers
+- Self-labeling support with `com.atproto.label.defs#selfLabels`
+- Enhanced error handling for AT Protocol-specific failures
+- CDN URL generation for image display from blob references
+
+**Key Files:**
+```
+/src/http/handle_atproto_image_upload.rs
+/src/services/atproto_labeling/blob_upload.rs
+/src/services/atproto_labeling/record_creation.rs
+/src/services/atproto_labeling/metadata_stripper.rs
+/src/models/atproto_image_record.rs
+/src/atproto/lexicon/community_lexicon_calendar_event_image.rs
+```
+
+### Phase 3: User Experience & Preferences (Weeks 5-6)
+
+**Deliverables:**
+- User moderation preferences interface aligned with `app.bsky.actor.defs`
+- Labeler subscription management with per-labeler preferences
+- Content filtering engine based on AT Protocol moderation patterns
+- HTMX Self-labeling i18n UI for content creators during upload
+- Localized preference descriptions and label explanations
+- Integration with existing OAuth flow for preference persistence
+
+**Key Files:**
+```
+/src/services/user_moderation/mod.rs
+/src/services/user_moderation/preferences.rs
+/src/services/atproto_labeling/moderation_engine.rs
+/templates/labeler_preferences.*.html
+/src/http/handle_labeler_subscriptions.rs
+/i18n/*/atproto_moderation.ftl
+/static/labeler-subscription.css
+```
+
+## User Preference Integration
+
+### 1. User Moderation Preferences Service (`/src/services/user_preferences/mod.rs`)
+
+**Purpose**: Manage user content filtering preferences according to AT Protocol standards.
+
+**Core Types (from AT Protocol documentation):**
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ModerationPrefs {
+    pub adult_content_enabled: bool,
+    pub labels: HashMap<String, LabelPreference>, // Global label settings
+    pub labelers: Vec<ModerationPrefsLabeler>,
+    pub muted_words: Vec<MutedWord>,
+    pub hidden_posts: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ModerationPrefsLabeler {
+    pub did: String,
+    pub labels: HashMap<String, LabelPreference>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum LabelPreference {
+    #[serde(rename = "hide")]
+    Hide,    // Filter from listings, blur content
+    #[serde(rename = "warn")]  
+    Warn,    // Show warning overlay
+    #[serde(rename = "ignore")]
+    Ignore,  // Show content normally
+}
+```
+
+**User Preferences Management:**
+```rust
+impl UserModerationService {
+    pub async fn get_user_preferences(&self, user_did: &str) -> Result<ModerationPrefs> {
+        // Get from database or use defaults
+        let prefs = self.db.get_user_preferences(user_did).await?
+            .unwrap_or_else(|| self.get_default_preferences());
+        
+        Ok(prefs)
+    }
+    
+    pub async fn update_user_preferences(
+        &self, 
+        user_did: &str, 
+        prefs: ModerationPrefs
+    ) -> Result<()> {
+        // Update labeler subscriptions via HTTP headers
+        self.update_labeler_subscriptions(&prefs.labelers).await?;
+        
+        // Save to database
+        self.db.save_user_preferences(user_did, prefs).await?;
+        
+        Ok(())
+    }
+    
+    pub async fn subscribe_to_labeler(
+        &self,
+        user_did: &str,
+        labeler_did: &str,
+        label_preferences: HashMap<String, LabelPreference>
+    ) -> Result<()> {
+        let mut prefs = self.get_user_preferences(user_did).await?;
+        
+        // Add new labeler subscription
+        prefs.labelers.push(ModerationPrefsLabeler {
+            did: labeler_did.to_string(),
+            labels: label_preferences,
+        });
+        
+        self.update_user_preferences(user_did, prefs).await?;
+        Ok(())
+    }
+}
+```
+
+### 2. Content Moderation Engine (`/src/services/moderation/mod.rs`)
+
+**Purpose**: Apply user preferences to filter and moderate content display.
+
+**Moderation Decision Engine:**
+```rust
+#[derive(Debug, Clone)]
+pub struct ModerationDecision {
+    pub filter: bool,        // Remove from listings
+    pub blur: bool,          // Put behind cover/warning
+    pub alert: bool,         // Show danger warning
+    pub inform: bool,        // Show neutral info
+    pub no_override: bool,   // Disable clicking through warning
+}
+
+impl ModerationEngine {
+    pub async fn moderate_event_image(
+        &self,
+        image_labels: &[Label],
+        user_preferences: &ModerationPrefs,
+        context: &str // "contentList", "contentView", "contentMedia"
+    ) -> ModerationDecision {
+        let mut decision = ModerationDecision::default();
+        
+        for label in image_labels {
+            let preference = self.get_label_preference(label, user_preferences);
+            
+            match (&label.val, preference, context) {
+                // Global labels with special behavior
+                ("!hide", _, _) => {
+                    decision.filter = true;
+                    decision.blur = true;
+                    decision.no_override = true;
+                }
+                ("!warn", _, _) => {
+                    decision.blur = true;
+                    decision.alert = true;
+                }
+                ("porn", LabelPreference::Hide, _) if !user_preferences.adult_content_enabled => {
+                    decision.filter = true;
+                    decision.blur = true;
+                    decision.no_override = true;
+                }
+                ("porn", LabelPreference::Warn, "contentMedia") => {
+                    decision.blur = true;
+                    decision.alert = true;
+                }
+                ("sexual", LabelPreference::Warn, _) => {
+                    decision.blur = true;
+                    decision.inform = true;
+                }
+                ("nudity", LabelPreference::Ignore, _) => {
+                    // Show normally
+                }
+                _ => {
+                    // Apply custom labeler preferences
+                    self.apply_custom_labeler_preference(label, user_preferences, &mut decision);
+                }
+            }
+        }
+        
+        decision
+    }
+    
+    fn get_label_preference(&self, label: &Label, prefs: &ModerationPrefs) -> LabelPreference {
+        // Check if it's from a subscribed labeler
+        for labeler in &prefs.labelers {
+            if labeler.did == label.src {
+                if let Some(pref) = labeler.labels.get(&label.val) {
+                    return pref.clone();
+                }
+            }
+        }
+        
+        // Check global label preferences
+        prefs.labels.get(&label.val)
+            .cloned()
+            .unwrap_or(LabelPreference::Warn) // Default to warn
+    }
+}
+```
+## Component Specifications
+
+### 1. AT Protocol Labeler Client (`/src/services/atproto_labeling/labeler_client.rs`)
+
+**Purpose**: Interface with AT Protocol labeling system using current API specifications and proper labeler subscription mechanisms.
+
+**Key Features:**
+- Header-based labeler subscription using `atproto-accept-labelers`
+- Proper label fetching using `com.atproto.label.queryLabels`
+- Real-time label subscription via `com.atproto.label.subscribeLabels`
+- Integration with existing OAuth infrastructure
+- Labeler service discovery and definition caching
+
+**Core Implementation:**
+```rust
+use crate::atproto::atrium_auth::AtriumOAuthManager;
+use atrium_api::com::atproto::label::{queryLabels, subscribeLabels};
+use atrium_api::types::string::Datetime;
+
+pub struct ATProtoLabelerClient {
+    oauth_manager: Arc<AtriumOAuthManager>,
+    subscribed_labelers: Arc<RwLock<Vec<String>>>, // DIDs of subscribed labelers
+    http_client: reqwest::Client,
+    label_cache: Arc<LabelCache>,
+}
+
+impl ATProtoLabelerClient {
+    /// Query labels for a specific AT URI from subscribed labelers
+    pub async fn query_labels_for_uri(&self, uri: &str) -> Result<Vec<Label>> {
+        let agent = self.oauth_manager.get_atproto_client().await?;
+        
+        let query_input = queryLabels::Input {
+            uri_patterns: vec![uri.to_string()],
+            sources: Some(self.get_subscribed_labelers().await),
+            limit: Some(50),
+            cursor: None,
+        };
+        
+        let response = agent.api.com.atproto.label.query_labels(query_input).await?;
+        Ok(response.labels)
+    }
+    
+    /// Create image record with proper self-labeling support
+    pub async fn create_image_record_with_labels(
+        &self,
+        blob_ref: BlobRef,
+        metadata: ImageMetadata,
+        self_labels: Option<Vec<SelfLabel>>
+    ) -> Result<CreateRecordOutput> {
+        let agent = self.oauth_manager.get_atproto_client().await?;
+        
+        let record = ImageRecord {
+            blob: blob_ref,
+            alt: metadata.alt_text,
+            aspect_ratio: metadata.aspect_ratio,
+            labels: self_labels,
+            created_at: Datetime::now(),
+        };
+        
+        let create_input = CreateRecordInput {
+            repo: agent.session.as_ref().unwrap().did.clone(),
+            collection: "community.lexicon.calendar.event.image".to_string(),
+            rkey: None,
+            validate: Some(true),
+            record: serde_json::to_value(record)?,
+            swap_commit: None,
+        };
+        
+        agent.api.com.atproto.repo.create_record(create_input).await
+    }
+    
+    /// Set proper labeler headers for requests
+    pub fn add_labeler_headers(&self, request: &mut reqwest::Request) {
+        let labelers = self.subscribed_labelers.read().unwrap();
+        if !labelers.is_empty() {
+            let labeler_header = labelers.join(",");
+            request.headers_mut().insert(
+                "atproto-accept-labelers", 
+                HeaderValue::from_str(&labeler_header).unwrap()
+            );
+        }
+    }
+}
+```
+
+**Labeler Service Discovery:**
+```rust
+impl ATProtoLabelerClient {
+    /// Discover available labeler services
+    pub async fn discover_labelers(&self, query: Option<&str>) -> Result<Vec<LabelerService>> {
+        // In practice, this would query a directory or use search APIs
+        // For now, return well-known labelers
+        let well_known_labelers = vec![
+            LabelerService {
+                did: "did:plc:ar7c4by46qjdydhdevvrndac".to_string(), // Bluesky Moderation Service
+                handle: "bsky.social".to_string(),
+                display_name: "Bluesky Moderation".to_string(),
+                description: "Official Bluesky content moderation".to_string(),
+                policies: self.fetch_labeler_policies("did:plc:ar7c4by46qjdydhdevvrndac").await?,
+            }
+        ];
+        
+        Ok(well_known_labelers)
+    }
+    
+    /// Fetch labeler policies and supported labels
+    pub async fn fetch_labeler_policies(&self, labeler_did: &str) -> Result<LabelerPolicies> {
+        // Use existing cache or fetch from labeler service record
+        if let Some(cached) = self.label_cache.get_labeler_policies(labeler_did).await? {
+            return Ok(cached);
+        }
+        
+        let agent = self.oauth_manager.get_atproto_client().await?;
+        let record = agent.get_record(&format!("at://{}/app.bsky.labeler.service/self", labeler_did)).await?;
+        
+        let service: LabelerServiceRecord = serde_json::from_value(record.value)?;
+        
+        // Cache for 6 hours as recommended
+        self.label_cache.cache_labeler_policies(labeler_did, &service.policies, Duration::hours(6)).await?;
+        
+        Ok(service.policies)
+    }
+}
+```
+
+### 2. AT Protocol Label Types (`/src/services/atproto_labeling/label_types.rs`)
+
+**Purpose**: Define AT Protocol-compliant label handling based on current specifications and `com.atproto.label.defs`.
+
+**AT Protocol Label Structure (Current Specification):**
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Label {
+    /// The DID of the actor who created this label
+    pub src: String,
+    /// AT URI of the record, repository (account), or other resource
+    pub uri: String,
+    /// Optionally, CID specifying the specific version of 'uri' resource  
+    pub cid: Option<String>,
+    /// The short string name of the value or type of this label
+    pub val: String,
+    /// If true, this is a negation label, overwriting a previous label
+    pub neg: Option<bool>,
+    /// Timestamp when this label was created (ISO 8601)
+    pub cts: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SelfLabels {
+    pub values: Vec<SelfLabel>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SelfLabel {
+    pub val: String,
+}
+```
+
+**Global Label Values (Per Current AT Protocol Documentation):**
+```rust
+pub mod global_labels {
+    /// Cannot be clicked through, filters from listings completely
+    pub const HIDE: &str = "!hide";
+    /// Generic warning, can be clicked through  
+    pub const WARN: &str = "!warn";
+    /// Content inaccessible to logged-out users
+    pub const NO_UNAUTHENTICATED: &str = "!no-unauthenticated";
+    /// Adult content warning on images, 18+ restricted
+    pub const PORN: &str = "porn";
+    /// Less intense sexual content than porn
+    pub const SEXUAL: &str = "sexual";
+    /// Violence/gore content
+    pub const GRAPHIC_MEDIA: &str = "graphic-media";
+    /// Artistic nudity, not 18+ restricted
+    pub const NUDITY: &str = "nudity";
+}
+
+/// Self-labeling values that users can apply to their own content
+pub const SELF_LABEL_VALUES: &[&str] = &[
+    global_labels::NO_UNAUTHENTICATED,
+    global_labels::PORN,
+    global_labels::SEXUAL,
+    global_labels::NUDITY,
+    global_labels::GRAPHIC_MEDIA,
+];
+```
+
+**Label Behavior Definitions (Based on AT Protocol Standards):**
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct LabelValueDefinition {
+    pub identifier: String,
+    pub severity: LabelSeverity,
+    pub blurs: BlurBehavior,
+    pub default_setting: DefaultSetting,
+    pub adult_only: bool,
+    pub locales: Vec<LabelLocale>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum LabelSeverity {
+    #[serde(rename = "alert")]
+    Alert,   // "Danger" warning with red styling
+    #[serde(rename = "inform")]
+    Inform,  // "Info" neutral warning
+    #[serde(rename = "none")]
+    None,    // No warning UI
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum BlurBehavior {
+    #[serde(rename = "content")]
+    Content, // Hide content completely, requires click-through
+    #[serde(rename = "media")]
+    Media,   // Blur/hide images in content only
+    #[serde(rename = "none")]
+    None,    // No visual hiding
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum DefaultSetting {
+    #[serde(rename = "hide")]
+    Hide,    // Remove from feeds, hide content
+    #[serde(rename = "warn")]
+    Warn,    // Show with warning overlay
+    #[serde(rename = "ignore")]
+    Ignore,  // Show content normally
+}
+```
+
+**Label Processing for Images:**
+```rust
+impl ImageLabelProcessor {
+    /// Determine if upload should be blocked based on AT Protocol global labels
+    pub fn should_block_upload(&self, labels: &[Label]) -> bool {
+        labels.iter().any(|label| {
+            matches!(label.val.as_str(), 
+                global_labels::HIDE | 
+                global_labels::PORN  // Block porn uploads by default
+            )
+        })
+    }
+    
+    /// Check if user should be warned about content
+    pub fn should_warn_user(&self, labels: &[Label]) -> bool {
+        labels.iter().any(|label| {
+            matches!(label.val.as_str(), 
+                global_labels::WARN | 
+                global_labels::SEXUAL | 
+                global_labels::GRAPHIC_MEDIA |
+                global_labels::NUDITY
+            )
+        })
+    }
+    
+    /// Generate upload feedback based on applied labels
+    pub fn get_upload_feedback(&self, labels: &[Label]) -> UploadFeedback {
+        if self.should_block_upload(labels) {
+            UploadFeedback::Blocked { 
+                reason: "Content violates platform guidelines".to_string(),
+                labels: labels.to_vec() 
+            }
+        } else if self.should_warn_user(labels) {
+            UploadFeedback::Warning { 
+                message: "Content contains material that may be sensitive".to_string(),
+                labels: labels.to_vec(),
+                can_proceed: true,
+            }
+        } else {
+            UploadFeedback::Approved
+        }
+    }
+    
+    /// Validate self-labels are in allowed set
+    pub fn validate_self_labels(&self, self_labels: &[SelfLabel]) -> Result<(), ValidationError> {
+        for label in self_labels {
+            if !SELF_LABEL_VALUES.contains(&label.val.as_str()) {
+                return Err(ValidationError::InvalidSelfLabel(label.val.clone()));
+            }
+        }
+        Ok(())
+    }
+}
+```
+
+### 3. AT Protocol Image Upload Handler (`/src/http/handle_atproto_image_upload.rs`)
+
+**Purpose**: Implement proper AT Protocol blob upload with metadata stripping and labeling integration.
+
+**Lexicon Definition for Event Images:**
+```json
+{
+  "lexicon": 1,
+  "id": "community.lexicon.calendar.event.image", 
+  "defs": {
+    "main": {
+      "type": "record",
+      "description": "Event image record with AT Protocol compliance",
+      "key": "tid",
+      "record": {
+        "type": "object",
+        "required": ["blob", "createdAt"],
+        "properties": {
+          "blob": {
+            "type": "blob",
+            "accept": ["image/png", "image/jpeg", "image/webp"],
+            "maxSize": 1000000
+          },
+          "alt": {
+            "type": "string",
+            "maxLength": 300,
+            "description": "Alt text for accessibility"
+          },
+          "aspectRatio": {
+            "type": "object",
+            "properties": {
+              "width": {"type": "integer", "minimum": 1},
+              "height": {"type": "integer", "minimum": 1}
+            }
+          },
+          "labels": {
+            "$ref": "com.atproto.label.defs#selfLabels"
+          },
+          "createdAt": {
+            "type": "string",
+            "format": "datetime"
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+**Core Upload Workflow with Metadata Stripping:**
+```rust
+use atrium_api::com::atproto::repo::{uploadBlob, createRecord};
+
+pub async fn handle_atproto_image_upload(
+    State(app_state): State<AppState>,
+    Extension(auth): Extension<Auth>,
+    Multipart(mut multipart): Multipart,
+) -> Result<impl IntoResponse, WebError> {
+    // 1. Validate and process image
+    let image_data = validate_and_process_image(multipart).await?;
+    
+    // 2. Strip metadata for privacy/security (per AT Protocol recommendations)
+    let cleaned_image_data = strip_image_metadata(&image_data.bytes)?;
+    
+    // 3. Get user's AT Protocol client with proper session
+    let atproto_client = app_state.oauth_manager
+        .get_atproto_client()
+        .await?;
+    
+    // 4. Upload blob to user's PDS
+    let blob_upload_result = upload_image_blob(
+        &atproto_client,
+        &cleaned_image_data,
+        &image_data.mime_type
+    ).await?;
+    
+    // 5. Validate self-labels if provided
+    if let Some(ref self_labels) = image_data.self_labels {
+        app_state.label_processor.validate_self_labels(self_labels)?;
+    }
+    
+    // 6. Create image record with blob reference and self-labels
+    let image_record = CreateImageRecord {
+        blob: blob_upload_result.blob.clone(),
+        alt: image_data.alt_text,
+        aspect_ratio: image_data.aspect_ratio,
+        labels: image_data.self_labels.map(|labels| SelfLabels { values: labels }),
+        created_at: Datetime::now(),
+    };
+    
+    // 7. Create record in user's repository        let record_result = create_image_record(
+            &atproto_client,
+            image_record
+        ).await?;
+    
+    // 8. Query labels from subscribed labelers using proper headers
+    let applied_labels = query_labels_for_record(
+        &app_state.labeler_client,
+        &record_result.uri
+    ).await?;
+    
+    // 9. Process labels and determine upload outcome
+    let upload_result = ProcessedUploadResult {
+        at_uri: record_result.uri,
+        blob_ref: blob_upload_result.blob,
+        cid: record_result.cid,
+        labels: applied_labels.clone(),
+        display_url: generate_cdn_url(&blob_upload_result.blob),
+        moderation_decision: app_state.label_processor.get_upload_feedback(&applied_labels),
+    };
+    
+    Ok(Json(upload_result))
+}
+```
+
+**Metadata Stripping Implementation:**
+```rust
+use image::{ImageFormat, DynamicImage};
+
+/// Strip potentially sensitive metadata from images before upload
+/// This implements AT Protocol recommendation for privacy protection
+pub fn strip_image_metadata(image_bytes: &[u8]) -> Result<Vec<u8>, ImageProcessingError> {
+    // Load image
+    let img = image::load_from_memory(image_bytes)?;
+    
+    // Determine format
+    let format = image::guess_format(image_bytes)?;
+    
+    // Re-encode without metadata
+    let mut output = Vec::new();
+    match format {
+        ImageFormat::Jpeg => {
+            img.write_to(&mut std::io::Cursor::new(&mut output), ImageFormat::Jpeg)?;
+        }
+        ImageFormat::Png => {
+            img.write_to(&mut std::io::Cursor::new(&mut output), ImageFormat::Png)?;
+        }
+        ImageFormat::WebP => {
+            img.write_to(&mut std::io::Cursor::new(&mut output), ImageFormat::WebP)?;
+        }
+        _ => return Err(ImageProcessingError::UnsupportedFormat),
+    }
+    
+    Ok(output)
+}
+```
+
+**Proper AT Protocol Blob Upload:**
+```rust
+async fn upload_image_blob(
+    atproto_client: &AtpAgent<MemoryStore<(), Object<OutputData>>, DpopAwareHttpClient>,
+    image_data: &[u8],
+    mime_type: &str,
+) -> Result<uploadBlob::Output, ImageUploadError> {
+    let upload_input = uploadBlob::Input {
+        blob: image_data.to_vec(),
+    };
+    
+    // Set content type header manually if needed
+    let mut request = atproto_client.api.com.atproto.repo.upload_blob(upload_input);
+    
+    let blob_result = request.await
+        .map_err(|e| ImageUploadError::BlobUploadFailed(e.to_string()))?;
+    
+    // Verify blob metadata
+    if blob_result.blob.mime_type != mime_type {
+        return Err(ImageUploadError::MimeTypeMismatch {
+            expected: mime_type.to_string(),
+            received: blob_result.blob.mime_type,
+        });
+    }
+    
+    Ok(blob_result)
+}
+
+async fn create_image_record(
+    atproto_client: &AtpAgent<MemoryStore<(), Object<OutputData>>, DpopAwareHttpClient>,
+    image_record: CreateImageRecord,
+) -> Result<createRecord::Output, ImageUploadError> {
+    let create_input = createRecord::Input {
+        repo: atproto_client.session.as_ref().unwrap().did.clone(),
+        collection: "community.lexicon.calendar.event.image".to_string(),
+        rkey: None, // Let PDS generate the record key
+        validate: Some(true),
+        record: serde_json::to_value(image_record)?,
+        swap_commit: None,
+    };
+    
+    atproto_client.api.com.atproto.repo.create_record(create_input).await
+        .map_err(|e| ImageUploadError::RecordCreationFailed(e.to_string()))
+}
+```
+
+### 4. AT Protocol Label Cache System (`/src/services/atproto_labeling/cache.rs`)
+
+**Purpose**: Cache label definitions and applied labels according to AT Protocol patterns with proper TTL management.
+
+**Cache Architecture Aligned with AT Protocol:**
+```rust
+pub struct ATProtoLabelCache {
+    redis_client: Redis,
+    local_cache: LRU<String, CachedLabels>,
+    labeler_definitions_cache: LRU<String, CachedLabelerDefinitions>,
+    subscription_cache: LRU<String, CachedSubscription>,
+}
+
+#[derive(Debug, Clone)]
+pub struct CachedLabels {
+    pub at_uri: String,
+    pub labels: Vec<Label>,
+    pub cached_at: DateTime<Utc>,
+    pub ttl: Duration,
+    pub labeler_sources: Vec<String>, // Which labelers provided these labels
+}
+
+#[derive(Debug, Clone)]
+pub struct CachedLabelerDefinitions {
+    pub labeler_did: String,
+    pub policies: LabelerPolicies,
+    pub label_definitions: Vec<LabelValueDefinition>,
+    pub cached_at: DateTime<Utc>,
+    pub ttl: Duration, // 6 hours as per AT Protocol recommendations
+}
+
+#[derive(Debug, Clone)]
+pub struct CachedSubscription {
+    pub user_did: String,
+    pub subscribed_labelers: Vec<String>,
+    pub cached_at: DateTime<Utc>,
+    pub ttl: Duration,
+}
+```
+
+**Cache Strategy (per AT Protocol recommendations):**
+```rust
+impl ATProtoLabelCache {
+    /// Get cached labels for an AT URI with proper TTL handling
+    pub async fn get_labels(&self, at_uri: &str) -> Option<Vec<Label>> {
+        // Try local cache first (fastest)
+        if let Some(cached) = self.local_cache.get(at_uri) {
+            if cached.cached_at + cached.ttl > Utc::now() {
+                return Some(cached.labels.clone());
+            }
+        }
+        
+        // Try Redis cache (shared across instances)
+        if let Ok(Some(cached)) = self.redis_client.get::<CachedLabels>(at_uri).await {
+            if cached.cached_at + cached.ttl > Utc::now() {
+                // Refresh local cache
+                self.local_cache.put(at_uri.to_string(), cached.clone());
+                return Some(cached.labels);
+            }
+        }
+        
+        None
+    }
+    
+    /// Cache labels with appropriate TTL based on source
+    pub async fn cache_labels(
+        &self, 
+        at_uri: &str, 
+        labels: Vec<Label>,
+        labeler_sources: Vec<String>
+    ) -> Result<()> {
+        // Determine TTL based on label types and sources
+        let ttl = self.determine_label_ttl(&labels, &labeler_sources);
+        
+        let cached = CachedLabels {
+            at_uri: at_uri.to_string(),
+            labels: labels.clone(),
+            cached_at: Utc::now(),
+            ttl,
+            labeler_sources,
+        };
+        
+        // Store in both caches
+        self.local_cache.put(at_uri.to_string(), cached.clone());
+        
+        // Redis cache with expiration
+        let redis_key = format!("labels:{}", at_uri);
+        self.redis_client.set_ex(redis_key, cached, ttl.num_seconds() as u64).await?;
+        
+        Ok(())
+    }
+    
+    /// Cache labeler definitions with 6-hour TTL as recommended
+    pub async fn cache_labeler_definitions(
+        &self, 
+        labeler_did: &str, 
+        policies: LabelerPolicies,
+        definitions: Vec<LabelValueDefinition>
+    ) -> Result<()> {
+        let cached = CachedLabelerDefinitions {
+            labeler_did: labeler_did.to_string(),
+            policies,
+            label_definitions: definitions,
+            cached_at: Utc::now(),
+            ttl: Duration::hours(6), // AT Protocol recommendation
+        };
+        
+        // Store in local cache
+        self.labeler_definitions_cache.put(labeler_did.to_string(), cached.clone());
+        
+        // Store in Redis with expiration
+        let redis_key = format!("labeler_def:{}", labeler_did);
+        self.redis_client.set_ex(redis_key, cached, 6 * 3600).await?; // 6 hours
+        
+        Ok(())
+    }
+    
+    /// Determine appropriate TTL based on label content and usage patterns
+    fn determine_label_ttl(&self, labels: &[Label], sources: &[String]) -> Duration {
+        // Global labels (!hide, !warn) should have shorter TTL for rapid updates
+        let has_global_labels = labels.iter().any(|l| l.val.starts_with('!'));
+        
+        // High-severity labels should refresh more frequently
+        let has_high_severity = labels.iter().any(|l| {
+            matches!(l.val.as_str(), 
+                global_labels::HIDE | 
+                global_labels::PORN | 
+                global_labels::GRAPHIC_MEDIA
+            )
+        });
+        
+        match (has_global_labels, has_high_severity) {
+            (true, _) => Duration::hours(1),         // Global labels - 1 hour (reduced from 15min)
+            (_, true) => Duration::hours(4),         // High severity labels - 4 hours
+            _ => Duration::hours(12),                // Standard labels - 12 hours (increased)
+        }
+    }
+    
+    /// Get labeler definitions with cache fallback
+    pub async fn get_labeler_definitions(&self, labeler_did: &str) -> Option<CachedLabelerDefinitions> {
+        // Check local cache first
+        if let Some(cached) = self.labeler_definitions_cache.get(labeler_did) {
+            if cached.cached_at + cached.ttl > Utc::now() {
+                return Some(cached.clone());
+            }
+        }
+        
+        // Check Redis cache
+        let redis_key = format!("labeler_def:{}", labeler_did);
+        if let Ok(Some(cached)) = self.redis_client.get::<CachedLabelerDefinitions>(&redis_key).await {
+            if cached.cached_at + cached.ttl > Utc::now() {
+                self.labeler_definitions_cache.put(labeler_did.to_string(), cached.clone());
+                return Some(cached);
+            }
+        }
+        
+        None
+    }
+    
+    /// Cache user's labeler subscriptions
+    pub async fn cache_user_subscriptions(
+        &self,
+        user_did: &str,
+        subscribed_labelers: Vec<String>
+    ) -> Result<()> {
+        let cached = CachedSubscription {
+            user_did: user_did.to_string(),
+            subscribed_labelers,
+            cached_at: Utc::now(),
+            ttl: Duration::hours(1), // User prefs change less frequently
+        };
+        
+        // Store in local cache
+        self.subscription_cache.put(user_did.to_string(), cached.clone());
+        
+        // Store in Redis
+        let redis_key = format!("user_subs:{}", user_did);
+        self.redis_client.set_ex(redis_key, cached, 3600).await?; // 1 hour
+        
+        Ok(())
+    }
+    
+    /// Invalidate cache for specific AT URI (e.g., when content is updated)
+    pub async fn invalidate_labels(&self, at_uri: &str) -> Result<()> {
+        // Remove from local cache
+        self.local_cache.pop(at_uri);
+        
+        // Remove from Redis
+        let redis_key = format!("labels:{}", at_uri);
+        self.redis_client.del(redis_key).await?;
+        
+        Ok(())
+    }
+}
+```
+
+## Database Schema Design
+
+### AT Protocol Label Storage (Compliant with Current Specifications)
+```sql
+-- /migrations/20250618000001_atproto_labels.sql
+CREATE TABLE atproto_labels (
+    id BIGSERIAL PRIMARY KEY,
+    
+    -- Core AT Protocol Label fields (matching com.atproto.label.defs)
+    src VARCHAR(255) NOT NULL,        -- DID of labeler who created this label
+    uri VARCHAR(500) NOT NULL,        -- AT URI of labeled resource
+    cid VARCHAR(100),                 -- Optional CID for specific version
+    val VARCHAR(100) NOT NULL,        -- Label value (e.g., "porn", "nudity")
+    neg BOOLEAN DEFAULT FALSE,        -- Negation flag
+    cts TIMESTAMPTZ NOT NULL,         -- Label creation timestamp
+    
+    -- Local metadata for caching and performance
+    cached_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL DEFAULT (NOW() + INTERVAL '6 hours'),
+    labeler_priority INTEGER DEFAULT 0, -- For handling conflicting labels
+    
+    -- Indexes for efficient querying
+    CONSTRAINT unique_label UNIQUE(src, uri, cid, val),
+    INDEX idx_atproto_labels_uri (uri),
+    INDEX idx_atproto_labels_src (src),
+    INDEX idx_atproto_labels_val (val),
+    INDEX idx_atproto_labels_cts (cts),
+    INDEX idx_atproto_labels_expires (expires_at)
+);
+
+-- Event to AT URI mapping (updated for AT Protocol)
+CREATE TABLE event_image_records (
+    id BIGSERIAL PRIMARY KEY,
+    event_id BIGINT NOT NULL REFERENCES events(id) ON DELETE CASCADE,
+    
+    -- AT Protocol record references
+    at_uri VARCHAR(500) NOT NULL UNIQUE,     -- AT URI of image record
+    record_key VARCHAR(100) NOT NULL,        -- Record key (rkey)
+    collection VARCHAR(255) NOT NULL DEFAULT 'community.lexicon.calendar.event.image',
+    
+    -- Blob reference for display
+    blob_cid VARCHAR(100) NOT NULL,          -- CID of the blob
+    blob_mime_type VARCHAR(50) NOT NULL,     -- MIME type from blob metadata
+    
+    -- Image metadata
+    alt_text TEXT,
+    aspect_ratio_width INTEGER,
+    aspect_ratio_height INTEGER,
+    
+    -- Self-labels as JSON array
+    self_labels JSONB DEFAULT '[]',          -- [{"val": "nudity"}, {"val": "!no-unauthenticated"}]
+    
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    
+    INDEX idx_event_image_records_event (event_id),
+    INDEX idx_event_image_records_at_uri (at_uri),
+    INDEX idx_event_image_records_collection (collection),
+    INDEX idx_event_image_records_self_labels USING GIN (self_labels)
+);
+```
+
+### Labeler Service Registry (For Discovery and Subscription)
+```sql
+-- /migrations/20250618000002_labeler_services.sql
+CREATE TABLE labeler_services (
+    id BIGSERIAL PRIMARY KEY,
+    
+    -- Labeler identification
+    did VARCHAR(255) NOT NULL UNIQUE,        -- Labeler's DID
+    handle VARCHAR(255),                     -- Human-readable handle
+    service_url VARCHAR(500),                -- Labeler service endpoint
+    
+    -- Service metadata
+    display_name VARCHAR(200),
+    description TEXT,
+    terms_of_service_url VARCHAR(500),
+    privacy_policy_url VARCHAR(500),
+    
+    -- Supported labels and policies
+    label_values JSONB NOT NULL DEFAULT '[]',           -- Supported label values
+    label_definitions JSONB NOT NULL DEFAULT '[]',      -- LabelValueDefinition objects
+    subject_types JSONB DEFAULT '["repo", "record"]',   -- What can be labeled
+    subject_collections JSONB DEFAULT '["app.bsky.feed.post", "community.lexicon.calendar.event.image"]', -- ["app.bsky.feed.post", "community.lexicon.calendar.event.image"]
+    reason_types JSONB DEFAULT '["spam", "violation", "misleading", "sexual", "rude"]',      -- ["spam", "violation", "misleading", "sexual", "rude"]
+    
+    -- Service status
+    is_active BOOLEAN DEFAULT TRUE,
+    last_checked_at TIMESTAMPTZ,
+    response_time_ms INTEGER,
+    
+    -- Cache metadata
+    policies_cached_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    policies_expires_at TIMESTAMPTZ NOT NULL DEFAULT (NOW() + INTERVAL '6 hours'),
+    
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    
+    INDEX idx_labeler_services_did (did),
+    INDEX idx_labeler_services_active (is_active),
+    INDEX idx_labeler_services_expires (policies_expires_at)
+);
+```
+
+### User Moderation Preferences (Aligned with app.bsky.actor.defs)
+```sql
+-- /migrations/20250618000003_user_moderation_prefs.sql
+CREATE TABLE user_moderation_preferences (
+    user_did VARCHAR(255) PRIMARY KEY,
+    
+    -- Global moderation settings
+    adult_content_enabled BOOLEAN DEFAULT FALSE,
+    
+    -- Global label preferences (applies to all labelers unless overridden)
+    global_label_prefs JSONB NOT NULL DEFAULT '{}', -- {label_val: "hide"|"warn"|"ignore"}
+    
+    -- Labeler subscriptions with per-labeler preferences
+    labeler_subscriptions JSONB NOT NULL DEFAULT '[]', -- [{did: "", labels: {label_val: setting}}]
+    
+    -- Content filtering preferences
+    muted_words JSONB DEFAULT '[]',           -- Array of muted word patterns
+    hidden_posts JSONB DEFAULT '[]',          -- Array of hidden post AT URIs
+    hidden_reposts JSONB DEFAULT '[]',        -- Array of hidden repost AT URIs
+    
+    -- Privacy settings
+    hide_from_unauthenticated BOOLEAN DEFAULT FALSE,
+    
+    -- Metadata
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    
+    INDEX idx_user_moderation_did (user_did),
+    INDEX idx_user_moderation_updated (updated_at)
+);
+
+-- Insert default preferences template
+INSERT INTO user_moderation_preferences (
+    user_did, 
+    global_label_prefs, 
+    labeler_subscriptions
+) VALUES (
+    'default_template', 
+    jsonb_build_object(
+        'porn', 'hide',
+        'sexual', 'warn', 
+        'graphic-media', 'warn',
+        'nudity', 'ignore',
+        '!hide', 'hide',
+        '!warn', 'warn',
+        '!no-unauthenticated', 'hide'
+    ),
+    jsonb_build_array(
+        jsonb_build_object(
+            'did', 'did:plc:ar7c4by46qjdydhdevvrndac',
+            'labels', jsonb_build_object(
+                'porn', 'hide',
+                'sexual', 'warn',
+                'graphic-media', 'warn'
+            )
+        )
+    )
+) ON CONFLICT (user_did) DO NOTHING;
+```
+
+### Self-Labels Tracking for Events
+```sql
+-- /migrations/20250618000004_event_self_labels.sql
+-- Update events table to track self-labeling
+ALTER TABLE events ADD COLUMN image_self_labels JSONB DEFAULT '[]';
+ALTER TABLE events ADD COLUMN requires_login BOOLEAN DEFAULT FALSE; -- For !no-unauthenticated
+
+-- Index for querying events by self-labels
+CREATE INDEX idx_events_self_labels ON events USING GIN (image_self_labels);
+CREATE INDEX idx_events_requires_login ON events (requires_login);
+
+-- View for events with resolved labels (both self-labels and external labels)
+CREATE VIEW events_with_labels AS
+SELECT 
+    e.*,
+    eir.at_uri as image_at_uri,
+    eir.blob_cid as image_blob_cid,
+    eir.self_labels as image_self_labels,
+    COALESCE(
+        jsonb_agg(
+            jsonb_build_object(
+                'src', al.src,
+                'val', al.val,
+                'neg', al.neg,
+                'cts', al.cts
+            )
+        ) FILTER (WHERE al.id IS NOT NULL),
+        '[]'::jsonb
+    ) as external_labels
+FROM events e
+LEFT JOIN event_image_records eir ON e.id = eir.event_id
+LEFT JOIN atproto_labels al ON al.uri = eir.at_uri
+GROUP BY e.id, eir.at_uri, eir.blob_cid, eir.self_labels;
+```
+
+## API Integration Points
+
+### 1. AT Protocol Labeler Integration
+
+**Current AT Protocol Label Structure (per `com.atproto.label.defs`):**
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Label {
+    /// The DID of the actor who created this label
+    pub src: String,
+    /// AT URI of the record, repository (account), or other resource
+    pub uri: String,
+    /// Optionally, CID specifying the specific version of 'uri' resource  
+    pub cid: Option<String>,
+    /// The short string name of the value or type of this label
+    pub val: String,
+    /// If true, this is a negation label, overwriting a previous label
+    pub neg: Option<bool>,
+    /// Timestamp when this label was created (ISO 8601)
+    pub cts: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SelfLabels {
+    pub values: Vec<SelfLabel>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SelfLabel {
+    pub val: String,
+}
+```
+
+**Global Label Values (Current AT Protocol Standard):**
+- `!hide` - Content must be hidden, cannot be clicked through, filters from listings
+- `!warn` - Generic warning, can be clicked through  
+- `!no-unauthenticated` - Content inaccessible to logged-out users
+- `porn` - Adult content warning, 18+ restricted
+- `sexual` - Sexual content, less intense than porn
+- `graphic-media` - Violence/gore content
+- `nudity` - Artistic nudity, not 18+ restricted
+
+### 2. Labeler Subscription Using HTTP Headers
+
+**Confirmed AT Protocol Integration Details**
+
+**Labeler Header Support (Confirmed)**
+
+Based on AT Protocol documentation, the `atproto-accept-labelers` header **is supported** with this syntax:
+```
+atproto-accept-labelers: did:web:mod.example.com;redact, did:plc:abc123, did:plc:xyz789
+```
+
+**Implementation:**
+```rust
+// Confirmed working pattern from AT Protocol specs
+const LABELER_ACCEPT_HEADER: &str = "atproto-accept-labelers";
+
+impl LabelerSubscriptionManager {
+    /// Add labeler subscription headers with confirmed syntax
+    pub fn add_labeler_headers(&self, request: &mut reqwest::Request, user_did: &str) {
+        if let Some(subscriptions) = self.user_subscriptions.read().unwrap().get(user_did) {
+            if !subscriptions.is_empty() {
+                // Format: did1, did2, did3;flags
+                let labeler_header = subscriptions.join(", ");
+                request.headers_mut().insert(
+                    LABELER_ACCEPT_HEADER,
+                    HeaderValue::from_str(&labeler_header).unwrap()
+                );
+            }
+        }
+    }
+}
+```
+
+### 3. Primary Labeler Service
+
+**moderation.bsky.app Details:**
+- DID: `did:plc:ar7c4by46qjdydhdevvrndac` (Bluesky Moderation Service)
+- Primary labeler for initial implementation
+- Fallback strategy: Direct connection to moderation.bsky.app if other labelers fail
+- Supported labels: Standard AT Protocol global labels (`!hide`, `!warn`, `porn`, `sexual`, `nudity`, `graphic-media`)
+
+### 4. Error Handling & Rollback Strategy
+
+**Transaction Compensation Pattern (Research-Based):**
+Since AT Protocol doesn't have built-in transaction rollback, we implement compensation:
+
+```rust
+pub struct ImageUploadTransaction {
+    pub blob_ref: Option<BlobRef>,
+    pub record_uri: Option<String>,
+    pub postgres_id: Option<i64>,
+    pub cache_keys: Vec<String>,
+}
+
+impl ImageUploadTransaction {
+    /// Rollback strategy for failed uploads
+    pub async fn compensate(&self, atproto_client: &AtpAgent) -> Result<()> {
+        // 1. Delete AT Protocol record if created
+        if let Some(uri) = &self.record_uri {
+            let _ = atproto_client.api.com.atproto.repo.delete_record(DeleteRecordInput {
+                repo: atproto_client.session.as_ref().unwrap().did.clone(),
+                collection: "community.lexicon.calendar.event.image".to_string(),
+                rkey: extract_rkey_from_uri(uri)?,
+            }).await; // Best effort - blobs remain in PDS temporarily
+        }
+        
+        // 2. Remove PostgreSQL entries
+        if let Some(id) = self.postgres_id {
+            sqlx::query!("DELETE FROM event_image_records WHERE id = $1", id)
+                .execute(&self.db)
+                .await?;
+        }
+        
+        // 3. Clear cache entries
+        for key in &self.cache_keys {
+            self.cache.invalidate(key).await?;
+        }
+        
+        Ok(())
+    }
+}
+
+/// Upload with compensation on failure
+pub async fn upload_with_compensation(
+    upload_data: ImageUploadData,
+    atproto_client: &AtpAgent,
+    db: &PgPool,
+) -> Result<UploadResult, UploadError> {
+    let mut transaction = ImageUploadTransaction::default();
+    
+    // Step 1: Upload blob
+    let blob_result = match upload_blob_to_pds(&upload_data, atproto_client).await {
+        Ok(result) => {
+            transaction.blob_ref = Some(result.blob.clone());
+            result
+        }
+        Err(e) => return Err(UploadError::BlobUploadFailed(e)),
+    };
+    
+    // Step 2: Create AT Protocol record
+    let record_result = match create_atproto_record(&blob_result, atproto_client).await {
+        Ok(result) => {
+            transaction.record_uri = Some(result.uri.clone());
+            result
+        }
+        Err(e) => {
+            transaction.compensate(atproto_client).await?;
+            return Err(UploadError::RecordCreationFailed(e));
+        }
+    };
+    
+    // Step 3: Store in PostgreSQL
+    let postgres_id = match store_in_postgres(&record_result, db).await {
+        Ok(id) => {
+            transaction.postgres_id = Some(id);
+            id
+        }
+        Err(e) => {
+            transaction.compensate(atproto_client).await?;
+            return Err(UploadError::DatabaseStorageFailed(e));
+        }
+    };
+    
+    Ok(UploadResult {
+        at_uri: record_result.uri,
+        blob_cid: blob_result.blob.ref_link,
+        postgres_id,
+    })
+}
+```
+
+### 4. Cache Strategy Research Results
+
+**Optimized TTL Strategy:**
+Based on AT Protocol patterns and realistic usage:
+
+```rust
+impl ATProtoLabelCache {
+    /// Determine appropriate TTL based on label content and usage patterns
+    fn determine_label_ttl(&self, labels: &[Label], sources: &[String]) -> Duration {
+        // Global labels (!hide, !warn) should have shorter TTL for rapid updates
+        let has_global_labels = labels.iter().any(|l| l.val.starts_with('!'));
+        
+        // High-severity labels should refresh more frequently
+        let has_high_severity = labels.iter().any(|l| {
+            matches!(l.val.as_str(), 
+                global_labels::HIDE | 
+                global_labels::PORN | 
+                global_labels::GRAPHIC_MEDIA
+            )
+        });
+        
+        match (has_global_labels, has_high_severity) {
+            (true, _) => Duration::hours(1),         // Global labels - 1 hour (reduced from 15min)
+            (_, true) => Duration::hours(4),         // High severity labels - 4 hours
+            _ => Duration::hours(12),                // Standard labels - 12 hours (increased)
+        }
+    }
+    
+    /// Cache invalidation strategy for distributed instances
+    pub async fn invalidate_distributed(&self, at_uri: &str) -> Result<()> {
+        // Use Redis pub/sub for cache invalidation across instances
+        let invalidation_message = CacheInvalidationMessage {
+            at_uri: at_uri.to_string(),
+            timestamp: Utc::now(),
+            reason: "content_updated".to_string(),
+        };
+        
+        self.redis_client
+            .publish("cache_invalidation", serde_json::to_string(&invalidation_message)?)
+            .await?;
+        
+        // Also invalidate local cache immediately
+        self.local_cache.pop(at_uri);
+        
+        Ok(())
+    }
+}
+```
+## Outstanding Research & Implementation Questions
+
+### 1. Critical Technical Decisions
+
+**Question: Data Consistency Strategy**
+- **Status**: Requires investigation
+- **Decision**: Implement transaction compensation pattern with detailed logging
+- **Rollback Strategy**: 
+  1. Log all operations with unique transaction ID
+  2. Implement compensation functions for each step
+  3. Use circuit breaker pattern for external API failures
+  4. Background cleanup process for orphaned resources
+
+**Question: Cache TTL Optimization** 
+- **Status**: Research needed
+- **Initial Strategy**: Conservative TTLs (1-12 hours) with invalidation on content changes
+- **Monitoring**: Track cache hit rates, API call frequency, user experience metrics
+- **Optimization**: Adjust TTLs based on actual usage patterns and performance data
+
+**Question: Distributed Cache Invalidation**
+- **Status**: Requires implementation
+- **Solution**: Redis pub/sub with fallback to polling
+- **Pattern**: Event-driven invalidation with eventual consistency model
+
+### 2. Performance Baseline Research
+
+**Realistic Response Time Targets (Based on Workflow Complexity):**
+
+1. **Blob Upload to PDS**: 1-3 seconds
+   - Network latency to user's PDS
+   - Image metadata stripping: ~100ms
+   - File size optimization: ~200ms
+
+2. **AT Protocol Record Creation**: 500ms-1s
+   - Authentication token validation
+   - Record validation and creation
+   - PDS persistence
+
+3. **Label Fetching from moderation.bsky.app**: 500ms-2s
+   - API call with proper headers
+   - Label processing and validation
+   - Cache storage
+
+4. **PostgreSQL Operations**: 50-200ms
+   - Event-image relationship storage
+   - Index updates and queries
+
+**Total Realistic Target: 2-5 seconds** for complete upload workflow
+
+### 3. Small Market Considerations (10M Population)
+
+**Load Estimates:**
+- Concurrent users: ~1,000-5,000 peak
+- Image uploads: ~50-200 per minute peak
+- Cache storage: ~10GB for image labels
+- Database growth: ~1M records per year
+
+**Infrastructure Scaling:**
+- Single Redis instance sufficient initially
+- PostgreSQL connection pooling (20-50 connections)
+- Rate limiting well within moderation.bsky.app capacity
+- ServeProxy CDN rate limits adequate for market size
+
+### 4. RFC Process Timeline
+
+**Lexicon Submission Strategy:**
+1. **Week 1**: Draft initial lexicon specification
+2. **Week 2**: Community feedback period
+3. **Week 3-4**: Iteration based on feedback
+4. **Week 5**: Formal submission to AT Protocol working group
+5. **Week 6-8**: Implementation while awaiting approval
+
+**Fallback Plan**: Use existing image embedding patterns if RFC delayed
+
+### 5. Feature Flag Implementation
+
+**Rollout Control:**
+```rust
+#[derive(Debug, Clone)]
+pub struct ATProtoImageFeatureFlags {
+    pub enabled_for_admins: bool,
+    pub enabled_for_percentage: f32,  // 0.0 to 1.0
+    pub labeling_enabled: bool,
+    pub cdn_integration_enabled: bool,
+    pub self_labeling_enabled: bool,
+}
+
+impl ATProtoImageFeatureFlags {
+    pub fn is_enabled_for_user(&self, user_id: i64, is_admin: bool) -> bool {
+        if is_admin && self.enabled_for_admins {
+            return true;
+        }
+        
+        // Deterministic percentage rollout based on user ID
+        let hash = user_id as f32 / i64::MAX as f32;
+        hash <= self.enabled_for_percentage
+    }
+}
+```
+
+### 6. Monitoring & Alerting Strategy
+
+**Key Metrics to Track:**
+- Upload success rate (target: >95%)
+- Average upload time (target: <5 seconds)
+- Label accuracy (manual review sample)
+- Cache hit rate (target: >80%)
+- Error rate by component
+- User satisfaction scores
+
+**Alert Thresholds:**
+- Critical: Upload failure rate >10% for 5 minutes
+- Warning: Average upload time >7 seconds for 10 minutes
+- Info: Cache hit rate <70% for 1 hour
+
+### 7. Business Continuity Planning
+
+**Fallback Strategies:**
+1. **AT Protocol Unavailable**: Temporary local image storage with batch sync
+2. **moderation.bsky.app Down**: Basic keyword filtering + admin review queue
+3. **ServeProxy CDN Issues**: Direct blob serving from PDS
+4. **PostgreSQL Issues**: Read-only mode with cached data
+
+**Data Recovery:**
+- Daily PostgreSQL backups
+- AT Protocol records serve as source of truth
+- Image regeneration from blobs if cache corrupted