diff --git a/js/docs/src/content/docs/lex-reference/live/place-stream-live-getclip.md b/js/docs/src/content/docs/lex-reference/live/place-stream-live-getclip.md
new file mode 100644
index 000000000..db64f1b7b
--- /dev/null
+++ b/js/docs/src/content/docs/lex-reference/live/place-stream-live-getclip.md
@@ -0,0 +1,85 @@
+---
+title: place.stream.live.getClip
+description: Reference for the place.stream.live.getClip lexicon
+---
+
+**Lexicon Version:** 1
+
+## Definitions
+
+<a name="main"></a>
+
+### `main`
+
+**Type:** `query`
+
+Clip a livestream between two instants as a flat (faststart) MP4. The clip is cut on MUXL segment boundaries: it holds every segment whose start falls within [start, end], so it may begin up to one segment late and run up to one segment past end. Segments come from the node's livestream recordings and from the recent stream it holds in memory; each segment's C2PA signature passes through verbatim. Only published (live) segments are clipped. Requires a signed-in caller: an OAuth session, or a service-auth token bound to this method (lxm), so third-party apps can call it through the PDS with the rpc:place.stream.live.getClip scope.
+
+**Parameters:**
+
+| Name       | Type     | Req'd | Description                                                                     | Constraints        |
+| ---------- | -------- | ----- | ------------------------------------------------------------------------------- | ------------------ |
+| `streamer` | `string` | ✅    | The streamer: a DID or a Bluesky handle (resolved to its DID).                  |                    |
+| `start`    | `string` | ✅    | Start of the clip (wall-clock time).                                            | Format: `datetime` |
+| `end`      | `string` | ✅    | End of the clip (wall-clock time). Must be after start, at most one hour later. | Format: `datetime` |
+
+**Output:**
+
+- **Encoding:** `video/mp4`
+- **Schema:**
+
+_Schema not defined._
+**Possible Errors:**
+
+- `ClipNotFound`: This node has no published segments of the stream in the requested range.
+- `ClipUnavailable`: Part of the requested range is still being recorded and is held only by the node the streamer is streaming to; retry there, or later once the recording has been written.
+
+---
+
+## Lexicon Source
+
+```json
+{
+  "lexicon": 1,
+  "id": "place.stream.live.getClip",
+  "defs": {
+    "main": {
+      "type": "query",
+      "description": "Clip a livestream between two instants as a flat (faststart) MP4. The clip is cut on MUXL segment boundaries: it holds every segment whose start falls within [start, end], so it may begin up to one segment late and run up to one segment past end. Segments come from the node's livestream recordings and from the recent stream it holds in memory; each segment's C2PA signature passes through verbatim. Only published (live) segments are clipped. Requires a signed-in caller: an OAuth session, or a service-auth token bound to this method (lxm), so third-party apps can call it through the PDS with the rpc:place.stream.live.getClip scope.",
+      "parameters": {
+        "type": "params",
+        "required": ["streamer", "start", "end"],
+        "properties": {
+          "streamer": {
+            "type": "string",
+            "description": "The streamer: a DID or a Bluesky handle (resolved to its DID)."
+          },
+          "start": {
+            "type": "string",
+            "format": "datetime",
+            "description": "Start of the clip (wall-clock time)."
+          },
+          "end": {
+            "type": "string",
+            "format": "datetime",
+            "description": "End of the clip (wall-clock time). Must be after start, at most one hour later."
+          }
+        }
+      },
+      "output": {
+        "encoding": "video/mp4"
+      },
+      "errors": [
+        {
+          "name": "ClipNotFound",
+          "description": "This node has no published segments of the stream in the requested range."
+        },
+        {
+          "name": "ClipUnavailable",
+          "description": "Part of the requested range is still being recorded and is held only by the node the streamer is streaming to; retry there, or later once the recording has been written."
+        }
+      ]
+    }
+  }
+}
+```
diff --git a/js/docs/src/content/docs/lex-reference/openapi.json b/js/docs/src/content/docs/lex-reference/openapi.json
index 3e4268ca5..73f18aef1 100644
--- a/js/docs/src/content/docs/lex-reference/openapi.json
+++ b/js/docs/src/content/docs/lex-reference/openapi.json
@@ -3511,6 +3511,84 @@
         }
       }
     },
+    "/xrpc/place.stream.live.getClip": {
+      "get": {
+        "summary": "Clip a livestream between two instants as a flat (faststart) MP4. The clip is cut on MUXL segment boundaries: it holds every segment whose start falls within [start, end], so it may begin up to one segment late and run up to one segment past end. Segments come from the node's livestream recordings and from the recent stream it holds in memory; each segment's C2PA signature passes through verbatim. Only published (live) segments are clipped. Requires a signed-in caller: an OAuth session, or a service-auth token bound to this method (lxm), so third-party apps can call it through the PDS with the rpc:place.stream.live.getClip scope.",
+        "operationId": "place.stream.live.getClip",
+        "tags": ["place.stream.live"],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "video/mp4": {
+                "schema": {}
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": ["error", "message"],
+                  "properties": {
+                    "error": {
+                      "type": "string",
+                      "oneOf": [
+                        {
+                          "const": "ClipNotFound"
+                        },
+                        {
+                          "const": "ClipUnavailable"
+                        }
+                      ]
+                    },
+                    "message": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "streamer",
+            "in": "query",
+            "required": true,
+            "description": "The streamer: a DID or a Bluesky handle (resolved to its DID).",
+            "schema": {
+              "type": "string",
+              "description": "The streamer: a DID or a Bluesky handle (resolved to its DID)."
+            }
+          },
+          {
+            "name": "start",
+            "in": "query",
+            "required": true,
+            "description": "Start of the clip (wall-clock time).",
+            "schema": {
+              "type": "string",
+              "description": "Start of the clip (wall-clock time).",
+              "format": "date-time"
+            }
+          },
+          {
+            "name": "end",
+            "in": "query",
+            "required": true,
+            "description": "End of the clip (wall-clock time). Must be after start, at most one hour later.",
+            "schema": {
+              "type": "string",
+              "description": "End of the clip (wall-clock time). Must be after start, at most one hour later.",
+              "format": "date-time"
+            }
+          }
+        ]
+      }
+    },
     "/xrpc/place.stream.live.getLiveUsers": {
       "get": {
         "summary": "Get a list of livestream segments for a user",
diff --git a/js/e2e-web/flows/live-clip.spec.ts b/js/e2e-web/flows/live-clip.spec.ts
new file mode 100644
index 000000000..3de08fa52
--- /dev/null
+++ b/js/e2e-web/flows/live-clip.spec.ts
@@ -0,0 +1,88 @@
+import { expect, test } from "@playwright/test";
+
+// place.stream.live.getClip, called the way a third-party app does: with a
+// service-auth token the user's PDS mints for exactly this method (the rpc
+// scope), not the node's own OAuth session. The clip of the harness's live
+// stream must be a playable MP4. Backend-only for now: there is no app surface
+// yet, so there is no mobile counterpart.
+test("live-clip: a service-auth caller clips the live stream to a playable MP4", async ({
+  page,
+}) => {
+  const pdsUrl = process.env.PDS_HTTPS_URL;
+  test.skip(!pdsUrl, "needs the harness's HTTPS mode for the PDS");
+  const did = process.env.ACCOUNT_DID!;
+
+  await page.goto("/");
+  await expect(page.getByTestId("home-stream-card").first()).toBeVisible({
+    timeout: 30_000,
+  });
+
+  // Everything runs in the page: the browser is what trusts the harness's
+  // certificates, and a browser is where a third-party web app would call from.
+  const result = await page.evaluate(
+    async ({ pdsUrl, handle, password, did }) => {
+      const nodeDid = (await (await fetch("/.well-known/did.json")).json()).id;
+      const session = await (
+        await fetch(`${pdsUrl}/xrpc/com.atproto.server.createSession`, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ identifier: handle, password }),
+        })
+      ).json();
+      const lxm = "place.stream.live.getClip";
+      const { token } = await (
+        await fetch(
+          `${pdsUrl}/xrpc/com.atproto.server.getServiceAuth?aud=${encodeURIComponent(nodeDid)}&lxm=${lxm}`,
+          { headers: { Authorization: `Bearer ${session.accessJwt}` } },
+        )
+      ).json();
+
+      const end = new Date();
+      const start = new Date(end.getTime() - 20_000);
+      const url = `/xrpc/${lxm}?streamer=${encodeURIComponent(did)}&start=${start.toISOString()}&end=${end.toISOString()}`;
+      const anonymous = (await fetch(url)).status;
+      const res = await fetch(url, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      const bytes = new Uint8Array(await res.arrayBuffer());
+      const contentLength = res.headers.get("content-length");
+
+      // A plain <video> plays it from memory.
+      let duration = 0;
+      if (res.ok) {
+        const video = document.createElement("video");
+        video.muted = true;
+        video.src = URL.createObjectURL(
+          new Blob([bytes], { type: "video/mp4" }),
+        );
+        duration = await new Promise<number>((resolve, reject) => {
+          video.onloadedmetadata = () => resolve(video.duration);
+          video.onerror = () =>
+            reject(new Error(`video error ${video.error?.code}`));
+        });
+      }
+      return {
+        anonymous,
+        status: res.status,
+        contentType: res.headers.get("content-type"),
+        contentLength,
+        size: bytes.length,
+        firstBox: new TextDecoder().decode(bytes.slice(4, 8)),
+        duration,
+      };
+    },
+    {
+      pdsUrl: pdsUrl!,
+      handle: process.env.ACCOUNT_HANDLE!,
+      password: process.env.ACCOUNT_PASSWORD!,
+      did,
+    },
+  );
+
+  expect(result.anonymous).toBe(401);
+  expect(result.status).toBe(200);
+  expect(result.contentType).toBe("video/mp4");
+  expect(result.contentLength).toBe(`${result.size}`);
+  expect(result.firstBox).toBe("ftyp");
+  expect(result.duration).toBeGreaterThan(0);
+});
diff --git a/lexicons/place/stream/live/getClip.json b/lexicons/place/stream/live/getClip.json
new file mode 100644
index 000000000..f09bf110e
--- /dev/null
+++ b/lexicons/place/stream/live/getClip.json
@@ -0,0 +1,43 @@
+{
+  "lexicon": 1,
+  "id": "place.stream.live.getClip",
+  "defs": {
+    "main": {
+      "type": "query",
+      "description": "Clip a livestream between two instants as a flat (faststart) MP4. The clip is cut on MUXL segment boundaries: it holds every segment whose start falls within [start, end], so it may begin up to one segment late and run up to one segment past end. Segments come from the node's livestream recordings and from the recent stream it holds in memory; each segment's C2PA signature passes through verbatim. Only published (live) segments are clipped. Requires a signed-in caller: an OAuth session, or a service-auth token bound to this method (lxm), so third-party apps can call it through the PDS with the rpc:place.stream.live.getClip scope.",
+      "parameters": {
+        "type": "params",
+        "required": ["streamer", "start", "end"],
+        "properties": {
+          "streamer": {
+            "type": "string",
+            "description": "The streamer: a DID or a Bluesky handle (resolved to its DID)."
+          },
+          "start": {
+            "type": "string",
+            "format": "datetime",
+            "description": "Start of the clip (wall-clock time)."
+          },
+          "end": {
+            "type": "string",
+            "format": "datetime",
+            "description": "End of the clip (wall-clock time). Must be after start, at most one hour later."
+          }
+        }
+      },
+      "output": {
+        "encoding": "video/mp4"
+      },
+      "errors": [
+        {
+          "name": "ClipNotFound",
+          "description": "This node has no published segments of the stream in the requested range."
+        },
+        {
+          "name": "ClipUnavailable",
+          "description": "Part of the requested range is still being recorded and is held only by the node the streamer is streaming to; retry there, or later once the recording has been written."
+        }
+      ]
+    }
+  }
+}
diff --git a/pkg/api/api.go b/pkg/api/api.go
index 402ab0e2d..1030f6128 100644
--- a/pkg/api/api.go
+++ b/pkg/api/api.go
@@ -1142,11 +1142,13 @@ func (a *StreamplaceAPI) ServerWithShutdown(ctx context.Context, handler http.Ha
 	// one NetworkTimeoutError warning per PATCH chunk (plus, more importantly,
 	// prevents tusd from extending the read deadline mid-upload so chunks
 	// taking longer than the default NetworkTimeout will fail). Skip gzip for
-	// /api/upload/*; compressing opaque upload bytes is pointless anyway.
+	// /api/upload/*; compressing opaque upload bytes is pointless anyway. Clips
+	// skip it too: already-compressed video gains nothing, and gzip would drop
+	// the Content-Length a downloader uses for progress.
 	raw := handler
 	gzipped := gziphandler.GzipHandler(handler)
 	handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if strings.HasPrefix(r.URL.Path, upload.BasePath) {
+		if strings.HasPrefix(r.URL.Path, upload.BasePath) || r.URL.Path == "/xrpc/place.stream.live.getClip" {
 			raw.ServeHTTP(w, r)
 			return
 		}
diff --git a/pkg/api/api_internal.go b/pkg/api/api_internal.go
index 0a6e3400b..e73395954 100644
--- a/pkg/api/api_internal.go
+++ b/pkg/api/api_internal.go
@@ -30,6 +30,7 @@ import (
 	notificationpkg "stream.place/streamplace/pkg/notifications"
 	"stream.place/streamplace/pkg/rtcrec"
 	v0 "stream.place/streamplace/pkg/schema/v0"
+	"stream.place/streamplace/pkg/vod"
 )
 
 func (a *StreamplaceAPI) ServeInternalHTTP(ctx context.Context) error {
@@ -542,13 +543,16 @@ func (a *StreamplaceAPI) InternalHandler(ctx context.Context) (http.Handler, err
 			}
 			secs = parsedSecs
 		}
-		after := time.Now().Add(-time.Duration(secs) * time.Second)
-		w.Header().Set("Content-Type", "video/mp4")
-		err = a.MediaManager.ClipUser(ctx, user, w, nil, &after)
+		now := time.Now()
+		clip, err := vod.FindClip(ctx, a.StatefulDB, a.PlaybackStore, a.MediaManager, user, now.Add(-time.Duration(secs)*time.Second), now, true)
 		if err != nil {
 			errors.WriteHTTPInternalServerError(w, "unable to clip user", err)
 			return
 		}
+		w.Header().Set("Content-Type", "video/mp4")
+		if err := clip.WriteMP4(ctx, w); err != nil {
+			log.Error(ctx, "error writing clip", "error", err)
+		}
 	})
 
 	handler := sloghttp.Recovery(router)
diff --git a/pkg/director/s3_upload.go b/pkg/director/s3_upload.go
index 4e158e0e3..51ec20eee 100644
--- a/pkg/director/s3_upload.go
+++ b/pkg/director/s3_upload.go
@@ -86,6 +86,9 @@ func (ss *StreamSession) maybeStartS3Upload(ctx context.Context, repoDID string)
 	// finalized VOD blobs (blobs/) and anything else in the bucket.
 	keyPrefix := liveRecPrefix + repoDID + "/"
 	ss.s3Uploader = s3.NewS3Uploader(cfg, repoDID, keyPrefix, s3.DefaultCutoverEvery, ss.statefulDB)
+	// The object being uploaded can't be read back until it completes, so
+	// hold the stream's segments in memory that long for clips to draw on.
+	ss.mm.RetainSegments(repoDID, s3.MaxOpenObjectAge)
 	// Best-effort initial resolve of the livestream URI so the very first
 	// object is tagged. The director treats "latest livestream for repo" as
 	// the current stream everywhere (notification blast, idle finalize), so we
@@ -106,7 +109,7 @@ func (ss *StreamSession) s3Upload(ctx context.Context, notif *media.NewSegmentNo
 	ss.Go(ctx, func() error {
 		// notif.Muxl is the bare canonical segment; it concatenates directly
 		// (the S3 uploader synthesizes one init and prepends it per object).
-		return ss.s3Uploader.AddSegment(ctx, notif.Muxl)
+		return ss.s3Uploader.AddSegment(ctx, notif.Muxl, notif.Segment.StartTime)
 	})
 }
 
diff --git a/pkg/media/media.go b/pkg/media/media.go
index 14f92680e..25d021571 100644
--- a/pkg/media/media.go
+++ b/pkg/media/media.go
@@ -52,12 +52,11 @@ type MediaManager struct {
 	// concurrently, so it is how a late pre-live segment is told apart
 	// from the stream going back to preview.
 	liveWindowLatest map[string]time.Time
-	// modBuffers holds a short in-memory ring of each live user's most recent
-	// canonical segments, the source for moderation/report clips now that
-	// segments are no longer archived to disk. Keyed by repoDID. See
-	// moderation_buffer.go.
-	modBuffers     map[string]*modBuffer
-	modBuffersMut  sync.Mutex
+	// segBuffers holds each stream's recent canonical segments in memory: the
+	// part of a stream this node can clip that no recording holds yet. Keyed
+	// by repoDID. See segment_buffer.go.
+	segBuffers     map[string]*segmentBuffer
+	segBuffersMut  sync.Mutex
 	httpPipes      map[string]io.Writer
 	httpPipesMutex sync.Mutex
 	newSegmentSubs []*segmentSubscriber
@@ -147,7 +146,7 @@ func MakeMediaManager(ctx context.Context, cli *config.CLI, signer crypto.Signer
 		liveWindows:         map[string]*livehls.Writer{},
 		liveWindowPublished: map[string]bool{},
 		liveWindowLatest:    map[string]time.Time{},
-		modBuffers:          map[string]*modBuffer{},
+		segBuffers:          map[string]*segmentBuffer{},
 		httpPipes:           map[string]io.Writer{},
 		model:               mod,
 		bus:                 bus,
diff --git a/pkg/media/moderation_buffer.go b/pkg/media/moderation_buffer.go
deleted file mode 100644
index 778baf3f2..000000000
--- a/pkg/media/moderation_buffer.go
+++ /dev/null
@@ -1,142 +0,0 @@
-package media
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io"
-	"sort"
-	"time"
-
-	"stream.place/streamplace/pkg/muxl"
-)
-
-// modClipWindow is how long a user's recent canonical segments are kept in the
-// in-memory moderation buffer. Moderation/report clips grab the last ~60s (see
-// the makeClip / /clip handlers), so this is that window plus margin. It mirrors
-// the old on-disk moderationRetention (120s) — the point at which a reported
-// stream's evidence is still available — but holds the bytes in RAM instead of
-// on disk. A hard modClipMaxSegments cap bounds memory against pathologically
-// short segments.
-const (
-	modClipWindow      = 2 * time.Minute
-	modClipMaxSegments = 240
-)
-
-// modSegment is one canonical segment retained for moderation clipping.
-type modSegment struct {
-	startTime time.Time // media start time (what clips filter by)
-	addedAt   time.Time // wall-clock arrival, for age eviction
-	data      []byte    // bare canonical .m4s bytes
-}
-
-// modBuffer is a per-user time-bounded ring of recent canonical segments. All
-// access goes through MediaManager (guarded by modBuffersMut), so it needs no
-// lock of its own.
-type modBuffer struct {
-	segs []modSegment
-}
-
-// feedModerationBuffer appends a canonical segment to the user's moderation
-// buffer and evicts anything older than modClipWindow. Called for every
-// validated segment — published or not, so moderation can clip pre-live content
-// exactly as the on-disk archive used to allow. The bytes are copied since the
-// caller reuses its buffer.
-func (mm *MediaManager) feedModerationBuffer(did string, startTime time.Time, segment []byte) {
-	now := time.Now()
-	mm.modBuffersMut.Lock()
-	defer mm.modBuffersMut.Unlock()
-	// Lazily initialize: distributeSegment runs under MediaManager values built by
-	// several constructors besides MakeMediaManager (isolated ingest/whip/rtmp
-	// workers, tests), not all of which seed the map. Reads/deletes on a nil map
-	// are safe, but the assignment below is not.
-	if mm.modBuffers == nil {
-		mm.modBuffers = map[string]*modBuffer{}
-	}
-	b := mm.modBuffers[did]
-	if b == nil {
-		b = &modBuffer{}
-		mm.modBuffers[did] = b
-	}
-	b.segs = append(b.segs, modSegment{
-		startTime: startTime,
-		addedAt:   now,
-		data:      append([]byte(nil), segment...),
-	})
-	b.evict(now)
-}
-
-// evict drops segments older than the retention window and enforces the hard
-// count cap (keeping the newest). Caller holds modBuffersMut.
-func (b *modBuffer) evict(now time.Time) {
-	cutoff := now.Add(-modClipWindow)
-	drop := 0
-	for drop < len(b.segs) && b.segs[drop].addedAt.Before(cutoff) {
-		drop++
-	}
-	if drop > 0 {
-		b.segs = append(b.segs[:0:0], b.segs[drop:]...)
-	}
-	if len(b.segs) > modClipMaxSegments {
-		b.segs = append(b.segs[:0:0], b.segs[len(b.segs)-modClipMaxSegments:]...)
-	}
-}
-
-// moderationSegments returns copies of the user's retained segments whose media
-// start time falls in [after, before] (either bound nil = open), oldest first.
-// Stale buffers (all segments aged out — a stream that ended) are dropped from
-// the map so they're freed.
-func (mm *MediaManager) moderationSegments(user string, before, after *time.Time) [][]byte {
-	now := time.Now()
-	mm.modBuffersMut.Lock()
-	defer mm.modBuffersMut.Unlock()
-	b := mm.modBuffers[user]
-	if b == nil {
-		return nil
-	}
-	b.evict(now)
-	if len(b.segs) == 0 {
-		delete(mm.modBuffers, user)
-		return nil
-	}
-	picked := make([]modSegment, 0, len(b.segs))
-	for _, s := range b.segs {
-		if after != nil && s.startTime.Before(*after) {
-			continue
-		}
-		if before != nil && s.startTime.After(*before) {
-			continue
-		}
-		picked = append(picked, s)
-	}
-	sort.Slice(picked, func(i, j int) bool {
-		return picked[i].startTime.Before(picked[j].startTime)
-	})
-	out := make([][]byte, len(picked))
-	for i, s := range picked {
-		out[i] = s.data
-	}
-	return out
-}
-
-// ClipUser concatenates a user's recent canonical .m4s segments over the given
-// time window into a single flat MP4 written to writer (moderation/report
-// clips). Segments come from the in-memory moderation buffer — on-disk archival
-// was removed — so the window is bounded by modClipWindow; a request for a
-// longer span yields only what is still retained. The segments are blindly
-// concatenatable MUXL, so the clip is their bytes wrapped in a synthesized
-// ftyp+moov, and each segment's C2PA signature passes through verbatim.
-func (mm *MediaManager) ClipUser(ctx context.Context, user string, writer io.Writer, before, after *time.Time) error {
-	segs := mm.moderationSegments(user, before, after)
-	if len(segs) == 0 {
-		return fmt.Errorf("no segments found")
-	}
-	readers := make([]io.Reader, len(segs))
-	for i, data := range segs {
-		readers[i] = bytes.NewReader(data)
-	}
-	if err := muxl.RunMuxlWrap(ctx, io.MultiReader(readers...), "flat", writer); err != nil {
-		return fmt.Errorf("unable to clip segments: %w", err)
-	}
-	return nil
-}
diff --git a/pkg/media/moderation_buffer_test.go b/pkg/media/moderation_buffer_test.go
deleted file mode 100644
index 9dd8dcab0..000000000
--- a/pkg/media/moderation_buffer_test.go
+++ /dev/null
@@ -1,79 +0,0 @@
-package media
-
-import (
-	"context"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func newTestMM() *MediaManager {
-	return &MediaManager{modBuffers: map[string]*modBuffer{}}
-}
-
-// TestModerationBufferNilMap guards the crash CI caught: distributeSegment runs
-// under MediaManager values from constructors that don't seed modBuffers (ingest
-// workers, tests), so feedModerationBuffer must lazily initialize the map rather
-// than panic assigning into a nil one.
-func TestModerationBufferNilMap(t *testing.T) {
-	mm := &MediaManager{} // modBuffers deliberately nil
-	require.NotPanics(t, func() {
-		mm.feedModerationBuffer("did:x", time.Unix(0, 0), []byte("seg"))
-	})
-	require.Len(t, mm.moderationSegments("did:x", nil, nil), 1)
-}
-
-// TestModerationBufferWindow verifies fed segments come back oldest-first and
-// that the [after, before] filter selects the right slice by media start time.
-func TestModerationBufferWindow(t *testing.T) {
-	mm := newTestMM()
-	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	// Feed 5 segments at t=base+0s..+8s (2s apart), out of insertion order.
-	for _, i := range []int{2, 0, 4, 1, 3} {
-		mm.feedModerationBuffer("did:x", base.Add(time.Duration(i)*2*time.Second), []byte(fmt.Sprintf("seg%d", i)))
-	}
-
-	all := mm.moderationSegments("did:x", nil, nil)
-	require.Len(t, all, 5)
-	require.Equal(t, []byte("seg0"), all[0], "oldest first")
-	require.Equal(t, []byte("seg4"), all[4], "newest last")
-
-	// after = base+3s should drop seg0 (0s) and seg1 (2s), keep seg2..seg4.
-	after := base.Add(3 * time.Second)
-	got := mm.moderationSegments("did:x", nil, &after)
-	require.Len(t, got, 3)
-	require.Equal(t, []byte("seg2"), got[0])
-
-	// before = base+3s should keep only seg0 (0s) and seg1 (2s).
-	before := base.Add(3 * time.Second)
-	got = mm.moderationSegments("did:x", &before, nil)
-	require.Len(t, got, 2)
-	require.Equal(t, []byte("seg1"), got[1])
-}
-
-// TestModerationBufferCountCap verifies the hard segment cap keeps the newest
-// modClipMaxSegments entries and drops the oldest.
-func TestModerationBufferCountCap(t *testing.T) {
-	mm := newTestMM()
-	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	total := modClipMaxSegments + 50
-	for i := 0; i < total; i++ {
-		mm.feedModerationBuffer("did:x", base.Add(time.Duration(i)*time.Millisecond), []byte(fmt.Sprintf("s%d", i)))
-	}
-	got := mm.moderationSegments("did:x", nil, nil)
-	require.Len(t, got, modClipMaxSegments)
-	// The very first (oldest) segment must have been evicted; the newest kept.
-	require.Equal(t, []byte(fmt.Sprintf("s%d", total-1)), got[len(got)-1])
-	require.Equal(t, []byte(fmt.Sprintf("s%d", total-modClipMaxSegments)), got[0])
-}
-
-// TestClipUserNoSegments verifies ClipUser reports "no segments" (so the
-// moderation report still goes through) when the buffer is empty for a user.
-func TestClipUserNoSegments(t *testing.T) {
-	mm := newTestMM()
-	err := mm.ClipUser(context.Background(), "did:unknown", nil, nil, nil)
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "no segments")
-}
diff --git a/pkg/media/segment_buffer.go b/pkg/media/segment_buffer.go
new file mode 100644
index 000000000..816668448
--- /dev/null
+++ b/pkg/media/segment_buffer.go
@@ -0,0 +1,116 @@
+package media
+
+import (
+	"sort"
+	"time"
+)
+
+// segmentBufferWindow is how long a stream's recent canonical segments are
+// kept in memory by default. Moderation/report clips grab the last ~60s (see
+// the makeClip / /clip handlers), so this is that window plus margin. A
+// stream this node records keeps its segments longer (see RetainSegments).
+const segmentBufferWindow = 2 * time.Minute
+
+// segmentBufferMinAverage bounds a buffer's memory against pathologically
+// short segments: a buffer holds at most its retention divided by this many
+// segments (240 for the default window), keeping the newest.
+const segmentBufferMinAverage = 500 * time.Millisecond
+
+// BufferedSegment is one canonical segment held in memory.
+type BufferedSegment struct {
+	Start     time.Time // media start time
+	Published bool
+	Data      []byte // bare canonical .m4s bytes; never modified once buffered
+	addedAt   time.Time
+}
+
+// segmentBuffer is a stream's time-bounded run of recent segments. All
+// access goes through MediaManager (guarded by segBuffersMut), so it needs
+// no lock of its own.
+type segmentBuffer struct {
+	retain time.Duration
+	segs   []BufferedSegment
+}
+
+// bufferSegment appends a canonical segment to the stream's buffer and evicts
+// what has aged out. Called for every validated segment — published or not,
+// local or replicated — so whatever this node has seen of a stream recently
+// can be clipped. The bytes are copied since the caller reuses its buffer.
+func (mm *MediaManager) bufferSegment(did string, start time.Time, published bool, segment []byte) {
+	now := time.Now()
+	mm.segBuffersMut.Lock()
+	defer mm.segBuffersMut.Unlock()
+	b := mm.segmentBufferLocked(did)
+	b.segs = append(b.segs, BufferedSegment{
+		Start:     start,
+		Published: published,
+		Data:      append([]byte(nil), segment...),
+		addedAt:   now,
+	})
+	b.evict(now)
+}
+
+// RetainSegments keeps the stream's segments in memory for at least d
+// instead of the default window. A node recording a stream uses it to hold
+// the segments of the object it is still uploading, which can't be read back
+// until the upload completes.
+func (mm *MediaManager) RetainSegments(did string, d time.Duration) {
+	mm.segBuffersMut.Lock()
+	defer mm.segBuffersMut.Unlock()
+	b := mm.segmentBufferLocked(did)
+	b.retain = max(b.retain, d)
+}
+
+// segmentBufferLocked returns the stream's buffer, creating it if needed.
+// Caller holds segBuffersMut.
+func (mm *MediaManager) segmentBufferLocked(did string) *segmentBuffer {
+	// Lazily initialize: distributeSegment runs under MediaManager values
+	// built by several constructors besides MakeMediaManager (isolated
+	// ingest/whip/rtmp workers, tests), not all of which seed the map.
+	if mm.segBuffers == nil {
+		mm.segBuffers = map[string]*segmentBuffer{}
+	}
+	b := mm.segBuffers[did]
+	if b == nil {
+		b = &segmentBuffer{retain: segmentBufferWindow}
+		mm.segBuffers[did] = b
+	}
+	return b
+}
+
+// evict drops segments older than the retention and enforces the count cap
+// (keeping the newest). Caller holds segBuffersMut.
+func (b *segmentBuffer) evict(now time.Time) {
+	cutoff := now.Add(-b.retain)
+	drop := 0
+	for drop < len(b.segs) && b.segs[drop].addedAt.Before(cutoff) {
+		drop++
+	}
+	if maxSegs := int(b.retain / segmentBufferMinAverage); len(b.segs)-drop > maxSegs {
+		drop = len(b.segs) - maxSegs
+	}
+	if drop > 0 {
+		b.segs = append(b.segs[:0:0], b.segs[drop:]...)
+	}
+}
+
+// BufferedSegments returns the stream's segments held in memory, oldest
+// first. A buffer whose segments have all aged out (a stream that ended) is
+// dropped so it's freed.
+func (mm *MediaManager) BufferedSegments(did string) []BufferedSegment {
+	now := time.Now()
+	mm.segBuffersMut.Lock()
+	defer mm.segBuffersMut.Unlock()
+	b := mm.segBuffers[did]
+	if b == nil {
+		return nil
+	}
+	b.evict(now)
+	if len(b.segs) == 0 {
+		delete(mm.segBuffers, did)
+		return nil
+	}
+	out := append([]BufferedSegment(nil), b.segs...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Start.Before(out[j].Start) })
+	return out
+}
diff --git a/pkg/media/segment_buffer_test.go b/pkg/media/segment_buffer_test.go
new file mode 100644
index 000000000..497114719
--- /dev/null
+++ b/pkg/media/segment_buffer_test.go
@@ -0,0 +1,72 @@
+package media
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestSegmentBufferNilMap guards the crash CI caught: distributeSegment runs
+// under MediaManager values from constructors that don't seed segBuffers
+// (ingest workers, tests), so bufferSegment must lazily initialize the map
+// rather than panic assigning into a nil one.
+func TestSegmentBufferNilMap(t *testing.T) {
+	mm := &MediaManager{} // segBuffers deliberately nil
+	require.NotPanics(t, func() {
+		mm.bufferSegment("did:x", time.Unix(0, 0), true, []byte("seg"))
+	})
+	require.Len(t, mm.BufferedSegments("did:x"), 1)
+}
+
+// TestSegmentBufferOrder verifies segments fed out of order come back oldest
+// first, carrying their published flag.
+func TestSegmentBufferOrder(t *testing.T) {
+	mm := &MediaManager{}
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	for _, i := range []int{2, 0, 4, 1, 3} {
+		mm.bufferSegment("did:x", base.Add(time.Duration(i)*2*time.Second), i > 0, []byte(fmt.Sprintf("seg%d", i)))
+	}
+	all := mm.BufferedSegments("did:x")
+	require.Len(t, all, 5)
+	for i, s := range all {
+		require.Equal(t, []byte(fmt.Sprintf("seg%d", i)), s.Data)
+		require.Equal(t, i > 0, s.Published)
+	}
+}
+
+// TestSegmentBufferCountCap verifies the hard segment cap keeps the newest
+// entries and drops the oldest.
+func TestSegmentBufferCountCap(t *testing.T) {
+	mm := &MediaManager{}
+	base := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	limit := int(segmentBufferWindow / segmentBufferMinAverage)
+	total := limit + 50
+	for i := 0; i < total; i++ {
+		mm.bufferSegment("did:x", base.Add(time.Duration(i)*time.Millisecond), true, []byte(fmt.Sprintf("s%d", i)))
+	}
+	got := mm.BufferedSegments("did:x")
+	require.Len(t, got, limit)
+	require.Equal(t, []byte(fmt.Sprintf("s%d", total-1)), got[len(got)-1].Data)
+	require.Equal(t, []byte(fmt.Sprintf("s%d", total-limit)), got[0].Data)
+}
+
+// TestSegmentBufferRetain verifies RetainSegments holds a stream's segments
+// past the default window (a recording node relies on it to cover the object
+// it is still uploading), while other streams still age out on the default.
+func TestSegmentBufferRetain(t *testing.T) {
+	mm := &MediaManager{}
+	mm.bufferSegment("did:recorded", time.Now(), true, []byte("a"))
+	mm.bufferSegment("did:other", time.Now(), true, []byte("b"))
+	mm.RetainSegments("did:recorded", 12*time.Minute)
+
+	later := time.Now().Add(5 * time.Minute)
+	mm.segBuffers["did:recorded"].evict(later)
+	mm.segBuffers["did:other"].evict(later)
+	require.Len(t, mm.segBuffers["did:recorded"].segs, 1)
+	require.Empty(t, mm.segBuffers["did:other"].segs)
+
+	mm.segBuffers["did:recorded"].evict(time.Now().Add(13 * time.Minute))
+	require.Empty(t, mm.segBuffers["did:recorded"].segs)
+}
diff --git a/pkg/media/validate.go b/pkg/media/validate.go
index 21f12a5e5..cc6005c6b 100644
--- a/pkg/media/validate.go
+++ b/pkg/media/validate.go
@@ -212,9 +212,9 @@ func (mm *MediaManager) streamerIsBanned(repoDID string) (bool, error) {
 func (mm *MediaManager) distributeSegment(ctx context.Context, vs *validatedSegment, seg []byte) error {
 	meta := vs.meta
 
-	// Retain the canonical segment in the in-memory moderation buffer (this
-	// replaces on-disk .m4s archival) so reports can clip the recent window.
-	mm.feedModerationBuffer(vs.repoDID, meta.StartTime.Time(), seg)
+	// Hold the canonical segment in the stream's in-memory buffer, the recent
+	// part of the stream that clips (and moderation reports) draw on.
+	mm.bufferSegment(vs.repoDID, meta.StartTime.Time(), meta.Published, seg)
 
 	// Fold the validated segment into the streamer's live-HLS window, off the
 	// critical path. This runs for every segment — locally signed or replicated
diff --git a/pkg/placestream/livegetclip.go b/pkg/placestream/livegetclip.go
new file mode 100644
index 000000000..a45de15e2
--- /dev/null
+++ b/pkg/placestream/livegetclip.go
@@ -0,0 +1,33 @@
+// Code generated by glex; DO NOT EDIT.
+
+// Lexicon schema: place.stream.live.getClip
+
+package placestream
+
+import (
+	"bytes"
+	"context"
+
+	glex "github.com/streamplace/glex/runtime"
+)
+
+// LiveGetClip calls the XRPC method "place.stream.live.getClip".
+//
+// Clip a livestream between two instants as a flat (faststart) MP4. The clip is cut on MUXL segment boundaries: it holds every segment whose start falls within [start, end], so it may begin up to one segment late and run up to one segment past end. Segments come from the node's livestream recordings and from the recent stream it holds in memory; each segment's C2PA signature passes through verbatim. Only published (live) segments are clipped. Requires a signed-in caller: an OAuth session, or a service-auth token bound to this method (lxm), so third-party apps can call it through the PDS with the rpc:place.stream.live.getClip scope.
+//
+// end: End of the clip (wall-clock time). Must be after start, at most one hour later.
+// start: Start of the clip (wall-clock time).
+// streamer: The streamer: a DID or a Bluesky handle (resolved to its DID).
+func LiveGetClip(ctx context.Context, c glex.LexClient, end string, start string, streamer string) ([]byte, error) {
+	buf := new(bytes.Buffer)
+
+	params := map[string]interface{}{}
+	params["end"] = end
+	params["start"] = start
+	params["streamer"] = streamer
+
+	if err := c.LexDo(ctx, glex.Query, "", "place.stream.live.getClip", params, nil, buf); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
diff --git a/pkg/s3/live_test.go b/pkg/s3/live_test.go
index 709b9ca71..78a2053db 100644
--- a/pkg/s3/live_test.go
+++ b/pkg/s3/live_test.go
@@ -61,7 +61,7 @@ func (r *keyRecorder) RecordStart(ctx context.Context, userDID, bucket, key, liv
 	return key, nil
 }
 
-func (r *keyRecorder) RecordComplete(ctx context.Context, id string, parts int32, size int64) error {
+func (r *keyRecorder) RecordComplete(ctx context.Context, id string, parts int32, size int64, segments []RecordedSegment) error {
 	return nil
 }
 
@@ -88,7 +88,7 @@ func TestLiveS3Uploader(t *testing.T) {
 	for _, mb := range []int{2, 2, 2, 3, 3, 1, 2} { // parts: 6MB, 6MB(3+3), then 3MB tail
 		seg := bytes.Repeat([]byte("streamplace-live-s3-test"), mb*1024*1024/24)
 		seg = append(seg, bytes.Repeat([]byte{0xAB}, 137*mb)...) // knock sizes off round numbers
-		require.NoError(t, up.AddSegment(ctx, seg))
+		require.NoError(t, up.AddSegment(ctx, seg, time.Now()))
 		want = append(want, seg...)
 	}
 	require.NoError(t, up.Close(ctx))
diff --git a/pkg/s3/s3.go b/pkg/s3/s3.go
index 6bad8e1a5..0d191df94 100644
--- a/pkg/s3/s3.go
+++ b/pkg/s3/s3.go
@@ -31,10 +31,21 @@ type Config struct {
 // to RecordComplete when the upload is finalized. Implementations should
 // tolerate nil contexts being passed. livestreamURI ties the object to the
 // livestream it belongs to (may be empty if not yet known) so the live-to-VOD
-// finalize can later enumerate exactly the objects for one stream.
+// finalize can later enumerate exactly the objects for one stream. started is
+// the media start time of the object's first segment, and RecordComplete
+// carries the index of every segment in the object, so a clip can range-read
+// exactly the segments it needs.
 type Recorder interface {
 	RecordStart(ctx context.Context, userDID, bucket, key, livestreamURI string, started time.Time) (id string, err error)
-	RecordComplete(ctx context.Context, id string, parts int32, size int64) error
+	RecordComplete(ctx context.Context, id string, parts int32, size int64, segments []RecordedSegment) error
+}
+
+// RecordedSegment locates one canonical segment inside a recorded object: its
+// media start time and byte length. Segments are stored back to back, so a
+// segment's offset is the sum of the sizes before it.
+type RecordedSegment struct {
+	StartMs int64 `json:"t"` // media start, unix milliseconds
+	Size    int64 `json:"n"`
 }
 
 // uploadAPI is the subset of *s3.Client the upload loop uses. Pulled out so
@@ -112,10 +123,17 @@ type activeUpload struct {
 	started       time.Time
 	buf           []byte // accumulates segments until we hit minPartSize
 	totalSize     int64  // running total of bytes flushed across all parts
+	segments      []RecordedSegment
 }
 
 var DefaultCutoverEvery = 10 * time.Minute
 
+// MaxOpenObjectAge is how long a live recording's object can stay open (and
+// so unreadable): the cutover interval plus slack for the final flush and
+// completion. Nodes hold a recorded stream's segments in memory this long so
+// clips can cover the object still being uploaded.
+var MaxOpenObjectAge = DefaultCutoverEvery + 2*time.Minute
+
 // NewS3Uploader creates a new S3Uploader. keyPrefix is prepended to every
 // object key (typically the streamer DID + "/"). userDID is passed through
 // to the Recorder so uploads can be attributed to a user. recorder may be
@@ -165,23 +183,25 @@ func newS3Uploader(client uploadAPI, bucket, userDID, keyPrefix string, cutoverE
 // request to complete the current object now (cutover). Both travel the same
 // channel so a cutover stays FIFO-ordered behind the segments queued before it.
 type uploadCmd struct {
-	seg     []byte // bare canonical MUXL segment to append; nil for a cutover
-	cutover bool   // complete the current object now (see Cutover)
+	seg     []byte    // bare canonical MUXL segment to append; nil for a cutover
+	start   time.Time // the segment's media start time
+	cutover bool      // complete the current object now (see Cutover)
 }
 
 // AddSegment feeds one bare canonical MUXL segment (uuid+moof+mdat per track)
-// for upload. The bytes are copied, so the caller may reuse its buffer. It is
-// the caller's responsibility not to call AddSegment concurrently with Close
-// (the StreamSession guarantees this by draining its goroutines before closing,
-// see director.Start); the closed guard here is a best-effort backstop that
-// turns a late call into an error rather than a send-on-closed-channel panic.
-func (u *S3Uploader) AddSegment(ctx context.Context, data []byte) error {
+// that starts at start for upload. The bytes are copied, so the caller may
+// reuse its buffer. It is the caller's responsibility not to call AddSegment
+// concurrently with Close (the StreamSession guarantees this by draining its
+// goroutines before closing, see director.Start); the closed guard here is a
+// best-effort backstop that turns a late call into an error rather than a
+// send-on-closed-channel panic.
+func (u *S3Uploader) AddSegment(ctx context.Context, data []byte, start time.Time) error {
 	if u.closed.Load() {
 		return fmt.Errorf("s3 uploader closed")
 	}
 	seg := append([]byte(nil), data...)
 	select {
-	case u.segCh <- uploadCmd{seg: seg}:
+	case u.segCh <- uploadCmd{seg: seg, start: start}:
 		return nil
 	case <-ctx.Done():
 		return ctx.Err()
@@ -236,7 +256,7 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 	var current *activeUpload
 	objSeq := 0 // disambiguates keys when two objects roll over within one second
 
-	startUpload := func() error {
+	startUpload := func(firstSegment time.Time) error {
 		objSeq++
 		now := time.Now()
 		key := fmt.Sprintf("%s%s-%d.m4s", u.keyPrefix, now.UTC().Format("2006-01-02T15-04-05"), objSeq)
@@ -258,7 +278,7 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 			livestreamURI: uri,
 		}
 		if u.recorder != nil {
-			id, recErr := u.recorder.RecordStart(ctx, u.userDID, u.bucket, key, uri, now)
+			id, recErr := u.recorder.RecordStart(ctx, u.userDID, u.bucket, key, uri, firstSegment)
 			if recErr != nil {
 				log.Error(ctx, "recording S3 upload start", "key", key, "error", recErr)
 			}
@@ -331,7 +351,7 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 		}
 		log.Log(ctx, "completed S3 multipart upload", "key", current.key, "parts", len(current.parts), "size", current.totalSize)
 		if u.recorder != nil && current.recordID != "" {
-			if recErr := u.recorder.RecordComplete(ctx, current.recordID, int32(len(current.parts)), current.totalSize); recErr != nil {
+			if recErr := u.recorder.RecordComplete(ctx, current.recordID, int32(len(current.parts)), current.totalSize, current.segments); recErr != nil {
 				log.Error(ctx, "recording S3 upload completion", "key", current.key, "error", recErr)
 			}
 		}
@@ -339,7 +359,7 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 		return nil
 	}
 
-	handleSegment := func(seg []byte) error {
+	handleSegment := func(seg []byte, start time.Time) error {
 		now := time.Now()
 
 		// Roll over to a new object when the current one has run for cutoverEvery,
@@ -355,13 +375,14 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 
 		// Start a new upload if needed
 		if current == nil {
-			if err := startUpload(); err != nil {
+			if err := startUpload(start); err != nil {
 				return err
 			}
 		}
 
 		// Append segment data to buffer
 		current.buf = append(current.buf, seg...)
+		current.segments = append(current.segments, RecordedSegment{StartMs: start.UnixMilli(), Size: int64(len(seg))})
 
 		// Flush full-size parts; a sub-part remainder stays buffered until the
 		// next segment or the object's completing flush.
@@ -428,7 +449,7 @@ func (u *S3Uploader) uploadLoop(ctx context.Context) {
 				continue
 			}
 			log.Debug(ctx, "received segment for S3 upload", "size", len(cmd.seg))
-			if err := handleSegment(cmd.seg); err != nil {
+			if err := handleSegment(cmd.seg, cmd.start); err != nil {
 				// The triggering segment is dropped along with the object: it may
 				// already be partially flushed into it, so it can't be salvaged.
 				abandonCurrent(fmt.Errorf("error handling segment: %w", err))
diff --git a/pkg/s3/uploader_test.go b/pkg/s3/uploader_test.go
index b344c5993..d9d753769 100644
--- a/pkg/s3/uploader_test.go
+++ b/pkg/s3/uploader_test.go
@@ -62,24 +62,31 @@ func (f *fakeUploadAPI) AbortMultipartUpload(_ context.Context, _ *awss3.AbortMu
 	return &awss3.AbortMultipartUploadOutput{}, nil
 }
 
-// fakeRecorder captures the (key, livestreamURI) of every started object.
+// fakeRecorder captures the (key, livestreamURI, start) of every started
+// object and the segment index of every completed one.
 type fakeRecorder struct {
-	mu     sync.Mutex
-	keys   []string
-	uris   []string
-	starts int
+	mu      sync.Mutex
+	keys    []string
+	uris    []string
+	started []time.Time
+	indexes [][]RecordedSegment
+	starts  int
 }
 
-func (r *fakeRecorder) RecordStart(_ context.Context, _, _, key, livestreamURI string, _ time.Time) (string, error) {
+func (r *fakeRecorder) RecordStart(_ context.Context, _, _, key, livestreamURI string, started time.Time) (string, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.keys = append(r.keys, key)
 	r.uris = append(r.uris, livestreamURI)
+	r.started = append(r.started, started)
 	r.starts++
 	return fmt.Sprintf("rec-%d", r.starts), nil
 }
 
-func (r *fakeRecorder) RecordComplete(_ context.Context, _ string, _ int32, _ int64) error {
+func (r *fakeRecorder) RecordComplete(_ context.Context, _ string, _ int32, _ int64, segments []RecordedSegment) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.indexes = append(r.indexes, segments)
 	return nil
 }
 
@@ -123,11 +130,11 @@ func TestS3UploaderCutoverOnLivestreamChange(t *testing.T) {
 	seg := make([]byte, 1024) // well under minPartSize: buffered until the object completes
 
 	u.SetLivestreamURI("at://A")
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 1) // object 1, livestream A
 
 	u.SetLivestreamURI("at://B")
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 2) // livestream changed -> object 2, livestream B
 
 	require.NoError(t, u.Close(ctx))
@@ -153,11 +160,11 @@ func TestS3UploaderCutoverCompletesObject(t *testing.T) {
 	seg := make([]byte, 1024) // under minPartSize: buffered until the object completes
 
 	u.SetLivestreamURI("at://A")
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 1) // object 1
 
 	require.NoError(t, u.Cutover(ctx)) // completes object 1
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 2) // object 2
 
 	require.NoError(t, u.Close(ctx))
@@ -168,6 +175,34 @@ func TestS3UploaderCutoverCompletesObject(t *testing.T) {
 	require.NotEqual(t, keys[0], keys[1], "post-cutover object must have a distinct key")
 }
 
+// TestS3UploaderRecordsSegmentIndex proves each completed object is recorded
+// with exactly its own segments' start times and sizes, in order, and starts
+// at its first segment's start: clips locate segments inside recorded objects
+// by that index, so a segment attributed to the wrong object (or a stale
+// index carried across a cutover) would cut the wrong bytes.
+func TestS3UploaderRecordsSegmentIndex(t *testing.T) {
+	fc := &fakeUploadAPI{}
+	rec := &fakeRecorder{}
+	u := newS3Uploader(fc, "bucket", "did:plc:test", "did:plc:test/", time.Hour, rec)
+
+	ctx := context.Background()
+	t0 := time.UnixMilli(1_760_000_000_000)
+	at := func(s int) time.Time { return t0.Add(time.Duration(s) * time.Second) }
+	require.NoError(t, u.AddSegment(ctx, make([]byte, 100), at(0)))
+	require.NoError(t, u.AddSegment(ctx, make([]byte, 200), at(2)))
+	require.NoError(t, u.Cutover(ctx))
+	require.NoError(t, u.AddSegment(ctx, make([]byte, 300), at(4)))
+	require.NoError(t, u.Close(ctx))
+
+	rec.mu.Lock()
+	defer rec.mu.Unlock()
+	require.Equal(t, []time.Time{at(0), at(4)}, rec.started)
+	require.Equal(t, [][]RecordedSegment{
+		{{StartMs: at(0).UnixMilli(), Size: 100}, {StartMs: at(2).UnixMilli(), Size: 200}},
+		{{StartMs: at(4).UnixMilli(), Size: 300}},
+	}, rec.indexes)
+}
+
 // TestS3UploaderUniformParts proves the uploader slices its buffer into
 // exactly liveUploadPartSize parts regardless of segment sizes, with only the
 // object's final part smaller. R2 rejects multipart completes whose
@@ -182,7 +217,7 @@ func TestS3UploaderUniformParts(t *testing.T) {
 	ctx := context.Background()
 	total := 0
 	for _, mb := range []int{2, 3, 4, 3} { // 12MB in irregular chunks
-		require.NoError(t, u.AddSegment(ctx, make([]byte, mb*1024*1024)))
+		require.NoError(t, u.AddSegment(ctx, make([]byte, mb*1024*1024), time.Now()))
 		total += mb * 1024 * 1024
 	}
 	require.NoError(t, u.Close(ctx))
@@ -217,11 +252,11 @@ func TestS3UploaderRecoversFromCompleteFailure(t *testing.T) {
 	ctx := context.Background()
 	seg := make([]byte, 1024)
 
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 1)           // object 1
 	require.NoError(t, u.Cutover(ctx)) // complete fails -> object 1 abandoned+aborted
 
-	require.NoError(t, u.AddSegment(ctx, seg))
+	require.NoError(t, u.AddSegment(ctx, seg, time.Now()))
 	waitForStarts(t, rec, 2) // loop survived: object 2 started
 
 	require.NoError(t, u.Close(ctx), "mid-stream failure must not surface at Close; the final object completed fine")
@@ -266,7 +301,7 @@ func TestS3UploaderCloseIdempotent(t *testing.T) {
 	}
 
 	// A late AddSegment must be rejected, not panic on a closed channel.
-	if err := u.AddSegment(context.Background(), []byte("late")); err == nil {
+	if err := u.AddSegment(context.Background(), []byte("late"), time.Now()); err == nil {
 		t.Fatalf("AddSegment after Close should return an error")
 	}
 }
diff --git a/pkg/spxrpc/com_atproto_moderation.go b/pkg/spxrpc/com_atproto_moderation.go
index 56f996109..520abcb26 100644
--- a/pkg/spxrpc/com_atproto_moderation.go
+++ b/pkg/spxrpc/com_atproto_moderation.go
@@ -15,9 +15,8 @@ import (
 	"github.com/rivo/uniseg"
 	"github.com/streamplace/oatproxy/pkg/oatproxy"
 	"go.opentelemetry.io/otel"
-	"stream.place/streamplace/pkg/config"
 	"stream.place/streamplace/pkg/log"
-	"stream.place/streamplace/pkg/media"
+	"stream.place/streamplace/pkg/vod"
 )
 
 func (s *Server) HandleComAtprotoModerationCreateReport(c echo.Context) error {
@@ -109,7 +108,7 @@ func (s *Server) handleComAtprotoModerationCreateReport(ctx context.Context, bod
 	if did != "" {
 		clipPrefix := fmt.Sprintf("Clip: https://%s/api/clip/%s/", s.cli.BroadcasterHost, did)
 		if reportReasonFits(*body.Reason, clipPrefix+uuid.Nil.String()+".mp4") {
-			clipID, err := makeClip(ctx, s.cli, s.mm, did)
+			clipID, err := s.makeClip(ctx, did)
 			if err != nil {
 				// we still want the report to go through!
 				log.Error(ctx, "failed to make clip for report", "error", err)
@@ -146,15 +145,19 @@ func reportReasonFits(reason, extra string) bool {
 		uniseg.GraphemeClusterCount(reason)+separator+uniseg.GraphemeClusterCount(extra) <= 2000
 }
 
-func makeClip(ctx context.Context, cli *config.CLI, mm *media.MediaManager, did string) (string, error) {
-	after := time.Now().Add(-time.Duration(60) * time.Second)
+func (s *Server) makeClip(ctx context.Context, did string) (string, error) {
+	now := time.Now()
+	clip, err := vod.FindClip(ctx, s.statefulDB, s.playbackStore, s.mm, did, now.Add(-60*time.Second), now, true)
+	if err != nil {
+		return "", echo.NewHTTPError(http.StatusInternalServerError, "failed to clip user")
+	}
 
 	uu, err := uuid.NewV7()
 	if err != nil {
 		return "", echo.NewHTTPError(http.StatusInternalServerError, "failed to generate uuid")
 	}
 
-	fd, err := cli.DataFileCreate([]string{did, "clips", fmt.Sprintf("%s.mp4", uu.String())}, false)
+	fd, err := s.cli.DataFileCreate([]string{did, "clips", fmt.Sprintf("%s.mp4", uu.String())}, false)
 	if err != nil {
 		return "", echo.NewHTTPError(http.StatusInternalServerError, "failed to create data file")
 	}
@@ -167,7 +170,7 @@ func makeClip(ctx context.Context, cli *config.CLI, mm *media.MediaManager, did
 		}
 	}()
 
-	err = mm.ClipUser(ctx, did, fd, nil, &after)
+	err = clip.WriteMP4(ctx, fd)
 	if err != nil {
 		return "", echo.NewHTTPError(http.StatusInternalServerError, "failed to clip user")
 	}
diff --git a/pkg/spxrpc/place_stream_live_getclip.go b/pkg/spxrpc/place_stream_live_getclip.go
new file mode 100644
index 000000000..050f84b78
--- /dev/null
+++ b/pkg/spxrpc/place_stream_live_getclip.go
@@ -0,0 +1,79 @@
+package spxrpc
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/labstack/echo/v4"
+
+	"stream.place/streamplace/pkg/log"
+	"stream.place/streamplace/pkg/vod"
+)
+
+// The lexgen stub streams its reader with no Content-Length; NewServer
+// registers HandleGetClip over it so a client knows the clip's size up front.
+func (s *Server) handlePlaceStreamLiveGetClip(ctx context.Context, end string, start string, streamer string) (io.Reader, error) {
+	return nil, stubMisrouted("getClip")
+}
+
+// HandleGetClip serves place.stream.live.getClip: the streamer's published
+// segments starting in [start, end], as a flat MP4. Any signed-in caller may
+// clip — an OAuth session, or a service-auth token bound to this method, which
+// is how a third-party app holding the rpc scope calls it through its PDS.
+func (s *Server) HandleGetClip(c echo.Context) error {
+	ctx := c.Request().Context()
+	if GetCaller(ctx) == nil {
+		return echo.NewHTTPError(http.StatusUnauthorized, "AuthenticationRequired")
+	}
+	start, err := time.Parse(time.RFC3339, c.QueryParam("start"))
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "start must be a datetime")
+	}
+	end, err := time.Parse(time.RFC3339, c.QueryParam("end"))
+	if err != nil {
+		return echo.NewHTTPError(http.StatusBadRequest, "end must be a datetime")
+	}
+	if !end.After(start) || end.Sub(start) > vod.MaxClipDuration {
+		return echo.NewHTTPError(http.StatusBadRequest, "end must be after start, by at most "+vod.MaxClipDuration.String())
+	}
+	did, err := s.resolveStreamer(ctx, c.QueryParam("streamer"))
+	if err != nil {
+		return err
+	}
+	if banned, err := s.accountBanned(did); err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	} else if banned {
+		return echo.NewHTTPError(http.StatusForbidden, "StreamUnavailable")
+	}
+
+	clip, err := vod.FindClip(ctx, s.statefulDB, s.playbackStore, s.mm, did, start, end, false)
+	switch {
+	case errors.Is(err, vod.ErrClipNotFound):
+		return echo.NewHTTPError(http.StatusNotFound, "ClipNotFound")
+	case errors.Is(err, vod.ErrClipUnavailable):
+		return echo.NewHTTPError(http.StatusServiceUnavailable, "ClipUnavailable")
+	case err != nil:
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+	header, err := clip.Header(ctx)
+	if err != nil {
+		return echo.NewHTTPError(http.StatusInternalServerError, err.Error())
+	}
+
+	h := c.Response().Header()
+	h.Set("Content-Type", "video/mp4")
+	h.Set("Content-Length", strconv.FormatInt(int64(len(header))+clip.BodySize(), 10))
+	c.Response().WriteHeader(http.StatusOK)
+	if _, err := c.Response().Write(header); err != nil {
+		return nil
+	}
+	if err := clip.WriteSegments(ctx, c.Response()); err != nil {
+		// The status is already sent; the short body tells the client.
+		log.Warn(ctx, "getClip: writing clip body failed", "streamer", did, "error", err)
+	}
+	return nil
+}
diff --git a/pkg/spxrpc/spxrpc.go b/pkg/spxrpc/spxrpc.go
index 456302e0b..256511812 100644
--- a/pkg/spxrpc/spxrpc.go
+++ b/pkg/spxrpc/spxrpc.go
@@ -155,6 +155,8 @@ func NewServer(ctx context.Context, cli *config.CLI, model model.Model, stateful
 	// The same segments under a path-shaped URL, for a CDN pulling from
 	// this node (see liveCDN): one cacheable, signable path per segment.
 	e.GET(liveSegmentPathRoute, s.HandleGetLiveSegmentPath)
+	// Clips stream with a Content-Length the generated stub can't set.
+	e.GET("/xrpc/place.stream.live.getClip", s.HandleGetClip)
 	// glex code-generated these but we want them just passed upstream
 	e.POST("/xrpc/com.atproto.repo.createRecord", s.HandleWildcard)
 	e.POST("/xrpc/com.atproto.repo.putRecord", s.HandleWildcard)
diff --git a/pkg/spxrpc/stubs.go b/pkg/spxrpc/stubs.go
index 11f8c795e..318cbc37b 100644
--- a/pkg/spxrpc/stubs.go
+++ b/pkg/spxrpc/stubs.go
@@ -436,6 +436,7 @@ func (s *Server) RegisterHandlersPlacestream(e *echo.Echo) error {
 	e.GET("/xrpc/place.stream.graph.getFollowingUser", s.HandlePlaceStreamGraphGetFollowingUser)
 	e.GET("/xrpc/place.stream.ingest.getIngestUrls", s.HandlePlaceStreamIngestGetIngestUrls)
 	e.POST("/xrpc/place.stream.live.denyTeleport", s.HandlePlaceStreamLiveDenyTeleport)
+	e.GET("/xrpc/place.stream.live.getClip", s.HandlePlaceStreamLiveGetClip)
 	e.GET("/xrpc/place.stream.live.getLiveUsers", s.HandlePlaceStreamLiveGetLiveUsers)
 	e.GET("/xrpc/place.stream.live.getProfileCard", s.HandlePlaceStreamLiveGetProfileCard)
 	e.GET("/xrpc/place.stream.live.getRecommendations", s.HandlePlaceStreamLiveGetRecommendations)
@@ -774,6 +775,22 @@ func (s *Server) HandlePlaceStreamLiveDenyTeleport(c echo.Context) error {
 	return c.JSON(200, out)
 }
 
+func (s *Server) HandlePlaceStreamLiveGetClip(c echo.Context) error {
+	ctx, span := otel.Tracer("server").Start(c.Request().Context(), "HandlePlaceStreamLiveGetClip")
+	defer span.End()
+	end := c.QueryParam("end")
+	start := c.QueryParam("start")
+	streamer := c.QueryParam("streamer")
+	var out io.Reader
+	var handleErr error
+	// func (s *Server) handlePlaceStreamLiveGetClip(ctx context.Context,end string,start string,streamer string) (io.Reader, error)
+	out, handleErr = s.handlePlaceStreamLiveGetClip(ctx, end, start, streamer)
+	if handleErr != nil {
+		return handleErr
+	}
+	return c.Stream(200, "video/mp4", out)
+}
+
 func (s *Server) HandlePlaceStreamLiveGetLiveUsers(c echo.Context) error {
 	ctx, span := otel.Tracer("server").Start(c.Request().Context(), "HandlePlaceStreamLiveGetLiveUsers")
 	defer span.End()
diff --git a/pkg/statedb/auto_publish_vod_test.go b/pkg/statedb/auto_publish_vod_test.go
index 23812b8e3..c66b02fce 100644
--- a/pkg/statedb/auto_publish_vod_test.go
+++ b/pkg/statedb/auto_publish_vod_test.go
@@ -50,7 +50,7 @@ func recordObject(t *testing.T, state *StatefulDB, did, uri, key string, complet
 	id, err := state.RecordStart(ctx, did, "bucket", key, uri, time.Now())
 	require.NoError(t, err)
 	if completed {
-		require.NoError(t, state.RecordComplete(ctx, id, 1, 100))
+		require.NoError(t, state.RecordComplete(ctx, id, 1, 100, nil))
 	}
 }
 
diff --git a/pkg/statedb/s3_segment.go b/pkg/statedb/s3_segment.go
index 02af1346c..7f7e999af 100644
--- a/pkg/statedb/s3_segment.go
+++ b/pkg/statedb/s3_segment.go
@@ -6,6 +6,8 @@ import (
 
 	"github.com/google/uuid"
 	"gorm.io/gorm"
+
+	"stream.place/streamplace/pkg/s3"
 )
 
 type S3Segment struct {
@@ -14,16 +16,21 @@ type S3Segment struct {
 	// LivestreamURI ties this object to the place.stream.livestream it was
 	// recorded for, so live-to-VOD finalize can enumerate exactly the objects
 	// of one stream. May be empty for objects started before the URI was known.
-	LivestreamURI string     `gorm:"column:livestream_uri;index"`
-	Bucket        string     `gorm:"column:bucket;not null"`
-	Key           string     `gorm:"column:key;not null"`
-	URL           string     `gorm:"column:url"`
-	StartedAt     time.Time  `gorm:"column:started_at"`
-	CompletedAt   *time.Time `gorm:"column:completed_at"`
-	Size          int64      `gorm:"column:size"`
-	PartCount     int32      `gorm:"column:part_count"`
-	CreatedAt     time.Time  `gorm:"column:created_at"`
-	UpdatedAt     time.Time  `gorm:"column:updated_at"`
+	LivestreamURI string `gorm:"column:livestream_uri;index"`
+	Bucket        string `gorm:"column:bucket;not null"`
+	Key           string `gorm:"column:key;not null"`
+	URL           string `gorm:"column:url"`
+	// StartedAt is the media start time of the object's first segment.
+	StartedAt   time.Time  `gorm:"column:started_at"`
+	CompletedAt *time.Time `gorm:"column:completed_at"`
+	// Segments indexes the object's segments, so a clip can range-read just
+	// the ones it needs. Set on completion; empty for objects recorded before
+	// the index existed, which clips skip.
+	Segments  []s3.RecordedSegment `gorm:"column:segments;type:json;serializer:json"`
+	Size      int64                `gorm:"column:size"`
+	PartCount int32                `gorm:"column:part_count"`
+	CreatedAt time.Time            `gorm:"column:created_at"`
+	UpdatedAt time.Time            `gorm:"column:updated_at"`
 }
 
 func (s *S3Segment) TableName() string {
@@ -80,6 +87,34 @@ func (state *StatefulDB) ListS3SegmentsForLivestreams(ctx context.Context, lives
 	return segs, nil
 }
 
+// ListS3SegmentsInRange returns repoDID's completed objects that may hold
+// segments starting in [from, to], in recording order. An object's segments
+// all start between its StartedAt and its CompletedAt, so this is a superset;
+// callers pick the exact segments out of each object's index.
+func (state *StatefulDB) ListS3SegmentsInRange(ctx context.Context, repoDID string, from, to time.Time) ([]S3Segment, error) {
+	var segs []S3Segment
+	err := state.DB.WithContext(ctx).
+		Where("user_did = ? AND completed_at IS NOT NULL AND started_at <= ? AND completed_at >= ?", repoDID, to, from).
+		Order("started_at ASC").
+		Find(&segs).Error
+	return segs, err
+}
+
+// LatestOpenS3Segment returns repoDID's most recently started object whose
+// upload has not completed and that started at or after since, or nil.
+func (state *StatefulDB) LatestOpenS3Segment(ctx context.Context, repoDID string, since time.Time) (*S3Segment, error) {
+	var segs []S3Segment
+	err := state.DB.WithContext(ctx).
+		Where("user_did = ? AND completed_at IS NULL AND started_at >= ?", repoDID, since).
+		Order("started_at DESC").
+		Limit(1).
+		Find(&segs).Error
+	if err != nil || len(segs) == 0 {
+		return nil, err
+	}
+	return &segs[0], nil
+}
+
 // CountOpenS3Segments counts the objects recorded for one livestream whose
 // uploads have not completed yet.
 func (state *StatefulDB) CountOpenS3Segments(ctx context.Context, livestreamURI string) (int64, error) {
@@ -91,16 +126,12 @@ func (state *StatefulDB) CountOpenS3Segments(ctx context.Context, livestreamURI
 }
 
 // RecordComplete marks an S3 multipart upload as completed and records the
-// final part count and size. Implements s3.Recorder.
-func (state *StatefulDB) RecordComplete(ctx context.Context, id string, parts int32, size int64) error {
+// final part count, size and segment index. Implements s3.Recorder.
+func (state *StatefulDB) RecordComplete(ctx context.Context, id string, parts int32, size int64, segments []s3.RecordedSegment) error {
 	now := time.Now().UTC()
-	return state.DB.WithContext(ctx).Model(&S3Segment{}).
-		Where("id = ?", id).
-		Updates(map[string]any{
-			"completed_at": &now,
-			"size":         size,
-			"part_count":   parts,
-		}).Error
+	return state.DB.WithContext(ctx).Model(&S3Segment{ID: id}).
+		Select("completed_at", "size", "part_count", "segments").
+		Updates(&S3Segment{CompletedAt: &now, Size: size, PartCount: parts, Segments: segments}).Error
 }
 
 // GetS3Segment fetches an S3Segment by ID. Returns (nil, nil) if not found.
diff --git a/pkg/statedb/s3_segment_test.go b/pkg/statedb/s3_segment_test.go
index 7815db455..4d03496c6 100644
--- a/pkg/statedb/s3_segment_test.go
+++ b/pkg/statedb/s3_segment_test.go
@@ -22,7 +22,7 @@ func TestListS3SegmentsForLivestreams(t *testing.T) {
 		id, err := RecordStartHelper(ctx, state, uri, key, at)
 		require.NoError(t, err)
 		if complete {
-			require.NoError(t, state.RecordComplete(ctx, id, 1, 100))
+			require.NoError(t, state.RecordComplete(ctx, id, 1, 100, nil))
 		}
 	}
 	rec(first, "07-12-34-1.m4s", t0, true)
diff --git a/pkg/vod/clip.go b/pkg/vod/clip.go
new file mode 100644
index 000000000..808911f6c
--- /dev/null
+++ b/pkg/vod/clip.go
@@ -0,0 +1,195 @@
+package vod
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"sort"
+	"time"
+
+	"stream.place/streamplace/pkg/blob"
+	"stream.place/streamplace/pkg/media"
+	"stream.place/streamplace/pkg/s3"
+	"stream.place/streamplace/pkg/statedb"
+)
+
+// MaxClipDuration is the longest span one clip may cover.
+const MaxClipDuration = time.Hour
+
+var (
+	// ErrClipNotFound: this node holds no segments of the stream in the range.
+	ErrClipNotFound = errors.New("no segments in the requested range")
+	// ErrClipUnavailable: part of the range is in a recording object still
+	// being uploaded by another node, which alone holds those segments.
+	ErrClipUnavailable = errors.New("part of the requested range is still being recorded on another node")
+)
+
+// clipPart is a run of canonical segments: bytes held in memory, or a byte
+// range of a completed recording object.
+type clipPart struct {
+	startMs   int64
+	data      []byte
+	key       string
+	off, size int64
+}
+
+// Clip is a stream between two instants, as the canonical segments starting
+// in that span, drawn from wherever this node holds them. The segments are
+// blindly concatenatable MUXL, so the clip's MP4 is a synthesized faststart
+// header followed by their bytes verbatim, C2PA signatures included.
+type Clip struct {
+	store blob.Store
+	parts []clipPart
+}
+
+// SegmentBuffer is a node's in-memory buffer of recent segments; a
+// *media.MediaManager.
+type SegmentBuffer interface {
+	BufferedSegments(did string) []media.BufferedSegment
+}
+
+// FindClip collects the segments of did's stream that start in [from, to]:
+// from completed recordings (skipped when state or store is nil) and from the
+// node's in-memory buffer, which holds what isn't readable from a recording
+// yet. Recordings only hold published segments; includeUnpublished also takes
+// pre-live segments from memory, for moderation.
+func FindClip(ctx context.Context, state *statedb.StatefulDB, store blob.Store, buf SegmentBuffer, did string, from, to time.Time, includeUnpublished bool) (*Clip, error) {
+	fromMs, toMs := from.UnixMilli(), to.UnixMilli()
+	c := &Clip{store: store}
+	recorded := map[int64]bool{}
+	if state != nil && store != nil {
+		objs, err := state.ListS3SegmentsInRange(ctx, did, from, to)
+		if err != nil {
+			return nil, fmt.Errorf("list recordings: %w", err)
+		}
+		for _, obj := range objs {
+			// An object's segments are in time order, so those in range are
+			// one contiguous run of its bytes.
+			var run *clipPart
+			var off int64
+			for _, seg := range obj.Segments {
+				if seg.StartMs >= fromMs && seg.StartMs <= toMs {
+					if run == nil {
+						run = &clipPart{startMs: seg.StartMs, key: obj.Key, off: off}
+					}
+					run.size += seg.Size
+					recorded[seg.StartMs] = true
+				}
+				off += seg.Size
+			}
+			if run != nil {
+				c.parts = append(c.parts, *run)
+			}
+		}
+	}
+
+	buffered := buf.BufferedSegments(did)
+	for _, seg := range buffered {
+		ms := seg.Start.UnixMilli()
+		if ms < fromMs || ms > toMs || recorded[ms] || (!seg.Published && !includeUnpublished) {
+			continue
+		}
+		c.parts = append(c.parts, clipPart{startMs: ms, data: seg.Data, size: int64(len(seg.Data))})
+	}
+	sort.SliceStable(c.parts, func(i, j int) bool { return c.parts[i].startMs < c.parts[j].startMs })
+
+	if state != nil {
+		if err := checkOpenRecording(ctx, state, did, fromMs, toMs, buffered); err != nil {
+			return nil, err
+		}
+	}
+	if len(c.parts) == 0 {
+		return nil, ErrClipNotFound
+	}
+	return c, nil
+}
+
+// checkOpenRecording fails with ErrClipUnavailable when the range reaches into
+// a recording object still being uploaded whose segments this node doesn't
+// hold: the node recording the stream holds them all in memory until the
+// object completes (see MediaManager.RetainSegments), but another node may
+// only hold the last few minutes. The buffer runs contiguously from its
+// oldest segment to now, so it covers the range if it reaches back to either
+// the object's first segment or the range's start.
+func checkOpenRecording(ctx context.Context, state *statedb.StatefulDB, did string, fromMs, toMs int64, buffered []media.BufferedSegment) error {
+	open, err := state.LatestOpenS3Segment(ctx, did, time.Now().Add(-s3.MaxOpenObjectAge))
+	if err != nil {
+		return fmt.Errorf("find open recording: %w", err)
+	}
+	if open == nil || open.StartedAt.UnixMilli() > toMs {
+		return nil
+	}
+	if len(buffered) > 0 {
+		oldest := buffered[0].Start.UnixMilli()
+		if oldest <= open.StartedAt.UnixMilli() || oldest <= fromMs {
+			return nil
+		}
+	}
+	return ErrClipUnavailable
+}
+
+// Header synthesizes the clip's flat-MP4 faststart header. The MP4 is the
+// header followed by WriteSegments: len(header) + BodySize() bytes.
+func (c *Clip) Header(ctx context.Context) ([]byte, error) {
+	r, closeParts, err := c.open(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer closeParts()
+	return synthFlatHeader(ctx, r)
+}
+
+// BodySize is the byte length of the clip's segments.
+func (c *Clip) BodySize() int64 {
+	var n int64
+	for _, p := range c.parts {
+		n += p.size
+	}
+	return n
+}
+
+// WriteSegments writes the clip's segments, the body of its MP4.
+func (c *Clip) WriteSegments(ctx context.Context, w io.Writer) error {
+	r, closeParts, err := c.open(ctx)
+	if err != nil {
+		return err
+	}
+	defer closeParts()
+	_, err = io.Copy(w, r)
+	return err
+}
+
+// WriteMP4 writes the clip as a complete flat MP4.
+func (c *Clip) WriteMP4(ctx context.Context, w io.Writer) error {
+	header, err := c.Header(ctx)
+	if err != nil {
+		return err
+	}
+	if _, err := w.Write(header); err != nil {
+		return err
+	}
+	return c.WriteSegments(ctx, w)
+}
+
+// open returns a reader over the clip's segment bytes, in order, and a func
+// closing the recordings it opened.
+func (c *Clip) open(ctx context.Context) (io.Reader, func(), error) {
+	readers := make([]io.Reader, 0, len(c.parts))
+	var closers []io.Closer
+	for _, p := range c.parts {
+		if p.key == "" {
+			readers = append(readers, bytes.NewReader(p.data))
+			continue
+		}
+		r, err := c.store.Open(ctx, p.key)
+		if err != nil {
+			closeAll(closers)
+			return nil, nil, fmt.Errorf("open recording %s: %w", p.key, err)
+		}
+		closers = append(closers, r)
+		readers = append(readers, io.NewSectionReader(r, p.off, p.size))
+	}
+	return io.MultiReader(readers...), func() { closeAll(closers) }, nil
+}
diff --git a/pkg/vod/clip_test.go b/pkg/vod/clip_test.go
new file mode 100644
index 000000000..79fa4662a
--- /dev/null
+++ b/pkg/vod/clip_test.go
@@ -0,0 +1,158 @@
+package vod
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"stream.place/streamplace/pkg/blob"
+	"stream.place/streamplace/pkg/config"
+	"stream.place/streamplace/pkg/media"
+	"stream.place/streamplace/pkg/muxl"
+	"stream.place/streamplace/pkg/s3"
+	"stream.place/streamplace/pkg/statedb"
+)
+
+type fakeBuffer []media.BufferedSegment
+
+func (b fakeBuffer) BufferedSegments(string) []media.BufferedSegment { return b }
+
+// liveSegments signs the fragmented fixture the way live ingest does and
+// returns each GoP's bare canonical segment, in order.
+func liveSegments(t *testing.T) [][]byte {
+	t.Helper()
+	ms, err := media.NewEphemeralMediaSigner("test-streamer")
+	require.NoError(t, err)
+	frag, err := os.ReadFile(getFixture("h264-opus-frag.mp4"))
+	require.NoError(t, err)
+	events := make(chan *muxl.MuxlEvent, 16)
+	errCh := make(chan error, 1)
+	go func() {
+		errCh <- ms.SignSegmentStream(context.Background(), bytes.NewReader(frag), events)
+		close(events)
+	}()
+	var segs [][]byte
+	for ev := range events {
+		if ev.Type != "signed-segment" {
+			continue
+		}
+		tids := make([]string, 0, len(ev.Tracks))
+		for tid := range ev.Tracks {
+			tids = append(tids, tid)
+		}
+		sort.Strings(tids)
+		var seg []byte
+		for _, tid := range tids {
+			seg = append(seg, ev.Tracks[tid]...)
+		}
+		segs = append(segs, seg)
+	}
+	require.NoError(t, <-errCh)
+	return segs
+}
+
+// flatOracle is muxl's own flat MP4 of the segments: what a clip of exactly
+// those segments must be, byte for byte.
+func flatOracle(t *testing.T, segs [][]byte) []byte {
+	t.Helper()
+	var out bytes.Buffer
+	require.NoError(t, muxl.RunMuxlWrap(context.Background(), bytes.NewReader(bytes.Join(segs, nil)), "flat", &out))
+	return out.Bytes()
+}
+
+// TestFindClip clips across completed recordings and the in-memory buffer,
+// which overlap the way they do on a recording node (the buffer still holds
+// segments a completed object also has). A clip must take each segment once,
+// in order, cut a recording at the right byte offsets, and come out as muxl's
+// flat MP4 of exactly the segments starting in range.
+func TestFindClip(t *testing.T) {
+	ctx := context.Background()
+	segs := liveSegments(t)
+	require.Len(t, segs, 2, "fixture GoPs")
+
+	t0 := time.UnixMilli(1_760_000_000_000)
+	at := func(i int) time.Time { return t0.Add(time.Duration(i) * 2 * time.Second) }
+
+	state, err := statedb.MakeDB(ctx, &config.CLI{DBURL: ":memory:"}, nil, nil)
+	require.NoError(t, err)
+	store, err := blob.NewFileStore(t.TempDir())
+	require.NoError(t, err)
+	// record stores segs as one completed object of did's stream, starting at at(0).
+	record := func(did string, segs [][]byte) {
+		key := "live-rec/" + did + "/a.m4s"
+		body := bytes.Join(segs, nil)
+		require.NoError(t, writeBlob(ctx, store, key, body))
+		id, err := state.RecordStart(ctx, did, "bucket", key, "at://"+did, at(0))
+		require.NoError(t, err)
+		var index []s3.RecordedSegment
+		for i, seg := range segs {
+			index = append(index, s3.RecordedSegment{StartMs: at(i).UnixMilli(), Size: int64(len(seg))})
+		}
+		require.NoError(t, state.RecordComplete(ctx, id, 1, int64(len(body)), index))
+	}
+	clipBytes := func(did string, from, to time.Time, b SegmentBuffer) []byte {
+		t.Helper()
+		clip, err := FindClip(ctx, state, store, b, did, from, to, false)
+		require.NoError(t, err)
+		var out bytes.Buffer
+		require.NoError(t, clip.WriteMP4(ctx, &out))
+		header, err := clip.Header(ctx)
+		require.NoError(t, err)
+		require.Equal(t, int64(len(header))+clip.BodySize(), int64(out.Len()), "advertised length")
+		return out.Bytes()
+	}
+
+	// Segment 0 is in a completed recording; memory still holds it, plus
+	// segment 1, which is newer than any recording.
+	record("did:plc:mixed", segs[:1])
+	buf := fakeBuffer{
+		{Start: at(0), Published: true, Data: segs[0]},
+		{Start: at(1), Published: true, Data: segs[1]},
+	}
+	require.Equal(t, flatOracle(t, segs), clipBytes("did:plc:mixed", at(0), at(1), buf), "recording + memory, each segment once")
+
+	// Pre-live segments in memory stay out of a public clip.
+	prelive := fakeBuffer{{Start: at(1), Published: false, Data: segs[1]}}
+	require.Equal(t, flatOracle(t, segs[:1]), clipBytes("did:plc:mixed", at(0), at(1), prelive))
+	_, err = FindClip(ctx, state, store, prelive, "did:plc:mixed", at(1), at(2), false)
+	require.ErrorIs(t, err, ErrClipNotFound)
+
+	// A range starting inside a recording is cut out of the object's middle.
+	record("did:plc:recorded", segs)
+	require.Equal(t, flatOracle(t, segs[1:]), clipBytes("did:plc:recorded", at(1).Add(-time.Millisecond), at(2), fakeBuffer{}))
+}
+
+// TestFindClipOpenRecording covers a node that doesn't hold the object still
+// being recorded (another node ingests the stream and this one only buffers
+// the last few minutes): a clip reaching into the gap must fail rather than
+// silently skip it, while one this node fully holds still succeeds.
+func TestFindClipOpenRecording(t *testing.T) {
+	ctx := context.Background()
+	segs := liveSegments(t)
+	const did = "did:plc:clip"
+	now := time.Now()
+	state, err := statedb.MakeDB(ctx, &config.CLI{DBURL: ":memory:"}, nil, nil)
+	require.NoError(t, err)
+	store, err := blob.NewFileStore(t.TempDir())
+	require.NoError(t, err)
+	_, err = state.RecordStart(ctx, did, "bucket", "live-rec/"+did+"/open.m4s", "at://ls", now.Add(-5*time.Minute))
+	require.NoError(t, err)
+	buf := fakeBuffer{{Start: now.Add(-time.Minute), Published: true, Data: segs[0]}}
+
+	_, err = FindClip(ctx, state, store, buf, did, now.Add(-3*time.Minute), now, false)
+	require.ErrorIs(t, err, ErrClipUnavailable)
+	_, err = FindClip(ctx, state, store, buf, did, now.Add(-time.Minute), now, false)
+	require.NoError(t, err)
+
+	// The recording node holds the whole open object in memory.
+	held := fakeBuffer{
+		{Start: now.Add(-5 * time.Minute), Published: true, Data: segs[0]},
+		{Start: now.Add(-2 * time.Minute), Published: true, Data: segs[1]},
+	}
+	_, err = FindClip(ctx, state, store, held, did, now.Add(-3*time.Minute), now, false)
+	require.NoError(t, err)
+}
diff --git a/pkg/vod/flat_vod.go b/pkg/vod/flat_vod.go
index 73f3bc1ac..770967848 100644
--- a/pkg/vod/flat_vod.go
+++ b/pkg/vod/flat_vod.go
@@ -92,18 +92,23 @@ func hashAndBuildFragmentMetafile(ctx context.Context, store blob.Store, keys []
 }
 
 // synthFlatHeaderForObjects emits the metafile stream for the canonical
-// fragments and synthesizes the flat-MP4 faststart header from it. muxl owns
-// all the co64 offset math over the [header][fragments] layout, so the returned
-// header is exactly the bytes to prepend to the fragments.
+// fragments and synthesizes the flat-MP4 faststart header from it.
 func synthFlatHeaderForObjects(ctx context.Context, store blob.Store, keys []string) ([]byte, error) {
 	readers, closers, err := openFragmentReaders(ctx, store, keys)
 	if err != nil {
 		return nil, err
 	}
 	defer closeAll(closers)
+	return synthFlatHeader(ctx, io.MultiReader(readers...))
+}
 
+// synthFlatHeader synthesizes the flat-MP4 faststart header for a stream of
+// bare canonical fragments. muxl owns all the co64 offset math over the
+// [header][fragments] layout, so the returned header is exactly the bytes to
+// prepend to the fragments.
+func synthFlatHeader(ctx context.Context, fragments io.Reader) ([]byte, error) {
 	var metas bytes.Buffer
-	if err := muxl.RunMuxlMetafiles(ctx, io.MultiReader(readers...), &metas); err != nil {
+	if err := muxl.RunMuxlMetafiles(ctx, fragments, &metas); err != nil {
 		return nil, fmt.Errorf("emit metafiles: %w", err)
 	}
 	var header bytes.Buffer