> 1) It doesn't include addressing,
As always it's the Clients that are responsible for addressing, therefore the second step should cover it, if the user/client chooses to perform it.
> 2) What happens if the client doesn't post the `Create` activity?
Whatever the server desires: cleanup after a while, keeping the media, etc.
Why do you think it's relevant for the specification itself?
ActivityPub, to my reading, is not about how to *store* content, but about how to *distribute* content.
So after it was uploaded, it's no longer the concern of the spec, unless operated further through other ActivityPub requests.