How a durable publication key keeps a watchdog canary to one live
By Internal Canary
Please publish this on https://www.google.com/url?q=http://adamtorkildson.com&source=gmail&ust=1788987992464000&sa=E only. Author is Internal Canary. Token TM-WD-CANARY-521-20260908.
Title: How a durable publication key keeps a watchdog canary to one live post
A publishing watchdog is only useful if an order that already reached WordPress cannot be created again when a worker times out. The first canary on this host proved the observe-before-fulfill path and also proved the failure: WordPress accepted the create, the isolate died before a local receipt, and the retry searched for an HTML comment that the destination had stripped. The result was three live posts for one job.
This retry exists to prove the opposite contract. Before any create, the orchestrator persists a publish intent that carries the job id and the deterministic publication key. It also holds a single active lease so cron, idle, and a manual run cannot start two creates for the same job. The WordPress adapter then stamps that key as supported post metadata and as a durable in-body marker that is not an HTML comment. On every retry the adapter searches for that exact key and adopts the existing post id and live URL before it considers create.
If WordPress returns success and the worker dies before local persistence, the next invocation must discover and reuse the same post. It must not open a second editor session and it must not call create again. Expansion, when needed, happens on its own invocation so a long OpenAI rewrite cannot share a CPU budget with the publish hop. After a post id and URL are known they are persisted before verification, invoicing, or any customer report. Reporting retries must be receipt-only.
That is the whole experiment. One email, one job, one WordPress post, one terminal receipt. No invoice for an admin sender. No second destination. No marketplace accept. No extra canary if this one already created a live URL. The body is long enough to clear the word-count gate so this run is about publish idempotency, not expansion.
Operators should treat a missing local receipt as incomplete bookkeeping, not as proof that WordPress is empty. Public search can lie when comments are stripped or when the worker IP is the only one that can see drafts. The durable key is the source of truth. If this paragraph is live once, the fix held. If it is live twice, stop and do not send another canary.
A durable publication key is a boring control and that is why it works. It does not depend on title uniqueness. It does not depend on a process-local memo. It does not depend on the worker staying alive long enough to write the receipt. It lives on the post itself, in a field WordPress already knows how to store, and in a marker that survives sanitizer passes that eat comments. The next operator who sees a 1102 should look up the key, not create again.
Please keep this article on https://www.google.com/url?q=http://adamtorkildson.com&source=gmail&ust=1788987992465000&sa=E. Do not fan it out. Do not invoice. Do not send a client fulfillment email if the sender is an admin. Archive the job after the live URL is recorded. Token again: TM-WD-CANARY-521-20260908.