@growth-labs/cms 0.8.2 → 0.8.4

package/src/engine/publication.ts

@@ -11,10 +11,18 @@ import {
 	serializeContentMetadata,
 } from './content-metadata.js'
 import type { D1Database, D1Result } from './d1.js'
+import { frontsPodcastSourceGeneration, podcastPublishBlocker } from './podcast-source.js'
 import {
+	assertCurrentMediaPublicationSnapshot,
 	assertCurrentPublicationSnapshot,
+	CURRENT_MEDIA_PUBLICATION_GUARD,
 	CURRENT_PUBLICATION_GUARD,
 	currentPublicationSqlGuard,
+	MEDIA_PUBLICATION_ITEM_FIELDS,
+	PUBLISHED_PODCAST_MEDIA_FIELDS,
+	PUBLISHED_VIDEO_MEDIA_FIELDS,
+	PublicationCurrentSnapshotError,
+	snapshotRecord,
 } from './publication-current-guard.js'
 import { evaluateArticleBody } from './publish-guard.js'
 import {
@@ -30,6 +38,7 @@ import {
 import { getRevision } from './revisions.js'
 import { slugify } from './slug.js'
 import { TagInputError, validateDeclaredTagList } from './taxonomy.js'
+import { frontsVideoSourceGeneration } from './video-source.js'
 
 export type PublicationOperation = 'publish' | 'rollback'
 export type PublicationSurfacePhase = 'prepare' | 'commit' | 'abort'
@@ -683,6 +692,7 @@ function publicationAttemptInsert(
 		surfaceNames: string[]
 		packageVersion: string | null
 		now: number
+		idempotent?: boolean
 	},
 ) {
 	return db
@@ -693,7 +703,8 @@ function publicationAttemptInsert(
 			   surface_names_json, pending_surface_names_json,
 			   prepared_surface_names_json, receipts_json,
 			   package_version, created_at, updated_at
-			 ) VALUES (?, ?, ?, ?, ?, ?, 'preparing', ?, ?, '[]', '[]', ?, ?, ?)`,
+			 ) VALUES (?, ?, ?, ?, ?, ?, 'preparing', ?, ?, '[]', '[]', ?, ?, ?)
+			 ${input.idempotent ? 'ON CONFLICT(id) DO NOTHING' : ''}`,
 		)
 		.bind(
 			id,
@@ -776,17 +787,24 @@ async function createRevisionAndPublicationAttempt(
 		createdBy?: string | null
 		expectedCurrentSnapshot?: Record<string, unknown>
 		expectedReceiptIdentity?: string
+		mediaReplacement?: { identity: string; payload: Record<string, unknown> }
 	},
 ): Promise<{
 	revisionId: string
 	snapshot: Record<string, unknown>
 	attempt: PublicationAttempt
 }> {
-	const snapshot = await getContentSnapshot(db, input.contentId)
-	if (!snapshot) throw new PublicationNotFoundError(`content not found: ${input.contentId}`)
+	const current = await getContentSnapshot(db, input.contentId)
+	if (!current) throw new PublicationNotFoundError(`content not found: ${input.contentId}`)
+	const snapshot = input.mediaReplacement?.payload ?? current
 	if (input.expectedCurrentSnapshot) {
-		assertCurrentPublicationSnapshot(snapshot, input.expectedCurrentSnapshot)
-		snapshot.publication_guard = CURRENT_PUBLICATION_GUARD
+		if (input.mediaReplacement) {
+			assertCurrentMediaPublicationSnapshot(current, input.expectedCurrentSnapshot)
+			snapshot.publication_guard = CURRENT_MEDIA_PUBLICATION_GUARD
+		} else {
+			assertCurrentPublicationSnapshot(snapshot, input.expectedCurrentSnapshot)
+			snapshot.publication_guard = CURRENT_PUBLICATION_GUARD
+		}
 		if (input.expectedReceiptIdentity !== undefined) {
 			if (!/^[a-f0-9]{64}$/.test(input.expectedReceiptIdentity))
 				throw new Error('Invalid guarded publication receipt identity')
@@ -794,12 +812,17 @@ async function createRevisionAndPublicationAttempt(
 		}
 	}
 	assertPublicationSnapshotBodyValid(snapshot, input.contentId)
-	const revisionId = crypto.randomUUID()
-	const attemptId = crypto.randomUUID()
+	const revisionId = input.mediaReplacement
+		? `media:${input.mediaReplacement.identity}`
+		: crypto.randomUUID()
+	const attemptId = input.mediaReplacement
+		? `media:${input.mediaReplacement.identity}`
+		: crypto.randomUUID()
 	await db.batch([
 		db
 			.prepare(
-				'INSERT INTO content_revisions (id, content_id, payload_json, created_at, created_by) VALUES (?, ?, ?, ?, ?)',
+				`INSERT INTO content_revisions (id, content_id, payload_json, created_at, created_by) VALUES (?, ?, ?, ?, ?)
+				${input.mediaReplacement ? 'ON CONFLICT(id) DO NOTHING' : ''}`,
 			)
 			.bind(
 				revisionId,
@@ -817,9 +840,17 @@ async function createRevisionAndPublicationAttempt(
 			surfaceNames: input.surfaceNames,
 			packageVersion: input.packageVersion,
 			now: input.now,
+			idempotent: Boolean(input.mediaReplacement),
 		}),
 	])
-	return { revisionId, snapshot, attempt: await getPublicationAttempt(db, attemptId) }
+	const persisted = input.mediaReplacement
+		? await getRevision(db, input.contentId, revisionId)
+		: null
+	return {
+		revisionId,
+		snapshot: persisted ? snapshotRecord(persisted.payload) : snapshot,
+		attempt: await getPublicationAttempt(db, attemptId),
+	}
 }
 
 function assertPublicationSnapshotBodyValid(
@@ -1039,6 +1070,33 @@ function normalizeReceipt(
 	}
 }
 
+async function mediaPreparationStillCurrent(
+	db: D1Database,
+	input: PublicationReconciliationInput,
+	allowCommittedPointer = false,
+): Promise<boolean> {
+	if (
+		input.operation !== 'publish' ||
+		input.snapshot.publication_guard !== CURRENT_MEDIA_PUBLICATION_GUARD
+	)
+		return false
+	const current = await getContentSnapshot(db, input.contentId)
+	const expected = structuredClone(snapshotRecord(input.snapshot.publication_current_snapshot))
+	if (
+		allowCommittedPointer &&
+		snapshotRecord(current?.item).published_revision_id === input.revisionId
+	) {
+		snapshotRecord(expected.item).published_revision_id = input.revisionId
+	}
+	try {
+		assertCurrentMediaPublicationSnapshot(current ?? {}, expected)
+		return true
+	} catch (error) {
+		if (error instanceof PublicationCurrentSnapshotError) return false
+		throw error
+	}
+}
+
 async function prepareSurfaces(
 	db: D1Database,
 	attempt: PublicationAttempt,
@@ -1053,8 +1111,19 @@ async function prepareSurfaces(
 	let durable = attempt
 	let receipts: PublicationSurfaceReceipt[] = [...durable.receipts]
 	let preparedNames = new Set(durable.preparedSurfaceNames)
+	const mediaReplacement =
+		input.operation === 'publish' &&
+		input.snapshot.publication_guard === CURRENT_MEDIA_PUBLICATION_GUARD
+	const preparedSuccessfully = (name: string) =>
+		durable.receipts
+			.filter((receipt) => receipt.name === name && receipt.phase === 'prepare')
+			.at(-1)?.status === 'ok'
 	surfaceLoop: for (const surface of surfaces) {
-		if (preparedNames.has(surface.name)) continue
+		if (
+			preparedNames.has(surface.name) &&
+			(!mediaReplacement || preparedSuccessfully(surface.name))
+		)
+			continue
 		if (durable.state !== 'preparing') {
 			throw new PublicationReconciliationError(
 				`publication attempt advanced concurrently to ${durable.state}`,
@@ -1091,6 +1160,40 @@ async function prepareSurfaces(
 		}
 		receipts = [...durable.receipts, normalized]
 		if (normalized.status !== 'ok') {
+			// A partial private preparation remains owned by this attempt. Retrying
+			// its idempotent prepare must never race a late abort of the same revision.
+			if (await mediaPreparationStillCurrent(db, input)) {
+				for (;;) {
+					if (preparedSuccessfully(surface.name)) {
+						receipts = [...durable.receipts]
+						preparedNames = new Set(durable.preparedSurfaceNames)
+						continue surfaceLoop
+					}
+					if (durable.state !== 'preparing') break
+					try {
+						durable = await persistPublicationAttempt(db, {
+							attemptId: durable.id,
+							expectedVersion: durable.version,
+							expectedStates: ['preparing'],
+							state: 'preparing',
+							pendingSurfaceNames: durable.pendingSurfaceNames,
+							preparedSurfaceNames: [...new Set([...durable.preparedSurfaceNames, surface.name])],
+							receipts: [...durable.receipts, normalized],
+							lastError: durableDiagnostic('surface_prepare_failed'),
+							now: input.now,
+						})
+						break
+					} catch (error) {
+						if (!(error instanceof PublicationAttemptConflictError)) throw error
+						durable = error.current
+					}
+				}
+				throw new PublicationReconciliationError(
+					`publication surface requires retry: ${surface.name}`,
+					durable.receipts,
+					durable.id,
+				)
+			}
 			let cleanupNames = new Set([...preparedNames, surface.name])
 			let claimed: PublicationAttempt
 			for (;;) {
@@ -1110,7 +1213,10 @@ async function prepareSurfaces(
 				} catch (error) {
 					if (!(error instanceof PublicationAttemptConflictError)) throw error
 					durable = error.current
-					if (durable.preparedSurfaceNames.includes(surface.name)) {
+					if (
+						durable.preparedSurfaceNames.includes(surface.name) &&
+						(!mediaReplacement || preparedSuccessfully(surface.name))
+					) {
 						receipts = [...durable.receipts]
 						preparedNames = new Set(durable.preparedSurfaceNames)
 						continue surfaceLoop
@@ -1179,7 +1285,10 @@ async function prepareSurfaces(
 			} catch (error) {
 				if (!(error instanceof PublicationAttemptConflictError)) throw error
 				durable = error.current
-				if (durable.preparedSurfaceNames.includes(surface.name)) {
+				if (
+					durable.preparedSurfaceNames.includes(surface.name) &&
+					(!mediaReplacement || preparedSuccessfully(surface.name))
+				) {
 					receipts = [...durable.receipts]
 					preparedNames = new Set(durable.preparedSurfaceNames)
 					break
@@ -1603,6 +1712,9 @@ async function movePointerAndBeginCommit(
 	attempt: PublicationAttempt,
 	now: number,
 ): Promise<void> {
+	const targetRevision = await getRevision(db, attempt.contentId, attempt.revisionId)
+	const mediaReplacement =
+		snapshotRecord(targetRevision?.payload).publication_guard === CURRENT_MEDIA_PUBLICATION_GUARD
 	if (
 		attempt.operation === 'publish' &&
 		(!Number.isSafeInteger(attempt.targetPublishedAt) || (attempt.targetPublishedAt as number) < 0)
@@ -1634,29 +1746,17 @@ async function movePointerAndBeginCommit(
 		  )
 	)`
 	const pointerStatement =
-		attempt.operation === 'publish'
+		mediaReplacement && attempt.operation === 'publish'
 			? db
-					.prepare(
-						`UPDATE content_items
-						 SET status = 'published', published_at = ?, publish_at = NULL,
-						     published_revision_id = ?, updated_at = unixepoch(),
-						     ${PUBLISH_METADATA_STAMP_SQL}
-						 WHERE id = ?
-						   AND COALESCE(published_revision_id, '') = ?
-						   AND EXISTS (
-						     SELECT 1 FROM content_publication_attempts
-						     WHERE id = ? AND state = 'prepared' AND revision_id = ? AND content_id = ?
-						   )
-						   AND ${targetRevisionSlugAvailable}`,
-					)
+					.prepare(`UPDATE content_items SET published_revision_id = ?
+				WHERE id = ? AND published_revision_id IS ?
+				AND EXISTS (SELECT 1 FROM content_publication_attempts
+				WHERE id = ? AND state = 'prepared' AND revision_id = ? AND content_id = ?)
+				AND ${targetRevisionSlugAvailable}`)
 					.bind(
-						attempt.targetPublishedAt,
 						attempt.revisionId,
-						// Wall clock, NOT targetPublishedAt — the latter is routinely backdated
-						// to the source video's date on the channel sites.
-						...publishMetadataStampBinds(now),
 						attempt.contentId,
-						attempt.previousRevisionId ?? '',
+						attempt.previousRevisionId,
 						attempt.id,
 						attempt.revisionId,
 						attempt.contentId,
@@ -1664,9 +1764,39 @@ async function movePointerAndBeginCommit(
 						attempt.contentId,
 						attempt.contentId,
 					)
-			: db
-					.prepare(
-						`UPDATE content_items
+			: attempt.operation === 'publish'
+				? db
+						.prepare(
+							`UPDATE content_items
+						 SET status = 'published', published_at = ?, publish_at = NULL,
+						     published_revision_id = ?, updated_at = unixepoch(),
+						     ${PUBLISH_METADATA_STAMP_SQL}
+						 WHERE id = ?
+						   AND COALESCE(published_revision_id, '') = ?
+						   AND EXISTS (
+						     SELECT 1 FROM content_publication_attempts
+						     WHERE id = ? AND state = 'prepared' AND revision_id = ? AND content_id = ?
+						   )
+						   AND ${targetRevisionSlugAvailable}`,
+						)
+						.bind(
+							attempt.targetPublishedAt,
+							attempt.revisionId,
+							// Wall clock, NOT targetPublishedAt — the latter is routinely backdated
+							// to the source video's date on the channel sites.
+							...publishMetadataStampBinds(now),
+							attempt.contentId,
+							attempt.previousRevisionId ?? '',
+							attempt.id,
+							attempt.revisionId,
+							attempt.contentId,
+							attempt.revisionId,
+							attempt.contentId,
+							attempt.contentId,
+						)
+				: db
+						.prepare(
+							`UPDATE content_items
 						 SET status = 'published', publish_at = NULL,
 						     published_revision_id = ?, updated_at = unixepoch()
 						 WHERE id = ?
@@ -1676,18 +1806,18 @@ async function movePointerAndBeginCommit(
 						     WHERE id = ? AND state = 'prepared' AND revision_id = ? AND content_id = ?
 						   )
 						   AND ${targetRevisionSlugAvailable}`,
-					)
-					.bind(
-						attempt.revisionId,
-						attempt.contentId,
-						attempt.previousRevisionId ?? '',
-						attempt.id,
-						attempt.revisionId,
-						attempt.contentId,
-						attempt.revisionId,
-						attempt.contentId,
-						attempt.contentId,
-					)
+						)
+						.bind(
+							attempt.revisionId,
+							attempt.contentId,
+							attempt.previousRevisionId ?? '',
+							attempt.id,
+							attempt.revisionId,
+							attempt.contentId,
+							attempt.revisionId,
+							attempt.contentId,
+							attempt.contentId,
+						)
 	const attemptStatement = db
 		.prepare(
 			`UPDATE content_publication_attempts
@@ -1761,6 +1891,15 @@ async function abortAfterPointerFailure(
 	receipts: PublicationSurfaceReceipt[],
 	surfaceHookTimeoutMs: number,
 ): Promise<never> {
+	// A transport failure may precede execution or lose the successful response.
+	// Keep this capture's durable attempt recoverable while its guard still holds.
+	if (await mediaPreparationStillCurrent(db, reconciliationInput, true)) {
+		throw new PublicationReconciliationError(
+			'Published media pointer requires retry',
+			receipts,
+			attempt.id,
+		)
+	}
 	let claimed: PublicationAttempt
 	try {
 		claimed = await persistPublicationAttempt(db, {
@@ -1824,6 +1963,216 @@ async function abortAfterPointerFailure(
 	)
 }
 
+export interface CommitPreparedPublishedMediaInput {
+	contentId: string
+	sourceGeneration: string
+	/** The host verifies the exact prepared private objects and binds their receipt. */
+	checkReadiness(input: {
+		snapshot: Record<string, unknown>
+		sourceGeneration: string
+		signal: AbortSignal
+	}): Promise<{ ready: boolean; receiptIdentity?: string }>
+	surfaces: PublicationReconciler[]
+	allowNoSurfaces?: boolean
+	now?: number
+	packageVersion?: string | null
+}
+
+export type CommitPreparedPublishedMediaResult =
+	| { status: 'ineligible' }
+	| { status: 'pending'; reason: 'media_incomplete' | 'verification_unready' }
+	| { status: 'committed'; deduped: boolean; revisionId: string; attemptId: string }
+
+async function mediaIdentity(value: string): Promise<string> {
+	const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value))
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('')
+}
+
+/** A media callback can finish this existing publication without publishing its draft. */
+export async function commitPreparedPublishedMedia(
+	db: D1Database,
+	input: CommitPreparedPublishedMediaInput,
+): Promise<CommitPreparedPublishedMediaResult> {
+	const current = await getContentSnapshot(db, input.contentId)
+	if (!current) throw new PublicationCurrentSnapshotError()
+	const item = snapshotRecord(current.item)
+	const content = snapshotRecord(current.content)
+	if (
+		!['video', 'podcast'].includes(String(item.type)) ||
+		content.processing_publication_guard == null
+	) {
+		return { status: 'ineligible' }
+	}
+	let capture: Record<string, unknown>
+	try {
+		capture = snapshotRecord(JSON.parse(String(content.processing_publication_guard)))
+	} catch {
+		throw new PublicationCurrentSnapshotError()
+	}
+	const capturedItem = snapshotRecord(capture.item)
+	if (
+		capture.version !== 1 ||
+		(capture.preparation_generation != null &&
+			(typeof capture.preparation_generation !== 'string' ||
+				!capture.preparation_generation ||
+				capture.preparation_generation.length > 256)) ||
+		capturedItem.status !== 'published' ||
+		typeof capturedItem.published_revision_id !== 'string' ||
+		!capturedItem.published_revision_id ||
+		typeof content.processing_trigger_token !== 'string' ||
+		!content.processing_trigger_token ||
+		capture.trigger_token_hash !==
+			`sha256:${await mediaIdentity(content.processing_trigger_token)}` ||
+		item.status !== 'published' ||
+		item.deleted_at != null ||
+		MEDIA_PUBLICATION_ITEM_FIELDS.some(
+			(field) => field !== 'published_revision_id' && item[field] !== capturedItem[field],
+		)
+	) {
+		throw new PublicationCurrentSnapshotError()
+	}
+	const source = {
+		content_id: input.contentId,
+		slug: String(item.slug),
+		canonical_version: Number(item.canonical_version),
+		processing_source_url:
+			typeof content.processing_source_url === 'string' ? content.processing_source_url : null,
+		processing_source_kind:
+			typeof content.processing_source_kind === 'string' ? content.processing_source_kind : null,
+		processing_trigger_token: content.processing_trigger_token,
+	}
+	const generation = await (item.type === 'video'
+		? frontsVideoSourceGeneration(source)
+		: frontsPodcastSourceGeneration(source))
+	if (generation !== input.sourceGeneration) throw new PublicationCurrentSnapshotError()
+	const identity = await mediaIdentity(
+		JSON.stringify([
+			CURRENT_MEDIA_PUBLICATION_GUARD,
+			input.contentId,
+			capturedItem.published_revision_id,
+			capture.trigger_token_hash,
+			generation,
+			capture.preparation_generation ?? null,
+		]),
+	)
+	const revisionId = `media:${identity}`
+	const attemptId = revisionId
+	if (
+		item.published_revision_id !== capturedItem.published_revision_id &&
+		item.published_revision_id !== revisionId
+	) {
+		throw new PublicationCurrentSnapshotError()
+	}
+	const storedRevision = await getRevision(db, input.contentId, revisionId)
+	if (storedRevision) {
+		const stored = snapshotRecord(storedRevision.payload)
+		if (
+			stored.publication_media_identity !== identity ||
+			stored.publication_guard !== CURRENT_MEDIA_PUBLICATION_GUARD
+		) {
+			throw new PublicationCurrentSnapshotError()
+		}
+		const expected = structuredClone(snapshotRecord(stored.publication_current_snapshot))
+		if (item.published_revision_id === revisionId)
+			snapshotRecord(expected.item).published_revision_id = revisionId
+		assertCurrentMediaPublicationSnapshot(current, expected)
+		const durable = await getPublicationAttempt(db, attemptId)
+		if (durable.state === 'committed') {
+			if (item.published_revision_id !== revisionId) throw new PublicationCurrentSnapshotError()
+			return { status: 'committed', deduped: true, revisionId, attemptId }
+		}
+	}
+	const incomplete =
+		item.type === 'video'
+			? content.processing_state !== 'ready' ||
+				content.hls_ready !== 1 ||
+				content.transcript_ready !== 1 ||
+				!content.hls_manifest_url ||
+				!content.transcript_url
+			: Boolean(podcastPublishBlocker(content))
+	if (incomplete) return { status: 'pending', reason: 'media_incomplete' }
+	const controller = new AbortController()
+	let timeout: ReturnType<typeof setTimeout> | undefined
+	let readiness: { ready: boolean; receiptIdentity?: string }
+	try {
+		readiness = await Promise.race([
+			input.checkReadiness({
+				snapshot: structuredClone(current),
+				sourceGeneration: generation,
+				signal: controller.signal,
+			}),
+			new Promise<never>((_resolve, reject) => {
+				timeout = setTimeout(() => {
+					controller.abort()
+					reject(new Error('Published media verification timed out'))
+				}, 10_000)
+			}),
+		])
+	} finally {
+		if (timeout !== undefined) clearTimeout(timeout)
+	}
+	if (readiness.ready !== true) return { status: 'pending', reason: 'verification_unready' }
+	if (!readiness.receiptIdentity || !/^[a-f0-9]{64}$/.test(readiness.receiptIdentity)) {
+		throw new Error('Verified published media requires an exact receipt identity')
+	}
+	assertCurrentMediaPublicationSnapshot(
+		(await getContentSnapshot(db, input.contentId)) ?? {},
+		current,
+	)
+	const surfaces = normalizeSurfaces(input)
+	if (!storedRevision) {
+		const base = await getRevision(db, input.contentId, capturedItem.published_revision_id)
+		if (
+			!base ||
+			base.payload.item.slug !== item.slug ||
+			base.payload.item.visibility !== item.visibility
+		) {
+			throw new PublicationCurrentSnapshotError()
+		}
+		const fields =
+			item.type === 'video' ? PUBLISHED_VIDEO_MEDIA_FIELDS : PUBLISHED_PODCAST_MEDIA_FIELDS
+		const payload = snapshotRecord(structuredClone(base.payload))
+		payload.content = {
+			...snapshotRecord(payload.content),
+			...Object.fromEntries(fields.map((field) => [field, content[field] ?? null])),
+		}
+		payload.publication_media_identity = identity
+		payload.publication_current_snapshot = {
+			item: Object.fromEntries(
+				MEDIA_PUBLICATION_ITEM_FIELDS.map((field) => [field, item[field] ?? null]),
+			),
+			content: Object.fromEntries(
+				[...fields, 'processing_publication_guard'].map((field) => [field, content[field] ?? null]),
+			),
+		}
+		await createRevisionAndPublicationAttempt(db, {
+			contentId: input.contentId,
+			previousRevisionId: capturedItem.published_revision_id,
+			targetPublishedAt: Number(capturedItem.published_at),
+			surfaceNames: surfaces.map((surface) => surface.name),
+			packageVersion: input.packageVersion ?? null,
+			now: input.now ?? nowSeconds(),
+			createdBy: 'cms.media-replacement',
+			expectedCurrentSnapshot: current,
+			expectedReceiptIdentity: readiness.receiptIdentity,
+			mediaReplacement: { identity, payload },
+		})
+	}
+	const persisted = await getRevision(db, input.contentId, revisionId)
+	const persistedPayload = snapshotRecord(persisted?.payload)
+	if (persistedPayload.publication_receipt_identity !== readiness.receiptIdentity)
+		throw new PublicationCurrentSnapshotError()
+	const durable = await getPublicationAttempt(db, attemptId)
+	if (durable.state === 'committed') {
+		const actual = await getContentItem(db, input.contentId)
+		if (actual?.published_revision_id !== revisionId) throw new PublicationCurrentSnapshotError()
+		return { status: 'committed', deduped: true, revisionId, attemptId }
+	}
+	const result = await retryPublicationSurfaces(db, { attemptId, now: input.now, surfaces })
+	if (result.status !== 'reconciled') throw new Error('Published media surfaces require retry')
+	return { status: 'committed', deduped: Boolean(storedRevision), revisionId, attemptId }
+}
+
 export async function publishOne(
 	db: D1Database,
 	input: PublishOneInput,
@@ -2017,10 +2366,24 @@ export async function retryPublicationSurfaces(
 		attempt = await supersedePublicationAttempt(db, attempt, now)
 		throw new PublicationAttemptSupersededError(attempt)
 	}
+	const revision = await getRevision(db, attempt.contentId, attempt.revisionId)
+	if (!revision) throw new PublicationNotFoundError(`revision not found: ${attempt.revisionId}`)
+	const reconciliationInput: PublicationReconciliationInput = {
+		operation: attempt.operation,
+		contentId: attempt.contentId,
+		revisionId: attempt.revisionId,
+		previousRevisionId: attempt.previousRevisionId,
+		snapshot: snapshotRecord(revision.payload),
+		now,
+		packageVersion: attempt.packageVersion,
+	}
 	const stalePrecanonicalAttempt =
 		['preparing', 'prepared'].includes(attempt.state) &&
-		item.published_revision_id !== attempt.previousRevisionId &&
-		item.published_revision_id !== attempt.revisionId
+		((item.published_revision_id !== attempt.previousRevisionId &&
+			item.published_revision_id !== attempt.revisionId) ||
+			(attempt.operation === 'publish' &&
+				reconciliationInput.snapshot.publication_guard === CURRENT_MEDIA_PUBLICATION_GUARD &&
+				!(await mediaPreparationStillCurrent(db, reconciliationInput, true))))
 	if (stalePrecanonicalAttempt) {
 		attempt = await claimPrecanonicalAttemptForCleanup(db, attempt, now)
 	}
@@ -2033,17 +2396,6 @@ export async function retryPublicationSurfaces(
 		retrySurfaceInput,
 		cleanupRecovery ? attempt.preparedSurfaceNames : attempt.pendingSurfaceNames,
 	)
-	const revision = await getRevision(db, attempt.contentId, attempt.revisionId)
-	if (!revision) throw new PublicationNotFoundError(`revision not found: ${attempt.revisionId}`)
-	const reconciliationInput: PublicationReconciliationInput = {
-		operation: attempt.operation,
-		contentId: attempt.contentId,
-		revisionId: attempt.revisionId,
-		previousRevisionId: attempt.previousRevisionId,
-		snapshot: revision.payload as unknown as Record<string, unknown>,
-		now,
-		packageVersion: attempt.packageVersion,
-	}
 	if (cleanupRecovery) {
 		const cleanup = await retryAbortCleanup(
 			db,