fix: allow retry after definitive publish failures

server/internal/tenant/app/publish_job_service_test.go

@@ -203,6 +203,32 @@ func TestCreatePublishJobResponseForRequeuedTaskReportsRequeuedTaskID(t *testing
 	}
 }
 
+func TestPublishUnknownTaskHasDefinitiveFailureReleasesCSRF403(t *testing.T) {
+	t.Parallel()
+
+	task := &repository.DesktopTask{
+		Kind:   "publish",
+		Status: "unknown",
+		Error:  []byte(`{"error_code":403,"error_msg":"CSRF token invalid"}`),
+	}
+	if !publishUnknownTaskHasDefinitiveFailure(task) {
+		t.Fatal("unknown publish task with CSRF 403 should be treated as definitive failed")
+	}
+}
+
+func TestPublishUnknownTaskHasDefinitiveFailureKeepsSubmitUncertain(t *testing.T) {
+	t.Parallel()
+
+	task := &repository.DesktopTask{
+		Kind:   "publish",
+		Status: "unknown",
+		Error:  []byte(`{"publish_submit_uncertain":true,"message":"network interrupted after submit"}`),
+	}
+	if publishUnknownTaskHasDefinitiveFailure(task) {
+		t.Fatal("submit-uncertain unknown publish task must stay in dedup set")
+	}
+}
+
 func TestLoadExistingPublishRecordTargetsDedupeUnknownTasks(t *testing.T) {
 	t.Parallel()
 
@@ -220,6 +246,9 @@ func TestLoadExistingPublishRecordTargetsDedupeUnknownTasks(t *testing.T) {
 	if !strings.Contains(normalizedSQL, "dt.status IN ('queued', 'in_progress', 'succeeded', 'unknown')") {
 		t.Fatalf("publish dedup lookup should include unknown task status; query:\n%s", tx.sql)
 	}
+	if !strings.Contains(normalizedSQL, "OR dt.status = 'unknown'") {
+		t.Fatalf("publish dedup lookup should include unknown tasks even when publish record is failed; query:\n%s", tx.sql)
+	}
 	if !strings.Contains(normalizedSQL, "AND dt.tenant_id = $1") {
 		t.Fatalf("publish dedup lookup should constrain desktop_tasks by tenant for the payload index; query:\n%s", tx.sql)
 	}