Every seller has lived this: the person who "does the posting" gets sick, and the brand goes silent for a week. Or worse — a platform changes its API, the scheduling script dies quietly, and nobody notices until reach craters. Auto-posting is easy to demo and hard to keep alive. This article covers the architecture that keeps a Vietnamese seller's presence running across Facebook, Zalo OA and TikTok through outages, token expiries and policy re-reviews.
The calendar is data, not a person's memory
The foundation is a content calendar stored as structured data: each entry has a post ID, target platforms, scheduled time, caption per platform, media asset references, campaign tags and an approval status. From this one record, the system knows what to post, where, when, and whether a human has signed off. When the calendar is data, everything downstream — scheduling, retries, reporting — becomes a query instead of a conversation. The assets it references come straight from your image and video pipelines, already named and sized.
Adapter architecture: one platform's problem stays one platform's problem
Each platform lives behind its own adapter — a module that owns that platform's authentication, media specs, publishing calls, error taxonomy and rate limits. The core scheduler speaks one internal contract; adapters translate. The payoff:
- API changes are contained. When one platform deprecates an endpoint or changes a field, you update one adapter. The calendar, the queue and the other platforms never notice.
- Outages are contained. One platform's downtime must never block the queue for the others. Each adapter has its own worker and its own retry backlog; a stuck TikTok upload does not delay a Zalo post by one second.
- Testing is contained. Each adapter can be exercised against a sandbox or dry-run mode independently.
This is the same isolation principle the end-to-end automation stack applies to carriers and invoice providers: never let a third party's change stop your whole pipeline.
Approval before publish, always
Automation drafts; a human approves. Posts sit in a review state until someone taps approve — from a phone, in seconds. For high-volume accounts, approval can be batched ("approve this week's calendar") with spot-check sampling. The one configuration we refuse to ship is fully unattended publishing of AI-drafted content to a brand account: the cost of one bad post outweighs the seconds approval takes.
The media spec matrix
Every platform has its own limits on ratios, durations, file sizes and caption lengths, and they change. Encode them as a versioned spec matrix the pipeline validates against before upload, so failures happen at render time with a clear message, not at publish time at 21:00.
| Dimension | Why it needs a matrix |
|---|---|
| Aspect ratio & resolution | Feed, story and short-video surfaces on the same platform accept different ratios |
| Video duration & size caps | Limits differ per platform and per account tier, and are revised over time |
| Caption length & link rules | Some surfaces truncate, some strip links, some penalise them |
| Media formats | Codec and container support varies; transcode per adapter, not per crisis |
Retries with dedup keys — the double-post killer
Platform APIs fail ambiguously: a timeout after upload may mean the post published or it did not. A naive retry double-posts, which looks broken and can trigger spam heuristics. Every publish call carries a deterministic dedup key derived from the post ID; before retrying, the adapter checks whether that key already resulted in a live post. Never retry blind.
Traps that surface after launch
Token lifecycles
Long-lived tokens still expire — and they expire on weekends. Track every token's issue and expiry time, refresh ahead of schedule, and alert on refresh failure before the token dies, not when a publish fails.
App review re-audits
Platforms periodically re-review apps and their permission scopes. A re-audit can suspend publish permissions with little warning. Keep your use-case documentation current and your requested scopes minimal — recovering a suspended scope takes far longer than maintaining it.
Velocity limits and shadow penalties
Posting too much, too fast, or too identically gets reach quietly suppressed with no error returned. Respect per-platform velocity budgets in the scheduler, vary captions per platform, and watch reach-per-post trends as a health signal.
Close the loop: comments feed the bot
Posts generate comments and messages; those are sales conversations. Each adapter exposes comment-monitoring hooks that feed new comments and DMs into the same brain behind your customer service bot — so the question "còn hàng không?" under a TikTok video gets answered in minutes, with the conversation and its UTM-tagged origin recorded against the campaign that produced it.