[rudycelekli]

What this changes

Conversation naming checks whether a channel was deleted before asking the model. If deletion happens while that model call is pending, the final write can still add a summary to the soft-deleted row and announce it to the channel's members. A hard-deleted channel is also reported as successfully named even though no row changed.

Recheck deletedAt in the conditional write. If no row changes, distinguish a surviving channel another writer named from a channel that is gone. Both settle their queue item, while a deleted channel gets no new summary, timestamp, or summary announcement.

Where it runs

• New state that outlives a request? None. Existing channel and work-queue rows remain in shared Postgres.
• What happens on the second replica? The conditional database write checks the channel's current deletion state, whichever replica performed the deletion or generated the title.
• Anything serialised? Existing queue claims and the conditional channel update remain authoritative. The no-op check uses the same transaction connection.
• Anything fanned out to a browser? An actual summary write retains its existing commit-time notification. A deleted channel produces no successful summary event.
• New listener, port, or schedule? None.

Boundary and audit

• Channel access, deletion, and queue boundaries are unchanged.
• No new refusal or failure category is introduced. Missing or deleted targets use the existing settled/skipped path; model failures retain their existing retry handling.
• No new client-supplied trust or permissions.

Changelog

• Added an Unreleased entry.

Proof

Base 743649efc3f21d7bf0badbe6af2bcd5daedd97ce, head c0f3c577ccbabe91d7d1f0740d4cfce1c62e265d.

Two regressions pause the model with a promise barrier while the real worker holds a queue claim, perform a soft or hard deletion in Postgres, then release the title. Before: both fail. A real LISTEN connection captures the late summary announcement after soft deletion; hard deletion is incorrectly listed as written. After: the deleted row is unchanged or absent, neither job reports a successful name, both jobs finish, and no summary announcement is emitted. A commit-ordered NOTIFY marker confirms the listener observed the completed transaction; no timing sleeps or live model calls are used.

The full channel-summary file passes 19 tests and 47 assertions. All 10 channel and work-queue files pass together: 206 tests, 503 assertions. Controls retain another writer's existing title, ordinary naming, concurrent claims, delayed transcripts, model-failure retries, and notification size limits.

Format, lint, workspace typecheck, the test-typecheck baseline guard, and build pass on this exact head.

The full suite was not run on this head. A separate routing candidate (d428f669f10e21700b6d5eb1fb14e90c9cc59cfe) on the same base ran full test:ci: 11,017 passed, 210 skipped, two failed (routine-sweep concurrency expectation and recorder held-steps service-worker timing). Both passed when isolated on unchanged base and that routing candidate; full-suite order/timing causality remains unresolved.

The tests use a dedicated disposable PostgreSQL 15 database (hosted CI uses 17), with no application data or live provider calls. PRs #917 and #918 change task-brief unwrapping in a different part of this file; they do not change this final write.

AI assistance: implemented and locally validated with OpenAI Codex. Hosted CI and maintainer review remain required.

[davidmckayv]

Thanks. Checked together with the other fixes on one tree with the full test suite, and merging.