Comment by Ahmet Özel on "Deleting Personal Data from a RAG System in .NET"

The distinction between an obsolete writer being cancelled and its external write actually settling is the important race here. A timed-out upsert can still complete at the provider after a verification lookup has reported absence.

I would add a test that delays the provider commit until after the first verification attempt, rather than only pausing the worker before the write. Completion evidence should identify the writer generation and settled pending-write set it was checked against. A timestamped negative lookup alone is a snapshot, not proof that no already-issued request can recreate the artefact.

Yeah, that’s why the controlled writer section requires outstanding provider writes to settle before verification completes, with uncertain outcomes reconciled. The delayed commit test is a useful concrete addition to that coverage, as is tying completion evidence to the writer generation and settled write set.

You are right: settling outstanding writes and reconciling uncertain outcomes is already required in that section. My comment should have framed the delayed commit as a concrete test of your existing invariant, rather than suggesting the invariant was missing.

I would have that test assert the request remains pending after the first negative lookup, then completes only after the delayed provider result is reconciled and verification runs again. A separate case where the provider never settles would confirm that the deadline produces an unresolved outcome rather than false completion.

Yeah thats it, both are useful test cases. The delayed commit case should prove that the first negative lookup cant complete the deletion while a write remains outstanding. The 'never settles' case should prove that reaching the deadline leaves the outcome unresolved.

Those two outcomes should remain distinguishable in the completion evidence as well as the test assertions. The delayed-commit case can record the reconciled write result and the subsequent verification; the never-settles case should preserve the unresolved write identifier and generation.

A later reconciliation must then resume the pending request without treating the earlier deadline as evidence of absence. That gives the tests an observable state transition to assert, while keeping the existing settle-before-verification invariant explicit.

Search Hashnode