Messages maintain causal order within a single thread; reply not emitted before parent

A reply delivered before its parent message renders as an orphaned response with no visible context. Users see Re: [message not found] or a floating reply with no thread anchor, which destroys comprehension and trust in the threading system. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) applies when two related writes (parent then child) can arrive out of order due to race conditions in asynchronous handlers. Threading is a key value-add for community platforms; broken ordering negates that value.

Validate that the parent message exists server-side before accepting a reply. Reject the reply with an error if the parent is not found.

socket.on('send_reply', async (data: { parentId: string; content: string; channel: string }) => {
  const parent = await db.query.messages.findFirst({
    where: eq(messages.id, data.parentId),
  });
  if (!parent) {
    socket.emit('error', { code: 422, message: 'Parent message not found' });
    return;
  }
  const reply = {
    id: nanoid(),
    parentId: data.parentId,
    content: data.content,
    userId: socket.userId,
    seq: await nextSeq(data.channel),
    timestamp: Date.now(),
  };
  await db.insert(messages).values(reply);
  io.to(data.channel).emit('message', reply);
});