diff --git a/apps/client/src/features/comment/components/comment-list-item.test.tsx b/apps/client/src/features/comment/components/comment-list-item.test.tsx
index 99164111..eb35c601 100644
--- a/apps/client/src/features/comment/components/comment-list-item.test.tsx
+++ b/apps/client/src/features/comment/components/comment-list-item.test.tsx
@@ -46,7 +46,12 @@ const baseComment = (over?: Partial<IComment>): IComment =>
     ...over,
   }) as IComment;
 
-function renderItem(comment: IComment, canEdit = true, canComment = true) {
+function renderItem(
+  comment: IComment,
+  canEdit = true,
+  canComment = true,
+  userSpaceRole?: string,
+) {
   return render(
     <MantineProvider>
       <CommentListItem
@@ -54,6 +59,7 @@ function renderItem(comment: IComment, canEdit = true, canComment = true) {
         pageId="page-1"
         canComment={canComment}
         canEdit={canEdit}
+        userSpaceRole={userSpaceRole}
       />
     </MantineProvider>,
   );
@@ -173,38 +179,49 @@ describe("CommentListItem — dismiss suggestion (#329)", () => {
       ...over,
     });
 
-  it("renders a Dismiss button alongside Apply when canEdit and canComment", () => {
-    renderItem(suggestion(), true, true);
+  // A space admin (userSpaceRole="admin") satisfies the owner-or-admin gate
+  // regardless of who authored the comment; the tests below use it as the lever
+  // since the currentUser atom is unseeded (null) in this harness.
+  it("renders a Dismiss button alongside Apply when canEdit and canComment (owner/admin)", () => {
+    renderItem(suggestion(), true, true, "admin");
     expect(screen.getByRole("button", { name: "Apply" })).toBeDefined();
     expect(screen.getByRole("button", { name: "Dismiss" })).toBeDefined();
   });
 
-  it("shows Dismiss but NOT Apply for a commenter who cannot edit", () => {
-    renderItem(suggestion(), false, true);
+  it("shows Dismiss but NOT Apply for an admin commenter who cannot edit", () => {
+    renderItem(suggestion(), false, true, "admin");
     expect(screen.queryByRole("button", { name: "Apply" })).toBeNull();
     expect(screen.getByRole("button", { name: "Dismiss" })).toBeDefined();
   });
 
   it("hides Dismiss when the viewer cannot comment", () => {
-    renderItem(suggestion(), false, false);
+    renderItem(suggestion(), false, false, "admin");
     expect(screen.queryByRole("button", { name: "Dismiss" })).toBeNull();
     expect(screen.queryByRole("button", { name: "Apply" })).toBeNull();
   });
 
+  it("hides Dismiss for a non-owner non-admin even with canComment (#338 F5: mirrors server 403)", () => {
+    // canComment=true but NOT a space admin and NOT the comment owner (the
+    // currentUser atom is null while the comment is authored by user-1), so the
+    // server would 403 a dismiss — the button must not be shown at all.
+    renderItem(suggestion(), false, true, "member");
+    expect(screen.queryByRole("button", { name: "Dismiss" })).toBeNull();
+  });
+
   it("hides Dismiss once the thread is resolved", () => {
-    renderItem(suggestion({ resolvedAt: new Date() }), true, true);
+    renderItem(suggestion({ resolvedAt: new Date() }), true, true, "admin");
     expect(screen.queryByRole("button", { name: "Dismiss" })).toBeNull();
   });
 
   it("hides Dismiss (shows the Applied badge) once applied", () => {
-    renderItem(suggestion({ suggestionAppliedAt: new Date() }), true, true);
+    renderItem(suggestion({ suggestionAppliedAt: new Date() }), true, true, "admin");
     expect(screen.queryByRole("button", { name: "Dismiss" })).toBeNull();
     expect(screen.getByText("Applied")).toBeDefined();
   });
 
   it("calls the dismiss mutation when the Dismiss button is clicked", () => {
     dismissMutateAsync.mockClear();
-    renderItem(suggestion(), true, true);
+    renderItem(suggestion(), true, true, "admin");
     fireEvent.click(screen.getByRole("button", { name: "Dismiss" }));
     expect(dismissMutateAsync).toHaveBeenCalledWith({
       commentId: "c-1",
@@ -243,24 +260,27 @@ describe("canShowDismiss predicate", () => {
   const c = (over?: Partial<IComment>): IComment =>
     ({ suggestedText: "x", ...over }) as IComment;
 
-  it("true when suggestion present, can comment, not applied/resolved, top-level", () => {
-    expect(canShowDismiss(c(), true)).toBe(true);
+  it("true when suggestion present, can comment, owner/admin, not applied/resolved, top-level", () => {
+    expect(canShowDismiss(c(), true, true)).toBe(true);
   });
   it("false without comment permission", () => {
-    expect(canShowDismiss(c(), false)).toBe(false);
+    expect(canShowDismiss(c(), false, true)).toBe(false);
+  });
+  it("false when not owner and not admin (#338 F5)", () => {
+    expect(canShowDismiss(c(), true, false)).toBe(false);
   });
   it("false when no suggestion", () => {
-    expect(canShowDismiss(c({ suggestedText: null }), true)).toBe(false);
+    expect(canShowDismiss(c({ suggestedText: null }), true, true)).toBe(false);
   });
   it("false when already applied", () => {
-    expect(canShowDismiss(c({ suggestionAppliedAt: new Date() }), true)).toBe(
+    expect(canShowDismiss(c({ suggestionAppliedAt: new Date() }), true, true)).toBe(
       false,
     );
   });
   it("false when resolved", () => {
-    expect(canShowDismiss(c({ resolvedAt: new Date() }), true)).toBe(false);
+    expect(canShowDismiss(c({ resolvedAt: new Date() }), true, true)).toBe(false);
   });
   it("false for a reply comment", () => {
-    expect(canShowDismiss(c({ parentCommentId: "p" }), true)).toBe(false);
+    expect(canShowDismiss(c({ parentCommentId: "p" }), true, true)).toBe(false);
   });
 });
diff --git a/apps/client/src/features/comment/components/comment-list-item.tsx b/apps/client/src/features/comment/components/comment-list-item.tsx
index ff62bdd3..6bda2794 100644
--- a/apps/client/src/features/comment/components/comment-list-item.tsx
+++ b/apps/client/src/features/comment/components/comment-list-item.tsx
@@ -56,6 +56,12 @@ function CommentListItem({
   const [currentUser] = useAtom(currentUserAtom);
   const createdAtAgo = useTimeAgo(comment.createdAt);
 
+  // Owner-or-space-admin gate (#338): mirrors the server authz for both the
+  // comment menu (edit/delete) and the suggestion Dismiss button, so we never
+  // render an action the server will 403.
+  const isOwnerOrAdmin =
+    currentUser?.user?.id === comment.creatorId || userSpaceRole === "admin";
+
   useEffect(() => {
     setContent(comment.content);
   }, [comment]);
@@ -205,7 +211,7 @@ function CommentListItem({
                 />
               )}
 
-              {(currentUser?.user?.id === comment.creatorId || userSpaceRole === 'admin') && (
+              {isOwnerOrAdmin && (
                 <CommentMenu
                   onEditComment={handleEditToggle}
                   onDeleteComment={handleDeleteComment}
@@ -271,7 +277,7 @@ function CommentListItem({
               </Badge>
             ) : (
               (canShowApply(comment, canEdit) ||
-                canShowDismiss(comment, canComment)) && (
+                canShowDismiss(comment, canComment, isOwnerOrAdmin)) && (
                 <Group gap="xs" mt={6}>
                   {canShowApply(comment, canEdit) && (
                     <Button
@@ -290,7 +296,7 @@ function CommentListItem({
                   )}
                   {/* Dismiss ("Не применять", #329): removes the suggestion
                       without changing the page text. Gated on canComment. */}
-                  {canShowDismiss(comment, canComment) && (
+                  {canShowDismiss(comment, canComment, isOwnerOrAdmin) && (
                     <Button
                       size="compact-xs"
                       variant="subtle"
diff --git a/apps/client/src/features/comment/utils/suggestion.ts b/apps/client/src/features/comment/utils/suggestion.ts
index d6c2370f..ae05b203 100644
--- a/apps/client/src/features/comment/utils/suggestion.ts
+++ b/apps/client/src/features/comment/utils/suggestion.ts
@@ -14,13 +14,20 @@ export function canShowApply(comment: IComment, canEdit?: boolean): boolean {
 }
 
 // Whether the suggested-edit (#329) "Не применять" (Dismiss) button should be
-// shown. Dismiss does NOT change the page text, so it is gated on canComment
-// (looser than canEdit): a viewer allowed to comment but not edit can still
-// dismiss a suggestion. Same not-applied/not-resolved/top-level conditions as
-// Apply.
-export function canShowDismiss(comment: IComment, canComment?: boolean): boolean {
+// shown. Dismiss does NOT change the page text (so it needs only canComment, not
+// canEdit), BUT a childless dismiss IRREVERSIBLY hard-deletes the comment, so the
+// server gates it on comment-owner-OR-space-admin (#338 F5). The button must
+// mirror that authz or a non-owner non-admin sees a live Dismiss that always
+// 403s → red error. Hence isOwnerOrAdmin is required IN ADDITION to canComment.
+// Same not-applied/not-resolved/top-level conditions as Apply.
+export function canShowDismiss(
+  comment: IComment,
+  canComment?: boolean,
+  isOwnerOrAdmin?: boolean,
+): boolean {
   return Boolean(
     canComment &&
+      isOwnerOrAdmin &&
       comment.suggestedText &&
       !comment.suggestionAppliedAt &&
       !comment.resolvedAt &&
diff --git a/apps/server/src/core/comment/comment.service.ts b/apps/server/src/core/comment/comment.service.ts
index 812737d9..8e3d435b 100644
--- a/apps/server/src/core/comment/comment.service.ts
+++ b/apps/server/src/core/comment/comment.service.ts
@@ -623,17 +623,18 @@ export class CommentService {
    * bug #329 targets). Let the exception propagate (→ 5xx); the operation is
    * then repeatable with row + mark still consistent.
    *
-   * RACE (#338 F1): the caller read `hasChildren` BEFORE the (slow) mark
+   * RACE (#338 F4): the caller read `hasChildren` BEFORE the (slow) mark
    * removal, so a reply can land in that window. `comments.parent_comment_id` is
    * ON DELETE CASCADE, so an unconditional delete here would cascade-destroy the
    * just-added reply forever. Instead we use `deleteCommentIfChildless`, which
-   * re-checks childlessness inside the delete statement. If it removes the row
-   * (outcome 'deleted') we broadcast the deletion as before. If it removes 0
-   * rows (a reply interleaved) we do NOT hard-delete — we resolve the thread
-   * instead (outcome 'resolved'), preserving the discussion and the new reply.
-   * The anchor mark is already gone by then, an accepted degradation: the thread
-   * lands in the resolved tab without its inline highlight — far better than
-   * losing a reply.
+   * re-checks childlessness under a FOR UPDATE lock inside a transaction (a plain
+   * anti-join DELETE is NOT race-safe under READ COMMITTED — see the repo method
+   * docstring). If it removes the row (outcome 'deleted') we broadcast the
+   * deletion as before. If it removes 0 rows (a reply interleaved) we do NOT
+   * hard-delete — we resolve the thread instead (outcome 'resolved'), preserving
+   * the discussion and the new reply. The anchor mark is already gone by then, an
+   * accepted degradation: the thread lands in the resolved tab without its inline
+   * highlight — far better than losing a reply.
    */
   private async deleteEphemeralSuggestion(
     comment: Comment,
diff --git a/apps/server/src/database/repos/comment/comment.repo.ts b/apps/server/src/database/repos/comment/comment.repo.ts
index 29d3a6e5..afb3afec 100644
--- a/apps/server/src/database/repos/comment/comment.repo.ts
+++ b/apps/server/src/database/repos/comment/comment.repo.ts
@@ -140,34 +140,62 @@ export class CommentRepo {
   }
 
   /**
-   * Atomic conditional delete for an ephemeral suggestion (#338 / #329 F1):
-   * delete the row ONLY if it is still childless, in a single statement, and
-   * return the number of rows removed (0 or 1). This closes a race: dismiss/apply
-   * read `hasChildren`, then remove the anchor mark (a collab round-trip of
-   * tens-to-hundreds of ms), then delete. `comments.parent_comment_id` is
-   * ON DELETE CASCADE, so if a reply lands in that window an unconditional delete
-   * would cascade-delete the just-added reply forever. The `NOT EXISTS` re-checks
-   * childlessness at delete time inside the same statement, so an interleaved
-   * reply makes this delete 0 rows and the caller can fall back to resolving the
-   * thread instead of destroying the discussion.
+   * Delete an ephemeral suggestion row ONLY if it is still childless, returning
+   * the number of rows removed (0 or 1). Closes the data-loss race in
+   * dismiss/apply (#338 F4): the service reads `hasChildren`, then removes the
+   * anchor mark (a collab round-trip of tens-to-hundreds of ms), then calls this.
+   * `comments.parent_comment_id` is ON DELETE CASCADE, so a reply landing in that
+   * window would be cascade-destroyed by a blind delete.
+   *
+   * A single anti-join `DELETE … WHERE NOT EXISTS(child)` is NOT sufficient under
+   * READ COMMITTED: if a reply INSERT (holding FOR KEY SHARE on the parent, not
+   * yet committed) interleaves, the DELETE's snapshot does not see the
+   * uncommitted child, so `NOT EXISTS` is true and the parent qualifies; the
+   * DELETE then blocks on the child's key-share lock, and when it wakes the row
+   * was only LOCKED (not modified), so EvalPlanQual does NOT re-evaluate the
+   * predicate → the parent is deleted and the just-committed reply cascades away.
+   *
+   * So we do a lock-then-recheck in ONE transaction:
+   *  1. `SELECT id … FOR UPDATE` on the parent. FOR UPDATE conflicts with the
+   *     FOR KEY SHARE a concurrent reply INSERT takes on its parent (FK), so a
+   *     reply in the window serializes against us: it either commits before we
+   *     acquire the lock, or it must wait until this tx ends.
+   *  2. Re-read childlessness with a FRESH statement in the SAME tx. Under RC a
+   *     new statement gets a new snapshot, so a reply that committed while we
+   *     waited on the lock is now visible.
+   *  3. Delete only if still childless (return 1); otherwise return 0 so the
+   *     caller resolves the thread instead. The FOR UPDATE lock is held to
+   *     end-of-tx, so no new reply can insert between the re-check and the delete.
    */
   async deleteCommentIfChildless(commentId: string): Promise<number> {
-    const result = await this.db
-      .deleteFrom('comments')
-      .where('id', '=', commentId)
-      .where((eb) =>
-        eb.not(
-          eb.exists(
-            eb
-              .selectFrom('comments as child')
-              .select('child.id')
-              .whereRef('child.parentCommentId', '=', 'comments.id'),
-          ),
-        ),
-      )
-      .executeTakeFirst();
+    return this.db.transaction().execute(async (trx) => {
+      const parent = await trx
+        .selectFrom('comments')
+        .select('id')
+        .where('id', '=', commentId)
+        .forUpdate()
+        .executeTakeFirst();
 
-    return Number(result?.numDeletedRows ?? 0n);
+      // Already gone (e.g. a racing delete won) → nothing to remove.
+      if (!parent) return 0;
+
+      const child = await trx
+        .selectFrom('comments')
+        .select('id')
+        .where('parentCommentId', '=', commentId)
+        .limit(1)
+        .executeTakeFirst();
+
+      // A reply exists (possibly one that just committed) → do NOT hard-delete;
+      // the cascade would destroy it. Caller falls back to resolving the thread.
+      if (child) return 0;
+
+      await trx
+        .deleteFrom('comments')
+        .where('id', '=', commentId)
+        .execute();
+      return 1;
+    });
   }
 
   async hasChildren(commentId: string): Promise<boolean> {
diff --git a/apps/server/test/integration/comment-delete-if-childless.int-spec.ts b/apps/server/test/integration/comment-delete-if-childless.int-spec.ts
new file mode 100644
index 00000000..771a6a49
--- /dev/null
+++ b/apps/server/test/integration/comment-delete-if-childless.int-spec.ts
@@ -0,0 +1,160 @@
+import { Kysely } from 'kysely';
+import { CommentRepo } from '../../src/database/repos/comment/comment.repo';
+import {
+  getTestDb,
+  destroyTestDb,
+  buildTestDb,
+  createWorkspace,
+  createSpace,
+  createPage,
+  createUser,
+  createComment,
+} from './db';
+
+/**
+ * Real-DB coverage for CommentRepo.deleteCommentIfChildless (#338 F4/F6).
+ *
+ * This is the guard that keeps an ephemeral-suggestion hard-delete from
+ * cascade-destroying a reply (`comments.parent_comment_id` is ON DELETE CASCADE).
+ * The unit tests MOCK this method to 0/1, so only an int-spec actually exercises
+ * the SQL — the FOR UPDATE lock-then-recheck transaction — against Postgres.
+ *
+ * The concurrency case is the whole point: a plain anti-join
+ * `DELETE … WHERE NOT EXISTS(child)` passes (a) and (b) but SILENTLY loses a
+ * reply that commits mid-operation under READ COMMITTED (EvalPlanQual does not
+ * re-check a merely-locked row). Test (c) reproduces exactly that interleaving
+ * and asserts the row + reply both survive.
+ */
+describe('CommentRepo.deleteCommentIfChildless [integration]', () => {
+  let db: Kysely<any>;
+  let repo: CommentRepo;
+  let workspaceId: string;
+  let spaceId: string;
+  let pageId: string;
+  let userId: string;
+
+  beforeAll(async () => {
+    db = getTestDb();
+    repo = new CommentRepo(db as any);
+    workspaceId = (await createWorkspace(db)).id;
+    spaceId = (await createSpace(db, workspaceId)).id;
+    pageId = (await createPage(db, { workspaceId, spaceId })).id;
+    userId = (await createUser(db, workspaceId)).id;
+  });
+
+  afterAll(async () => {
+    await destroyTestDb();
+  });
+
+  async function rowExists(id: string): Promise<boolean> {
+    const row = await db
+      .selectFrom('comments')
+      .select('id')
+      .where('id', '=', id)
+      .executeTakeFirst();
+    return Boolean(row);
+  }
+
+  function seedTopLevel() {
+    return createComment(db, {
+      workspaceId,
+      spaceId,
+      pageId,
+      creatorId: userId,
+      selection: 'old text',
+      suggestedText: 'new text',
+    });
+  }
+
+  function seedReply(parentId: string) {
+    return createComment(db, {
+      workspaceId,
+      spaceId,
+      pageId,
+      creatorId: userId,
+      parentCommentId: parentId,
+    });
+  }
+
+  it('(a) childless top-level → returns 1 and the row is gone', async () => {
+    const parent = await seedTopLevel();
+    expect(await rowExists(parent.id)).toBe(true);
+
+    const deleted = await repo.deleteCommentIfChildless(parent.id);
+
+    expect(deleted).toBe(1);
+    expect(await rowExists(parent.id)).toBe(false);
+  });
+
+  it('(b) top-level WITH a committed reply → returns 0, parent AND reply survive (gate blocks the cascade)', async () => {
+    const parent = await seedTopLevel();
+    const reply = await seedReply(parent.id);
+
+    const deleted = await repo.deleteCommentIfChildless(parent.id);
+
+    expect(deleted).toBe(0);
+    expect(await rowExists(parent.id)).toBe(true);
+    expect(await rowExists(reply.id)).toBe(true);
+  });
+
+  it('(c) reply COMMITS mid-operation (FOR UPDATE path) → returns 0, parent + reply survive; a blind anti-join would lose the reply', async () => {
+    const parent = await seedTopLevel();
+
+    // Second connection holds an open transaction that inserts a reply (taking
+    // FOR KEY SHARE on the parent via the FK) and does NOT commit until we open
+    // the gate — reproducing the "reply not yet committed" window.
+    const conn2 = buildTestDb();
+    let openGate!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      openGate = resolve;
+    });
+    let replyId: string | undefined;
+
+    const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
+
+    try {
+      const replyTx = conn2.transaction().execute(async (trx) => {
+        const row = await trx
+          .insertInto('comments')
+          .values({
+            workspaceId,
+            spaceId,
+            pageId,
+            creatorId: userId,
+            parentCommentId: parent.id,
+          })
+          .returning(['id'])
+          .executeTakeFirstOrThrow();
+        replyId = row.id as string;
+        // Hold the FOR KEY SHARE lock on the parent until the gate opens.
+        await gate;
+      });
+
+      // Let the reply INSERT acquire its lock before the delete starts.
+      await sleep(250);
+
+      // deleteCommentIfChildless does SELECT ... FOR UPDATE on the parent, which
+      // conflicts with the reply's FOR KEY SHARE, so it BLOCKS here.
+      const deletePromise = repo.deleteCommentIfChildless(parent.id);
+
+      // Give the delete time to reach (and block on) its FOR UPDATE, then let the
+      // reply commit. The delete then wakes, re-checks under the lock, sees the
+      // now-committed reply, and returns 0.
+      await sleep(250);
+      openGate();
+      await replyTx;
+
+      const deleted = await deletePromise;
+
+      expect(deleted).toBe(0);
+      expect(await rowExists(parent.id)).toBe(true);
+      expect(replyId).toBeDefined();
+      expect(await rowExists(replyId!)).toBe(true);
+    } finally {
+      // Always release the gate (in case an assertion threw before openGate) and
+      // close the extra connection so global-teardown can DROP the database.
+      openGate();
+      await conn2.destroy();
+    }
+  });
+});
diff --git a/apps/server/test/integration/db.ts b/apps/server/test/integration/db.ts
index ede53494..fef0ac43 100644
--- a/apps/server/test/integration/db.ts
+++ b/apps/server/test/integration/db.ts
@@ -174,6 +174,40 @@ export async function createPage(
   return { id: row.id as string };
 }
 
+export async function createComment(
+  db: Kysely<any>,
+  args: {
+    workspaceId: string;
+    spaceId: string;
+    pageId: string;
+    creatorId?: string | null;
+    parentCommentId?: string | null;
+    content?: unknown;
+    selection?: string | null;
+    suggestedText?: string | null;
+    type?: string | null;
+  },
+): Promise<{ id: string }> {
+  const id = randomUUID();
+  const row = await db
+    .insertInto('comments')
+    .values({
+      id,
+      workspaceId: args.workspaceId,
+      spaceId: args.spaceId,
+      pageId: args.pageId,
+      creatorId: args.creatorId ?? null,
+      parentCommentId: args.parentCommentId ?? null,
+      content: (args.content ?? null) as any,
+      selection: args.selection ?? null,
+      suggestedText: args.suggestedText ?? null,
+      type: args.type ?? 'page',
+    })
+    .returning(['id'])
+    .executeTakeFirstOrThrow();
+  return { id: row.id as string };
+}
+
 export async function createRole(
   db: Kysely<any>,
   args: {