emdash 0.20.0 → 0.22.0

package/src/astro/middleware.ts

@@ -60,7 +60,9 @@ import { isMissingTableError } from "../utils/db-errors.js";
 import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 import type { EmDashConfig } from "./integration/runtime.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
+import { prefetchLayoutData } from "./prefetch.js";
 import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
+import { resolveSessionUser } from "./session-user.js";
 import type { EmDashHandlers } from "./types.js";
 
 /**
@@ -415,7 +417,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// turns normal traffic into a flood of KV read misses. See #733.
 		const hasSessionCookie = cookies.get("astro-session") !== undefined;
 		const sessionUser =
-			context.isPrerendered || !hasSessionCookie ? null : await context.session?.get("user");
+			context.isPrerendered || !hasSessionCookie ? null : await resolveSessionUser(context.session);
 
 		if (!isEmDashRoute && !isPublicRuntimeRoute && !hasEditCookie && !hasPreviewToken) {
 			if (!sessionUser && !playgroundDb) {
@@ -428,7 +430,13 @@ export const onRequest = defineMiddleware(async (context, next) => {
 				// Do a one-time lightweight probe using the same getDb() instance the
 				// page will use: if the migrations table doesn't exist, no migrations
 				// have ever run -- redirect to the setup wizard.
-				if (!isSetupVerified()) {
+				// Skip the probe when prerendering: a prerendered route is built to
+				// static HTML, so returning context.redirect("/_emdash/admin/setup")
+				// below would bake that redirect into the page and ship it to
+				// production. The build database is legitimately empty in CI and there
+				// is no live visitor to send to the wizard at build time (session reads
+				// are already skipped for prerender above for the same reason).
+				if (!isSetupVerified() && !context.isPrerendered) {
 					const t0 = performance.now();
 					try {
 						const { getDb } = await import("../loader.js");
@@ -475,6 +483,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
+							// Exposed so the wrapped image endpoint (`/_image`) can read media
+							// bytes from storage on the anonymous fast path -- public `<img>`
+							// requests carry no session.
+							storage: runtime.storage,
 						} as EmDashHandlers;
 					} catch {
 						// Non-fatal — EmDashHead will fall back to base SEO contributions
@@ -512,7 +524,28 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					const ctx = parent
 						? { ...parent, db: anonScoped.db }
 						: { editMode: false, db: anonScoped.db, metrics };
+					// Eagerly warm site-global layout data (menus, widget areas,
+					// taxonomy terms, settings) concurrently so the layout's
+					// per-component reads overlap into ~one wall-clock round trip and
+					// hit a warm cache instead of serializing. Three guards:
+					//  - request-scoped (remote) backend only -- this branch implies it;
+					//    pointless on synchronous local SQLite.
+					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
+					//    layout, so prefetching their chrome is pure waste.
+					//  - via after(): it runs immediately (still warms the render) but
+					//    hands the promise to waitUntil, so the surplus warm-up (chrome a
+					//    given page doesn't render) is kept alive past the response rather
+					//    than erroring on workerd as orphaned request I/O.
+					// Gate on the CLIENT'S PREFERRED type (leading media range), not a
+					// substring -- browser navigations lead with `text/html`, while feed
+					// readers lead with `application/rss+xml` etc. and only list
+					// `text/html;q=0.8` later, so a substring match would leak onto feeds.
+					const acceptsHtml = (request.headers.get("accept") ?? "")
+						.split(",", 1)[0]!
+						.trim()
+						.startsWith("text/html");
 					return runWithContext(ctx, async () => {
+						if (acceptsHtml) after(() => prefetchLayoutData());
 						// commit() in finally: the write reached the primary independently
 						// of render, so the bookmark cookie must be persisted even if
 						// render throws -- otherwise a write-then-failed-render leaves the
@@ -723,7 +756,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	try {
 		return await runWithContext({ editMode: false, queryRecorder, metrics }, run);
 	} finally {
-		if (queryRecorder) flushRecorder(queryRecorder);
+		// Streamed responses defer the flush to stream end (see
+		// wrapBodyForStreamMetrics) so the log captures queries issued while
+		// the body renders. Only flush here for responses that were not
+		// wrapped (no body: redirects, 304s, bodyless errors), where all
+		// queries have already run by the time middleware returns.
+		if (queryRecorder && !queryRecorder.deferredFlush) flushRecorder(queryRecorder);
 	}
 });
 

package/src/astro/object-cache/adapters.ts

@@ -0,0 +1,50 @@
+/**
+ * Object-cache adapter functions (config time).
+ *
+ * These run in `astro.config.mjs` and return serializable
+ * {@link ObjectCacheDescriptor}s. The backend is instantiated at runtime by
+ * loading the descriptor's `entrypoint`.
+ *
+ * For Cloudflare KV, use `kvCache()` from `@emdash-cms/cloudflare`.
+ *
+ * @example
+ * ```ts
+ * // astro.config.mjs (Node / local)
+ * import emdash, { memoryCache } from "emdash/astro";
+ *
+ * export default defineConfig({
+ *   integrations: [emdash({ objectCache: memoryCache() })],
+ * });
+ * ```
+ */
+
+import type { ObjectCacheDescriptor, ObjectCacheRuntimeConfig } from "../../object-cache/types.js";
+
+/** Options for {@link memoryCache}. */
+export interface MemoryCacheOptions extends ObjectCacheRuntimeConfig {
+	/**
+	 * Soft cap on the number of cached keys per isolate before FIFO eviction.
+	 * @default 1000
+	 */
+	maxEntries?: number;
+}
+
+/**
+ * In-isolate memory object cache.
+ *
+ * Caches query results across requests within a single isolate/process. On
+ * Node (one long-lived process) this is a genuine cross-request cache; on
+ * multi-isolate platforms (Cloudflare) prefer `kvCache()` so the cache is
+ * shared. Useful for local development regardless of target.
+ *
+ * @example
+ * ```ts
+ * emdash({ objectCache: memoryCache({ defaultTtl: 600 }) })
+ * ```
+ */
+export function memoryCache(options: MemoryCacheOptions = {}): ObjectCacheDescriptor {
+	return {
+		entrypoint: "emdash/object-cache/memory",
+		config: { ...options },
+	};
+}

package/src/astro/prefetch.ts

@@ -0,0 +1,77 @@
+/**
+ * Eager, transparent prefetch of site-global "chrome" data.
+ *
+ * On a public page render, the shared layout pulls the same site-global data on
+ * every request -- menus, widget areas, taxonomy term lists, site settings --
+ * but each is awaited inside a separately-rendered Astro component, so they
+ * execute as serial DB round trips. This fires them all CONCURRENTLY at the
+ * very start of the request, before `next()`:
+ *
+ *   - On remote backends (D1, Durable Objects) the round trips overlap instead
+ *     of serializing, collapsing ~N sequential RTTs into ~1 wall-clock RTT. On
+ *     a coalescing backend they additionally batch into a single round trip.
+ *   - The results land in the per-request `requestCached` store under the exact
+ *     keys the layout helpers use, so when the components render they hit a warm
+ *     (in-flight or resolved) cache entry instead of issuing their own query.
+ *
+ * Nothing here changes what templates call -- it warms the real helpers, so the
+ * cache keys and value shapes are guaranteed identical. The caller gates this to
+ * the public-page path on a request-scoped (remote) backend; it is a no-op-ish
+ * waste on synchronous local SQLite, so don't call it there.
+ *
+ * Fire-and-forget: never awaited by middleware, never throws (a prefetch failure
+ * must not affect the request -- the helpers will simply run on demand).
+ */
+
+import { getDb } from "../loader.js";
+import { getMenu } from "../menus/index.js";
+import { setRequestCacheEntry } from "../request-cache.js";
+import { getSiteSettings } from "../settings/index.js";
+import { getTaxonomyDefs, getTaxonomyTerms } from "../taxonomies/index.js";
+import { getWidgetAreas } from "../widgets/index.js";
+
+/** Warm widget areas: one bulk load, primed under each per-area cache key. */
+async function prefetchWidgetAreas(): Promise<void> {
+	const areas = await getWidgetAreas();
+	// getWidgetArea(name) caches under `widget-area:${name}` and returns the same
+	// WidgetArea shape getWidgetAreas yields, so priming here makes those calls hit.
+	for (const area of areas) {
+		setRequestCacheEntry(`widget-area:${area.name}`, area);
+	}
+}
+
+/** Warm every taxonomy's term list via the real helper (primes per-name keys). */
+async function prefetchTaxonomyTerms(): Promise<void> {
+	const defs = await getTaxonomyDefs();
+	await Promise.allSettled(defs.map((def) => getTaxonomyTerms(def.name)));
+}
+
+/** Warm every menu via the real helper (primes `menu:${name}:${locale}`). */
+async function prefetchMenus(): Promise<void> {
+	const db = await getDb();
+	// The layout calls getMenu(name) with hardcoded names; we can't know them, so
+	// discover every menu name and warm them all (small, bounded chrome table).
+	const rows = await db.selectFrom("_emdash_menus").select("name").distinct().execute();
+	const names = [...new Set(rows.map((r) => r.name))];
+	await Promise.allSettled(names.map((name) => getMenu(name)));
+}
+
+/**
+ * Concurrently warm the site-global layout data for the current request.
+ * Safe to call only inside the request ALS frame that owns the (remote)
+ * request-scoped db. Never throws.
+ */
+export async function prefetchLayoutData(): Promise<void> {
+	try {
+		await Promise.allSettled([
+			getSiteSettings(),
+			prefetchMenus(),
+			prefetchWidgetAreas(),
+			prefetchTaxonomyTerms(),
+		]);
+	} catch (error) {
+		// Defensive: Promise.allSettled shouldn't reject, but never let a prefetch
+		// failure surface to the request.
+		console.error("[emdash] layout prefetch failed (non-fatal):", error);
+	}
+}

package/src/astro/routes/api/comments/[collection]/[contentId]/reactions.ts

@@ -0,0 +1,97 @@
+/**
+ * Public comment reaction endpoints (Tier 1 of the best-in-class comments RFC).
+ *
+ * GET  /_emdash/api/comments/:collection/:contentId/reactions
+ *   - Aggregate reaction counts for the content's approved comments, plus the
+ *     current visitor's active reactions.
+ * POST /_emdash/api/comments/:collection/:contentId/reactions
+ *   - Toggle a reaction on a comment. Public, honeypot- and rate-limit-gated.
+ *
+ * Inherits the `/_emdash/api/comments/` public prefix (no auth); the POST still
+ * requires the `X-EmDash-Request: 1` CSRF header like the comment POST.
+ */
+
+import type { APIRoute } from "astro";
+
+import { apiError, apiSuccess, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReactionCounts, handleReactionToggle } from "#api/handlers/comment-reactions.js";
+import { hashIp } from "#api/handlers/comments.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { createReactionBody } from "#api/schemas.js";
+import { resolveSecretsCached } from "#config/secrets.js";
+import { extractRequestMeta } from "#plugins/request-meta.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash } = locals;
+	const { collection, contentId } = params;
+
+	if (!collection || !contentId) {
+		return apiError("VALIDATION_ERROR", "Collection and content ID required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	try {
+		// Salted voter hash from request IP (same primitive as comment ip_hash).
+		// Behind Cloudflare (CF-Connecting-IP) or a configured trusted proxy this
+		// is per-visitor. Without a trusted IP it collapses to a shared "unknown"
+		// bucket, so reaction dedup degrades for those visitors — a real
+		// per-visitor token is Tier 2 (visitor identity). Operators should set
+		// trustedProxyHeaders; see the comment ingest route for the same note.
+		const meta = extractRequestMeta(request, emdash.config);
+		let voterHash = "unknown";
+		if (meta.ip) {
+			const { ipSalt } = await resolveSecretsCached(emdash.db);
+			voterHash = await hashIp(meta.ip, ipSalt);
+		}
+
+		const result = await handleReactionCounts(emdash.db, collection, contentId, voterHash);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to read reactions", "REACTION_COUNTS_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash } = locals;
+	const { collection, contentId } = params;
+
+	if (!collection || !contentId) {
+		return apiError("VALIDATION_ERROR", "Collection and content ID required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	try {
+		const body = await parseBody(request, createReactionBody);
+		if (isParseError(body)) return body;
+
+		// Anti-spam: honeypot — hidden field filled only by bots. Silently accept.
+		if (body.website_url) {
+			return apiSuccess({ reacted: false, counts: {} });
+		}
+
+		const meta = extractRequestMeta(request, emdash.config);
+		let voterHash = "unknown";
+		if (meta.ip) {
+			const { ipSalt } = await resolveSecretsCached(emdash.db);
+			voterHash = await hashIp(meta.ip, ipSalt);
+		}
+
+		const result = await handleReactionToggle(emdash.db, {
+			collection,
+			contentId,
+			commentId: body.commentId,
+			reaction: body.reaction,
+			voterHash,
+		});
+
+		return unwrapResult(result, 200);
+	} catch (error) {
+		return handleError(error, "Failed to toggle reaction", "REACTION_TOGGLE_ERROR");
+	}
+};

package/src/astro/routes/api/setup/dev-bypass.ts

@@ -23,7 +23,7 @@ import { ulid } from "ulidx";
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { escapeHtml } from "#api/escape.js";
-import { handleApiTokenCreate } from "#api/handlers/api-tokens.js";
+import { deleteApiTokensByName, handleApiTokenCreate } from "#api/handlers/api-tokens.js";
 import { getPublicOrigin } from "#api/public-url.js";
 import { isSafeRedirect } from "#api/redirect.js";
 import { runMigrations } from "#db/migrations/runner.js";
@@ -134,6 +134,10 @@ async function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Respon
 		// Optionally create a PAT token (?token=1) for headless/CLI testing.
 		let token: string | undefined;
 		if (url.searchParams.has("token")) {
+			// Idempotent by name: a prior reset can leave a stale dev-bypass-token,
+			// and the raw token is only available at creation, so drop any existing
+			// one and mint a fresh, usable PAT rather than accumulating duplicates.
+			await deleteApiTokensByName(emdash.db, user.id, "dev-bypass-token");
 			const result = await handleApiTokenCreate(emdash.db, user.id, {
 				name: "dev-bypass-token",
 				scopes: [

package/src/astro/routes/api/snapshot.ts

@@ -20,6 +20,8 @@ import {
 import { getPublicOrigin } from "#api/public-url.js";
 import { resolveSecretsCached } from "#config/secrets.js";
 
+import { resolveSessionUser } from "../../session-user.js";
+
 export const prerender = false;
 
 export const GET: APIRoute = async ({ request, locals, url, session }) => {
@@ -31,7 +33,7 @@ export const GET: APIRoute = async ({ request, locals, url, session }) => {
 	if (!user && session && emdash?.db) {
 		try {
 			const { createKyselyAdapter } = await import("@emdash-cms/auth/adapters/kysely");
-			const sessionUser = await session.get("user");
+			const sessionUser = await resolveSessionUser(session);
 			if (sessionUser?.id) {
 				const adapter = createKyselyAdapter(emdash.db);
 				const resolved = await adapter.getUserById(sessionUser.id);

package/src/astro/session-user.ts

@@ -0,0 +1,57 @@
+import { after } from "../after.js";
+
+/**
+ * Backstop timeout for resolving the session user. A live session-store read
+ * settles in a few ms, so this only ever fires on a genuinely stalled read.
+ */
+export const SESSION_GET_TIMEOUT_MS = 3_000;
+
+/**
+ * Resolve the Astro session user without risking an isolate-wide hang.
+ *
+ * On Cloudflare Workers, a request cancelled mid-`session.get()` (client
+ * disconnect, context teardown) can leave the underlying session-store read as
+ * a promise that never settles — neither resolving nor rejecting. Awaiting it
+ * directly hangs the request, and because the stalled promise is shared at the
+ * isolate level, every later session-bearing request hangs too (observed as
+ * 0-CPU, multi-minute, `canceled` responses; see #1274). A surrounding
+ * try/catch cannot help: the promise never rejects.
+ *
+ * Two layers, mirroring the reclaimable-cache pattern used elsewhere in core:
+ *  1. `after()` anchors the read so a cancelled request still drives it to
+ *     completion — the promise settles and the isolate is not poisoned for
+ *     subsequent requests (prevents the hang rather than merely surviving it).
+ *  2. A timeout is a fail-closed backstop: a still-stalled (or rejecting) read
+ *     resolves to `undefined`, and every caller treats the absence of a session
+ *     user as unauthenticated (anonymous on public routes, 401/redirect on
+ *     protected ones). It can only ever drop privileges for that one request,
+ *     never grant them.
+ *
+ * Used by every session read on the request path: the main middleware (the
+ * first read on a session-bearing request), the auth middleware, and the
+ * preview-snapshot route (which bypasses the auth middleware).
+ */
+export async function resolveSessionUser<T>(
+	session: { get(key: "user"): Promise<T> } | undefined,
+	timeoutMs = SESSION_GET_TIMEOUT_MS,
+): Promise<T | undefined> {
+	if (!session) return undefined;
+	const read: Promise<T | undefined> = Promise.resolve(session.get("user")).catch(() => undefined);
+	// Keep the worker alive past response/cancellation so the read completes and
+	// the shared promise settles — this is what prevents the isolate poisoning.
+	after(() =>
+		read.then(
+			() => undefined,
+			() => undefined,
+		),
+	);
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	const timeout = new Promise<undefined>((resolve) => {
+		timer = setTimeout(resolve, timeoutMs, undefined);
+	});
+	try {
+		return await Promise.race([read, timeout]);
+	} finally {
+		clearTimeout(timer);
+	}
+}

package/src/astro/types.ts

@@ -265,6 +265,7 @@ export interface EmDashHandlers {
 			slug?: string;
 			status?: string;
 			authorId?: string;
+			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
 			locale?: string;
 			translationOf?: string;
 			createdAt?: string | null;

package/src/bylines/field-defs-cache.ts

@@ -8,8 +8,12 @@
  * but are read on every byline hydration (admin pages, content rendering,
  * API responses). Caching at the isolate level drops the SELECT-from-
  * `_emdash_byline_fields` from once-per-hydration to once-per-isolate-
- * after-bump. The cache holds a Promise (not the resolved value) so
- * concurrent cold-isolate readers share the in-flight query.
+ * after-bump. The cache holds the resolved *value* behind a reclaimable
+ * single-flight lock (see `utils/single-flight-cache.ts`), never an
+ * in-flight promise: concurrent cold-isolate readers coalesce onto one
+ * query by polling the published value, so a reader whose request is
+ * cancelled mid-query can never strand later byline hydrations on the
+ * isolate (the workerd never-settling-promise hazard that produced 524s).
  *
  * Stored on globalThis under `Symbol.for("emdash:byline-field-defs")` so
  * Vite SSR chunk duplication can't produce two independent caches (same
@@ -50,17 +54,23 @@
 
 import type { Kysely } from "kysely";
 
+import { after } from "../after.js";
 import type { Database } from "../database/types.js";
 import { requestCached } from "../request-cache.js";
 import { getRequestContext } from "../request-context.js";
 import { BylineSchemaRegistry } from "../schema/byline-registry.js";
 import type { BylineFieldDefinition } from "../schema/types.js";
+import { createInitLock, type InitLock, initWithLock } from "../utils/init-lock.js";
 
 interface FieldDefsHolder {
-	/** In-flight or resolved defs promise for the cached version. Null until first read. */
-	cached: Promise<BylineFieldDefinition[]> | null;
-	/** Persisted-version value that `cached` was fetched against. */
+	/** Last resolved defs, valid only when `hasValue` is true. */
+	value: BylineFieldDefinition[] | null;
+	/** Presence flag, separate from `value` so an empty-array result still caches. */
+	hasValue: boolean;
+	/** Persisted-version value that `value` was fetched against. */
 	cachedVersion: number;
+	/** Reclaimable single-flight lock so a cancelled owner can't wedge readers. */
+	lock: InitLock;
 }
 
 const HOLDER_KEY = Symbol.for("emdash:byline-field-defs");
@@ -69,7 +79,12 @@ const holder: FieldDefsHolder =
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern (see request-cache.ts)
 	(g[HOLDER_KEY] as FieldDefsHolder | undefined) ??
 	(() => {
-		const h: FieldDefsHolder = { cached: null, cachedVersion: -1 };
+		const h: FieldDefsHolder = {
+			value: null,
+			hasValue: false,
+			cachedVersion: -1,
+			lock: createInitLock(),
+		};
 		g[HOLDER_KEY] = h;
 		return h;
 	})();
@@ -77,6 +92,16 @@ const holder: FieldDefsHolder =
 const REQUEST_CACHE_KEY_VERSION = "byline-fields-version";
 const REQUEST_CACHE_KEY_DEFS_PREFIX = "byline-field-defs:";
 
+/**
+ * Reclaim window for the single-flight lock: if an owner holds it past
+ * this without publishing (e.g. its request was cancelled and the
+ * anchored fetch hasn't completed yet), the next reader reclaims and
+ * refetches. `listFields` is a single fast SELECT, so this only needs to
+ * cover a genuinely slow/stranded query. Mutable solely so tests can
+ * shorten it; production never changes it.
+ */
+let reclaimDeadlineMs = 10_000;
+
 /**
  * Read the persisted `options.byline_fields_version` counter. Cached for
  * the duration of the current request via `requestCached`. Returns `0`
@@ -107,19 +132,29 @@ export async function getBylineFieldDefs(db: Kysely<Database>): Promise<BylineFi
 		if (isolated || dirty) {
 			return new BylineSchemaRegistry(db).listFields();
 		}
-		if (holder.cached !== null && holder.cachedVersion === version) {
-			return holder.cached;
-		}
-		const defs = new BylineSchemaRegistry(db).listFields().catch((error) => {
-			if (holder.cached === defs) {
-				holder.cached = null;
-				holder.cachedVersion = -1;
-			}
-			throw error;
-		});
-		holder.cached = defs;
-		holder.cachedVersion = version;
-		return defs;
+		// Per-isolate single-flight cache keyed on the persisted version.
+		// Coalesce concurrent cold readers via the lock and read the
+		// published value; never await another request's in-flight promise
+		// (a cancelled owner would otherwise strand every later byline
+		// hydration on the isolate). The fetch is anchored so a cancelled
+		// originator still drives it to completion and populates the cache.
+		return initWithLock<BylineFieldDefinition[]>(
+			holder.lock,
+			() => (holder.hasValue && holder.cachedVersion === version ? holder.value : null),
+			(isCurrentClaim) =>
+				(async () => {
+					const defs = await new BylineSchemaRegistry(db).listFields();
+					// Publish only while still the current claim, and never
+					// regress over a newer version a concurrent reader stored.
+					if (isCurrentClaim() && version >= holder.cachedVersion) {
+						holder.value = defs;
+						holder.hasValue = true;
+						holder.cachedVersion = version;
+					}
+					return defs;
+				})(),
+			{ deadlineMs: reclaimDeadlineMs, anchor: (promise) => after(() => promise) },
+		);
 	});
 }
 
@@ -133,6 +168,21 @@ export async function getBylineFieldDefs(db: Kysely<Database>): Promise<BylineFi
  * coordination that lets other isolates see the change.
  */
 export function resetBylineFieldDefsCacheForTests(): void {
-	holder.cached = null;
+	holder.value = null;
+	holder.hasValue = false;
 	holder.cachedVersion = -1;
+	holder.lock.ownerStartedAt = null;
+	holder.lock.generation = 0;
+	reclaimDeadlineMs = 10_000;
+}
+
+/**
+ * Test-only: shorten the single-flight reclaim window so a "stranded
+ * owner" scenario can be exercised without waiting out the production
+ * deadline. Reset by `resetBylineFieldDefsCacheForTests`.
+ *
+ * @internal
+ */
+export function setBylineFieldDefsReclaimDeadlineForTests(ms: number): void {
+	reclaimDeadlineMs = ms;
 }

package/src/cli/commands/doctor.ts

@@ -124,7 +124,7 @@ async function checkDatabase(dbPath: string): Promise<CheckResult[]> {
 		try {
 			const usersResult = await sql<{
 				count: number;
-			}>`SELECT COUNT(id) as count FROM _emdash_users`.execute(db);
+			}>`SELECT COUNT(id) as count FROM users`.execute(db);
 			const count = usersResult.rows[0]?.count ?? 0;
 			results.push({
 				name: "users",