Approach: sound, but under-applied. Anchoring the session read with after()/waitUntil so a cancelled request still drives it to settlement — preventing the isolate poisoning rather than merely surviving it — plus a fail-closed timeout backstop, is the right pattern and mirrors the existing single-flight/reclaimable-cache + after() usage in emdash-runtime.ts, settings, and secrets. The fail-closed property holds: a stalled or rejecting read resolves to undefined, and every caller treats absence-of-user as unauthenticated, so the helper can only drop privileges, never grant them. The mechanics are correct — read is .catch-wrapped, the after callback handles both settle arms, and clearTimeout runs in finally (no timer leak, no unhandled rejection, no double read).

The headline problem is coverage. This PR hardens the three session.get("user") sites in auth.ts, but two structurally identical bare awaits are left untouched:

• packages/core/src/astro/middleware.ts:419 — the main middleware, registered before auth (in integration/index.ts, all order: "pre" in registration order: emdash/middleware → redirect → setup → emdash/middleware/auth). So on a session-bearing request like GET /_emdash/admin this is the first session read, before the hardened auth middleware ever runs. By this PR's own theory, a client disconnect during that await leaves a never-settling promise that hangs the request here and poisons the isolate — the auth-middleware fix never executes. The fix as written doesn't fully prevent the hang it set out to prevent.
• packages/core/src/astro/routes/api/snapshot.ts:34 — this route is in PUBLIC_API_EXACT, so the auth middleware return next()s in the isPublicApiRoute branch before any session read; this manual read is the endpoint's only session lookup, and its surrounding try/catch can't catch a never-settling promise (as the PR itself notes).

resolveSessionUser is currently module-local to auth.ts; extracting it to a shared module and applying it at both remaining sites closes the gap (the main middleware can keep its !hasSessionCookie short-circuit, which is the #733 KV-read-miss optimization).

Tests. None added. The workerd cancellation race itself isn't unit-testable, but the helper's two safety behaviors are: the timeout backstop (pass a session whose get("user") returns new Promise(() => {}) and assert resolveSessionUser resolves to undefined within the timeout instead of hanging) and fail-closed-on-reject. The infrastructure already exists — tests/unit/astro/middleware-prerender.test.ts mocks session.get and asserts on it for the #733 regression. Flagged below.

Checked: after()/clearTimeout/Promise.race mechanics; the fail-closed security property; import path and ordering; changeset (correct emdash/patch); every session.get("user") call site repo-wide (these two are the misses). Static review only — did not run typecheck/tests/lint.

Verdict: comment — the approach is right and the hardened paths are correct, but the same hole remains in the main middleware (the first session read on the request) and the snapshot route, and the testable backstop lacks a test.

Findings

• [needs fixing] packages/core/src/astro/middleware.ts:418-419

  Line 419 still does a bare await context.session?.get("user") with no after() anchor and no timeout backstop — exactly the pattern this PR fixes in auth.ts. Crucially, this middleware runs first: in integration/index.ts it's registered before emdash/middleware/auth (both order: "pre", in registration order), so for a session-bearing request like GET /_emdash/admin this is the first session read, before the hardened auth middleware runs at all.

  By this PR's own theory (an unanchored read cancelled mid-flight leaves a never-settling promise that hangs the request and poisons the isolate), this read is equally susceptible: a client disconnect during this await stalls it here, the request hangs before auth.ts executes, and the isolate is poisoned. The fix as written does not fully prevent the hang it set out to prevent.

  resolveSessionUser is module-local to auth.ts; extract it to a shared module and use it here (keeping the !hasSessionCookie short-circuit, which is the #733 KV-read-miss optimization):

  		const sessionUser =
  			context.isPrerendered || !hasSessionCookie
  				? null
  				: await resolveSessionUser(context.session);
  

  (Requires importing the extracted helper; resolveSessionUser already accepts session | undefined and returns undefined when absent, so passing context.session directly is safe.)

• [needs fixing] packages/core/src/astro/routes/api/snapshot.ts:34

  Same unprotected pattern: a bare await session.get("user"). The surrounding try/catch cannot help — as this PR notes, a stalled read neither resolves nor rejects, so the catch never fires and this request hangs (and can poison the isolate).

  This route is in PUBLIC_API_EXACT, so the auth middleware return next()s in the isPublicApiRoute branch before doing any session read. That makes this manual read the endpoint's only session lookup — the PR's resolveSessionUser never runs here. Lower traffic than the main middleware, but the same hole. Use the shared helper once it's extracted:

  			const sessionUser = await resolveSessionUser(session);
  

• [needs fixing] packages/core/src/astro/middleware/auth.ts:65

  AGENTS.md requires TDD for bugs ("A bug without a reproducing test is not fixed"), and this helper adds new, load-bearing behavior with no test. The workerd cancellation race itself isn't unit-testable, but the helper's two safety behaviors are:

  1. Timeout backstop — pass a session whose get("user") returns a never-settling promise (new Promise(() => {})) and assert resolveSessionUser resolves to undefined within the timeout instead of hanging the test.
  2. Fail-closed on reject — pass a get that rejects and assert undefined.

  The infrastructure already exists: tests/unit/astro/middleware-prerender.test.ts mocks session.get and asserts on it for the #733 regression, so this is straightforward. Extracting/exporting resolveSessionUser (which the two findings above require for reuse in middleware.ts and snapshot.ts) also makes it directly unit-testable in isolation. The live Workers traces are good evidence the fix works in production, but they don't guard the backstop logic against a future regression.