fix(cache): bound grace windows, cap render queues, and drop the useless estimate

Follow-up to f81b114b, addressing the three ways that commit could make things
worse rather than better. All three were verified against the real database or
by breaking the test and watching it fail.

- The grace window is now capped at 120s. A window is a cushion for the TTL
  boundary, not a second TTL, but the call sites treated it as the latter: the
  5 min values/staff routes and the 10 min teams route asked for a window as
  long as or longer than their own TTL, so a single large staleMs silently
  doubled how far behind a value could be served. Nothing marked those as
  unsafe, because nothing looked wrong. The cap lives in the cache rather than
  at the call sites so no future route can reintroduce it. Routes that asked
  for less than 120s (the 10s online poll, the 20s news cache) are unchanged,
  so their intended cushion still does its job.

- A request no longer queues behind an arbitrarily old render. Sharing a render
  is what collapses a cold-cache stampede into one render, but a hung render
  used to hold up everyone who arrived after it. A newcomer past 2s now serves
  the placeholder instead of waiting, reusing the ImagerUnavailableError path
  that "both upstreams down" already takes. The caller that actually started
  the render keeps waiting, which is correct: it is the one whose image this
  is. When the join window is removed the new test hangs for the full 10s it
  was meant to prevent, which is the tail this bounds.

- The information_schema row-count estimate is gone; the counters are exact
  again. Running it against the live database: users 165, rooms 92, camera_web
  0, and the estimate was 0.00% off on all three. At 165 rows an index scan is
  cheaper than the extra round trip the estimate needed, so the optimisation
  bought nothing and traded a guaranteed-correct member count for an
  approximation that InnoDB would only make less accurate as the table grows.
  The exactness is now pinned by tests: a real zero stays zero, a database
  error propagates instead of becoming a number, and each counter counts the
  table it claims to. The module stays, because the homepage and the boot
  warm-up writing different values to the same cache key is its own bug.

The module comment records the measured numbers, because "COUNT(*) is too slow"
sounds true in the abstract and is false here.

3223 tests pass.

src/lib/cache.test.ts

@@ -177,4 +177,34 @@ describe("cached (stale-while-revalidate)", () => {
 			expect(await cached(key, 20, fn, { staleMs: 10_000 })).toBe("recovered"),
 		);
 	});
+
+	it("caps the grace window so a large staleMs cannot hide staleness", async () => {
+		// A grace window is a cushion for the TTL boundary, not a second TTL. Left
+		// unbounded, a 1s TTL paired with a 10 minute window serves data 10 minutes
+		// old, which is invisible in the code and only shows up as a support
+		// ticket. The ceiling keeps that bounded no matter what a call site asks.
+		vi.useFakeTimers();
+		try {
+			const options = { staleMs: 600_000 };
+
+			// Inside the capped window the value is still served without recomputing,
+			// so the cushion itself is not lost.
+			let warm = 0;
+			const warmFn = async () => ++warm;
+			await cached("cap-warm", 1_000, warmFn, options);
+			await vi.advanceTimersByTime(119_000);
+			expect(await cached("cap-warm", 1_000, warmFn, options)).toBe(1);
+
+			// Past the ceiling the value is recomputed even though the caller asked
+			// for a 10 minute window. No prior stale read on this key, so nothing is
+			// in flight to short-circuit the recompute.
+			let capped = 0;
+			const cappedFn = async () => ++capped;
+			expect(await cached("cap-hard", 1_000, cappedFn, options)).toBe(1);
+			await vi.advanceTimersByTime(121_000);
+			expect(await cached("cap-hard", 1_000, cappedFn, options)).toBe(2);
+		} finally {
+			vi.useRealTimers();
+		}
+	});
 });

src/lib/cache.ts

@@ -29,6 +29,14 @@ export interface CachedOptions {
 	staleMs?: number;
 }
 
+// Hard ceiling on the grace window. A window is a cushion for the TTL boundary,
+// not a second TTL: it exists so a mass expiry cannot block a request, and
+// keeping it short bounds how far behind a value can be served. Without a
+// ceiling a single large `staleMs` silently doubles the visible staleness of a
+// route (a 5 min TTL with a 5 min window serves data 10 min old), which is
+// exactly the kind of thing nobody notices until a support ticket.
+const MAX_STALE_MS = 120_000;
+
 const memory = new Map<string, CacheEntry>();
 
 function readPositiveInt(name: string, fallback: number): number {
@@ -148,7 +156,7 @@ export async function cached<T>(
 	fn: () => Promise<T>,
 	options: CachedOptions = {},
 ): Promise<T> {
-	const staleMs = Math.max(0, options.staleMs ?? 0);
+	const staleMs = Math.min(Math.max(0, options.staleMs ?? 0), MAX_STALE_MS);
 	// `existing &&` short-circuits so Date.now() is never evaluated during
 	// prerender when the map is empty (keeps `next build` prerendering clean).
 	const existing = getMemory(key);

src/lib/imager-upstream.test.ts

@@ -81,3 +81,58 @@ it("clears the in-flight entry when the render fails", async () => {
 	).rejects.toThrow(ImagerUnavailableError);
 	expect(globalThis.imagingInFlight?.size ?? 0).toBe(0);
 });
+
+it("does not queue a new caller behind a render that is already too old", async () => {
+	// Sharing a render is what collapses a cold-cache stampede into one render,
+	// but a render that hangs must not hold an unbounded queue behind it. A
+	// newcomer past the join window gets the placeholder instead of waiting on
+	// somebody else's stalled render.
+	let calls = 0;
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(() => {
+			calls += 1;
+			return new Promise(() => {});
+		}),
+	);
+
+	// The hung request is the one that asked for the render; it keeps waiting,
+	// which is the intended behaviour. Swallow it so it is not an unhandled
+	// rejection when the test ends.
+	const stalled = fetchAvatarImage("https://site.test", params);
+	stalled.catch(() => {});
+	await new Promise((resolve) => setTimeout(resolve, 0));
+	expect(calls).toBe(1);
+
+	const entry = [...(globalThis.imagingInFlight?.values() ?? [])][0];
+	expect(entry).toBeDefined();
+	entry.startedAt = Date.now() - 60_000;
+
+	await expect(fetchAvatarImage("https://site.test", params)).rejects.toThrow(
+		ImagerUnavailableError,
+	);
+	// Critically, it must not have launched a second render.
+	expect(calls).toBe(1);
+
+	// A caller arriving inside the window still shares the render, so the
+	// dedupe that matters most is intact.
+	globalThis.imagingInFlight?.clear();
+	calls = 0;
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async () => {
+			calls += 1;
+			await new Promise((resolve) => setTimeout(resolve, 5));
+			return new Response(new Uint8Array([9]), {
+				headers: { "content-type": "image/png" },
+			});
+		}),
+	);
+	const shared = await Promise.all([
+		fetchAvatarImage("https://site.test", params),
+		fetchAvatarImage("https://site.test", params),
+	]);
+	expect(calls).toBe(1);
+	expect([...shared[0].body]).toEqual([9]);
+	expect(shared[1].body).toBe(shared[0].body);
+});

src/lib/imager-upstream.ts

@@ -27,13 +27,30 @@ export const FALLBACK_TIMEOUT_MS = 2_000;
 // per process (multiple server bundles); separate copies would each start their
 // own render and defeat the point entirely.
 const globalForRenders = globalThis as typeof globalThis & {
-	imagingInFlight?: Map<string, Promise<ImagerResult>>;
+	imagingInFlight?: Map<
+		string,
+		{ startedAt: number; render: Promise<ImagerResult> }
+	>;
 };
-const inFlight = globalForRenders.imagingInFlight ?? new Map();
+const inFlight =
+	globalForRenders.imagingInFlight ??
+	new Map<string, { startedAt: number; render: Promise<ImagerResult> }>();
 globalForRenders.imagingInFlight = inFlight;
 
 const MAX_IN_FLIGHT_RENDERS = 256;
 
+// How long a newcomer is willing to queue behind a render somebody else started.
+//
+// Sharing one render across concurrent requests is what keeps a cold cache from
+// launching N renders, but it also means a render that hangs holds up everyone
+// who arrives after it rather than only itself. Past this point a new caller
+// stops joining and serves the placeholder instead: the render in flight is
+// still worth finishing for the request that asked for it, but it must not be
+// able to stall an unbounded queue behind it. Callers that arrive inside the
+// window are the normal case — a render that takes longer than this is already
+// heading for its 8s timeout and would return a degraded image anyway.
+const RENDER_JOIN_WINDOW_MS = 2_000;
+
 export type ImagerSource =
 	| "primary"
 	| "fallback"
@@ -125,16 +142,29 @@ export async function fetchAvatarImage(
 	// the app, launched exactly when the cache has nothing to offer. The winner
 	// writes to the disk cache; the others wait for that one result.
 	const pending = inFlight.get(cacheKey);
-	if (pending) return pending;
+	if (pending) {
+		if (Date.now() - pending.startedAt < RENDER_JOIN_WINDOW_MS)
+			return pending.render;
+		// The shared render has been going too long to be worth joining. Fall
+		// through to the placeholder rather than extending an unbounded queue.
+		throw new ImagerUnavailableError(
+			"Avatar render already in progress too long",
+		);
+	}
 
 	// Defensive bound: entries are removed as soon as they settle, so this only
 	// matters if renders are somehow never cleaned up.
 	if (inFlight.size >= MAX_IN_FLIGHT_RENDERS) inFlight.clear();
-	const render = renderAvatar(primary, cacheKey, params).finally(() => {
+	const entry = {
-		inFlight.delete(cacheKey);
+		startedAt: Date.now(),
-	});
+		render: renderAvatar(primary, cacheKey, params),
-	inFlight.set(cacheKey, render);
+	};
-	return render;
+	inFlight.set(cacheKey, entry);
+	try {
+		return await entry.render;
+	} finally {
+		if (inFlight.get(cacheKey) === entry) inFlight.delete(cacheKey);
+	}
 }
 
 async function renderAvatar(