Await what the transactions start (PostgreSQL pass follow-up): the dashboard and list mappers now await postDto explicitly (behaviour unchanged: Promise.all already waited). A sync callback that calls async code returns before the work is done, so writes could land outside or after their transaction. npm test 25/25.

ddiff --git a/server/http/api.js b/server/http/api.js
iindex 4af5167..e7b2011 100644
---- a/server/http/api.js
++++ b/server/http/api.js
@@@ -181,10 +181,10 @@ function createApi(ctx) {
          if (req.query.all === '1') {
              if (req.viewer.kind === 'service' && !checkCapability(req.viewer.claims, 'blog.post.read').allowed) throw new ApiError(403, 'capability.denied', 'blog.post.read not granted');
              if (!await isMember(blog, req.viewer)) throw new ApiError(403, 'blog.forbidden', 'Only the blog’s members can list its drafts');
--            return { posts: await Promise.all((await posts.listForDashboard(blog, req.viewer)).slice(offset, offset + limit).map((p) => postDto(p, { full: false }))) };
++            return { posts: await Promise.all((await posts.listForDashboard(blog, req.viewer)).slice(offset, offset + limit).map(async (p) => await postDto(p, { full: false }))) };
          }
          const { total, posts: rows } = await posts.listPublished({ blogId: blog.id, restricted: await isMember(blog, req.viewer), limit, offset });
--        return { total, posts: await Promise.all(rows.map((p) => postDto(p))) };
++        return { total, posts: await Promise.all(rows.map(async (p) => await postDto(p))) };
      }));
  
      // The network changelog (server/changelog.js): what shipped on every OpenVibe site, newest first, and