model: don't "leak" promises