Update — solved on my side, and it had nothing to do with Ghost or comments-ui after all. Sharing in case it helps someone else.
The root cause was a Cloudflare anti-bot setup I had put in place months ago following the technique discussed in this thread: combining hostSettings.siteId on the Ghost side with a Cloudflare Transform Rule that injects an x-site-id request header, plus a WAF Custom Rule that blocks any request to /members/api/ missing that header. Together they prevent direct hits to the origin from bypassing Cloudflare.
When I tried to disable the protection to test comments-ui, I only disabled the Transform Rule (which adds the header) and removed hostSettings.siteId from Ghost — but I forgot the second piece, the WAF Custom Rule that blocks /members/api/ requests without the header. So every comments-ui fetch to /members/api/comments/counts/ was returning a Cloudflare 403 HTML page, which comments-ui then tried to parse as JSON and failed with TypeError: [object Promise] is not iterable.
Disabling that WAF rule fixed it immediately. Comments now load normally on Ghost 6.42.0, comments-ui@~1.4, official Source theme.
So: sorry for the noise, and apologies to @Kevin and @muratcorlu — this wasn’t a Ghost bug. But it might still be worth flagging that comments-ui swallowing a non-JSON response with such a cryptic error message makes this kind of misconfiguration very hard to diagnose. A clearer error (e.g. “got HTML instead of JSON from /members/api/…”) would have saved a lot of time.
Thanks all for your patience.