tdoc v0.7.5 — DO data-integrity fixes (Codex review)

An independent Codex review of the Durable Object work returned NOT SAFE. All six findings verified and fixed; worker redeployed.

P1 (data loss):

• Read-side first-touch migration was non-transactional — a concurrent mutation could be clobbered by a read writing back stale state. Reads now resolve inside a storage transaction.
• /api/doc DELETE wiped only the KV mirror, leaving canonical DO storage — delete-then-recreate resurrected old comments. Now wipes through the DO. Verified: recreate → 0 resurrected.

P2:

• Removed the post-commit KV mirror (could finish out of order and silently lose a committed update; never a reliable fallback). DO storage is the sole source of truth.
• Corrupt stored value now fails CLOSED (409, bytes preserved) instead of silently migrating to [] and overwriting recoverable data.

P3:

• Reaction labels escaped in the fork/export banner + overlay chip.
• Upload requires html to be a string (was a generic 500).

Re-verified live: 8 real comments intact, 25-way concurrency 0 lost, delete→recreate 0 resurrected, non-string html → 400.

🤖 Generated with Claude Code