…g, reset yoga init on failure

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…outer

# Conflicts:
#	package.json

…fer casts, Response BodyInit)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…alThis.__env__)

The /sponsors.png and /sponsors.svg routes now serve the cron/webhook
-warmed blob straight from R2 via the KV manifest (readImage). On a cold
cache miss they render THIS request live and kick off a background
refreshSponsorsCache(force) that warms all 4 blobs (svg/png x light/dark)
for next time. Cache-Control widened to
`public, s-maxage=600, max-age=600, stale-while-revalidate=86400`.

The three landing loaders (en/cn/pt-BR) read getCachedSponsors(KV) — the
cron/webhook-maintained snapshot when present, else the live GitHub fetch
so the wall still works before the first refresh.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…KV parse + live cold render

- refresh: guard against clobbering a good snapshot with an empty (degraded)
  fetch; read manifest once and reuse for the version check. Cold cache still
  writes empty (nothing better to serve).
- store: writeSnapshot re-reads the manifest and only deletes the previous
  version's R2 blobs if we are still the published version (concurrent-supersede
  guard). readManifest/readData parse defensively -> null on corrupt JSON so
  callers fall back instead of 500ing.
- routes/sponsors.{png,svg}: cold miss renders from the live loader (spec), not
  KV-first getCachedSponsors; drop the now-unused import.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crypto.subtle.verify's BufferSource param rejects the widened
Uint8Array<ArrayBufferLike> under TS 5.7+; the fresh allocation is
already backed by a plain ArrayBuffer, so annotate it. Type-only, no
runtime change. Clears the last non-pre-existing tsc --noEmit error.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The image cold path already loads good sponsor data (loadSponsors()) and
renders the response from it. The background warm re-fetched via
loadSponsors({bypassCache:true}); if that 2nd fetch degraded to empty
while the 1st succeeded, refreshSponsorsCache — on a cold cache with no
manifest, so the isEmpty guard can't trip — published an empty first
snapshot over a request that had live data. Reuse the already-loaded
`sponsors` for the warm (also drops a redundant GitHub fetch per cold
miss). cron/webhook keep the live bypassed fetch (no preloaded payload).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…OCTOU)

The isEmpty guard only skipped when a manifest already existed (`&& current`),
and current was read ONCE before the slow render. On a cold cache an empty
degraded refresh saw no manifest, rendered, and by writeSnapshot time a
concurrent good refresh may have published — the empty writer then overwrote
it (and its delete-guard removed the good version's R2 blobs). Drop the
`&& current`: refuse to publish an all-empty (degraded) snapshot at all.
A cold cache stays cold so cold-misses live-render and self-heal when GitHub
recovers; the empty writer never reaches writeSnapshot, so it can't clobber a
concurrently-published good snapshot. (Healthy fetch always has Special Thanks,
so all-empty reliably means degraded.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

KV has no atomic compare-and-swap, so a ~ms read→put window in the manifest
publish can't be closed at the KV layer. Document why it's acceptable here
(overlap needs two refreshes within ms with changed data; self-heals next
refresh) and that a Durable Object / R2 ETag CAS would be disproportionate for
a daily-refreshed sponsor wall. Response to Codex PR review P2 (accepted).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>