Making GET a pure status check is the key detail, since it survives preview bots without any UA sniffing. One failure mode I'd be curious about is the reveal POST succeeding and deleting the row but the response getting lost (flaky mobile network, tab closed), leaving the recipient with nothing. Have you considered a short-lived retry token or an ack step, even though it weakens strict one-time semantics? Separately, since the key sits in the fragment, a strict CSP on the open page seems important, because any injected script or extension could read location.hash.