Note that we now raise ValueError from doom() if not in a doomable state,
rather than asserting.

Note that we now raise ValueError if passed a non-positive count, rather
than asserting.

Note that we now raise ValueError if asked to free a foreign TXN, rather
than asserting.