Second-opinion findings: a park whose fence refused (stale claim, terminal row) still counted in tidepool_outbound_parked — the one signal an operator sizes a held queue by — and the bounced claim's +1 is exactly the abandoned-claim leak, invisible precisely during a degraded-DB incident. park/parkCausal now settle through one countPark tail: applied parks count, bounced ones log at Warn and do not. Also: the release statements are built once at package init (no per-call Sprintf, no future %-in-SQL edge); models.go documents Attempts' refunded- counter semantics; FOLLOWUPS' abandoned-claim entry no longer calls a permanent budget cost "cosmetic" nor describes the counter backwards; two guard tests pin settleLater's deliberate Release (settle-holds stay charged) and the state-half of the fence via a poisoned row with a live token. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>