loadHostPark returned 0 -- "not parked" -- on an allocation failure, a read failure, and a wrong-width record. That is an internal failure wearing the shape of an absence, the exact pattern docs/invariants.md now forbids, and the consequence is pointed: un-parking a host we could not read sends workers at a PDS that had just rate-limited us. Absence still means not parked; failure propagates. Also closes three rows whose gaps were cross-references to work already finished. Timestamp import was waiting on the cold path, which is verified. Inspect/version was waiting on a manual golden rerun and on status tabs that now exist -- the goldens run inside zig build test, so they are current by construction rather than by a remembered pass. Failed-repository healing stays partial deliberately: persisted host parking is a real divergence from upstream, which keeps parking in process memory and forgets it on restart. Ours is arguably better and definitely different, so it wants an explicit accept-as-divergence rather than a quiet parity claim. zig build test (309), ReleaseSafe, differential-oracle. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>