Parked
One service's entry of one parked aggregate, its id <service>:<subscription>:<aggregate> (Ledger.parkedId): the read model of the owning service's failure ledger, and where an operator acts on it.
Records: the owning service publishes the entry as it stands (RecordParked), again on every scan, and that it is resolved (RecordResolved). A record that says what the entry holds already changes nothing, so the scans leave the log as it is; a record of a parking at or before the latest one resolved (one a scan sent before the resolution, delivered after it), and one published before the record the entry holds, change nothing either.
Actions: Retry, Skip, MarkRecoverable and ApplyRetrySpec record the operator's request (RetryRequested, ...), which ParkedOperationSaga sends to the owning service; what came of it arrives as the service's next record, or, when the service refuses the request, as the saga's RecordActionRefused (ActionRefused). A resolved entry takes no action: there is nothing parked to act on.
An entry is a resource of its tenant (Ownership.TENANT): the ledger records it without an owner, and every operator of the tenant, a tenant-level caller, reads it; each action is authorized as the ledger's system command of its name. It has no lifecycle command: it mirrors the owning service's ledger, which alone resolves it.
Functions
Its count and durations are the command's input, checked at admission (ApplyRetrySpec's constraints).
The owning service refused the last request; a resolved entry has none to refuse.
Resolves the entry: the parking the resolution names (command.resolution.failedAt), or, undated, the one it holds. A resolution of a parking older than the one recorded, or of one resolved already, changes nothing; one of a later parking than the one resolved (its record never arrived, or not yet) is recorded, so that parking's late record changes nothing either.