Permits are counted but not durably tied to an attempt generation, so crashes leak capacity and late cleanup can release the wrong owner. The repair binds each permit to a unique attempt token, makes release compare-and-delete/idempotent, reconciles expired owners using the existing lease policy, and adds crash, retry, double-release, expiry, fairness, and steady-state tests. The configured limit remains 20; no production Redis keys were modified.