A priced side-operation delta pending checkpoint persistence.
Use exactly once: every prepare must be either committed (its update
persisted) or rolled back. _drain_recorded_costs is destructive, so a
prepare that is neither deletes that spend from the thread's lifetime total
permanently, and nothing can detect the loss afterwards.
_settled is init=False so a caller cannot construct a pre-neutralized
instance whose rollback is already a no-op. The class stays unfrozen only
because marking settlement on a frozen dataclass needs
object.__setattr__, which this project's lint rules reject.
