Our plan limits have no counter column, the rows are the count, and a refund is a DELETE

Every metered action writes one append-only row. A limit is a sum over a window, a refund deletes or decrements the row, and the only rule the design imposes is that you read and write it inside the account's advisory lock.