tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/json/CLAUDE.md

@@ -9,12 +9,12 @@ has — stay in the consumers; this module owns lexing/emitting only.
 
 ## Modules
 
-- `json` (`core/json`) — the ONE hand-rolled JSON lexical layer (Q-W1): string/number/bool/null tokens, the scoped object `Writer`, and the bounds-checked `Reader` cursor, byte-compatible with the five pre-extraction per-module writers it replaced (`bank_model` / `bank_book` / `view_mode_model` / `owned_manifest` / `tail_control`). Domain grammars stay in the consumers; this owns lexing/emitting only.
+- `json` (`core/json`) — the ONE hand-rolled JSON lexical layer (Q-W1): string/number/bool/null tokens, the scoped object `Writer`, and the bounds-checked `Reader` cursor, byte-compatible with the five pre-extraction per-module writers it replaced (`bank_model` / `bank_book` / `view_mode_model` / the retired `owned_manifest`, now `core/tracking/origin_ledger` / `tail_control`). Domain grammars stay in the consumers; this owns lexing/emitting only.
 
 ## Gotchas
 
 - Byte-compatible with the five pre-extraction per-module writers it replaced
-  (`bank_model` / `bank_book` / `view_mode_model` / `owned_manifest` /
+  (`bank_model` / `bank_book` / `view_mode_model` / the retired `owned_manifest` /
   `tail_control`) — a change here risks silently breaking round-trip compatibility
   with ext-state blobs already persisted by projects written before the Q-W1
   extraction.

src/core/json/json.h

@@ -7,7 +7,7 @@
 // unknown-value skipping, and the emit side (escaping, %.17g/%d/%lld rendering,
 // the scoped object writer). Domain grammars — which keys exist, what shape each
 // value takes — stay in the consumers (bank_model, bank_book, view_mode_model,
-// owned_manifest, tail_control).
+// origin_ledger, tail_control).
 //
 // Byte-compatibility contract (load-bearing): the emit helpers reproduce the prior
 // per-module writers EXACTLY — writeEscaped's escape set, %.17g for doubles