tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/reclaim/CLAUDE.md

@@ -32,7 +32,7 @@ enumeration and the actual deletion live in `shell/persist` (`prune_fs`), not he
 
 ## Modules
 
-- `prune_reconcile` — pure prune core: `pruneOrphans(present, referenced, owned)` computes `(owned ∩ present) − referenced`; the safety-critical "which files are orphans" decision, filesystem-free and hard-tested before any I/O exists. `mergeReferenced(bankRefs, heldPaths)` unions live instance holds into the referenced-set. Two of the three inputs (`owned`, and the held half of `referenced`) come from `core/tracking`'s authority, never assembled ad hoc by a shell. `PruneReport` carries the authority's verdict: `blockedByTracking` + `ledgerUnreadable` / `unreadableUsageKeys`.
+- `prune_reconcile` — pure prune core: `pruneOrphans(present, referenced, owned)` computes `(owned ∩ present) − referenced`; the safety-critical "which files are orphans" decision, filesystem-free and hard-tested before any I/O exists. `mergeReferenced(bankRefs, heldPaths)` unions live instance holds into the referenced-set. Two of the three inputs (`owned`, and the held half of `referenced`) come from `core/tracking`'s authority, never assembled ad hoc by a shell. `PruneReport` carries the authority's verdict: `blockedByTracking` + `ledgerUnreadable` / `ledgerFutureVersion` / `unreadableUsageKeys`.
 
 ## Gotchas
 

src/core/reclaim/prune_reconcile.h

@@ -53,9 +53,11 @@ namespace reasampler::reclaim {
 //                   (count 0, empty list) and the prune must HALT — deleting with
 //                   degraded protection is the data-loss direction. Set by the scan
 //                   shell, never by buildPruneReport (which stays a pure tally).
-//   * ledgerUnreadable / unreadableUsageKeys — which side blocked, so the action can
-//                   tell the operator what to recover. The key names are the exact
-//                   "rsusage_<guid>" spellings.
+//   * ledgerUnreadable / ledgerFutureVersion / unreadableUsageKeys — which side
+//                   blocked, so the action can tell the operator what to recover. The
+//                   two ledger flags need opposite advice (a corrupt blob may be
+//                   cleared; a newer build's blob must not be). The key names are the
+//                   exact "rsusage_<guid>" spellings.
 struct PruneReport {
     std::size_t              count = 0;
     std::uint64_t            totalBytes = 0;
@@ -63,6 +65,7 @@ struct PruneReport {
     bool                     truncated = false;
     bool                     blockedByTracking = false;
     bool                     ledgerUnreadable = false;
+    bool                     ledgerFutureVersion = false;
     std::vector<std::string> unreadableUsageKeys;
 };