tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/util/CLAUDE.md

@@ -3,12 +3,13 @@
 ## Scope
 
 Tiny, dependency-free pure helpers linked by both artifacts: whole-file byte
-loading and unit-interval clamping.
+loading, unit-interval clamping, and the absolute-path rejection test.
 
 ## Modules
 
 - `file_bytes` (`core/util`) — the ONE whole-file byte loader (Q-W1), linked by both artifacts; blocking I/O, off-audio-thread only.
 - `clamp01` (`core/util`, header-only) — the ONE unit-interval clamp (Q-W1), replacing four per-module static copies; NaN passes through unchanged rather than collapsing to a bound.
+- `relative_path` (`core/util`, header-only) — the ONE absolute-path rejection test behind the relative-paths-only invariant, shared by `bank_model` (`Sample.relativePath`) and `core/tracking/origin_ledger` (`OriginRecord.relativePath`). The two must reject identically or a path one accepts could be smuggled past the other; that is why it is one function and not two.
 
 ## Gotchas
 

src/core/util/relative_path.h

@@ -0,0 +1,26 @@
+#pragma once
+// relative_path — the ONE absolute-path rejection test behind the
+// relative-paths-only invariant, shared by every persisted path family
+// (Sample.relativePath, OriginRecord.relativePath).
+//
+// Rejects rather than normalizes: the pure core has no knowledge of the project
+// root, so any "normalization" would be a guess that could point at the wrong file.
+
+#include <cctype>
+#include <string>
+
+namespace reasampler::util {
+
+// True for POSIX root ("/x"), UNC ("\\host\share"), and any leading <alpha>: —
+// including drive-RELATIVE forms ("C:foo.wav"), which resolve against the drive's
+// current directory rather than the project root and so violate the invariant just
+// as much as "C:\foo.wav" does.
+inline bool isAbsolutePath(const std::string& p) {
+    if (p.empty()) return false;
+    if (p[0] == '/' || p[0] == '\\') return true;
+    if (p.size() >= 2 && std::isalpha(static_cast<unsigned char>(p[0])) && p[1] == ':')
+        return true;
+    return false;
+}
+
+}  // namespace reasampler::util