tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/wire/CLAUDE.md

@@ -57,8 +57,7 @@ This directory owns two cross-artifact contracts specifically:
     protected (identity-failure net — a matcher failure must never degrade toward
     delete). The guarantee: a capture held by any live instance can never be deleted; if
     the prune cannot determine with certainty which captures are held, it aborts
-    entirely (deletes nothing). Over-protection is the accepted residual; under-protection
-    is a data-loss bug. The fold reports `counted` — the live records still attributed to
+    entirely (deletes nothing). The fold reports `counted` — the live records still attributed to
     their `rsusage_*` keys — because the flattened path list cannot answer "who holds
     this"; `counted` is empty whenever `abortPrune` is set, since attribution is exactly
     what an unreadable record destroys.
@@ -70,14 +69,10 @@ This directory owns two cross-artifact contracts specifically:
     Resolution always leans over-protect: same-nonce + not-unioned → clean replace;
     same-track foreign nonce or unioned → union; cross-track foreign nonce → remint under
     a fresh key. None of the three directions can under-protect.
-  - **Deferred follow-up (TODO.md, deliberately NOT absorbed by the tracking
-    consolidation):** `ownerNonce` is not persisted, so after save→reopen an instance
-    cannot recognize its own prior-session usage record — it unions and marks the record
-    `unioned` forever, so prune stops reclaiming captures the instance once held but no
-    longer uses (safe, but the bank folder grows unbounded). This is a *completeness*
-    wart, not a safety one; every candidate fix examined so far trades it for a new
-    under-protection window, which the consolidation's own safety mandate forbids. See
-    `docs/TODO.md` for the constraint and the rejected session-epoch candidate.
+  - **Deferred follow-up:** `ownerNonce` is not persisted, so after save→reopen an
+    instance cannot recognize its own prior-session usage record and unions forever.
+    Reasoning, constraints, and the rejected candidates live in `docs/TODO.md`
+    ("Persist ReaSampler 9000 instance identity…").
 
 ## Modules
 

src/core/wire/sample_usage.h

@@ -17,11 +17,9 @@
 // per-instance key, never banks/view/tail/assign; the bridge's write entry
 // point structurally accepts only "rsusage_"-prefixed keys.
 //
-// THE SAFETY PROPERTY (overrides every other consideration): every failure,
-// ambiguity, or uncertainty here must fail-safe toward PROTECT. Over-protection
-// (prune skips a reclaimable file, or refuses to run) is an accepted residual;
-// under-protection (deleting a file an instance may still be playing) is a
-// data-loss bug. Three folds enforce this:
+// Every failure, ambiguity, or uncertainty here fails safe toward PROTECT (the
+// territory-wide asymmetry, stated in core/tracking/CLAUDE.md). Three folds enforce
+// it here:
 //   * sibling-collision -> UNION, never clean-replace over a foreign writer;
 //   * zero-identified   -> records exist but no instance was identified live ->
 //                          protect ALL records' paths (a matcher failure must