tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/wire/CLAUDE.md

@@ -57,8 +57,7 @@ This directory owns two cross-artifact contracts specifically:
     protected (identity-failure net — a matcher failure must never degrade toward
     delete). The guarantee: a capture held by any live instance can never be deleted; if
     the prune cannot determine with certainty which captures are held, it aborts
-    entirely (deletes nothing). Over-protection is the accepted residual; under-protection
-    is a data-loss bug. The fold reports `counted` — the live records still attributed to
+    entirely (deletes nothing). The fold reports `counted` — the live records still attributed to
     their `rsusage_*` keys — because the flattened path list cannot answer "who holds
     this"; `counted` is empty whenever `abortPrune` is set, since attribution is exactly
     what an unreadable record destroys.
@@ -70,14 +69,10 @@ This directory owns two cross-artifact contracts specifically:
     Resolution always leans over-protect: same-nonce + not-unioned → clean replace;
     same-track foreign nonce or unioned → union; cross-track foreign nonce → remint under
     a fresh key. None of the three directions can under-protect.
-  - **Deferred follow-up (TODO.md, deliberately NOT absorbed by the tracking
-    consolidation):** `ownerNonce` is not persisted, so after save→reopen an instance
-    cannot recognize its own prior-session usage record — it unions and marks the record
-    `unioned` forever, so prune stops reclaiming captures the instance once held but no
-    longer uses (safe, but the bank folder grows unbounded). This is a *completeness*
-    wart, not a safety one; every candidate fix examined so far trades it for a new
-    under-protection window, which the consolidation's own safety mandate forbids. See
-    `docs/TODO.md` for the constraint and the rejected session-epoch candidate.
+  - **Deferred follow-up:** `ownerNonce` is not persisted, so after save→reopen an
+    instance cannot recognize its own prior-session usage record and unions forever.
+    Reasoning, constraints, and the rejected candidates live in `docs/TODO.md`
+    ("Persist ReaSampler 9000 instance identity…").
 
 ## Modules