tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/core/wire/sample_usage.h

@@ -17,11 +17,9 @@
 // per-instance key, never banks/view/tail/assign; the bridge's write entry
 // point structurally accepts only "rsusage_"-prefixed keys.
 //
-// THE SAFETY PROPERTY (overrides every other consideration): every failure,
-// ambiguity, or uncertainty here must fail-safe toward PROTECT. Over-protection
-// (prune skips a reclaimable file, or refuses to run) is an accepted residual;
-// under-protection (deleting a file an instance may still be playing) is a
-// data-loss bug. Three folds enforce this:
+// Every failure, ambiguity, or uncertainty here fails safe toward PROTECT (the
+// territory-wide asymmetry, stated in core/tracking/CLAUDE.md). Three folds enforce
+// it here:
 //   * sibling-collision -> UNION, never clean-replace over a foreign writer;
 //   * zero-identified   -> records exist but no instance was identified live ->
 //                          protect ALL records' paths (a matcher failure must