tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/shell/persist/CLAUDE.md

@@ -34,17 +34,20 @@ REAPER/filesystem-facing half only, and it gathers rather than decides.
   record/input chains, containers recursively, take FX), and folds via the pure
   `sample_usage::foldUsageRecords`. Read-only at prune-scan time: `usage_scan` writes
   no ext-state.
-- **A malformed tracking ledger is Unreadable, never "empty".** `ext_state_io` keeps
+- **A ledger this build cannot read is degraded, never "empty".** `ext_state_io` keeps
   the `LedgerStatus` alongside the ledger, and `saveToActiveProject` SKIPS the
-  `owned_files` write while it is `Unreadable` — replacing a corrupt blob would
-  destroy the only record of every file created before the corruption, silently
-  turning them into permanently unreclaimable foreign files. Captures made during
-  such a session are recorded in memory but not persisted; they degrade to foreign
-  (untouchable), which is the safe direction.
+  `owned_files` write while `tracking::ledgerDegraded` holds — replacing a blob we
+  could not read would destroy the only record of every file created before it,
+  silently turning them into permanently unreclaimable foreign files. The status is
+  written only by `loadFromProject`, so it is sticky until the project is reloaded:
+  captures made during such a session are recorded in memory but not persisted, and
+  degrade to foreign (untouchable), which is the safe direction.
 - **`PruneReport` carries `blockedByTracking` + `ledgerUnreadable` /
-  `unreadableUsageKeys`**; dry-run, orphan-set, and reclaim each independently abort
-  (delete nothing) on a block. `BANK_PRUNE_FOLDER` (in `shell/actions`) halts on the
-  flag and prints whichever blockers fired.
+  `ledgerFutureVersion` / `unreadableUsageKeys`**; dry-run, orphan-set, and reclaim
+  each independently abort (delete nothing) on a block. `BANK_PRUNE_FOLDER` (in
+  `shell/actions`) halts on the flag and prints whichever blockers fired, with
+  channel-correct recovery lines — a corrupt blob may be cleared, a newer build's
+  must not be.
 
 ## Modules