tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/shell/persist/ext_state_io.cpp

@@ -161,11 +161,9 @@ bool ReaSamplerSession::saveToActiveProject() {
     SetProjExtState(static_cast<ReaProject*>(proj), projExtNamespace(),
                     kProjExtTailKey, tailJson.c_str());
 
-    // Written on every save so the ledger and the bank stay in lockstep on disk —
-    // EXCEPT over a blob we could not read: replacing it would destroy the only
-    // record of every file created before the corruption, silently turning them
-    // into permanently unreclaimable foreign files.
-    if (trackingStatus_ != tracking::LedgerStatus::Unreadable) {
+    // Never write over a blob this build could not read (see this directory's
+    // CLAUDE.md for why the suppression, not a rewrite, is the safe direction).
+    if (!tracking::ledgerDegraded(trackingStatus_)) {
         const std::string ledgerJson = tracking_.serialize();
         SetProjExtState(static_cast<ReaProject*>(proj), projExtNamespace(),
                         kProjExtOwnedKey, ledgerJson.c_str());
@@ -234,10 +232,8 @@ capture::TailSetting loadTailSetting(ReaProject* proj) {
     return *loaded;
 }
 
-// Absent/empty key -> Fresh (a new project, or a bank predating the ledger).
-// Malformed -> Unreadable, which halts the prune and suppresses the next write
-// rather than degrading to an empty ledger that looks like "nothing was ever
-// created".
+// Absent/empty key -> Fresh (a new project, or a bank predating the ledger). Anything
+// this build cannot read is a degraded status, never an empty ledger.
 tracking::LedgerLoad loadOriginLedger(ReaProject* proj) {
     if (!proj) return tracking::LedgerLoad{};
     tracking::LedgerLoad load = tracking::loadLedger(
@@ -246,6 +242,11 @@ tracking::LedgerLoad loadOriginLedger(ReaProject* proj) {
         ShowConsoleMsg("ReaSampler: the stored file-tracking ledger is malformed. Prune "
                        "is halted for this project and the stored value is left intact "
                        "for recovery.\n");
+    } else if (load.status == tracking::LedgerStatus::FutureVersion) {
+        ShowConsoleMsg("ReaSampler: the stored file-tracking ledger was written by a "
+                       "NEWER version of ReaSampler. Prune is halted for this project "
+                       "and the stored value will not be overwritten -- reopen the "
+                       "project with that version.\n");
     }
     return load;
 }