tracking: read the ledger's version, not just write it; clear owned on any block; channel-correct prune recovery

src/shell/persist/session.h

@@ -71,17 +71,20 @@ public:
     capture::TailSetting& tail() { return tail_; }
     const capture::TailSetting& tail() const { return tail_; }
 
-    // Birth records for the files the system itself created. Read as a PAIR —
-    // the ledger alone cannot say whether an absent record means never-recorded
-    // or unreadable, and the two demand opposite treatment. This is the reach
-    // any consumer outside persist uses to build a tracking::TrackingState.
-    const tracking::OriginLedger& tracking() const { return tracking_; }
-    tracking::LedgerStatus trackingStatus() const { return trackingStatus_; }
-
-    // Record a system-created file at the moment it exists — the ONLY way a
-    // birth record is written, so lineage can never be backfilled from a later
-    // guess. Lineage is read off the Sample's own provenance, the same act that
-    // stamped it, so the two cannot disagree. A repeat path is a no-op.
+    // Record a system-created file at the moment it exists — the ONLY way a birth
+    // record is written. Lineage is read off the Sample's own provenance, the same
+    // act that stamped it, so the two cannot disagree; where they later diverge the
+    // ledger record is authoritative (core/tracking/CLAUDE.md).
+    //
+    // Call it at EVERY creation site regardless of the bank's AddResult: a
+    // hash-collapse still wrote a file the tool owns, and an unrecorded file is a
+    // permanently unreclaimable foreign file. A rejected record is reported to the
+    // console — a file with no record is the gap this track exists to eliminate.
+    //
+    // A consumer outside persist that needs the ledger must take it WITH its
+    // LedgerStatus (a tracking::TrackingState); no accessor exposes one without the
+    // other, because an absent record and an unreadable ledger demand opposite
+    // treatment.
     void recordCreated(const model::Sample& sample, tracking::OriginKind kind);
 
     // The version that last wrote the active project: PreVersioning (no
@@ -153,9 +156,8 @@ private:
     ViewModeModel view_;             // reset to default on a project with no stored view_state
     capture::TailSetting tail_;      // reset to default (None / 2s) with no stored tail key
     tracking::OriginLedger tracking_;  // reset to empty/stored on EVERY load path, never inherited
-    // Unreadable is sticky for the project's session: it halts the prune AND
-    // suppresses the ledger write, so a corrupt blob survives for recovery
-    // instead of being silently replaced by a ledger missing every earlier file.
+    // Written only by loadFromProject, so a degraded status is sticky until the
+    // project is reloaded (see this directory's CLAUDE.md).
     tracking::LedgerStatus trackingStatus_ = tracking::LedgerStatus::Fresh;
     version::WritingVersion writingVersion_;  // recovered per load; PreVersioning default
     std::int64_t bankGeneration_ = 0;         // recovered per load (absent -> 0); monotonic