fix: classify future-version ledgers with changed record shape correctly, not as corrupt

Version-check now runs on the parseLedger failure path too, so a v3 blob whose record shape actually changed reports FutureVersion instead of Unreadable, avoiding the corrupt-blob "clear it" advice. Also closes the six minor findings.

src/core/tracking/origin_ledger.cpp

@@ -141,6 +141,8 @@ bool parseRecordArray(json::Reader& r, OriginLedger& out) {
 
 // `versionOut` stays 0 when no "v" key was present — the legacy path-only shape, or
 // an empty object. Read regardless of key order, so it is validated after the close.
+// A duplicate "v" key (never emitted by serialize()) is last-wins, same as every
+// other duplicate key here — not reachable except by hand-editing the blob.
 bool parseLedger(json::Reader& r, OriginLedger& out, int& versionOut) {
     if (!r.consume('{')) return false;
     r.skipWs();
@@ -174,7 +176,14 @@ ParseOutcome parseStored(const std::string& text, OriginLedger& out) {
     OriginLedger parsed;
     int version = 0;
     ::reasampler::json::Reader r(text);
-    if (!parseLedger(r, parsed, version)) return ParseOutcome::Malformed;
+    if (!parseLedger(r, parsed, version)) {
+        // A future record shape (e.g. v3 retyping "kind" or "records") fails these v2
+        // parse rules on the very field the version bump changed. "v" is read before
+        // any record parsing in our own writer's key order, so `version` already holds
+        // it here: report FutureVersion, not Malformed, or the operator gets the
+        // corrupt-blob "clear it" advice against a newer build's ledger.
+        return version > kLedgerVersion ? ParseOutcome::FutureVersion : ParseOutcome::Malformed;
+    }
     // Trailing garbage means the blob is not what it claims; accepting it would turn
     // a detectably-corrupt value into a silently-partial ledger.
     r.skipWs();

src/shell/actions/prune_action.cpp

@@ -50,7 +50,9 @@ void doBankPruneFolder(ReaSamplerSession& session) {
                    "ReaSampler than this one, so its records cannot be read safely. It "
                    "has been left intact and will NOT be overwritten. Reopen the project "
                    "with that newer version -- do NOT clear this key from here, that "
-                   "would discard tracking records this build cannot see.\n";
+                   "would discard tracking records this build cannot see. The block is "
+                   "held for the rest of this session, and until then no new capture is "
+                   "persisted to the ledger either.\n";
         }
         if (!report.unreadableUsageKeys.empty()) {
             msg += "One or more instance usage records could not be read or decoded. "

src/shell/capture/realtime_lifecycle.cpp

@@ -11,6 +11,7 @@
 
 #define REAPERAPI_MINIMAL
 #define REAPERAPI_WANT_EnumProjects
+#define REAPERAPI_WANT_GetProjectName
 #define REAPERAPI_WANT_ShowConsoleMsg
 #include "reaper_plugin_functions.h"
 
@@ -64,21 +65,30 @@ void DriveRealtimeCapture(ReaSamplerSession& session)
         // folder, so it survives here untracked — deleting a user's just-recorded
         // audio is the destructive direction and is not this shell's call, so the
         // path is NAMED instead and the operator decides (docs/TODO.md).
-        if (r.status == RealtimeTickStatus::Done && r.result.status == CaptureStatus::Ok)
+        //
+        // RealtimeTickStatus::Done implies CaptureStatus::Ok (RealtimeRecordBackend::
+        // abort only sets Done on that path) — the Ok branch below is therefore the
+        // whole Done case; anything else is Failed and falls to the last branch.
+        if (r.status == RealtimeTickStatus::Done && r.result.status == CaptureStatus::Ok) {
+            // g_rtCaptureProject is still valid here (reset only below) — it names the
+            // ORIGINAL project, not whatever is active now, which is the whole point:
+            // the user has already switched away from it.
+            char nameBuf[512] = {0};
+            GetProjectName(g_rtCaptureProject, nameBuf, sizeof(nameBuf));
+            const std::string projName = nameBuf[0] ? nameBuf : "(unsaved project)";
             ShowConsoleMsg(("ReaSampler realtime capture: project switched mid-record -- "
-                            "captured audio restored into the original project; not "
-                            "persisted to avoid crossing projects. The recorded file was "
-                            "left in the original project's bank folder as '" +
+                            "captured audio restored into the original project (" +
+                            projName + "); not persisted to avoid crossing projects. The "
+                            "recorded file was left in that project's bank folder as '" +
                             r.result.sample.relativePath +
-                            "', untracked -- reopen that project and re-import it, or "
-                            "delete it by hand.\n").c_str());
-        else if (r.status == RealtimeTickStatus::Done)
-            ShowConsoleMsg(("ReaSampler realtime capture: project switched mid-record -- "
-                            "the capture was aborted and produced no usable file: " +
-                            r.result.message + "\n").c_str());
-        else
+                            "', untracked. Re-importing it there does NOT adopt this file "
+                            "-- it copies the audio in under a new name -- so after "
+                            "re-importing, delete this untracked original by hand.\n")
+                               .c_str());
+        } else {
             ShowConsoleMsg(("ReaSampler realtime capture: project changed mid-record -- " +
                             r.result.message + "\n").c_str());
+        }
         g_rtCapture.reset();
         g_rtCaptureProject = nullptr;
         return;

src/shell/persist/session.cpp

@@ -61,9 +61,11 @@ void ReaSamplerSession::recordCreated(const model::Sample& sample,
     const tracking::RecordResult result = tracking_.record(rec);
     // A rejection means a file exists that nothing attributes to us — invisible
     // otherwise, and exactly the gap this ledger exists to close. AlreadyPresent is
-    // the normal dedup outcome, not a gap.
-    if (result == tracking::RecordResult::RejectedEmptyPath ||
-        result == tracking::RecordResult::RejectedAbsolutePath) {
+    // the normal dedup outcome, not a gap. Written as "anything but the two OK
+    // outcomes" rather than a rejection whitelist, so a future RecordResult value
+    // is reported by default instead of silently passing through unrecognized.
+    if (result != tracking::RecordResult::Recorded &&
+        result != tracking::RecordResult::AlreadyPresent) {
         ShowConsoleMsg(("ReaSampler: could not record the origin of '" +
                         sample.relativePath +
                         "' -- the path is empty or absolute. The file is NOT tracked and "