tracking: one ledger, one authority — prune protection and replace-vs-add answered from the same records, fail-safe on unreadable state

src/shell/capture/CLAUDE.md

@@ -36,7 +36,7 @@ detail not covered there:
 
 - `capture` — two CONCRETE backends with deliberately different lifecycles (no shared interface — the former `ICaptureBackend` was deleted in Q-W3, T4-26: one deriver, zero polymorphic call sites): `OfflineRenderBackend` (deterministic default, synchronous) and `RealtimeRecordBackend` (async begin/tick/abort). Input: `CaptureRequest`. Output: finished file + populated `Sample` handed to `bank_model`.
 - `scope_resolve` (`shell/capture`) — scope/source resolution shared by every capture entry point (Q-W3 hoist out of `main.cpp`): razor-else-time range inference, selected-track/selected-item-owning-track collection with canonical GUIDs, and the M10 provenance-assembly inputs (read BEFORE the FX-bypass guard neutralizes the in-scope chain).
-- `capture_orchestrator` (`shell/capture`) — single-capture orchestration + the realtime/insert action bodies (Q-W3 hoist, T4-02): `renderOffline` (one offline render under the scope's FX-bypass guard), `captureAndIndexOne` (render + provenance stamp + bank add + owned-manifest record, unpersisted), `RunCapture`/`RunCaptureItemAssign`, `RunCaptureRealtimeTrack`/`RunCancelRealtime` (the realtime action bodies — the in-flight state lives in `realtime_lifecycle`), and `RunInsertSelected` (the ONE deliberate exception to capture-never-places).
+- `capture_orchestrator` (`shell/capture`) — single-capture orchestration + the realtime/insert action bodies (Q-W3 hoist, T4-02): `renderOffline` (one offline render under the scope's FX-bypass guard), `captureAndIndexOne` (render + provenance stamp + bank add + tracking-ledger record, unpersisted), `RunCapture`/`RunCaptureItemAssign`, `RunCaptureRealtimeTrack`/`RunCancelRealtime` (the realtime action bodies — the in-flight state lives in `realtime_lifecycle`), and `RunInsertSelected` (the ONE deliberate exception to capture-never-places).
 - `capture_batch` (`shell/capture`) — the batch-capture family + re-capture-from-source (Q-W3 hoist, T4-02): `RunBatchCaptureItems` (one sample per selected item), `RunBatchCaptureRazor` (one sample per razor area), `RunRecaptureFromSource` (regenerate a provenanced sample from its recorded source's current state, bank-only). Every unit routes through `capture_orchestrator` so every precision invariant holds; persist is batched to one ext-state write per action.
 - `realtime_lifecycle` (`shell/capture`) — the in-flight realtime-capture state machine + globals (Q-W3 hoist): the action starts it, `OnTimer` drives it per tick via `DriveRealtimeCapture` (a single-pointer-test idle fast path — load-bearing hot-path guardrail), `CommitRealtimeResult` lands a finished capture in the bank, `AbortRealtimeCaptureForUnload` tears down cleanly on extension unload.
 - `capture_realtime_shell` (`shell/capture`) — the async realtime-record backend surface (Q-W6 split of the former fat `capture.h`): `RealtimeRecordBackend::begin`/`tick`/`abort`, transport-driven across timer ticks (a realtime record cannot block REAPER's UI for its own duration). Deliberately shares NO interface with the offline backend — the lifecycles genuinely differ (the former `ICaptureBackend` interface was deleted in Q-W3, T4-26).

src/shell/capture/capture_batch.cpp

@@ -458,14 +458,15 @@ void RunRecaptureFromSource(ReaSamplerSession& session)
     const bool changed = session.book().updateSampleInPlace(sampleId, updated);
     if (changed)
     {
-        // Record the regenerated file in the owned manifest; the superseded file
-        // becomes an orphan for prune to reclaim.
-        session.owned().add(updated.relativePath);
+        // Record the regenerated file's birth; the superseded file becomes an orphan
+        // for prune to reclaim. A re-capture onto the same path is a dedup no-op, so
+        // the original birth record — not this one — stays authoritative.
+        session.recordCreated(updated, tracking::OriginKind::Recapture);
         // Regenerating the same id's audio is exactly why instances need the generation
         // bump — they'd otherwise keep playing stale audio until reload. Bumped inside
         // the undo block so undo rolls back the generation with the rest of the blob.
         session.bumpBankGeneration();
-        const bool persisted = session.saveToActiveProject();  // book + manifest + generation + MarkProjectDirty
+        const bool persisted = session.saveToActiveProject();  // book + ledger + generation + MarkProjectDirty
         Undo_EndBlock2(nullptr, persisted ? "ReaSampler: re-capture from source" : "",
                        persisted ? UNDO_STATE_MISCCFG : 0);
     }

src/shell/capture/capture_orchestrator.cpp

@@ -188,7 +188,7 @@ CaptureResult renderOffline(CaptureScope scope,
 
 // Renders ONE capture request under the scope's FX-bypass guard, stamps provenance,
 // and adds the resulting Sample to the ACTIVE bank + records the created file in the
-// owned-file manifest — WITHOUT persisting. The caller persists once (single-capture:
+// tracking ledger — WITHOUT persisting. The caller persists once (single-capture:
 // right after; batch: once at the end) so a batch does not write ext state N times.
 //
 // Provenance is read from the LIVE selection here, so a batch that transiently
@@ -250,11 +250,10 @@ CaptureResult captureAndIndexOne(ReaSamplerSession& session,
     // AddResult tells a fresh add from a hash-dedup collapse, so the assign path (S8) can
     // target the sample actually in the bank (the existing entry on a collapse).
     const model::AddResult addResult = session.bank().add(res.sample);
-    // B-cap: record the created file in the owned-file manifest, at the same point the
-    // Sample is added. Recorded regardless of the index AddResult — even a hash-collapse
-    // still WROTE a file the tool owns, and the manifest dedups a repeat path itself
-    // (Phase R prune reconciles manifest vs index later).
-    session.owned().add(res.sample.relativePath);
+    // Record the birth at the same point the Sample is added, regardless of the index
+    // AddResult — even a hash-collapse still WROTE a file the tool owns, and the ledger
+    // dedups a repeat path itself (prune reconciles ledger vs index later).
+    session.recordCreated(res.sample, tracking::OriginKind::Capture);
 
     // Resolve the LANDED bank-index id into res.sample.id for the S8 assign path: the new
     // id on a fresh Added (already in res.sample.id); the EXISTING entry's id on a
@@ -297,8 +296,8 @@ std::string RunCapture(ReaSamplerSession& session, const CaptureActionDef& def)
     }
 
     // captureAndIndexOne has already stamped provenance, added the Sample to the ACTIVE
-    // bank, and recorded the created file in the owned-file manifest (WITHOUT persisting).
-    // Persist the updated book AND manifest into the active project's ext state (the
+    // bank, and recorded the created file in the tracking ledger (WITHOUT persisting).
+    // Persist the updated book AND ledger into the active project's ext state (the
     // `banks` + `owned_files` keys) so the capture survives Save / close+reopen (M4) and
     // travels with the .rpp. saveToActiveProject also clears the retired legacy key and
     // calls MarkProjectDirty. Non-destructive: writes only our own ext-state keys.

src/shell/capture/capture_orchestrator.h

@@ -2,7 +2,7 @@
 // Single-capture orchestration + the realtime/insert action bodies: renderOffline
 // (one offline render under the scope's FxBypassGuard, shared by single-shot/
 // batch/recapture), captureAndIndexOne (render + provenance + bank add +
-// owned-manifest record, unpersisted), RunCapture/RunCaptureItemAssign,
+// tracking-ledger record, unpersisted), RunCapture/RunCaptureItemAssign,
 // RunCaptureRealtimeTrack/RunCancelRealtime (in-flight state lives in
 // realtime_lifecycle), and RunInsertSelected — the one deliberate exception to
 // capture-never-places.
@@ -34,7 +34,7 @@ CaptureResult renderOffline(CaptureScope scope,
                             const CaptureRequest& req);
 
 // Renders one capture request, stamps provenance, adds the Sample to the
-// active bank + owned-file manifest — without persisting (batch persists once
+// active bank + tracking ledger — without persisting (batch persists once
 // at the end). res.sample.id carries the landed bank-index id (fresh add or
 // hash-dedup collapse target).
 CaptureResult captureAndIndexOne(ReaSamplerSession& session,

src/shell/capture/realtime_lifecycle.cpp

@@ -31,14 +31,13 @@ void CommitRealtimeResult(ReaSamplerSession& session, const CaptureResult& res)
         return;
     }
     session.bank().add(res.sample);
-    // Record the file in the owned manifest regardless of the index AddResult — even
-    // a hash-collapse still wrote a file the tool owns; the manifest dedups a repeat
-    // path itself (prune reconciles manifest vs index).
-    session.owned().add(res.sample.relativePath);
+    // Record the birth regardless of the index AddResult — even a hash-collapse still
+    // wrote a file the tool owns; the ledger dedups a repeat path itself.
+    session.recordCreated(res.sample, tracking::OriginKind::Capture);
     // A capture add changes what a live instance could play, so bump the generation
     // before persisting to refresh instances.
     session.bumpBankGeneration();
-    session.saveToActiveProject();  // persist book + manifest + generation + MarkProjectDirty
+    session.saveToActiveProject();  // persist book + ledger + generation + MarkProjectDirty
 }
 
 // Advances any in-flight realtime capture one tick. Detects a project switch