tracking: one ledger, one authority — prune protection and replace-vs-add answered from the same records, fail-safe on unreadable state

src/shell/capture/capture_orchestrator.cpp

@@ -188,7 +188,7 @@ CaptureResult renderOffline(CaptureScope scope,
 
 // Renders ONE capture request under the scope's FX-bypass guard, stamps provenance,
 // and adds the resulting Sample to the ACTIVE bank + records the created file in the
-// owned-file manifest — WITHOUT persisting. The caller persists once (single-capture:
+// tracking ledger — WITHOUT persisting. The caller persists once (single-capture:
 // right after; batch: once at the end) so a batch does not write ext state N times.
 //
 // Provenance is read from the LIVE selection here, so a batch that transiently
@@ -250,11 +250,10 @@ CaptureResult captureAndIndexOne(ReaSamplerSession& session,
     // AddResult tells a fresh add from a hash-dedup collapse, so the assign path (S8) can
     // target the sample actually in the bank (the existing entry on a collapse).
     const model::AddResult addResult = session.bank().add(res.sample);
-    // B-cap: record the created file in the owned-file manifest, at the same point the
-    // Sample is added. Recorded regardless of the index AddResult — even a hash-collapse
-    // still WROTE a file the tool owns, and the manifest dedups a repeat path itself
-    // (Phase R prune reconciles manifest vs index later).
-    session.owned().add(res.sample.relativePath);
+    // Record the birth at the same point the Sample is added, regardless of the index
+    // AddResult — even a hash-collapse still WROTE a file the tool owns, and the ledger
+    // dedups a repeat path itself (prune reconciles ledger vs index later).
+    session.recordCreated(res.sample, tracking::OriginKind::Capture);
 
     // Resolve the LANDED bank-index id into res.sample.id for the S8 assign path: the new
     // id on a fresh Added (already in res.sample.id); the EXISTING entry's id on a
@@ -297,8 +296,8 @@ std::string RunCapture(ReaSamplerSession& session, const CaptureActionDef& def)
     }
 
     // captureAndIndexOne has already stamped provenance, added the Sample to the ACTIVE
-    // bank, and recorded the created file in the owned-file manifest (WITHOUT persisting).
-    // Persist the updated book AND manifest into the active project's ext state (the
+    // bank, and recorded the created file in the tracking ledger (WITHOUT persisting).
+    // Persist the updated book AND ledger into the active project's ext state (the
     // `banks` + `owned_files` keys) so the capture survives Save / close+reopen (M4) and
     // travels with the .rpp. saveToActiveProject also clears the retired legacy key and
     // calls MarkProjectDirty. Non-destructive: writes only our own ext-state keys.