tracking: one ledger, one authority — prune protection and replace-vs-add answered from the same records, fail-safe on unreadable state

src/shell/capture/capture_orchestrator.h

@@ -2,7 +2,7 @@
 // Single-capture orchestration + the realtime/insert action bodies: renderOffline
 // (one offline render under the scope's FxBypassGuard, shared by single-shot/
 // batch/recapture), captureAndIndexOne (render + provenance + bank add +
-// owned-manifest record, unpersisted), RunCapture/RunCaptureItemAssign,
+// tracking-ledger record, unpersisted), RunCapture/RunCaptureItemAssign,
 // RunCaptureRealtimeTrack/RunCancelRealtime (in-flight state lives in
 // realtime_lifecycle), and RunInsertSelected — the one deliberate exception to
 // capture-never-places.
@@ -34,7 +34,7 @@ CaptureResult renderOffline(CaptureScope scope,
                             const CaptureRequest& req);
 
 // Renders one capture request, stamps provenance, adds the Sample to the
-// active bank + owned-file manifest — without persisting (batch persists once
+// active bank + tracking ledger — without persisting (batch persists once
 // at the end). res.sample.id carries the landed bank-index id (fresh add or
 // hash-dedup collapse target).
 CaptureResult captureAndIndexOne(ReaSamplerSession& session,