Function integration_ledger 

pub fn integration_ledger(target: &Utf8Path, trunk: &str) -> Ledger

The clone’s local integration ledger, keeping only the entries the trunk actually carries.

Both prune verbs read this, so the read has one owner beside the deletion discipline they already share. A clone that never integrated locally, a git that cannot answer, and a ledger this binary cannot parse all read as empty here: an empty ledger authorizes no deletion, which is the safe direction, and rk integrate is what refuses on an unreadable ledger, where refusing costs nothing.

An entry whose commit the trunk does not reach is dropped. Evidence is staged before its publication, so an integration whose publication failed leaves an entry naming a commit no ref carries, and an entry can also outlive a trunk someone reset. Reading reachability here is what makes that residue inert: the proof is the trunk carrying the work, never the ledger saying so.