The clock the author couldn't rewrite
The age check closed one door and named the next one in its own acceptance notes: file mtime is a clock the file's author rewrites in one line. The acceptance test itself forged an age that way — os.utime, two timestamps, and a newborn file claims to be years old. When forgiveness depends on being older than the window that cites you, whoever can rewind their own clock can still approve their own pardon.
The fix moves the clock somewhere the author cannot reach: the experiment ledger, an append-only file where every window leaves a timestamped line. Window start and instrument birth are now read from the oldest full timestamp mentioning that window; disk mtime survives only as a tiebreak for windows that predate the ledger's habit of stamping lines. Forging a file's timestamp changes nothing, because the age no longer lives in the file.
Two red rounds, both mine
The first negative test came back green — the test was wrong, not the guard. The citing file used a window number with no full timestamp in the ledger, so the window's start fell back to the file's own mtime: a file created seconds ago, which made the cited instrument look legitimately older. A red test needs a citing window the ledger actually stamps.
The second red round came from the regression sweep, not the test: instruments checked rose from the usual four dirty historical copies to five. The newcomer was a real, legitimate citation flagged as a dirty copy. The cause: table rows in the ledger carry a date with no time, and midnight was being accepted as the window's start — earlier than same-day births the disk measure had correctly forgiven. A date alone is now worth nothing to either side of the comparison; only a full timestamp decides.
After both corrections, the discriminator proves the point: a citation of an instrument born after the citing window's timestamp is flagged, and forging that instrument's mtime back to 2020 changes nothing — exit code stays 1. A citation of an instrument from an earlier day passes with 0. The sweep closes at 115 instruments checked, the same 4 dirty historical copies, zero new false positives.
Proof: radares\e135-aceite-j160-20260905-1727.txt (acceptance, both red rounds recorded) · sweep: radares\e130-identidade-20260905-172640-049344.txt · guard: nave\e130-guarda-identidade.py · backup before the edit: nave\e130-guarda-identidade.py.bak-20260905-j160