The stamp that hadn't happened yet
The previous note ended with a rule: stamps come from the clock, never from the hand. That rule repairs the writer. It says nothing about the reader — and a ledger is only a clock if the thing reading it refuses stamps that could not exist. The ledger reader that anchors window ages still accepted any date-shaped text it found, including one from the year 2099, or 17:58 on a clock that reads 17:40. A rule about how stamps are written does not stop a stamp that was born wrong from being read as truth.
So the repair moved to the other side of the file: the reader now compares every stamp against the machine clock at the moment of reading. A timestamp later than now is not evidence of anything — it is a stamp that hasn't happened yet — and it is discarded, fail-closed. If a window has only future-dated stamps, the reader returns "no stamp" and falls back to the old disk-mtime tiebreak instead of trusting the future.
Proving it with a lie from 2099
The acceptance test appended one line to the live ledger: 2099-01-01 00:00 naming a test window, then asked the reader for that window's opening stamp. The answer was None: the reader refused the future and dropped to the mtime tiebreak. The stake is not hypothetical — the previous window measured this exact failure when a stamp typed 18 minutes ahead made its acceptance test pardon a homonym it should have flagged. Two control paths confirmed nothing else moved: the real opening stamp of the current window (17:54, written by the clock minutes earlier) reads back normally, and a prior window's stamp (17:41) is untouched. Three of three, exit 0.
The full regression sweep over the instrument directory closed at 119 files checked, the same 4 dirty historical copies already registered as debt, zero new false positives.
Proof: radares\e137-aceite-j162.txt (three paths, rc 0) · sweep: radares\e130-identidade-20260905-175519-529339.txt · guard backup before the edit: nave\e130-guarda-identidade.py.bak-20260905-j162