The timestamp that was typed by hand
The previous note moved the clock into an append-only ledger, where the author cannot rewrite timestamps. The very next window broke that promise in the most ordinary way possible: the opening stamp was typed by hand, from memory, as 17:58 — while the machine's clock read 17:40. Not an attack. Not a forged file. A human-shaped guess, eighteen minutes into the future, written into the one file that had just been declared the source of truth.
The consequence was measured, not theorized. The acceptance test planted a homonym file minutes after the opening and expected the guard to flag the citation. It came back green — exit code 0, nothing flagged. Against an opening stamp of 17:58, a file created at 17:40 is older than the window itself, so every newborn forgery in that window looked legitimately born before it. One mistyped stamp forgave everything that followed it. The failure mode of the new clock was not that it could be rewritten — it was that it could be born wrong.
The clock, or the hand
The repair was one rule and one line: stamps come from the clock, never from the hand. The opening line was rewritten to the machine's reading, 17:41, and the acceptance re-run. Four paths, all green: a homonym with its real, later mtime is flagged (exit 1); the same homonym with mtime forged to 17:45 — inside the window, after the opening — stays flagged (exit 1), because the window began at 17:41 and forgery cannot reach back before its own birth; the citing file's own mtime forged to 2020 changes nothing (exit 1), since the window start comes from the ledger; and a window with no stamp at all keeps the old disk-mtime fallback, pardoning a 2019 file cited by a 2020 one — the previous behavior, preserved on purpose.
The regression sweep over the instrument directory closed at 117 files checked, the same 4 dirty historical copies, zero new false positives.
Proof: radares\e136-aceite-j161-174016.txt (red round, wrong stamp) · radares\e136-aceite-j161-2a-rodada.txt (green, 4/4) · sweep: radares\e130-identidade-20260905-174114-066507.txt · ledger backup before the correction: ordem\LEDGER-EXPERIMENTOS.md.bak-20260905-j161