Lock adversarial lineage and window goldens

[iam-brain]

Question

Add a sanitized adversarial corpus and scanner-level goldens that lock lineage, requested-window, and degraded-evidence behavior before production promotion.

Required families

• Long-lived parent outside the normal lookback with included descendants.
• Parent spanning multiple UTC days and random child or sibling date inclusion.
• Out-of-window observations used as lineage context but excluded from accounting totals.
• Missing parent that later becomes available, plus truncated parent or child.
• Conflicting filename and metadata identities, ancestry cycles, and the same UUID in separate simulated Codex homes.
• Identical complete token states in unrelated families.
• Missing last_token_usage, missing cumulative totals, and total-only events.
• Active-to-archive movement without recounting.
• Cancellation during discovery and reconciliation.

Locked semantics

Discovery and accounting windows are separate. Referenced ancestors may be loaded outside the requested range, but only the canonical earliest local occurrence inside the accounting interval contributes. Incomplete ancestry keeps deterministic descendant usage, lowers provenance quality, and never shifts observations into the window to improve parity. Malformed or irrecoverable families may use explicit family-level containment; ordinary and known fork goldens must use primary ledger accounting.