Reconcile an authenticated assessment coverage ledger

Repair coverage.sql. Return exactly asset_id, owner, coverage_status, attempt_id, assessed_second, high_findings, with one row per inventory asset; repeated identical imported rows must not multiply the ledger. Preserve the inventory owner, including an unknown NULL owner. scope_state excluded means EXCLUDED; pending means AUTHORIZATION_PENDING. Both retain NULL attempt/time and zero findings, even if old scan records exist. Never silently remove an unassessed or excluded inventory asset. For approved assets, assessment evidence is eligible only when outcome='complete', authenticated=1 and inventory_collected=1. At the fixed observation second 1000, finished must be in the inclusive 700..1000 window. Select the newest eligible finished value; a later failed attempt does not erase an earlier still-current successful assessment. If times tie, select the lexicographically greatest attempt_id. Missing eligible evidence means NOT_ASSESSED, NULL attempt/time and zero findings; otherwise report ASSESSED with that actual attempt and finished time. Zero findings from failed credentials or missing inventory must not become an assessed result. high_findings counts distinct finding_id values only for that selected attempt AND that asset, with confirmed=1 and severity>=7. Imported duplicates, another asset's records and older scan findings must not inflate it. The threshold is this team's policy, not an exploitation verdict. A window-ranked eligible-attempt query or an equivalent correlated/anti-join selection is valid. Inspect actual inventory status, chosen attempt and finding counts; repair a newly visible stale or duplicate-evidence error without Reset.