# Creation dates, and three guesses wearing a fact's clothes

_2026-09-23 · booth_

The operator asked for creation and update dates on booths. **Update** was
already there — `landed_at`, the newest mtime among CONTENT excluding our own
machinery. **Creation** had no honest source, and the interesting part is the
three wrong answers.

## Only 18 of 30 booths could state a creation time

`.booth.json` carries a declared `created`, but it exists only for booths posted
through the CLI since U5. Twelve live booths had nothing.

## ⚠ Every convenient substitute was a GUESS PRESENTED AS A FACT

- **Oldest content mtime** — wrong the moment an agent copies files with
  timestamps preserved (`cp -p`, `rsync -a`), which is common. It would report
  the SOURCE material's age as the booth's.
- **Directory mtime** — that is "last thing added", i.e. `landed_at` under a
  second name. Two fields, one meaning, displayed as if they were different.
- **Stamp a first-seen marker on read** — and this is the one worth flagging,
  because it is the same write-on-read shape that had *already* cost this
  service an hour that same day when the thumbnail cache aged the booth it
  cached ([[2026-09-23-the-cache-that-aged-the-thing-it-cached]]). A fix whose
  shape you just finished paying for is not a fix.

## The answer was a fact the disk already held

**ext4 records a real birth time.** CPython does not expose `st_birthtime` on
Linux, but `statx(2)` does and glibc has wrapped it since 2.28, so
`booth/birthtime.py` reads it through `ctypes`. Verified against `stat(1)` on
live booths: **6 of 6 exact**, including every booth with no manifest.

One rule for all thirty, which is what invariant 6 asks of anything statable in
a line. `None` when the filesystem cannot say (tmpfs, NFS, an old kernel), and
**None renders as nothing** — a blank is the honest output when nobody knows,
and better than a plausible number.

**The generalisable bit:** when a fact seems unavailable, check whether the
system already records it before reaching for a proxy. Three plausible proxies
were considered and one was nearly built; the real answer was a syscall away.