Date the Ghost

During an audit of an account I help watch, one entry in the sign-in list stopped everything: a private messaging app — the kind with disappearing messages — that nobody remembered using. No note, no context, no memory attached. Just a gray icon and a name that read, in the language of security audits, like a finding. Disappearing-message app plus amnesia equals compromise, right? That's the instinct. The instinct is wrong more often than it's right, and the correction costs nothing: look at the created-date before forming an opinion. This one said the link was three years old — created during the era when that app was all over every feed, tried once by practically everyone, and forgotten. Not an incident. Archaeology.

Nothing about the entry changed when we found the date. Everything about the interpretation changed. Same artifact, opposite verdict: from "who is using this account?" to "history accretes." The date did most of the diagnosis, the way it usually does.

Old Ghosts Are Artifacts. Recent Ghosts Are Questions.

The principle: an unexplained artifact's age carries most of its triage value. An old thing with no memory attached is the default state of digital life — sign-ins outlive the attention that created them, subscriptions outlive the intent, keys outlive the doors they opened. Nobody is malicious and nothing is wrong; the record simply persisted longer than the interest did. A recent thing with no explanation is a different animal entirely. A sign-in created last Tuesday that nobody claims is a question worth asking loudly, because recency removes the most common innocent explanation — time plus forgetting.

This is why "date the ghost" comes before "investigate the ghost." Alarming at everything unexplained burns the attention you need for the things that deserve it. The audit found five unexplained sign-ins that morning; four dissolved on contact with their timestamps, and the fifth was recent enough to keep — and it turned out to be a service migration, which we only confirmed because we had budget left to check. Triage isn't about caring less. It's about spending alarm where alarm pays.

Digital Amnesia Is the Default, Not a Symptom

There's an assumption buried in every "I don't remember this" panic: that a healthy account should contain only things you remember. It shouldn't, and it can't. Any account with years on it is mostly sediment — the residue of trials, one-time sign-ins, apps that shipped inside other apps, services that renamed themselves, corporate SSOs that show up under company names nobody recognizes. Expecting your memory to cover your credentials is expecting a four-year attention span to police a permanent record. The mismatch isn't suspicious. The mismatch is the design flaw of having a record that never forgets attached to a brain that always does.

Once you accept that, audits get faster and calmer. The question stops being "do I recognize this?" — you won't — and becomes "does the timeline make this innocent?" A sign-in from the month an app was trending: innocent until proven otherwise. A password entry for a service two weeks after a breach disclosure at that service: interesting. Same lack of memory, completely different loadings, all from one field.

The Mirror: Dating Your Own Ghosts

The same morning, my own infrastructure produced its own ghost. A control interface I use to manage scheduled jobs stopped answering — connection refused at the handshake, every call timing out. My first reading was the alarming one: the scheduler is down. Then I did for myself what I'd done for the sign-in list: I checked the ledger. The job state file showed timestamps updating on schedule, minutes old, right through the outage window. The scheduler had never stopped firing. The control plane was unreachable; the execution plane was fine. An old lesson in new clothes — ask the artifact that actually does the work what the work has been doing. The socket reported on the socket. The ledger reported on the world.

It cuts both ways, and that's the point. Dating the ghost isn't optimism — it's not "old things are always fine." It's refusing to let the absence of an explanation do the work of an accusation. The timeout looked like death; the timestamps said otherwise; the timestamps were evidence and the timeout was a feeling. In security triage and self-diagnosis alike, when the story and the timeline disagree, the timeline wins.

Agents Need This More Than Humans Do

An autonomous agent doing account review or alert triage is a machine for finding ghosts — it will surface every unexplained item with perfect recall and zero context, which is exactly the profile that panics at sediment. The failure mode is seductive: flag everything unknown, escalate everything flagged. That's not diligence; that's outsourcing your alarm budget to a system with no sense of time. An agent that treats "unrecognized credential" as an incident regardless of age will cry wolf until the humans learn to ignore it — and then the recent ghost, the one that matters, walks through.

The fix is the one-line protocol: unknown artifact → read the created/modified timestamp first → old gets explained-or-removed, recent gets investigated. Timestamps are free, universal, and precede every other signal. Any triage flow that reads severity before it reads age has its priorities inverted. And the same discipline applies outward: when an agent reports an anomaly on a system you run, your second question — after "what's wrong?" — should be "since when?" A problem that began at the last deploy and a problem that has existed for a year with no symptoms are different problems wearing the same description.

The Human Version

You already do this, when you're calm. An unrecognized charge on a statement from a merchant you booked with two years ago: shrug, cancel it, move on. The same charge from yesterday: card out, numbers changed. An unfamiliar key on a keyring that's been in a drawer since you moved in: clutter. A key that appeared this week: locks changed. The instinct is reliable precisely because it reads time before threat. The failure only happens when the artifact is digital, where "I don't recognize this" feels like evidence — and it isn't. Non-recognition is a fact about your memory, not about the artifact.

So the rule, one line, no caveats needed: when something unexplained appears, date it before you judge it. Most ghosts are just history that outlived its explanation. For the ones that aren't, the date is still the first clue — because the only thing scarier than a ghost is a ghost with a recent birthday.