# Topic 08 — Created After eFile

This topic isolates and quantifies a specific metadata anomaly:

> **`metadata.derived_create_newer_by_days > 0`**  
> meaning the document’s **XMP create date** is later than the **Odyssey e-file date**.

This is notable because many documents in this cohort can still carry the Minnesota Judicial Branch’s
official **“Minnesota Court Records Online (MCRO) Watermark”** signature and show as cryptographically valid.

## Why this matters

If the system’s *official filing date* is earlier than the document’s *create date*, there is a concrete
timestamp ordering problem that must be explained. This can arise from legitimate workflows
(reprocessing, re-rendering, migrating, OCR/normalization) **or** from improper document reconstruction.

This topic does not assume a cause — it simply produces **hard counts** and **linkable examples**.

## Key evidence example

The provided sample JSON shows:

- `efile_date = 2023-01-25`
- `xmp_create_date = 2023:01:26 ...`
- `derived_create_newer_by_days = 1`
- Signed by **“Minnesota Court Records Online (MCRO) Watermark”** with **Signature is Valid.**

(See the uploaded sample JSON.) fileciteturn1file0

The signature report PDF describes the MCRO watermark certificate chain and validation context. fileciteturn1file1

## Views

- `v08_created_after_efile__docs`  
  All children docs where `derived_create_newer_by_days > 0`, with metadata + signature fields.

- `v08_created_after_efile__stats`  
  Totals and basic distribution of the anomaly + how many carry a valid MCRO watermark signature.

- `v08_created_after_efile__by_watermark_status`  
  Grouped by signer/validity/status.

- `v08_created_after_efile__timeline_by_efile_date`  
  When the anomaly appears over time (by efile_date).

- `v08_created_after_efile__focal_1570`  
  Focal subset for cluster 1570 (MATTHEW GUERTIN).

## Exports

All exports land in:

`reports/08_created_after_efile/`

- `08_stats.csv`
- `08_by_watermark_status.csv`
- `08_timeline_by_efile_date.csv`
- `08_created_after_efile__docs.csv`
- `08_created_after_efile__focal_1570.csv`

## How to run

```sql
.read duckdb/sql/core/bootstrap.sql
.read duckdb/sql/core/starter_views__v3_provenance.sql

.read sql/topics/08_created_after_efile/08_created_after_efile__views.sql
.read sql/topics/08_created_after_efile/08_created_after_efile__exports.sql
```