There seems to be swapped file's accessed and created values on Linux

[Oldes]

It can be demonstrated with this test in a console:

>> write %aaa "aaa"
== %aaa

>> query %aaa [created: accessed:]
== [
    created: 27-Sep-2024/16:16:47+2:00
    accessed: 27-Sep-2024/16:16:47+2:00
]

>> write/append %aaa "aaa"
== %aaa

>> query %aaa [created: accessed:]
== [
    created: 27-Sep-2024/16:17:02+2:00  ;<-- modified value
    accessed: 27-Sep-2024/16:16:47+2:00 ;<-- unchanged value
]

On Windows it is ok.

[Oldes]

The reason is, that used st_ctime on Linux does not mean created, but changed (e.g., changing permissions)!

To get a file creation time one must use statx system call (requires Linux kernel 4.11 or later) instead of plain stat.

[Oldes]

https://man7.org/linux/man-pages/man2/statx.2.html