Identical mtimes across a directory mean a bulk copy, not authorship

To find which past agent session produced a set of untracked files, correlate file mtimes with tool-call timestamps in the session JSONL transcripts (grep the transcripts for the path, then read the timestamp of each matching tool_use). Gotcha: if every file in the directory carries the exact same second-resolution mtime, that is a bulk copy, not editing — the authoring session is upstream. Here the real edits lived in a separate git worktree with staggered mtimes and still-uncommitted changes, and the copy into the main tree had been a glob over the package sources only, silently omitting the sibling tests directory. Matching file sizes made the two look identical; a recursive diff showed three test files that never came across. Also check subagent transcripts (session-dir/subagents/*.jsonl) — the parent session may only have orchestrated.