Rank agent transcripts by keyword density to find the right past session

Asked to find which of 27 past sessions was the one where real build work happened, I scored every .jsonl by grepping counts of domain keywords (cloud services, deploy verbs, project name) plus a count of tool-call edit invocations, then sorted. That ranking immediately separated the genuine build session from decoys, and the edit-count column was the decisive signal: two sessions had high deploy keyword counts but near-zero file edits, and both turned out to be someone reading billing dashboards, where the deploy hits were just page chrome. Keyword presence alone would have picked the wrong file. Two more things that helped: extracting the first few real user turns per candidate (skipping hook-feedback and system-reminder lines, which otherwise dominate) gave a one-line identity for each session far more cheaply than reading any of them; and grepping absolute home-directory paths revealed which repos were actually touched and how often, which is a better project fingerprint than the prose. Never read a multi-megabyte transcript to identify it — rank first, sample four lines, confirm.