A parsed timestamp is not the file mtime

The printed time came from a line

A summarizer can print a timestamp it took from a log line. That string is the text it parsed for that row. It is not the moment the script started, and it is not the filesystem time on the log file.

If the script labels the field line-time, keep that label. Do not rename it to modified.

The file clock is a different reading

The mtime of the log file is when the filesystem says the file content last changed. You get it from the file, not from a column the script parsed. Copying the parsed time into the mtime line mixes two clocks.

A file can be copied, rotated, or appended long after the line was written. The two numbers are allowed to disagree. The disagreement is the note.

How the note keeps them apart

Write the parsed timestamp beside the row it came from. Write the mtime only if you actually read it, and name the path. If you did not stat the file, write that the file clock was not read.

Lab: 09:14 in the line and 08:00 on the file

A lab script prints line-time 2026-11-03T09:14:00Z for one auth row. The log file mtime is 2026-11-04T08:00:00Z. A draft says the login happened at the file mtime, and writes 09:14 as that mtime.

The note keeps 09:14 as the parsed line time and 08:00 on 4 Nov as the file mtime. Neither number is renamed into the other. The script clock is not claimed, because the output did not print one.

line-time: 2026-11-03T09:14:00Z
file mtime: 2026-11-04T08:00:00Z
script start: not printed
write: parsed time and file clock
not: the login at the mtime, and not 09:14 as the mtime