Give same-second Commands distinct owned logs and records #795

Parent

#794

What to build

Give each top-level Command its own Command log and Command record even when another Command starts on the same issue in the same second. Both Commands' output must survive interleaved writes, and status, show and logs must point to the correct Command log.

Deliver the first complete slice of the parent's Command log owner module: immutable storage identity, exclusive file allocation, new-name encoding and legacy/new decoding. Session writers remain temporarily tokenless in this slice; the next Ticket completes Session ownership.

Acceptance criteria

• One module owns allocation and filename encoding/decoding for Command artifacts. A Command gets its original display stamp plus an opaque random token once work starts; callers do not reconstruct uniqueness from PID, issue number or timestamp.
• New Command-log names retain the existing repository/kind directories and subject prefix, inserting a tilde and owner token immediately after the twenty-character stamp. New Command record names derive from that exact owned stem. Process-liveness facts remain unchanged.
• New Command logs use exclusive creation. A colliding pre-existing name is preserved and allocation selects a fresh token. An allocation failure never adopts another Command's existing file as owned partial output. A genuinely acquired file remains owned after a later write failure, with existing warning behavior.
• The fixed-clock recording test starts two Commands with identical repository, issue, stamp and process facts, interleaves distinct output markers and verifies distinct log/record paths and both logs' intact bytes. Add a real temporary-directory regression and a forced-collision case through the module's interface.
• status, show, Command-log selection and follow read the exact new log path rather than stripping away its owner token. Keep JSON version 1, existing human Command names, live/newest selection, ambiguity behavior and actual allocated paths in Activity starts and notifications.
• Current legacy Command records with their old root-record suffixes still resolve to the same legacy Command-log names. Mixed legacy/new histories retain record precedence and do not invent a separate Command from a covered log.
• Hold startup output as today; quiet skipped Passes and failures before work starts keep no Command log. Pass-dispatched work retains one owning Command log, while child-owned records keep exact parent/dispatch links and no independent Command log.
• Preserve partial-file and unwritable-log behavior, Command-log warning suppression, Stop record targeting, and exact-parent retained-resource behavior. No already-owned identity changes after being exposed.
• Expand the shared decoder for both token-bearing and tokenless Session names so the next Ticket can switch writers without another reader format. New identity is not inferred from a matching timestamp alone; explicit existing record or Model evidence remains usable during this transition.
• Exercise the recording, Command-log, status, show/logs and Stop checks relevant to this slice. Prefer ownership/content assertions over coupling every fixture to random filename spelling.
• Update the domain-to-code navigation for Command-log allocation and decoding to point to the shared module. Follow Deepen the Command reader around selection and ownership #793's reader implementation if it has landed; do not reproduce its discovery, selection or process-ownership refactor.

Blocked by

None (can start immediately).