Carry exact Command ownership through Session logs and child Runs #796

Parent

#794

What to build

Complete exact Command ownership for Session logs and their Model evidence. Two Commands sharing an issue and start second must keep disjoint Session logs, review reports and Model sidecars; each Command's inspections and notification must read only its own evidence, including through Ticket Runs and nested Base fixes.

Reuse the preceding Ticket's Command log owner module for Session naming, capture, child inheritance and matching. Remove the distributed timestamp-only reconstruction once these callers cross the shared interface.

Acceptance criteria

• Session names use the captured Command's stamp and owner token with existing subject and kind suffixes. Different Commands cannot overwrite each other's Session logs, Model sidecars or review reports. Existing Resume kinds and numbered Repair selection remain supported.
• Capture immutable owner metadata once and pass it through child-process inheritance with one internal serialized value containing stamp, token and optional owning Command-log path. Actual child Runs consume it; top-level Commands allocate their own owner. Local ownership wins over stale inherited state and absence clears stale child state.
• Preserve exact parent-record/parent-dispatch links and the hidden start-stamp argument for their current purposes. A Pass and its dispatched Run/Spec, a Spec and its Ticket Runs, and a Run and nested Base fixes retain the outer Command's log owner without creating new outer Command logs.
• A Command-log writer failure does not discard an already allocated identity or force shared timestamp-only Session targets. If no safe owner exists, retain existing logging warnings and return a causal error when a Session requires its log path. Never adopt an existing unrelated log.
• Command inspection, history recovery, Session inventory and kind selection use the shared filename decoder. Legacy tokenless logs remain readable without migration, and token-bearing ownership is never associated with legacy ownership only because their timestamps agree.
• Model collection selects the captured owner and retains the exact owning Command-log comparison. Preserve stream evidence across interruption and existing authoritative completed-report handling, including completed reports with no observed Models.
• Add a fixed-stamp ownership regression with two Commands carrying different Session, Model and report markers. Verify separate file contents, correct Session inventories and isolated notification evidence through the shared interfaces. Distinguish this from merely testing that filenames differ.
• Cover inherited ownership through a Ticket Run and nested Base fix, Pass-dispatched work, Resume and Repair logs, and coexistence with a legacy Command at the same timestamp. Retain fixture-owned process cleanup and existing Session/notification failure behavior.
• status, show, logs and Stop preserve existing version 1 output, human naming, process checks, live/newest selection, ambiguity rules and retained-resource trees. Update their fixture data or the Deepen the Command reader around selection and ownership #793 reader to consume the decoder without duplicating its observation implementation.
• Delete superseded filename slicing, stamp-only inventory grouping and independent owner reconstruction after behavior is covered through the shared interface. Keep the production filesystem and deterministic test adapters; introduce no generic storage framework.
• Clarify existing Session log and Command log glossary definitions: start stamps are display/grouping facts and distinct Commands have distinct storage ownership even when those stamps agree. Update the domain-to-code index, user-guide filename examples and the existing logging ADR's examples. Preserve its repository ownership and scheduler decisions; add no new glossary term or ADR.
• Run relevant Session-recording, Session-execution, Command-log, status, show/logs, Stop and Run-notification checks, plus repository-required final checks. Existing files are not moved, rewritten or deleted by upgrading.

Blocked by

#795