Give same-second Commands distinct owned logs and records

[JacobStephens2]

Summary

Commands started on the same issue in the same second keep separate output and records, including interleaved writes.

 start work
- truncate <subject>-<stamp>.log
- add a separate process suffix to the root record
+ exclusively acquire <subject>-<stamp>~<token>.log
+ derive the root .command.json from that exact owned stem
+ decode owned and legacy names through logs::owner

Readers retain exact allocated paths, existing human Command names and JSON version 1. Failed acquisition publishes no root record; a later write failure retains the acquired owner and partial file. Session writers remain tokenless for this first slice, with both Session formats readable and explicit record/Model evidence available during the transition.

Closes #795

Evidence

• Before: cargo test --bin thirdshift commands_started_on_the_same_issue_in_one_second_keep_separate_output_and_records failed with “starting the second Command erased the first Command output.”
  After: it passes, with distinct log/record paths and intact interleaved markers. Real temporary-directory allocation and forced-collision tests also pass.
• Before: running owned_and_legacy_commands_keep_exact_paths_and_record_precedence with the base readers omitted the selected owned Session from show.
  After: the same test passes through status, show, Command logs, follow and Session selection with mixed legacy/new fixtures.
• Before: the Spec review's retained acquisition_failure_does_not_publish_a_record_claiming_the_existing_log failed with “a persisted record claims a Command log that was never acquired.”
  After: the exact test passes using this package's --bin thirdshift target; partial-write retention tests still pass.

Validation: full cargo test, cargo fmt --check, and cargo clippy --all-targets -- -D warnings. Relevant Command-log, Activity-log, status, show/logs, Stop and notification suites were also exercised directly.

Test seams

• Owned recording lifecycle (logs::recording::Record) with the fixed-clock file adapter: identical issue/process facts, interleaved bytes, failed acquisition and partial writes.
• Command artifact interface (logs::owner::allocate and decode) with real files and a forced-collision adapter: exclusive ownership and legacy/new filename compatibility.
• CLI (status, show, logs, follow and Stop), using fixture records and fake GitHub/Harness processes: exact paths, history precedence, explicit transitional Session ownership and existing process/parent behavior.

Review

Independent thirdshift-code-review axes used issue-794 as the fixed point and inspected the fixes:

• Standards: one P3 duplication heuristic addressed by CommandRecord::session_references(); no outstanding findings.
• Spec: one P2 failed-acquisition finding reproduced, fixed and retained as a regression; no outstanding findings.

Both final files-read lists cover all 21 changed paths, including the deleted src/logs/command_log.rs and the migrated Architect and log-failure fixtures. No generated-output exclusions. Unread changed files: none on either axis. Reports are saved in .thirdshift-review-LggTMu/standards.md and .thirdshift-review-LggTMu/spec.md beside this implementation Session's artifacts.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

No migration or deletion of existing artifacts; legacy reads remain supported. Session-writer ownership is deferred to the next Ticket in #794.

Blast Radius: logging

Command artifact allocation and inspection across Run, Spec run and Pass output; process identity, Stop targeting and exact parent/dispatch links remain unchanged.

Built with codex · gpt-6.1-sol · high