Spec: deepen Command log ownership to prevent same-second collisions

[JacobStephens2]

Summary

Commands started on the same issue in one second now retain separate output and evidence. One immutable stamp/token owner connects both Tickets' work: exclusive Command-log allocation and record naming (#795), followed by Session naming, child inheritance and exact reader matching (#796).

Command recording
  owner: stamp + opaque token
    Command log + Command record
    Session logs + Model sidecars + review reports
    dispatched work → Ticket Runs → nested Base fixes
    status / show / logs: decode and match the same owner

Allocation collisions retry without truncating an existing file. Write failures retain acquired ownership and partial output; allocation failures never claim another Command's file. Child Runs reuse the owner and preserve exact parent/dispatch links. Resume and Repair keep their existing Session kinds.

Legacy history remains readable alongside new files, with the existing directories, human selection syntax, Stop ownership and version-1 records/CLI JSON. Skipped Passes still keep no Command log. Domain definitions, navigation, the logging ADR and both manuals describe the final storage format.

Closes #794

Evidence

• Before: Spec: deepen Command log ownership to prevent same-second collisions #794 records a failing regression at de3c1ed: starting the second same-second Command erased the first Command's output.
  After: existing regressions exercise interleaved output, exclusive allocation/collision recovery, partial failures, mixed legacy/new inspection and Session/Model/report isolation.
• Test seams: owned recording with fixed-clock file effects; the production filesystem adapter; captured Session recording; the CLI with fixture records and fake GitHub/Harness processes. Child and Pass integration tests cover inheritance through Ticket Runs and nested Base fixes.
• Passed: full cargo test, cargo fmt --check, and cargo clippy --all-targets -- -D warnings on the final tree. The full run includes 1,057 passing unit tests (2 ignored).
• Focused post-refactor checks passed: cargo test logs::owner::tests (3 tests) and cargo test --bin thirdshift session::tests::same_second_commands_keep_session_model_and_review_contents_separate -- --exact (1 test). The eight relevant integration suites passed all 263 tests. In site, npm ci followed by npm test passed all 13 tests, including manual freshness.
• An earlier full-suite attempt was invalidated when a concurrent rebuild replaced its executable during child-test relaunches (ENOENT). The isolated test and the complete stable-build rerun passed; no Worktree change was needed.

Unaddressed findings

Standards

None. The single P3 design finding (duplicated stamp/token formatting in src/logs/owner.rs) was resolved by sharing Identity's formatter between Command and Session paths. Existing compatibility and isolation tests verify the refactor; no behavioral defect was claimed.

Spec

None. The independent whole-Spec review found no missing, incorrect or unrequested behavior.

Security

None. A single-session guidance review of de3c1ed94dc3ad78859fccf555b195b90ac76a0a...HEAD and supporting code found no introduced Security findings. The review covered exclusive allocation, filename/path handling, child ownership inheritance, Session/Model/report attribution, legacy history and CLI readers, and Stop ownership against the relevant attack-class guidance and repository trust decisions. This was source review; no proof-of-concept candidate required execution, and no source changes were made.

Security review outcome

No unaddressed introduced findings.

Review coverage

Both reviewers inspected all 27 changed paths, including deleted src/logs/command_log.rs and generated site/docs/index.html, plus supporting standards, domain definitions and applicable ADRs. Both inspected the final formatter refactor. Unread changed files: none. Generated-output exclusions: none.

Merge Danger

Door: two-way

No existing logs are moved or rewritten. New filenames persist; complete discovery of new Session logs requires an updated reader.

Blast Radius: logging

Command/Session allocation, evidence attribution and CLI history across Runs and Passes. Process ownership, parent links and scheduling retain their existing contracts.

Built with codex · gpt-6.1-sol · high

Tickets

• Give same-second Commands distinct owned logs and records #795 landed with Give same-second Commands distinct owned logs and records #797
• Carry exact Command ownership through Session logs and child Runs #796 landed with Carry exact Command ownership through Session logs and child Runs #799