[JacobStephens2]

Summary

Make status, show, logs and Stop share one Command reader for discovery, history, selection and exact ownership. Callers retain formatting, byte streaming and Stop effects.

status / show / logs / Stop
  Snapshot(logs root, sampled time)
    listing + name resolution
    selected observation + outer owner + child-refusal target
    Session inventory + bounded latest event
  retained_work(captured record path)
    exact Command tree -> distinct branches / PRs

Closes #793

Evidence

• Before: the first reader-interface test failed to compile because Snapshot and retained_work did not exist; callers reconstructed ownership across status/inspect/Stop.
  After: five reader-interface tests pass, covering direct Runs, Pass dispatches, equal-numbered children, separate Commands, historical selection, Session choice and retained-work reload.
• Existing compatibility checks: cargo test --test status --test show_logs --test stop passed all 42 existing tests.
• Added cargo test --test show_logs logs_follow_drains_final_bytes_after_an_outcome_or_selected_child_ends: passes for both a durably ended outer Command and a selected ended child, comparing all followed bytes to the final Command log.
• cargo fmt --check and cargo clippy --all-targets -- -D warnings pass.
• Full cargo test passed: 1,968 tests across 49 test groups, zero failures and two existing ignores.

Test seams

• Reader snapshot: filesystem-backed Command listing, resolution, captured ownership, Session selection, and retained-work reload by exact record path.
• Existing CLI: status/show JSON and text compatibility, Stop request/signaling, and log following through outer-process exit.

Unaddressed findings

Standards

• Optional duplicated ordering projection: kept the two small policy projections explicit. Listing at reading.rs:163 disables live-first grouping for --all and includes a repository tie-break; resolution at selection.rs:116 always prefers live observations. #793, decision 3 requires preserving their distinct listing/resolution rules. This judgement-only smell does not justify another abstraction in this migration.
• Internal production process dependency: kept OnMachine at reader construction, reading.rs:196 and follow observation, selection.rs:259. #793, decisions 2 and 8 settle explicit logs-root/time inputs, real filesystem fixtures and reuse of existing process identity, without a generic reader effects trait. The focused reader process-identity test and real-process final-byte test pass. A new internal port is unnecessary for this scope. No unresolved Spec or Day shift decision remains.

Spec

None.

Neither reviewer asserted a behavior defect, so there were no finding-specific failing commands to adjudicate.

Security

None. Reviewed b9a3330bd992460f2a4510ca7bc10590c7391983...HEAD and supporting Command record, filesystem ownership, Session selection, historical recovery and Stop/process-identity code using thirdshift-security-audit in guidance mode.

Validation: all 5 reader tests, 14 show/logs tests, 20 status tests and 9 Stop tests passed across isolated offline runs with local fixtures. No source changes were required.

Security review outcome

No unaddressed introduced findings.

Review coverage

Standards and Spec independently read every changed file, including the removed historical source. Changed files left unread: none on either axis. Generated-output exclusions: none. Full reports and each axis's final files-read list are retained in .thirdshift-review-1vxwfC/standards.md and .thirdshift-review-1vxwfC/spec.md in the implementation workspace.

Merge Danger

Door: two-way

Internal refactor with no persisted-format change.

Blast Radius: CLI

Command observation, log following and Stop selection across configured logs; existing durable-outcome and process-identity signaling checks remain in place.

Built with codex · gpt-6.1-sol · high