Make run identities collision-resistant and outputs exclusive

docs/operations.md

@@ -24,9 +24,17 @@ Durable logical files are written under:
 <output-root>/<run-id>/
 ```
 
-Each output file is written atomically. Notarius never automatically removes
-output. The [JSON output contract](integrations/json-output.md) owns the
-logical file names, schemas, and media types inside a run directory.
+The CLI generates one run ID in the form
+`run-<started-at-unix-nanoseconds>-<32-lowercase-hex-characters>` and uses it
+for output, manifests, and any requested debug bundle. It validates every
+logical output name before exclusively creating the run directory. If that
+directory already exists, the invocation fails without changing it.
+
+Each output file is written atomically. A later file-write failure leaves the
+newly allocated partial run directory in place for inspection; Notarius never
+automatically removes output. The
+[JSON output contract](integrations/json-output.md) owns the logical file
+names, schemas, and media types inside a run directory.
 
 Remove an output run directory only after its consumer data is no longer
 needed. This is data deletion, not cache cleanup.
@@ -148,10 +156,10 @@ summary.
 Use exact paths for manual cleanup. Examples:
 
 ```sh
-rm -rf ./notarius-output/run-1234567890
+rm -rf ./notarius-output/run-1721300000000000000-0123456789abcdef0123456789abcdef
 rm -rf /var/cache/notarius/chunk-plans/0123abcd
 rm -rf /var/cache/notarius/checkpoints/pipeline/input-0123/pipeline-4567/identity-89ab
-rm -rf ./notarius-debug/run-1234567890
+rm -rf ./notarius-debug/run-1721300000000000000-0123456789abcdef0123456789abcdef
 ```
 
 Avoid broad recursive cleanup against a parent root unless it is an explicit

docs/roadmap/implementation.md

@@ -213,7 +213,7 @@ pass.
 
 ## Stage 2: Make run identity collision-resistant and output exclusive
 
-**Status:** Not started
+**Status:** Complete
 
 ### Objective