Release Copilot idle hooks after native cancellation

KH
3h ago
+439-2

Cancelling a Copilot turn, or choosing Send Immediately for a new owner message, can leave Relay's waiting agentStop hook running until its 59-minute deadline. Release that wait when the native journal records cancellation, a new user turn or a session error, while leaving offered Relay messages available for the next valid hook.

The check anchors the current hook to Copilot's native input timestamp, validates the configured journal's file identity and length, and reads at most 64 KiB of control records. Earlier cancellations cannot cancel a later wait; replaced, truncated or unreadable journals release the waiter safely. Unix reads refuse symlinks and special files without blocking. Timestamp-free legacy stops retain their existing idle delivery. This change does not address MCP proof freshness or establish full Copilot end-to-end verification.

Validation:

  • Copilot Rust suite: 46 passed, 1 explicitly manual live-runtime proof ignored.
  • cargo fmt --check and git diff --check: passed.
  • Queue regression verifies cancellation leaves a message offered, and a later valid hook can claim it.
  • Local Clippy with -D warnings: 51 diagnostics on both this branch and clean base ac666f34d, with no new diagnostics.
  • Local rust-oleum: 99 findings on both this branch and clean base, with no new findings or raised baselines.
  • Linux and Windows checks were not run locally; the Windows control-reader counterpart is included. No live hook installation or deployment was performed.