[AI-897] Deliver Copilot post-sessionEnd session.shutdown tail (live finalize drain)

[realtonyyoung]

Problem

In the live hook path, Copilot session token stats show output-only — input/cache stay 0. Copilot writes session.shutdown (the per-model input/cache token aggregate) to events.jsonl after the sessionEnd hook returns:

line 29  hook.start  sessionEnd
line 30  hook.end    sessionEnd
line 31  session.shutdown      ← last line, written AFTER the hook

The hook's inline-drain runs before that line exists and then kills the live watcher, so the live path never delivers it. (Batch kcap import --copilot reads the complete file and is unaffected.) Secondary risk: a session that ends promptly can also drop its final assistant turn, since the watcher is killed before draining the tail.

Fix

Spawn a detached kcap copilot-finalize <sid> <path> process from the Copilot sessionEnd hook, after the session-end POST (so its poll budget isn't consumed by the pre-drain + POST). It outlives the hook, polls until session.shutdown is the terminal transcript line (or a 10s budget), then performs one idempotent inline-drain.

• No deadlock / no stall. Fully decoupled from the hook's return and from the server's StopAndDrainAsync (which sends StopWatcher and waits up to 10s on session-end). The watermark + deterministic event ids make the late delivery safe.
• Timeout fallback rescues a dropped final assistant turn when session.shutdown never lands (e.g. Copilot crash).
• Also redact WatcherManager.InlineDrainAsync output via SecretRedactor — it previously skipped redaction unlike the watcher's drain, a latent leak now exercised by the finalize tail.

Rejected the alternative "keep the watcher alive to observe shutdown": the server actively stops the watcher on session-end and waits on drain-complete, so lingering would deadlock or force a ~10s stall on every Copilot session-end.

Dependency

Server-side ingest of session.shutdown → CopilotUsageBackfilled ships separately in kurrent-io/kcap-server#763. Until that merges + deploys, this PR reliably delivers the line but token totals are unchanged. Real-copilot live E2E should run against a #763-inclusive server.

Testing

• 8 new tests: terminal-line detection (incl. resume-safety + malformed) and timing via WireMock (already-present, slow-hook delayed write, timeout fallback).
• Full Unit suite 1544/1544 green (confirms the shared InlineDrainAsync redaction change is safe); Integration 30/30 green.
• AOT publish clean — no IL2026/IL3050 warnings; native arm64 binary builds.

copilot-finalize is an internal command (spawned by the hook, like watch / generate-whats-done) — not user-facing, so no README change.

Linear: https://linear.app/kurrent/issue/AI-897

🤖 Generated with Claude Code

[linear-code]

AI-897

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[realtonyyoung]

One more stale-doc nit from the rerun: the file-level CopilotHookCommand wire-contract summary still says sessionEnd → kill watcher + capped inline drain, then POST /hooks/session-end/copilot (around lines 26-27), but the implementation now has a correctness-critical first step: spawn the detached copilot-finalize drainer before the pre-drain and POST. Can we update that summary too so it reflects the final ordering?

[realtonyyoung]

Done in the latest commit — updated the CopilotHookCommand wire-contract <remarks> so the sessionEnd entry leads with "spawn the detached copilot-finalize drainer FIRST" before the watcher kill + capped inline drain + POST. Also re-swept all finalize/shutdown-ordering comments across src/Capacitor.Cli; the rest are either already spawn-first or are correct statements that Copilot writes session.shutdown after the hook returns.

[realtonyyoung]

Approved to merge.