feat: execute durable client commands through supervisor

internal/server/session/agent_server.go

@@ -180,6 +180,19 @@ func (server *AgentServer) serveConnection(parent context.Context, connection *w
 		server.close(connection, websocket.StatusInternalError, "could not queue welcome")
 		return
 	}
+	targets, err := server.Store.ReconcileTargets(parent, hello.GetClientId())
+	if err != nil {
+		server.close(connection, websocket.StatusInternalError, "could not build reconciliation request")
+		return
+	}
+	reconcileRequest, err := proto.Marshal(&rvboxv1.AgentEnvelope{
+		SessionId: encodedSessionID, SessionGeneration: registration.Generation,
+		Payload: &rvboxv1.AgentEnvelope_ReconcileRequest{ReconcileRequest: &rvboxv1.ReconcileRequest{Targets: targets}},
+	})
+	if err != nil || queue.EnqueueControl(Frame{Kind: FrameControl, Payload: reconcileRequest}) != nil {
+		server.close(connection, websocket.StatusInternalError, "could not queue reconciliation request")
+		return
+	}
 
 	heartbeat := newSynchronizedHeartbeat(server.heartbeatIdle(), server.livenessTimeout(), 0)
 	writerDone := make(chan struct{})
@@ -213,7 +226,7 @@ func (server *AgentServer) serveConnection(parent context.Context, connection *w
 			return
 		}
 		if snapshot := envelope.GetReconcileSnapshot(); snapshot != nil {
-			result, reconcileErr := server.Store.ReconcileClientSnapshot(sessionContext, hello.GetClientId(), snapshot)
+			result, reconcileErr := server.Store.ReconcileClientSnapshotForSession(sessionContext, hello.GetClientId(), registration.Generation, snapshot)
 			if reconcileErr != nil {
 				server.close(connection, websocket.StatusPolicyViolation, "reconciliation failed")
 				return

internal/server/session/agent_server_test.go

@@ -238,6 +238,25 @@ func dialAndHello(t *testing.T, server *httptest.Server, clientID, instanceID st
 		connection.CloseNow()
 		t.Fatalf("welcome payload = %T", welcome.Payload)
 	}
+	// Reconnecting agents receive an advisory target list immediately after
+	// welcome. Consume it here so callers that exercise fencing or malformed
+	// frames observe the next read from the actual session boundary.
+	readContext, cancel = context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	messageType, advisoryBytes, err := connection.Read(readContext)
+	if err != nil {
+		connection.CloseNow()
+		t.Fatal(err)
+	}
+	if messageType != websocket.MessageBinary {
+		connection.CloseNow()
+		t.Fatalf("reconciliation message type = %v", messageType)
+	}
+	var advisory rvboxv1.AgentEnvelope
+	if err := proto.Unmarshal(advisoryBytes, &advisory); err != nil || advisory.GetReconcileRequest() == nil {
+		connection.CloseNow()
+		t.Fatalf("reconciliation advisory = %+v, %v", advisory.Payload, err)
+	}
 	return connection, &welcome
 }