fix: fence reconciliation admission race

internal/server/session/agent_server.go

@@ -102,6 +102,10 @@ func (server *AgentServer) serveConnection(parent context.Context, connection *w
 		return
 	}
 	hello := helloEnvelope.GetClientHello()
+	// This cutoff precedes registration, which is when control callers can
+	// first observe the live client. Reconciliation must compare only the
+	// state included in its request; later control commands are fresh work.
+	reconcileBoundary := server.now()
 	instanceID, err := domain.ParseUUIDv7(hello.GetClientInstanceId())
 	if err != nil {
 		server.close(connection, websocket.StatusPolicyViolation, "invalid client instance ID")
@@ -192,7 +196,7 @@ func (server *AgentServer) serveConnection(parent context.Context, connection *w
 		server.close(connection, websocket.StatusInternalError, "could not queue welcome")
 		return
 	}
-	targets, err := server.Store.ReconcileTargets(parent, hello.GetClientId())
+	targets, err := server.Store.ReconcileTargetsAt(parent, hello.GetClientId(), reconcileBoundary)
 	if err != nil {
 		server.close(connection, websocket.StatusInternalError, "could not build reconciliation request")
 		return
@@ -237,7 +241,7 @@ func (server *AgentServer) serveConnection(parent context.Context, connection *w
 			return
 		}
 		if snapshot := envelope.GetReconcileSnapshot(); snapshot != nil {
-			result, reconcileErr := server.Store.ReconcileClientSnapshotForSession(sessionContext, hello.GetClientId(), registration.Generation, snapshot)
+			result, reconcileErr := server.Store.ReconcileClientSnapshotForSessionAt(sessionContext, hello.GetClientId(), registration.Generation, snapshot, reconcileBoundary)
 			if reconcileErr != nil {
 				server.close(connection, websocket.StatusPolicyViolation, "reconciliation failed")
 				return