fix: fence reconciliation admission race

internal/server/store/reconcile.go

@@ -16,11 +16,26 @@ import (
 // client. It is a read-only snapshot used to tell a reconnecting agent which
 // UUIDs and durable cursors must be compared before fresh dispatch is enabled.
 func (store *Store) ReconcileTargets(ctx context.Context, clientID string) ([]*rvboxv1.ReconcileTarget, error) {
+	return store.ReconcileTargetsAt(ctx, clientID, time.Time{})
+}
+
+// ReconcileTargetsAt returns the durable non-terminal view at the supplied
+// receipt-time boundary. A connecting session uses one boundary for both the
+// request and its reply: commands admitted after it are fresh work, not absent
+// client evidence to be reconciled.
+func (store *Store) ReconcileTargetsAt(ctx context.Context, clientID string, receiptBoundary time.Time) ([]*rvboxv1.ReconcileTarget, error) {
 	if clientID == "" {
 		return nil, errors.New("client ID is required")
 	}
-	rows, err := store.db.QueryContext(ctx, `SELECT issue_uuid, last_event_seq, revision, immutable_request_sha256
-FROM commands WHERE client_id = ? AND lifecycle BETWEEN 1 AND 4 ORDER BY issue_time, issue_uuid`, clientID)
+	query := `SELECT issue_uuid, last_event_seq, revision, immutable_request_sha256
+FROM commands WHERE client_id = ? AND lifecycle BETWEEN 1 AND 4`
+	args := []any{clientID}
+	if !receiptBoundary.IsZero() {
+		query += ` AND server_receipt_time <= ?`
+		args = append(args, receiptBoundary.UTC().UnixNano())
+	}
+	query += ` ORDER BY issue_time, issue_uuid`
+	rows, err := store.db.QueryContext(ctx, query, args...)
 	if err != nil {
 		return nil, err
 	}
@@ -62,10 +77,19 @@ func (store *Store) ReconcileClientSnapshot(ctx context.Context, clientID string
 // incidented. Retained non-terminal rows are retargeted to this generation so
 // late events from the previous connection cannot advance the command.
 func (store *Store) ReconcileClientSnapshotForSession(ctx context.Context, clientID string, generation uint64, snapshot *rvboxv1.ReconcileSnapshot) (*rvboxv1.ReconcileResult, error) {
+	return store.ReconcileClientSnapshotForSessionAt(ctx, clientID, generation, snapshot, time.Time{})
+}
+
+// ReconcileClientSnapshotForSessionAt reconciles exactly the server state that
+// was included in the matching ReconcileRequest. Work admitted after the
+// boundary is intentionally left for the dispatch loop once reconciliation
+// completes; treating it as absent client evidence would lose a valid command
+// during the Hello/reconcile race.
+func (store *Store) ReconcileClientSnapshotForSessionAt(ctx context.Context, clientID string, generation uint64, snapshot *rvboxv1.ReconcileSnapshot, receiptBoundary time.Time) (*rvboxv1.ReconcileResult, error) {
 	if generation == 0 {
 		return nil, errors.New("session generation is required")
 	}
-	return store.reconcileClientSnapshot(ctx, clientID, generation, snapshot)
+	return store.reconcileClientSnapshotAt(ctx, clientID, generation, snapshot, receiptBoundary)
 }
 
 type reconcileServerRow struct {
@@ -78,6 +102,10 @@ type reconcileServerRow struct {
 }
 
 func (store *Store) reconcileClientSnapshot(ctx context.Context, clientID string, generation uint64, snapshot *rvboxv1.ReconcileSnapshot) (*rvboxv1.ReconcileResult, error) {
+	return store.reconcileClientSnapshotAt(ctx, clientID, generation, snapshot, time.Time{})
+}
+
+func (store *Store) reconcileClientSnapshotAt(ctx context.Context, clientID string, generation uint64, snapshot *rvboxv1.ReconcileSnapshot, receiptBoundary time.Time) (*rvboxv1.ReconcileResult, error) {
 	if clientID == "" {
 		return nil, errors.New("client ID is required")
 	}
@@ -112,7 +140,7 @@ func (store *Store) reconcileClientSnapshot(ctx context.Context, clientID string
 		return nil, err
 	}
 	defer tx.Rollback()
-	serverRows, tombstones, err := loadReconcileRows(ctx, tx, clientID)
+	serverRows, tombstones, err := loadReconcileRows(ctx, tx, clientID, receiptBoundary)
 	if err != nil {
 		store.writeMu.Unlock()
 		return nil, err
@@ -215,8 +243,14 @@ type reconcileIncident struct {
 	dataLoss bool
 }
 
-func loadReconcileRows(ctx context.Context, tx *sql.Tx, clientID string) (map[string]reconcileServerRow, map[string][]byte, error) {
-	rows, err := tx.QueryContext(ctx, `SELECT issue_uuid, lifecycle, revision, last_event_seq, immutable_request_sha256, target_session_generation FROM commands WHERE client_id = ?`, clientID)
+func loadReconcileRows(ctx context.Context, tx *sql.Tx, clientID string, receiptBoundary time.Time) (map[string]reconcileServerRow, map[string][]byte, error) {
+	query := `SELECT issue_uuid, lifecycle, revision, last_event_seq, immutable_request_sha256, target_session_generation FROM commands WHERE client_id = ?`
+	args := []any{clientID}
+	if !receiptBoundary.IsZero() {
+		query += ` AND server_receipt_time <= ?`
+		args = append(args, receiptBoundary.UTC().UnixNano())
+	}
+	rows, err := tx.QueryContext(ctx, query, args...)
 	if err != nil {
 		return nil, nil, err
 	}