The fence was main-owned state stored inside a renderer-owned field.
`sleepingAgentSessionsByPaneKey` is co-authored: the renderer emits the whole map
and main applies it as a wholesale replace, so main's stamp survived only until
the renderer's next write. That inversion is what produced the original P0 — the
fence was erased on disk, not just in memory — and every guard added since was
compensation for it: a carry predicate at each record builder, two equality hunks
behind that predicate, a volatile pane-key map with a seeded startup reply, and
main-side bookkeeping to synthesise lift edges for panes with no record.
The fence now lives in `legacyWorkerResumeFencesByPaneKey`, a runtime-authored
session field classified like `clientHostedBrowserPagesByWorktree`. It is absent
from the renderer's patch builder, so the renderer cannot write it, and the
persistence layer carries it across any write that never mentions it. Main
rewrites the whole set every recovery pass, record or no record. Level-triggered:
no announcement to consume once, no edge to miss, no generation to compare.
The renderer reads it through ordinary session hydration and re-reads it when
main pings that it changed; the ping carries no state, and reads are coalesced so
the last read is the last write. Hibernation eligibility, the resume decision, the
reattach choice and the park exemption all consult that one field.
`automaticResumeBlockedBy` stays on the record as an outbound projection for
clients too old to read the new field, stamped in `buildSleepingAgentSessionData`
alone — the single function both persistence paths build records through.
Deleted: the pane-key map and its writer, the startup seed helper and the reply
shape it needed, `carriesAutomaticResumeBlock` and its call in every record
writer, both equivalence hunks, `lastPlanBlockedPaneKeys`, the fence generation,
and the record-sweeping half of `liftRetiredFences`. All five Codex findings and
all five Opus findings are now unreachable rather than handled.
Jinwoo-H
4203db2457