fix(desktop): preserve session list on fetch failure instead of dropping to empty

[DavidMetcalfe]

Summary

Fixes #64157: refreshSessions() silently drops the session list to empty on transient fetch failures, making the sidebar appear as if all sessions are gone.

What this PR does

Adds a catch block to refreshSessions() in apps/desktop/src/app/session/hooks/use-session-list-actions.ts. Previously the function used try/finally with no catch — when listAllProfileSessions() threw (backend timeout on cold start after update, network error), $sessions stayed at its initial atom value of [] and $sessionsLoading flipped to false. The sidebar rendered "no sessions" with zero error indication.

The catch block preserves the previous session list on transient failure. The spinner still stops (finally), but the sidebar keeps whatever was loaded before the failure instead of dropping to empty.

Notes

• A follow-up could add an explicit error state atom + retry affordance in the sidebar. This PR is the minimal fix to prevent the silent data-loss appearance.
• The missing active-profile.json migration (separate issue) compounds this — on first boot after update, the Desktop defaults to the "default" profile, and if that profile's session fetch times out, the user sees an empty sidebar and assumes everything is gone.

[teknium1]

Thanks for isolating the failure path. The current change needs adjustment before it can deliver the stated UX guarantee.

Problems

• refreshSessions() already leaves an existing list intact on rejection: setSessions is only reached after a successful result at apps/desktop/src/app/session/hooks/use-session-list-actions.ts:175-182. The added catch does not write session state, while $sessions begins as [] at apps/desktop/src/store/session.ts:215; therefore it cannot preserve a list during the reported cold-start failure.
• The catch also suppresses the boot failure path. Boot awaits refreshSessions() at apps/desktop/src/app/gateway/hooks/use-gateway-boot.ts:479-485; a rejection currently reaches failDesktopBoot/notifyError at lines 487-492. With this catch, boot completes while the initial list remains empty.

Suggested changes

• Keep an initial fetch failure observable (for example, an explicit recoverable session-load error) rather than treating it as a successful empty result, while retaining stale rows after a later refresh failure.
• Add rejection-path coverage for both an already-populated list and the initial empty state.

Automated hermes-sweeper review.

[teknium1]

This catch resolves the initial fetch failure without changing $sessions. Since $sessions starts as [], boot then reaches completeDesktopBoot() (use-gateway-boot.ts:479-485) with an empty sidebar instead of the existing boot error path (use-gateway-boot.ts:487-492). Please keep an initial failure observable or provide a recoverable error/retry state rather than swallowing it here.

[DavidMetcalfe]

Thanks @teknium1 — both findings were correct. The original catch preserved $sessions only when there was something to preserve, so cold-start boot ended up with an empty sidebar and no error path because the rejection was swallowed before the existing boot error handler could see it. Pushed a rework at 3f83bfcb4 that:

• Introduces $sessionLoadError (a typed SessionLoadError atom in store/session.ts) plus a SessionRefreshError class so the boot hook can tell a session-list failure apart from other boot failures.
• Adds an isBoot?: boolean option to refreshSessions(). The boot caller passes isBoot: true and the catch re-throws as SessionRefreshError, which keeps the existing failDesktopBoot + notifyError path intact. Background callers (sidebar refresh, profile switch, reconnect) don't pass the flag and resolve normally with $sessionLoadError set, so their stale rows stay visible.
• Clears $sessionLoadError inside the existing success block — a transient success auto-clears the banner without a Retry click.
• Adds boot.errors.sessionLoadFailed (en/ja/zh/zh-hant) so the toast/overlay says "Couldn't load recent sessions" instead of the generic "Desktop boot failed" copy.
• 5 rejection-path tests in a new use-session-list-actions.test.tsx: cold-boot re-throws as SessionRefreshError, populated-list refresh failure preserves rows + records the error, success-after-failure clears the atom, non-Error rejection values are handled, and the explicit-isBoot contract is pinned (so future refactors don't start using $sessions.length === 0 as a substitute).

The "couldn't refresh — Retry" affordance in the sidebar UI is intentionally out of scope here — $sessionLoadError is now exposed so a follow-up PR can wire it up without re-touching this state machine. Happy to take that as a sibling if you'd rather have it land together.

Cross-vendor dual review (Flash + GPT-OSS) on the rework landed without BLOCKERs; the consensus was an explicit isBoot flag over a $hasFetchedSessions atom, plus the typed error class and the session-specific i18n key.