A failed local save after enrollment leaves an orphaned device at the controller #161

Summary

When enrollment succeeds at the controller but the daemon then fails to store its identity locally, the controller integration restarts and enrolls again under a new device ID. The device record from the failed attempt stays in the controller as a device that never connects. Every retry adds one more.

Seen with

The Windows service on main (05d3030), with tokens larger than the Credential Manager limit (#107). Each sign-in attempt ended with:

ERROR agentdesktop_agent::remote: controller integration failed; restarting ... error=store OAuth credentials: store secret in operating system credential store: Value of 'password encoded as UTF-16' is longer than the platform limit of 2560 chars

and the controller logged a new enrolled device for the same hostname each time:

INFO agentdesktop_controller::service: enrolled device device_id=a3b6ff32-… hostname="WIN-PAC" …
INFO agentdesktop_controller::service: enrolled device device_id=806e88c1-… hostname="WIN-PAC" …

After four attempts the device list held four WIN-PAC devices, none of which ever connected; they had to be deleted by hand.

Where

remote.rs: oidc::enroll completes the controller enrollment (the device record exists from then on) before identity::save stores the result. If the save returns an error, the ? restarts the integration, and the next attempt calls oidc::enroll again with a fresh identity.

#108 removes the trigger seen here (the credential size), but any other local save failure (disk full, permissions, a credential store that is unavailable) would leave records the same way.

Questions

• Should the daemon retry the local save with the identity it already received, instead of enrolling again?
• Or should the controller recognise a re-enrollment of the same device (same enrolling subject and hostname, never connected) and replace the earlier record?
• Or is a controller-side cleanup of devices that never connected the better place?