From 246d9d1b6a056aab23ef8f48430ebf2f1cdda73c Mon Sep 17 00:00:00 2001
From: Gregory Salaun <legreg002@hotmail.com>
Date: Tue, 4 Aug 2026 23:21:40 +0200
Subject: [PATCH] chore: call gate checks the active profile only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Checking every profile made a denied call unrecoverable — the process quits
before the operator can change it, and no profile switch could get back in.
Gating on the active profile alone keeps "--profile <other>" as a way back in,
and still turns away a denied operator whose active call is the blocked one.
---
 app.go | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/app.go b/app.go
index dd3f429..f536610 100644
--- a/app.go
+++ b/app.go
@@ -986,17 +986,12 @@ func (a *App) startup(ctx context.Context) {
 	}
 	a.settings.SetProfile(active.ID)
 	a.settingsScoped.Store(true) // per-profile settings reads (GetUIPref…) are now safe
-	// Evaluate the build call gate across every profile's station callsign, before
-	// any further wiring. A denied call exits here, silently.
-	{
-		gate := []string{active.Callsign}
-		if list, lerr := a.profiles.List(a.ctx); lerr == nil {
-			for _, p := range list {
-				gate = append(gate, p.Callsign)
-			}
-		}
-		enforceCallGate(gate...)
-	}
+	// Evaluate the build call gate on the ACTIVE profile's station callsign, before
+	// any further wiring. A denied call exits here, silently. Only the active
+	// profile is checked (not every profile) so that "--profile <other>" is always
+	// a way back in — a blocked call is otherwise unrecoverable, since the process
+	// quits before the operator can change it.
+	enforceCallGate(active.Callsign)
 	// US county resolver — its own local SQLite (data/uls.db), populated on demand
 	// by DownloadULSCounties. Opening (creating an empty store) is cheap and never
 	// fatal: county resolution simply stays inert until the operator downloads it.