fix(desktop): surface profile-switch failures instead of falling back to primary socket

[echoes666]

Fixes #81094

Problem

When switching to a secondary profile, openSecondary / ensureGatewayForProfile could silently fall back to the primary socket if the target backend's WebSocket failed to open (e.g. a manually started gateway process holding the profile's resources). This routed the user's messages to the wrong profile's backend and caused cross-profile session writes.

Changes

• apps/desktop/src/store/gateway.ts (openSecondary): rethrow connect failures with an actionable error message instead of letting the caller's catch path fall through to the primary socket.
• apps/desktop/src/store/profile.ts (ensureGatewayProfile): log and rethrow the switch failure instead of silently resetting the swap target.

Why fail loudly instead of retrying?

A silent fallback is strictly worse than an explicit error here: the user's message would be persisted into the wrong profile's session. Failing loudly surfaces the conflict (e.g. a manually started gateway holding the profile) and the message suggests how to resolve it. Retrying against a manually held socket would loop forever.

Notes

Replaces the previous PR #81099 (same fix, rebased onto current main; the old branch was force-pushed during a botched amend and GitHub does not allow reopening it).

[spfcraze]

This was generated by AI during triage.

Summary:
openSecondary's new rethrow is consumed by the unchanged catch { scheduleReconnect(entry) } at apps/desktop/src/store/gateway.ts:296, so a failed profile switch still ends at setActive(key) with a closed socket and the error never reaches the new catch in ensureGatewayProfile.

Problems:

• ensureGatewayForProfile wraps await openSecondary(entry) in a bare catch { scheduleReconnect(entry) } (apps/desktop/src/store/gateway.ts:295-297) that this diff does not touch — the rethrown Failed to connect to profile ... error is discarded there, and execution continues to setActive(key) (gateway.ts:301) with the secondary socket still closed.
• The new catch (error) in ensureGatewayProfile (apps/desktop/src/store/profile.ts) fires only if ensureGatewayForProfile or syncConnectionToActiveProfile rejects; on the connect-failure path the PR description names, ensureGatewayForProfile resolves normally, so the switch proceeds exactly as on main and the new error message is not shown. A gatewaySwitch rejection already propagated through main's finally-only try, so the catch's only new effect is the console.error.

Solution:
Make ensureGatewayForProfile propagate the failure — rethrow from its catch (or record the failure and skip setActive(key)) — so the error message built in openSecondary reaches a caller that can surface it; as written, every call site of openSecondary (reconnectSecondary, openGatewayForProfile, ensureGatewayForProfile) discards the error.

---

Checked against d399455 — the tip of fix/profile-switch-v2 when this was written — and b3aa561, main at the same moment.

[echoes666]

Thanks for catching this — you're right, the rethrow was swallowed by the unchanged catch { scheduleReconnect(entry) } in ensureGatewayForProfile, so a failed switch still fell through to setActive(key) with a closed socket and the new catch in ensureGatewayProfile never fired. The original fix was ineffective.

Fixed in 0882362 (pushed to this branch): the catch now keeps the reconnect schedule (transient failures still self-heal via the existing backoff) but re-throws, so ensureGatewayForProfile aborts before setActive, and ensureGatewayProfile receives the error and surfaces it instead of silently activating a profile whose backend is unreachable.

Verified: tsc --noEmit clean; profile.test.ts + gateway-switch.test.ts (12 tests) pass.

[teknium1]

Partial overlap with #87600, now on main: the silent-misroute half is fixed (activeGateway() returns null for missing named scopes; eviction paths restore the primary explicitly). What SURVIVES here and remains wanted: the error-surfacing UX — main's ensureGatewayForProfile still does catch { scheduleReconnect(entry) } then setActive, silently activating a scope whose socket is dead; no error reaches the user. Your revised rethrow+surface commit addresses exactly that gap. A rebase onto the post-#87600 store would slim this PR down to the UX half — happy to review it in that shape.