fix(desktop): surface profile-switch failures instead of falling back to primary socket - #81165

This was generated by AI during triage.

Summary:
openSecondary's new rethrow is consumed by the unchanged catch { scheduleReconnect(entry) } at apps/desktop/src/store/gateway.ts:296, so a failed profile switch still ends at setActive(key) with a closed socket and the error never reaches the new catch in ensureGatewayProfile.

Problems:

• ensureGatewayForProfile wraps await openSecondary(entry) in a bare catch { scheduleReconnect(entry) } (apps/desktop/src/store/gateway.ts:295-297) that this diff does not touch — the rethrown Failed to connect to profile ... error is discarded there, and execution continues to setActive(key) (gateway.ts:301) with the secondary socket still closed.
• The new catch (error) in ensureGatewayProfile (apps/desktop/src/store/profile.ts) fires only if ensureGatewayForProfile or syncConnectionToActiveProfile rejects; on the connect-failure path the PR description names, ensureGatewayForProfile resolves normally, so the switch proceeds exactly as on main and the new error message is not shown. A gatewaySwitch rejection already propagated through main's finally-only try, so the catch's only new effect is the console.error.

Solution:
Make ensureGatewayForProfile propagate the failure — rethrow from its catch (or record the failure and skip setActive(key)) — so the error message built in openSecondary reaches a caller that can surface it; as written, every call site of openSecondary (reconnectSecondary, openGatewayForProfile, ensureGatewayForProfile) discards the error.

Checked against d399455 — the tip of fix/profile-switch-v2 when this was written — and b3aa561, main at the same moment.

Thanks for catching this — you're right, the rethrow was swallowed by the unchanged catch { scheduleReconnect(entry) } in ensureGatewayForProfile, so a failed switch still fell through to setActive(key) with a closed socket and the new catch in ensureGatewayProfile never fired. The original fix was ineffective.

Fixed in 0882362b2 (pushed to this branch): the catch now keeps the reconnect schedule (transient failures still self-heal via the existing backoff) but re-throws, so ensureGatewayForProfile aborts before setActive, and ensureGatewayProfile receives the error and surfaces it instead of silently activating a profile whose backend is unreachable.

Verified: tsc --noEmit clean; profile.test.ts + gateway-switch.test.ts (12 tests) pass.

Partial overlap with #87600, now on main: the silent-misroute half is fixed (activeGateway() returns null for missing named scopes; eviction paths restore the primary explicitly). What SURVIVES here and remains wanted: the error-surfacing UX — main's ensureGatewayForProfile still does catch { scheduleReconnect(entry) } then setActive, silently activating a scope whose socket is dead; no error reaches the user. Your revised rethrow+surface commit addresses exactly that gap. A rebase onto the post-#87600 store would slim this PR down to the UX half — happy to review it in that shape.

The rebase targets the surviving UX seam cleanly, but the new rethrow skips the activation-lease cleanup immediately below this block. On current main, entry.activationLeaseUntil = 0 is reached only because the catch swallows the dial error; after this change, every rejected profile-door dial leaves the failed entry leased against pruning for the full 30-second window. That is bounded, but it defeats the documented “activation is settling either way — release the prune lease” contract and can retain a failed/cancelled target after the switch has already surfaced as failed.

Please release the lease on both success and rejection (for example, put the dial block and lease reset under try/finally, while still scheduling reconnect and rethrowing the original error), and add a regression assertion for the rejected path. The existing fake-timer test proves reconnect remains armed, but not that the activation lease is released.

Addressed the rejected-dial lease cleanup in the latest commit:

• The profile-door dial block now releases activationLeaseUntil from finally on both success and rejection.
• The reconnect catch remains scoped to openSecondary(), so only an actual dial failure schedules reconnect and the original error still propagates.
• Added a regression that rejects the first dial, immediately prunes the failed entry, and verifies disposal; the existing reconnect and no-activation assertions remain intact.

Validation:

• gateway.test.ts: 4/4 passed
• related gateway/profile suites: 13 files, 72/72 passed
• Desktop typecheck: passed
• Prettier and ESLint on the touched files: passed

Verified the lease-cleanup follow-up at bf6fca40e:

• the try/finally now clears activationLeaseUntil on both success and rejection while preserving reconnect scheduling and the original error;
• the new rejected-first-dial test proves the failed entry is immediately pruneable/disposed;
• targeted UI suites: 8/8 passed (gateway.test.ts, profile-switch-failure.test.ts, gateway-shared-remote.test.ts);
• Desktop typecheck: passed.

That resolves my review concern. GitHub currently reports the PR as CONFLICTING against main, so this is now an actual-conflict case where rebasing/updating the contributor branch is warranted; after that, the remaining owner is maintainer review/CI.

Merged via #95080 at 682a34a — your commit was cherry-picked into the consolidated salvage PR with authorship preserved, so this work carries your name in git history.

Thanks for surfacing profile-switch failures instead of silently falling back to the primary socket — failing loudly here was the right call.

Closing this original PR now that the consolidated branch has landed on main. Thanks for contributing to the desktop multi-gateway campaign (tracker: #94724).