Prevent MQTT callback errors from silently killing the network loop thread

[leandropineda]

Summary

paho dispatches user callbacks (on_message, on_connect, on_disconnect, …) on the network loop thread, and with suppress_exceptions=False (paho's default) it re-raises any exception that escapes a callback (client.py: if not self.suppress_exceptions: raise). That re-raise unwinds loop_forever, so the loop thread exits permanently — it is never restarted, yet is_connected() can keep reporting True. The result is a session that looks connected but silently drops every QoS-0 publish (pose, key-values) until the process is restarted.

This hardens RobotSession so a callback error can't wedge the session — and stays visible rather than merely suppressed — and reduces spurious keepalive-timeout disconnects.

Changes

• _guard_callback(name) wraps each registered callback (on_connect, on_message, on_disconnect): an exception is logged with a traceback through the session logger (tagged with the callback name) and swallowed, so it never reaches paho's re-raise path on the loop thread. This is the primary mechanism and keeps the error observable.
• client.enable_logger(self.logger) — without it, paho's own "Caught exception in …" message (emitted when suppress_exceptions swallows) went nowhere; now paho's internal logs are surfaced.
• client.suppress_exceptions = True — catch-all net for any callback path not wrapped above (and future ones).
• _on_message no longer re-raises — logs with traceback (topic context) and swallows.
• Keepalive default 10s → 60s — 10s trips spurious "keep alive timeout" disconnects whenever the loop thread is briefly busy. Still overridable via the keepalive_secs kwarg.

Note on the keepalive change

is_connected() is a cached state flag updated by the loop thread; a silent/black-hole link is only detected via keepalive, i.e. up to ~2× keepalive. Raising the default to 60s trades slower silent-drop detection (now up to ~120s, was ~20s) for far fewer false-positive disconnects. Latency-sensitive callers can pass a smaller keepalive_secs.

Test plan

• 4 new tests in test_robot_session_callbacks.py: handler error doesn't propagate out of _on_message; keepalive default is 60s; _guard_callback logs-and-swallows; enable_logger is wired.
• Suite: 122 passed. Pre-existing failures unrelated to this change: test_metrics (requires the opentelemetry extra) and test_video::test_robot_session_register_camera (OpenCV camera) — both fail identically with these edits reverted.
• flake8 clean, black --check clean.

🤖 Generated with Claude Code