fix(matrix): classify sync auth failures by status and errcode, not substring (salvage #66878)

[steveonjava]

This is gmoranxyz's work in #66878. The diagnosis and original patch are theirs. That PR went quiet after the maintainer left review asks open, so this carries it across the finish line.

Problem

MatrixAdapter._sync_loop() decided whether a sync failure was permanent by substring-matching the stringified exception for "401", "403", "unauthorized", "forbidden". The stringified exception embeds the request URL, and the Matrix sync pagination token is an arbitrary digit string:

Connection timeout to host https://.../_matrix/client/v3/sync?timeout=30000&since=s72802_401975_486...
                                                                                    ^^^^^^

"401" in err_str evaluates to True, so a plain network timeout was classified as a permanent auth error and the loop returned. _sync_task is created once at startup and never restarted, so the adapter went permanently deaf on Matrix while the process stayed healthy.

Real-world triggers include an Umbrel app-proxy 502 whose SVG coordinate 40.4302 contains 403, and since-token digits in the sync URL. The symptom is nasty because the bot looks alive: inbound dies, outbound keeps working.

What this salvage adds

Each item maps to teknium1's review asks on NousResearch#66878:

• Async loop-level regression test exercising _sync_loop's retry-versus-return flow (primary ask; original tests only called the helper directly). The fixture uses a plain connection timeout whose message wraps the real Matrix sync pagination token, which happens to contain 401. RED/GREEN proof: pre-fix classifier fails, fix passes.
• Explicit rationale for the bounded unstructured-text fallback (deliberate divergence from fix(matrix): stop classifying auth errors by substring match NousResearch/hermes-agent#57375's structured-only approach). Some exceptions lack .http_status or .errcode, so a word-boundary-safe scan on the first 200 characters provides a safety net without re-introducing false positives.
• M_UNAUTHORIZED considered. Found that M_UNAUTHORIZED is a distinct Matrix error code from M_UNKNOWN_TOKEN and M_FORBIDDEN. The classifier does not currently include it in the permanent errcode set. This is acceptable because the M_UNKNOWN_TOKEN pre-check on the returned sync object already covers the real revocation case, and M_UNAUTHORIZED is rarely emitted by modern homeservers in the sync path.
• Two extra hardening fixes found during review:
  • Tightened the attribute probe: no more first-int-wins across status/code/http_status. Each attribute is checked independently.
  • Transient exception types (TimeoutError, ConnectionError, OSError) are short-circuited before any keyword logic, so a timeout can never be misread regardless of its message content.

Cluster context

Four PRs address this same root cause: NousResearch#57375, NousResearch#78039, NousResearch#61206, and NousResearch#66878. GottZ's consolidation triage named NousResearch#66878 the survivor and recommended closing NousResearch#57375 as a duplicate. This PR is that consolidation carried out: it takes NousResearch#66878's approach, closes the review gaps, and lands it upstream. Not a fifth competing entry.

Testing

# Own suite (tests/gateway/test_matrix.py)
python -m pytest tests/gateway/test_matrix.py -v
# 133 passed in 3.59s

# Full suite (pre-existing noise, zero overlap with this change)
python -m pytest -x
# 1210 failed, 24328 passed, 324 skipped, 1 xfailed, 17 errors in 2980.32s
# Zero failures in tests/gateway/test_matrix.py

# Lint
ruff check plugins/platforms/matrix/adapter.py tests/gateway/test_matrix.py
# All checks passed

Explicitly out of scope

The sync watchdog (restart a dead or stalled _sync_task). This is a real remaining gap that none of the four PRs in this cluster address. A follow-up is planned.

---

Diff: 2 files changed, 274 insertions(+), 13 deletions(-)
Commits: 3 (all conventional, all Co-authored-by gmoranxyz)