apollo_l1_gas_price,apollo_l1_gas_price_types: hold Chainlink query failures for the retry interval - #14992

Holds a failed Chainlink query's error in OracleState::last_error and spawns the next query once failure_retry_interval_seconds elapses rather than on every call. Without it, every fetch_rate against a broken feed spawns a fresh query, two view calls per feed per proposal, for as long as the feed stays broken.

A9b of the split of #14942, on top of the A9a lifecycle.

• Precedence: a held failure is served only when no valid read is held, and a success clears it, so the client never reports a failure older than its newest read. no_call_is_denied_a_rate_the_client_holds is the regression test for the availability bug found in review of apollo_l1_gas_price,apollo_l1_gas_price_config,apollo_l1_gas_price_types: add Chainlink client #14942, where the one call that observed a failing query finish was handed that failure without consulting the rate the client already held.
• Deferred: bounding how far a held read may travel from the block timestamp it is served to is the next slice, apollo_l1_gas_price: bound Chainlink freshness fallback between blocks #14993. The client is still constructed only by tests until B4.

Detailed Summary for AI Bots

Stacked on #14991. Part of the L1 price oracle replacement split of #14942.

What

Negative caching for the Chainlink client: a failed query's error is held in OracleState::last_error and served to callers with nothing better, and the next query is spawned once failure_retry_interval_seconds elapses instead of on every call.

Why hold a failure

Without it, every fetch_rate against a failing feed spawns a fresh query: two view calls per feed per attempt, on every proposal, for as long as the feed stays broken. A hostile or broken feed would otherwise cost blocking VM executions per block. Holding the failure bounds the retry cadence to one query per retry interval, which is also why the interval is its own config key rather than the sampling interval: a transient failure costs one retry interval, not the rest of the sampling interval.

The precedence rule

A held failure is served only when no valid read is held. Bugbot's first review of #14942 caught an availability regression in exactly this spot: the one call that observed a failing query finish was returned that failure directly, without consulting the rate the client already held. no_call_is_denied_a_rate_the_client_holds is the regression test, asserting every call through the failure's harvest is served the held rate; a_held_failure_does_not_mask_the_last_valid_rate pins the steady state after the failure is held.

A success clears last_error, so the client never reports a failure older than its newest read.

Landing state

• The client is constructed only by tests until B4 wires it into the factory; metrics().register() runs under apollo_l1_gas_price: register each oracle metric set once #14977's Once guard.
• The module doc names source selection, which arrives in B3/B4.
• The [Temporary comment] above RateKind in apollo_l1_gas_price_types is deleted, which is why the title carries two scopes: apollo_l1_gas_price,apollo_l1_gas_price_config: ChainlinkOracleClient query lifecycle #14991's ChainlinkRate: RateKind supertrait bound is the cross-crate justification for its pub that the marker existed to promise.
• Deferred to the next slice: bounding how long a held read may serve across block timestamps (the fallback allowance), including no_call_is_denied_a_rate_the_client_holds.

Testing

4 new tests (82 total). A failing feed is queried once per retry interval, with the batcher call counter flat across ten calls inside the interval; the retry fires exactly at the interval and not one second earlier; a held failure does not mask the last valid rate, including on the very call that harvests the failure.

🤖 Generated with Claude Code