DoH circuit breaker counts endpoint-switch cancellations as failures and resets on any success

[kasnder]

Found in a correctness review of the DNS path (the malformed-query poisoning variant is already fixed by #753; these accounting gaps remain).

Endpoint switches convert in-flight queries into failure counts. DnsOverHttpsClient.getInstance(context, endpoint) (DnsOverHttpsClient.java:111-119) shuts the previous client down asynchronously via dispatcher().cancelAll() (:158-166). Pool threads still inside resolve() on the old client fail immediately, and DnsProxyServer counts every null resolve() as a DoH failure (UDP DnsProxyServer.java:244-272, TCP :377-387). Switching endpoints under load can add several instant failures and trip the breaker against the new, healthy endpoint — SERVFAIL for every app for 60s right after a settings change.

Any single success resets the counter. A successful response sets dohFailures = 0 and clears circuitOpenUntil (DnsProxyServer.java:252-253). A persistently dead endpoint that occasionally serves an HTTP-cached answer may therefore never trip the breaker, stretching full-SERVFAIL windows indefinitely.

One global counter conflates paths. dohFailures is shared by the UDP and TCP handlers, so failures from one transport mask or trigger the other.

Suggested direction: don't count cancellations caused by our own shutdown(); replace reset-on-success with a time-windowed failure rate; optionally per-path counters.

[kasnder]

Closing: one half is fixed, the other is working as intended.

Cancellation counted as failure — fixed. #768 landed the guard in DnsOverHttpsClient.resolve(): an IOException on a call that call.isCanceled() returns null without reporting, so an endpoint switch no longer trips the breaker against the healthy new endpoint. Covered by resolveDoesNotReportCanceledCallAsFailedAttempt.

"Resets on any success" — leaving as is. dohFailures.set(0) on success is still there, but #768 also changed the accounting to charge Math.max(1, queryFailedAttempts.get()) per query rather than 1. With up to three attempts per query, a flapping endpoint now trips after ~3–4 bad queries instead of needing ten consecutive clean failures, which removes most of the force of the original report. Resetting on success is the fail-open behaviour we want on a path that must not stay broken.

One loose end found while checking, fixed in #775. The two oversized-body branches added by #771 continue without calling reportFailedAttempt() — the only unusable-response paths that don't. Not "never trips the breaker" (the Math.max(1, …) floor still applies), but it meant an endpoint returning nothing but oversized bodies cost one failure per query however many attempts it burned: ten queries to trip, where every other failure mode takes three.