Stop one malformed event wedging the indexer forever #179

Background

parseEvents (src/decoder.ts:146-163) calls parseEvent in a bare loop with no try/catch. But parseEvent throws — there are six throw new Error("Malformed …") sites at src/decoder.ts:98, 103, 109, 113, 120, 124, and src/__tests__/decoder.test.ts:75-96 asserts that it throws.

Its own docstring at line 143 claims it is "silently skipping unrecognised or malformed ones". It isn't. The throw escapes pollOnce (src/indexer.ts:318) into the loop catch at src/indexer.ts:519-523, which sleeps and retries the identical ledger range forever. One bad event on chain stops indexing permanently, and the only symptom is a repeating log line.

Acceptance criteria

• parseEvents wraps each parseEvent in try/catch, counts failures, and returns the good records
• A batch of [good, malformed, good] returns 2 records instead of throwing — fails on main
• The skipped-decode count is logged distinctly from the existing "non-token events" count
• parseEvent keeps throwing; only the batch wrapper changes
• An events_skipped_total{reason} counter in src/metrics.ts

Drips Wave · Complexity: Easy · 100 points

How this repo is laid out

Wraith is a Soroban incoming-transfer indexer: it fills the gap Horizon leaves for SAC/SEP-41 token events by recipient address. Roughly 14k lines under src/, REST + GraphQL + WebSocket, Postgres via Prisma, deployed on Render.

• Unit tests are jest (src/**/__tests__, tests/*.test.ts), with a coverage gate.
• Integration tests are vitest (tests/integration/, vitest.integration.config.ts, Docker).
• Don't mix the two runners in one file.

Known state of main before you start

tsc --noEmit and the unit suite are green. The Integration tests CI job is red, and so is Load test — both predate this batch. Open PRs #177 and #178 address them. If the integration job is red when you open a PR, that is not your fault; say so in the PR and carry on.

Four modules are shipped, closed as done, and imported by nothing: src/indexer/checkpoint.ts, src/ingest/reorg.ts, src/middleware/opa.ts, and src/api/candles.ts + src/workers/ohlc-refresh.ts. So the live indexer today has no reorg handling and no atomic checkpointing, despite both features being closed. Two issues below start unpicking that — don't assume a closed issue means a wired feature.

Ground rules

• Every PR needs a test that fails before the change and passes after, unless the issue says otherwise.
• Don't widen a Prometheus label to something unbounded — addresses and contract ids must never become label values.
• Nothing may log or return a raw database error, a connection string, or a provider URL.
• Don't reformat a file you're changing. A diff that is 90% whitespace hides the 10% that matters.

Required: Before submitting, join the contributor Telegram so your work can be tracked and counted toward the Stellar Wave: https://t.me/+fxHXq8f1SwlkZDBk