Skip stream entries whose content does not match their trusty URI (fixes #208)

[tkuhn]

Root cause (corrects the diagnosis in #208)

The poison entry (RAAAAA…, counter 88951) has a valid signature but an invalid trusty hash — its content does not hash to its 43-char artifact code (knowledgepixels/nanopub-registry#164). The Jelly layer decodes it as a success item; nothing in the load path verifies the trusty hash, so it passed every constructor check and died in the repo writers:

java.lang.ArrayIndexOutOfBoundsException: Index 30 out of bounds for length 30
	at org.nanopub.NanopubUtils.updateXorChecksum(NanopubUtils.java:419)
	at com.knowledgepixels.query.NanopubLoader.loadNanopubToRepo(NanopubLoader.java:770)

The generic retry loops (8 attempts, backoff up to ~90 s, per repo task, per poll) treated this deterministic error as transient — so each poll cycle ground through ~10–20 minutes of retries, threw, and started over, forever. It was not actually silent (Failed to load nanopub <…> to repo 'full': Index 30 out of bounds lines were present but sparse), and the liveness age stamp already behaves correctly during failing batches — asks 2 and 3 of the issue were based on wrong incident-time observations.

Fix

• NanopubLoader: TrustyNanopubUtils.isValidTrustyNanopub(np) is now the first constructor check (~6 ms/np). On mismatch: ERROR log, note in the admin repo, aborted = true — riding the existing abort flow, so the counter advances past the entry. One bad stream entry can no longer stall ingestion; a future resync sails past counter 88951 with a note instead of wedging. Also guards the latent NPE when getArtifactCode returns null.
• JellyNanopubLoader.loadUpdates: a "loader wedged" ERROR with operator guidance once 3 consecutive batch failures pass without counter movement. Log-only by design — a store outage produces the same signature, and count-based skipping there would silently drop real nanopubs.
• Decode-level (!isSuccess) failures still throw and retry on purpose: truncated stream reads are transient, and skipping would leave holes.

Test

PoisonNanopubSkipTest uses the real captured registry stream segment (?afterCounter=88950 from registry.petapico.org, 2026-08-30) as a fixture: asserts the poison entry is aborted with the note and returns normally from load(), and that the valid sibling entry (88952) is not rejected. The abort path runs entirely on the calling thread, which is what makes it testable against InMemoryTripleStore. All 517 tests pass.

Fixes #208.

🤖 Generated with Claude Code