Fail closed when primary VF lookup is Err or missing

[Pitchfork-and-Torch]

Bug

VFCandidateHydrator turns a primary VF Err or a missing result key into visibility_reason = None. VFFilter keeps None.

Some(Err) used to return hydrator Err. Hydrator::update_all skips that write, so the candidate keeps the default None and still serves. A missing map key was written as None directly.

Ok(None) is a successful Allow. That path is unchanged.

This is the clean Pitchfork-main twin of upstream xai-org#121. It supersedes dirty fork #15, which reused the upstream branch and showed 297-file conflicts.

This is not a retweet-wrapper-id lookup bug. This is not QuoteHydrator TES / socialgraph. This is not label or TES-flag miss work.

• Entry: VFCandidateHydrator::resolve_visibility
• Sink: VFFilter::should_drop (None => false)
• Break: VF RPC error and omitted id both become Allow
• Viewer effect: a post that VF did not evaluate still serves
• Twin: XaiVfClient::results_to_map already writes UnspecifiedReason for a missing response id. The hydrator was throwing that away on Err and on Strato keys that never come back.

Fix

Stamp FilteredReason::UnspecifiedReason on primary Err and missing key so update_all writes it and VFFilter drops (Some(_) => true). Same sentinel the Xai VF client already uses.

Ancillary Err / missing key now set drop_ancillary_posts so a quote, reply, or retweet whose child was not evaluated is also dropped. Successful ancillary Allow (Ok(None)) is unchanged. Interstitial on a child is still not treated as Drop (leftover).

Ported onto latest Pitchfork main, including the existing per-safety-level VfVerdicts maps. VFFollowingCandidateHydrator is not on this tree, so it is not in this PR.

Tests

• Primary Err stamps UnspecifiedReason (no longer hydrator Err)
• Primary missing key stamps UnspecifiedReason
• Primary Ok(None) stays None (Allow)
• Hydrate: RPC Err and omitted id both stamp; Allow does not
• Ancillary Err / missing key drop; ancillary Allow does not
• VFFilter drops UnspecifiedReason and still keeps None

cargo test cannot run. Public dump has no Home Mixer manifest.

Leftover

Quote / retweet / ancestor Action::Interstitial still does not set drop_ancillary_posts. Wrapper can survive a soft verdict on the child. Separate from lookup miss.

Upstream: xai-org#121
Supersedes: #15

  

[Pitchfork-and-Torch]

Wrong base (fork PR). Ship vehicle is upstream xai-org#121. Per submit law: never PR Pitchfork-and-Torch/x-algorithm. Do not merge this.