Fail closed when primary VF lookup is Err or missing

[Pitchfork-and-Torch]

Bug

VFCandidateHydrator turns a primary VF Err or a missing result key into visibility_reason = None. VFFilter keeps None.

Some(Err) used to return hydrator Err. Hydrator::update_all skips that write, so the candidate keeps the default None and still serves. A missing map key was written as None directly.

Ok(None) is a successful Allow. That path is unchanged.

This is not #119 (retweet primary looked up by wrapper id). This is not #117 (QuoteHydrator TES / socialgraph). This is not label or TES-flag miss work.

• Entry: VFCandidateHydrator::resolve_visibility (Following uses the same function)
• Sink: VFFilter::should_drop (None => false)
• Break: VF RPC error and omitted id both become Allow
• Viewer effect: a post that VF did not evaluate still serves on For You and Latest Following
• Twin: XaiVfClient::results_to_map already writes UnspecifiedReason for a missing response id. The hydrator was throwing that away on Err and on Strato keys that never come back.

Fix

Stamp FilteredReason::UnspecifiedReason on primary Err and missing key so update_all writes it and VFFilter drops (Some(_) => true). Same sentinel the Xai VF client already uses.

Ancillary Err / missing key now set drop_ancillary_posts so a quote, reply, or retweet whose child was not evaluated is also dropped. Successful ancillary Allow (Ok(None)) is unchanged. Interstitial on a child is still not treated as Drop (leftover).

Tests

• Primary Err stamps UnspecifiedReason (no longer hydrator Err)
• Primary missing key stamps UnspecifiedReason
• Primary Ok(None) stays None (Allow)
• Ancillary Err / missing key drop; ancillary Allow does not
• VFFilter drops UnspecifiedReason and still keeps None

Standalone decision-table harness (same match arms): 12 assertions passed.

cargo test cannot run. Public dump has no Home Mixer manifest.

Leftover

Quote / retweet / ancestor Action::Interstitial still does not set drop_ancillary_posts. Wrapper can survive a soft verdict on the child. Separate from lookup miss.

[Pitchfork-and-Torch]

Parking this intern-stack PR per operator GitHub cleanup (2026-09-08). Hunt notes remain local. Not a reject of the class.

[Pitchfork-and-Torch]

Reopened. This was a serving-path hunt PR parked by mistake during the 2026-09-08 intern-stack cleanup. Not a reject of the class. Leaving it for xAI review.