Fix fail-open hydration: drop tweets when label or TES flag lookup fails

[Pitchfork-and-Torch]

Bug

Safety-critical tweet metadata fail-open on miss.

SafetyLabelHydrator collapsed lookup errors and missing keys into SafetyLabelMap::default(). VF tweet-label rules then saw unlabeled and allowed.

TesHydrator.assemble_tweet_features treated TES timeout/RPC Failed the same as Ok(None): nsfw_user, nsfw_admin, nullcast, takedown, and media became false. fetch_pure_core then omitted Err/None, and build_tweet_features unwrap_or_default wiped any Found flag bits. TweetNsfwUserDropRule / TweetNsfwAdminDropRule (OON), NullcastedTweetDropRule, and takedown/DMCA drops allowed.

This is not VF dual-role merge (PR 55 / residual 90). Not mute/block (PR 23 / PR 9). Not author/graph hydration (PR 7). Not HM TES miss wiping retweet/reply ids (PR 94).

Fix

On label miss, do not insert an empty map. On TES flag RPC Failed or missing core, mark the tweet. Found flag bits stay attached even when core is absent. Assemble sets safety_hydration_failed. SafetyHydrationFailureDropRule is the first TimelineHome / TimelineHomeRecommendations RuleSpec row and drops on that flag.

Ok(None) on a flag RPC still means the tweet is not flagged.

Proof

• Entry: SafetyLabelHydrator / TesHydrator.get_nsfw_user and fetch_pure_core
• Sink: VF tweet-label drops and TES flag drops (empty/false = allow)
• Break: None arm inserted SafetyLabelMap::default(); TES Failed used unwrap_or(false); core miss discarded Found flags
• Viewer effect: NSFW, nullcast, or takedown tweet still serves when the lookup errors
• Twin: PR 7 author/graph fail-closed via safety_hydration_failed

Tests

• hydrate_fails_closed_on_lookup_errors
• hydrate_fails_open_on_missing_results (successful empty labels still present)
• tes_nsfw_flag_rpc_failure_is_safety_critical
• tes_nsfw_flag_not_found_is_not_safety_critical
• assemble_keeps_found_nsfw_flag_when_core_missing
• assemble_marks_failed_safety_label_hydration_without_dropping_candidate
• assemble_marks_failed_tes_tweet_flag_hydration
• failed_safety_label_hydration_fails_closed_on_both_home_surfaces
• unit tests added; cargo test cannot run in the public dump

[Pitchfork-and-Torch]

Parking this intern-stack PR per operator GitHub cleanup (2026-09-08). Hunt notes remain local. Not a reject of the class.

[Pitchfork-and-Torch]

Reopened. This was a serving-path hunt PR parked by mistake during the 2026-09-08 intern-stack cleanup. Not a reject of the class. Leaving it for xAI review.