fix(mmle): wrap stale marginal ABI TypeError as RuntimeError

[cursor]

Scope

Close the residual fail-closed hole on #823: a version-matched fit_marginal callable that rejects the current keyword contract must raise the package-owned ABI RuntimeError, never a leaked TypeError and never NumPy production arithmetic.

Test-first lineage

#823 already rejects missing, malformed, stale, and future MARGINAL_CAPABILITY_VERSION before dispatch. Review of head 59332c93 found that after capability == 1 and callable(fit_marginal), only ValueError was wrapped. A stale keyword signature still leaked TypeError.

Implemented GREEN

• Catch TypeError from native fit_marginal and raise the existing ABI RuntimeError with causal chaining.
• Add a public fit(..., estimator="mmle", model="MLS2PLM") regression that injects a version-1 callable raising keyword TypeError and asserts no NumPy fallback.
• Make the missing-entrypoint ownership test inject the incomplete core so it does not depend on a compiled extension being importable.
• Compare the compiled export assertion to fit._MARGINAL_CAPABILITY_VERSION.

Boundaries

No NumPy production fallback, no formula redesign, and no gate weakening. Prefer this branch over merging #823 as-is.

Next action

Review this successor, wait for exact-head required checks, then merge this PR and close #823 as superseded.

  

[cursor]

Review: #933 head 094616e7

This successor closes the residual on #823 59332c93. After MARGINAL_CAPABILITY_VERSION == 1 and a callable fit_marginal, a stale keyword signature is now raised as the package-owned ABI RuntimeError (with causal chaining) and does not leak TypeError or enter fit_marginal_numpy.

No merge-blocking source defect on this head.

What was checked

• python/fast_mlsirm/fit.py fail-closed import, integer capability gate, callable gate, and except TypeError wrap around the native call.
• Rust export of MARGINAL_CAPABILITY_VERSION = 1 next to the existing fit_marginal keyword contract (pop_kind, anchors, covariates, zero-inflation).
• Ownership tests inject the incomplete / stale _core via fast_mlsirm._core (honored by from . import _core). Local PYTHONPATH=python pytest on the three new files: 9 passed, 1 skipped (test_compiled_rust_core_exports_current_marginal_capability without a compiled extension; CI builds the extension).
• backend="auto" is still fail-closed at resolve_backend when _core is missing; the new auto test covers the production path once it has already resolved to rust.

Not blocking (do not open a competing MMLE PR)

• The TypeError handler is broader than unexpected-keyword failures. That is acceptable fail-closed behavior; the original exception remains on __cause__.
• A version-1 callable that accepts the keywords but returns an incomplete dict can still leak KeyError after the call. Out of scope for this wrap.
• Pre-existing: Rust fit_marginal accepts singlefree while the invalid-pop_kind error text omits it. Not introduced here.

Next action

1. Mark this draft ready for review once required checks are green on this exact SHA (094616e7454fbec8241ada1405f06306f5dfd4ad).
2. Get a non-author approval. This automation will not approve or merge its own lineage.
3. Merge #933, then close #823 as superseded. Do not merge #823.
4. Do not open another marginal-MMLE ABI PR while this is the landing vehicle.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.