Crash-safe idempotency across grade and evaluation-history stores

Observed 2026-09-05 while integrating COR-4056 in ender-inference (PR #133, merged to staging: https://github.com/e3-solutions/ender-inference/pull/133).

Reusable finding: when one automated evaluation writes a retrievable grade row and append-only evaluation history, generic “durable in any tier” is not enough for crash safety. Commit history only after the exact primary grade row used by restart lookup is durable. On restart, reconcile missing history from that immutable grade row without rerunning the model, validate the original idempotency request digest, and require both stores before finalizing the job. Recovery provenance must come from the grade’s stored rubric/business-rule hashes, not current files. Any privacy tokenization used in persisted trace hashes must also use a process-stable keyed secret; a process-random token key breaks recovery bindings after restart.

Evidence: independent PR review exposed cold-only/legacy-only liveness and current-rubric misattribution gaps; regressions were added for cold-only storage, unconfigured history, replay without regrading, config changes during recovery, and stable redaction across manager instances. Final repository suite: 1,075 passed.