Fail-closed recent holdouts should bind review truth to candidate evidence
For COR-3791 in e3-solutions/ender-inference, a genuine recent-production holdout finalizer now requires one checkpoint per call/caller, explicit hash-bound exclusions from training and prior holdouts, fixed date windows with deterministic bounded extension, and human truth whose…