Held-out architecture tests generalisation

The strongest line in the spec is a concession written in advance: the conformance models cannot prove generalisation, because the ABI was designed against them. Only a held-out architecture, onboarded after freeze under zero format changes, tests fit versus generality — and if it fails, the portable-substrate claim is downgraded in the success criteria themselves. The bar cannot drift; it is written down before the results are.

OPEN · E8 — runs after the freeze, by design