diff --git a/audit/SKILL.md b/audit/SKILL.md
index c635024..0bfb77b 100644
--- a/audit/SKILL.md
+++ b/audit/SKILL.md
@@ -110,12 +110,23 @@ The orchestrator picks per item:
   commits always exist at cycle close — they carry the architect
   findings, the regression numbers, and the resolution.
 
+  A carry-on is honoured only with positive evidence the architect
+  actually reviewed: a non-empty **What holds** in its report (the
+  design commitments it confirmed it read). A bare `clean` with
+  nothing held — especially when Step 2 was a no-op (no regression
+  scripts, so the architect is the *sole* gate) — reads as an
+  unreviewed run, not a clean cycle; re-dispatch rather than close
+  on it. (The architect owes this itself — `agents/architect.md`
+  Red Flags, "about to return clean without having read the diff in
+  full"; the gate verifies it rather than trusting the status.)
+
 ## Handoff Contract
 
 `audit` hands to the orchestrator:
 
 | Field | Content |
 |-------|---------|
+| `holds` | architect's **What holds** — the 1-3 design commitments the cycle preserved (`agents/architect.md` Output format). Non-empty is the evidence-of-review the carry-on gate checks; an empty `holds` reads as an unreviewed run. |
 | `drift_items` | prioritised list (path + 1-line justification) from architect |
 | `regression_results` | per script: exit code + **raw output verbatim** (no rounding, no summarisation — the orchestrator second-guesses with the full numbers) |
 | `recommendation` | per-item: `fix` / `ratify` / `carry-on` |
diff --git a/docs/pipeline.md b/docs/pipeline.md
index 352e8b6..8b47a1e 100644
--- a/docs/pipeline.md
+++ b/docs/pipeline.md
@@ -90,7 +90,14 @@ hold:
    and its status roll-up is `clean`: every scenario
    demonstrably delivers what the milestone promised; no open
    `bug` findings; `friction` / `spec_gap` findings resolved or
-   ratified into the design ledger.
+   ratified into the design ledger. A `clean` roll-up is honoured
+   only with positive evidence the test actually ran — at least
+   2 examples in the working tree (`examples_added`). A `clean`
+   with fewer, over a milestone that touched user-visible surface,
+   is itself a `spec_gap`, not a clean close (the agent owes the
+   same floor — `fieldtest/agents/fieldtester.md` "What you DO NOT
+   ship"; the gate verifies it rather than trusting the roll-up). The empty
+   report is valid only when no example was applicable.
 
 The milestone fieldtest is the milestone-wide variant of the
 `fieldtest` skill: the same fieldtester agent, a carrier scoped