The handoff: what the console passes to the throttle, and in what form.

Why a contract

Modules that share everything eventually corrupt each other.

The lazy integration between two workbooks is total visibility: let each read whatever it wants from the other. It's also how module boundaries dissolve. If the throttle could reach into the console's raw ledgers, it would inevitably start consuming numbers it has no authority to interpret — floating P&L, unsettled outcomes, half-closed cycles — and the interpreter doctrine would erode one convenient lookup at a time. The handoff contract replaces total visibility with a defined interface: a short list of settled, authority-bearing figures that cross the boundary at a defined moment, in one direction at a time. Everything on the list is guaranteed meaningful; everything off the list is structurally invisible. The boundary does the discipline so the operator doesn't have to.

The forward payload

Console → throttle: the settled state the pricing needs.

At the cycle boundary — after the closing cycle's outcomes are settled into the closed ledger and the open book has been re-counted at current stops — the console's side of the contract delivers the inputs the throttle's pricing requires: settled equity and the resulting drawdown-from-peak (which fixes the gate), the active open risk figure at current stops (which fixes carryover), the open positions' count against the four slots, and the closing cycle's compliance notes for the log. Notably absent: floating P&L, in-progress trade narratives, and anything unsettled. The throttle prices the next cycle from this payload plus its own evidence inputs — daily EV state, weekly structural reads, overlays — and nothing else.

The return payload

Throttle → console: the authorization, ready to be enforced.

The second crossing runs the other way. Once the decision engine resolves — gate row applied, tier selected, overlays honored, carryover netted — the throttle hands back the authorization package: the final tier, the cycle pool percent, the per-trade average risk, the fresh-trade count Smart Capacity settled on, any override flag with its logged reason, and the operator directive in words. The console receives this not as information but as law for the opening cycle: slot sizing is checked against it, exposure pressure is measured against its pool, and end-of-cycle compliance is scored against its directive. The throttle decides; the console enforces and witnesses. Neither does both.

Timing discipline

The handoff happens at the boundary, whole, or not at all.

The contract's third clause is temporal. Both crossings belong to the cycle boundary — the seam where the old cycle is settled and the new one not yet open — and the payload crosses complete or waits. A mid-cycle 'partial update' in either direction is a violation even when the updated number is accurate, because downstream arithmetic assumes the package is internally consistent: an open-risk figure re-counted Tuesday paired with an equity figure from Sunday describes an account that never existed. The known legitimate mid-cycle event — a position closing early — updates the console's own ledgers immediately, but its deployment consequences wait for the next boundary, when they enter the next handoff as part of a coherent whole.

• Both crossings at the boundary; neither mid-cycle.
• Payloads cross complete — a partial package is a violation even if each number is individually correct.
• Early closes update the console at once, but re-enter the throttle's arithmetic only at the next boundary.

The key idea

A defined interface is how two authorities cooperate without merging.

The console owns accounting truth. The throttle owns deployment authority. The handoff is the only place they touch, and its formality — fixed payload, fixed direction, fixed moment — is exactly what keeps both authorities intact. Each side can trust everything it receives, ignore everything else, and evolve internally without breaking the other. It is the smallest possible integration, which is why it's the strongest: in governance architecture as in engineering, the modules that share the least surface are the ones that stay correct the longest.