The override exists — and every use of it is priced.

Why an override exists at all

Systems without legal exceptions generate illegal ones.

The argument for including an override is empirical rather than philosophical. Every rule set eventually meets a situation its authors didn't anticipate, and an operator facing that situation with no sanctioned exception will simply act outside the system — silently, unrecorded, and with no mechanism for later review. That outcome is strictly worse than a documented departure, because it corrupts the evidence record as well as the decision. So MARS provides a path: Force Full Tier Risk and manual throughput overrides exist, they work, and they are treated as exception-only. The design goal was never zero overrides. It was zero invisible ones.

The price

The override's cost is that it announces itself, permanently.

Using the override is cheap in the moment and expensive in the record, which is exactly the intended shape. Each use requires a logged reason at the time. Each use enters the cycle decision log and the dashboard analytics. And each use accumulates into the override-stress statistics that the benchmark maintains specifically to stop manual override from becoming a habit — the simulation layer tracks how often full-throughput override would exceed authorized pool, and the live comparison reads override frequency as one of its cross-checks. A single logged override with a specific reason is a defensible decision. A pattern of them is a finding, and the system will surface it whether or not the operator goes looking.

The legitimacy test

What separates a defensible override from a rationalized one.

The distinguishing feature is that a legitimate override cites information the engine structurally cannot see, not a disagreement with information it can. The engine doesn't know that a scheduled event invalidates the cycle's normal assumptions, or that an execution constraint makes the authorized structure impractical. Those are legitimate grounds. What is not: the tier feels too low after a strong week, the drawdown feels like it should be over, the setups look exceptional so surely more risk is warranted. Each of those is arguing with an input the engine already weighed — daily EV, gate state, structural permission — and the argument is being made by the party with the most immediate incentive to deploy. The engine's published reasoning makes this test practical: an override has to name which layer it's contradicting.

• Legitimate: information outside the engine's inputs entirely. Illegitimate: a different opinion about the engine's own inputs.
• Overrides that reduce deployment aren't overrides at all — declining authorization is always free.
• An override that can't name the specific layer it contradicts hasn't been thought through enough to log.

The hard boundary

What the override can never do.

The override operates on throughput and tier deployment inside the system's authority — it does not reach the gate ladder. No override lifts a gate cap, reopens a locked system, or authorizes deployment past the capital-state ceiling. This is the one place where the hierarchy admits no exception mechanism at all, and the reason is the same asymmetry that put capital state at the top of the stack: overriding an opportunity assessment risks one cycle's outcome, while overriding a capacity constraint risks the account. The override is a tool for disagreeing with the system's read of an opportunity. It was never a tool for disagreeing with arithmetic about what the account can survive.

The key idea

Visibility, not prohibition, is what keeps the exception rare.

The override's deterrent is structural rather than moral: it works because using it generates a record that follows the decision into every subsequent review, and because its frequency is measured against a benchmark that treats casual override as a governance failure. That's a system an honest operator can live with — the exception stays available for the situations that genuinely warrant it, and stays uncomfortable enough that the situations that don't warrant it rarely survive the requirement to write down why.