Sandbox → persistence window → documented verdict → promotion.

Gate one

The sandbox: prove the mechanism where nothing is at stake.

Every candidate begins its life sealed inside the R&D layer — scenario profiles, what-if projections, simulation runs — under a contract with pre-stated expected behavior. The sandbox gate asks the narrowest question in the workflow: does the change do what it claims, mechanically, under controlled conditions? A variant claiming better drawdown behavior must show it in the simulated distributions; a re-weighting claiming EV improvement must show it in the scenario comparison over real evidence. What the sandbox cannot show is durability — a mechanism that works is not yet a mechanism that keeps working — which is exactly why passing gate one earns a candidate nothing except entry to gate two. The architecture manual's phrasing is the operating rule: R&D layers test whether a change is statistically reasonable; they do not rewrite the live system on impulse.

Gate two

The persistence window: superiority must survive time.

The second gate holds the candidate against accumulating evidence across multiple weeks and months, and its rule is the workflow's heart: a profile must look better persistently, not in one flattering sample. The window defeats the failure mode the sandbox can't — a candidate that happened to fit the recent evidence the way an overfitted curve fits its training data. Through the window, the scenario profiles keep comparing the active configuration against the candidate over the growing live record: does the claimed advantage hold as new weeks arrive, or was it a portrait of one lucky stretch? The window has no fixed euphoria exit — strong early results don't shorten it, because strong early results are precisely what overfit candidates show. Time in the window is the price of knowing the difference.

Gate three

The documented verdict: the case is written before the change is made.

A candidate emerging from the persistence window still isn't promoted — it's ready to be argued. Gate three requires the written case: the original contract and its outcome, the persistence evidence, the trade-offs accepted (almost every real improvement costs something somewhere — the document must say what), the exact production parameters changing, and the rollback condition — what post-promotion evidence would reverse the decision. The rollback clause deserves emphasis: committing to reversal criteria before adoption is the same pre-commitment discipline as the scenario contract, applied one level up, and it converts a future bad outcome from a crisis into a documented procedure. A promotion that can't articulate its own reversal conditions isn't confident. It's unexamined.

• The verdict document is the promotion's audit trail — a year later, it answers 'why does the system work this way?'
• Unwritten trade-offs are the ones that surprise you. The document forces them into daylight.
• The rollback condition is decided while neutral, so post-promotion disappointment executes a plan instead of a panic.

Gate four

Promotion is a deliberate event — and it echoes through the stack.

The final gate is the adoption itself, and its defining property is deliberateness: a dated, logged change to the production rules — the trade plan, the workbook parameters, the doctrine documents — never a quiet drift where the sandbox configuration just starts getting used. Promotion also triggers the downstream obligations that keep the wider system coherent: an approved model change is exactly the event the Operating Standard names as legitimate grounds for a benchmark refresh, so the simulation baseline is rebuilt to model the system that now exists; and the post-promotion period inherits the rollback condition as an explicit monitoring assignment. The production system changes rarely, on paper, all at once, in daylight — which is what makes every comparison before and after the change interpretable.

The key idea

The gauntlet is slow because production trust compounds.

Every gate exists to kill a specific failure: the sandbox kills untested mechanisms, the window kills overfit flattery, the verdict kills undocumented trade-offs, deliberate adoption kills drift. What survives all four is rare — and that rarity is the point, because the production system's entire value is that its rules have been the same rules long enough to accumulate provable evidence. A system that promotes easily has no baseline; a system that promotes through the gauntlet has a constitution with an amendment process. The second one compounds.