A design contract states, for one subsystem: its invariants (what must always be true), its case matrix (every input case × the correct behaviour), and its known gaps. It's the artifact a review checks against — different from architecture docs, which describe what the code does.
Every PR that changes a subsystem opens its contract and confirms: (1) no invariant is violated, (2) no matrix cell is left unhandled.