Clause reference

The figures below are the mandate used in the recorded incident. They are a mandate, not a protocol constant: an owner signs whatever bounds they choose, and the guard enforces exactly those.

The measure the composition clauses are taken over

Sixty minutes, and trailing rather than tumbling. A window that reset on the hour would not be a bound at all: an agent spends the whole aggregate, waits for the boundary and spends it again, which is the structuring this product exists to name, one level up.

The measure is exact. The guard keeps a ledger per mandate (when each action settled, what it moved, and whether it counted against the concentration clause) and every evaluation sums the entries still inside the window. There is no estimate to reconcile, no residual to disclose, and no second reading of the same window that could disagree with the first: headroom and the stored figures are one answer, because there is only one place the answer comes from.

Exactness is what has to be paid for, and the price is a storage read per admitted action per ancestor. So the length of the ledger is the length of the bound: clause 3.5 may admit at most sixteen actions to a window, and the registry refuses a mandate asking for more rather than registering an instrument whose own enforcement could run out of gas. Once the ledger is full it is a ring, and the rate clause guarantees the entry about to be overwritten has already fallen out of the window.

Child mandates narrow monotonically and must carry an equal windowSeconds: a shorter child window resets faster than the parent it debits, which would be the bypass. Clause 2.5 narrows upward: a child that would accept less back than its parent does is the same widening, written the other way up. A window of zero seconds is refused at registration, because every action would roll the epoch and the composition tier would silently measure nothing.

Clause 2.5, and why it is not a slippage setting

The guard calls the venue with calldata the agent wrote, and every production router takes a recipient. So a mandate that bounds only how much leaves does not bound what the owner keeps: the agent can address the proceeds elsewhere, or accept a tenth of their value, and every notional clause is satisfied. minAmountOut is the agent’s parameter, and a value the caller controls is not a constraint.

Clause 2.5 is the owner’s term instead: a floor in basis points of what left, expressed in the output leg’s own units: both legs' decimals are read once, at registration, and stored with the instrument. It is checked twice. Before the branch, so an agent asking for less than the floor is held and recorded like any other breach. And on the measured result, where proceeds that went somewhere else appear as a balance that never arrived: a hold is impossible at that point, so that one reverts.

It needs no oracle, because it is not a price feed: it is a bound the owner states, the way they state every other one. A mandate may state no floor at all, and zero says so explicitly rather than leaving a protection quietly missing.