The shared language that keeps every surface honest.

Position sizing takes the minimum. The submitted size is the smallest of the size requested by the agent runtime, called the harness in code, and five named ceilings: gross_notional, leverage, planned_loss_ceiling, loss_budget, and account_margin when the account's own capacity is known. The result is truncated toward zero at the exchange's base-unit precision (entry.ts:208-211), so a size never rounds up past a ceiling.

Two validations run before the sizing math. A stop on the wrong side of entry returns stop_on_wrong_side before any arithmetic runs (entry.ts:226-241). And a size that was asked for is a ceiling, not a suggestion: "Nothing below raises it" (entry.ts:283-287). The harness's only lever for taking less risk than the mandate allows is the number it puts in the request.

Spec §16.2 as six equations. Realized mission result is closed PnL plus net funding minus all paid fees; realized loss used is clamped at zero, so a profitable mission lowers loss-used but never raises the ceiling; open positions and pending entries add their reserved risk; remaining is floored at zero; and exhausted flips when remaining reaches zero (lossAccounting.ts:106-138).

Under exhaustion, only cancel, reduce, close, and modify_stop pass. The comment says why: §16.4 "blocks taking on risk, not managing the risk already open" (lossAccounting.ts:145-158).

Stop movement as staged refusals, in a fixed order chosen so the most fundamental objection wins: wrong_side, then risk_envelope, then breakeven_ratchet, then step_too_large, noise_floor, target_encroachment, and finally adjustment_budget (stopAdjustment.ts:148-234).

The ratchet is the memorable one. Once a stop has crossed to the winning side of entry it stays there: "A trade that can no longer lose does not get to become one that can again" (stopAdjustment.ts:179-180). Comparisons use a PRICE_EPSILON of 1e-9 so a stop moved exactly to a cap is not refused by floating-point residue (stopAdjustment.ts:236-241).

Missing values do not invent directional risk. When a stop or weighted entry is missing, the directional loss-to-stop term contributes zero rather than full notional. Booking a missing stop as a zero price would book the entire notional of a long against the budget and exhaust it instantly. Instead "a missing stop is reported honestly as 'no directional risk reserved,' never as 'maximum risk'" (lossAccounting.ts:33-59). Fees and slippage still count; only the unknown term is zero.

Replaying an accepted commandId returns the original result sequence, not a second execution. A rejected one fails forever after with OrchestrationCommandPreviouslyRejectedError: a rejection is sticky. And a receipt aimed at a different aggregate raises OrchestrationCommandIdConflictError, because "A receipt only proves this exact command was handled" for that aggregate. Replaying it elsewhere would report success for work that never happened.

Every execution derives its client order id from SHA-256 over missionId, executionSequence, and actionType, truncated to 16 bytes and hex-encoded with the 0x prefix the exchange validates. Retries of the same action reuse every input, so they reuse the cloid.

One nuance from the implementation: "A cloid is a correlation id, not an idempotency key." Retry safety belongs to the executor, which refuses to resubmit a record that already reached the exchange; the stable cloid is what lets a fill be joined back to the execution that caused it (packages/hyperliquid/src/Cloid.ts:4-14). The prefix is load-bearing: an unprefixed cloid was once silently stored as null by the exchange, leaving a fill unjoinable to its own entry (Cloid.ts:20-23).

Watch fires and other wake sources land in a table with a unique index on (mission_id, deduplication_key), so "reconnects and replays drop duplicates before they generate a second wake-up". A watch fires exactly once even when the market feed reconnects mid-evaluation.