Following a hex between services
A curse rarely stays where it lands. It hops from one service to the next along the same paths your requests take, and by the time anyone notices, it has reached systems that never touched the original spell.
Tracing makes the path visible. When every request carries a trace ID, a hex shows up as a span with an unexpected passenger, and you can follow it hop by hop back to where it entered. Measure propagation in hops; a healthy system keeps it close to zero.
The gateway is the place to stop it. Inspect incoming spells at the edge, quarantine anything with an unfamiliar signature, and alert the on-call wizard before the hex reaches the treasury. Most curses give up once they meet a well-configured ward.