Thanks for assisting me in troubleshooting this.

I've attached a section of mail.log. Other than replacing my actual domain w/ "domain.tld", I didn't edit it.

I'm probably going to need to increase the logging level to see what's really going on, but it's at least a good introduction to the flow.  (Do you have a suggested postfix logging level to use? If not, I'll play with it until I hopefully get just enough detail to show how it's making its decision to skill the user-level BCC rule and use the domain default.)

The log shows the result of sending 3 mails, one to each of these addresses in sequence:
1. kids@domain.tld
2. kids-x@domain.tld
3. kids+x@domain.tld

GOALS:
- All received emails are BCC'd to copies@domain.tld, and land in one of these folders:
- - kids-in
- - other-in
- Emails to kids' accounts are also BCC'd to charles & michele, landing in their folders:
- - Kids-in

RESULTS:
- Email #1 was BCC'd to everyone and landed in the correct (kids-in, Kids-in) folders.
- Emails #2 & 3 was BCC'd to copies, but landed in "other-in" and were not BCC'd to parents.

Outbound messages work the same way, and have the same problem.

NOTABLE SERVER CONFIG:
Changed character for address tags:
    /etc/dovecot/dovecot.conf
        recipient_delimiter = -  (was +)
    /etc/postfix/main.cf
        recipient_delimiter = -+.  (was +)
Disabled auto-creation of folders based on address “detail” to accommodate  address tagging:
    /etc/dovecot/dovecot.conf:  lda_mailbox_autocreate = no
/etc/postfix/main.cf: always_bcc is NOT set

OpenLDAP (under domainName=domain.tld):
    enabledService=recipientbcc
    enabledService=senderbcc
    domainRecipientBccAddress=copies-other-in@domain.tld
    domainSenderBccAddress=copies-other-out@domain.tld

OpenLDAP (under ou=Users, mail=kids@domain.tld):
    enabledService=recipientbcc
    enabledService=senderbcc
    userRecipientBccAddress=copies-kids-in@domain.tld
    userSenderBccAddress=copies-kids-out@domain.tld

NOTEABLE Sieve filters on "copies" user
# rule:[Drop extra copies]
if header :is "x-sieve-redirected-from" "copies@boling.us"
{
    discard;
    stop;
}
# rule:[kids-in]
if header :contains "delivered-to" "copies-kids-in"
{
    redirect :copy "charles-kids-in@boling.us";
    redirect :copy "michele-kids-in@boling.us";
    stop;
}
# rule:[kids-out]
if header :contains "delivered-to" "copies-kids-out"
{
    redirect :copy "charles-kids-out@boling.us";
    redirect :copy "michele-kids-out@boling.us";
    stop;
}

NOTE:
The messages were actually sent to copies-other-in instead of copies-kids-in, confirming that it's postfix, not dovecot.

It's true that I changed it; support of something other than "+" for a delimiter was a primary requirement for this mail server when I built it two years ago, having been on my wish list for over a decade. "-" is the primary delimiter that I use. Dovecot only supports a single delimiter for automatic folder selection, so it's set to "-". Postfix supports multiple delimiters, so to support delivery of messages to "legacy" addresses, I set its list to include both "-" and "+" (and added "." while I was at it)

Good thing to check, though, since the system wouldn't have received as much testing w/ other delimiters.  To see if the glitch is indeed only triggered when an alternate delimiter was used, I temporarily changed the postfix & dovecot configs both to "+" only (& restarted them), changed the LDAP BCC email addresses, and sent another test mail using "+".  Mail to "kids+x" was BCC'd to "copies+other-in" instead of "copies+kids-in".

The glitch occurs independent of the tag delimiter.