PREVIEW. This endpoint is deployed but gated: it returns 404 unless the hosted app platform is enabled for your organization. It is published here so the contract describes the whole surface, not so it can be called today.

Set this app's hard credit cap for a window.

set_limit and clear_limit shipped with the repository layer (repositories/usage.py:198,229), with a Protocol (contracts.py:957) and tests, and NO route ever called them. So a builder could read their cap and could never set one, and the only way a limit row came into existence was by hand.

That matters more than a missing endpoint usually would: in a builder-pays model the cap is the entire spend-safety story. Enforcement was complete and unreachable.

Same shape as the #16816 bug, where store_credential and revoke_credential shipped without callers so no service token could ever be minted.

SINGULAR /limit, not /limits. The read half is singular and is frozen that way in openapi_operation_ids.json and the published bundle; adding a plural verb would put two spellings of one resource in the public contract forever.