AP-1 A ceiling on what the surface costs

Each surface a product serves to agents, its tool schemas, skill descriptions and bodies, and command responses, MUST carry a token ceiling that a gate enforces, raised only with its reason written beside the number or in the commit that raises it.

Field	Value
Keyword	MUST
Level	profile
Checked	by judgement
Findings	F406, F4
Harness facts	H3, H9
Threat	internal: freewilly's budget borrows Shio's argument
Status	active

Rationale: Shio, roadkeep, freewilly and winwright each measured what their surface costs a consuming agent and held it under a ceiling read by a test or lint (F406, R3/S4). Shio's tool-list test failed on a real change, "3 tokens over its 2200 ceiling" [shio@821f18d74:docs/CHANGELOG.md#L22], and a description was trimmed instead. The ceiling did not stop growth in roadkeep, where the session ceiling was raised twelve times; what it did was make each raise a written decision with the task that paid for it (F4, R3/S4), which is why the reason is part of the rule. The two costs are priced apart because a skill's description is paid every session and its body only when used (H3). H9 bears on tool schemas: with tool search on, the documented default, not every definition is sent up front, so a schema ceiling measures serialized size, which is not in doubt, rather than a cost every session is certain to pay. A change to H9 re-opens that part.