Five @Nested cap surfaces (envs, apps, outbound, alert rules, users) share a single synthetic license with cap=1 each. Each test pushes just past the cap and verifies the standard 403 envelope plus a cap_exceeded audit row. Per-limit ITs cover full per-cap behavior; this IT catches accidental wire-rip regressions across all caps. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>