docs: add resource-limits page, rename cycles-costs to cycle-costs (#267)

## Summary

- Adds `docs/references/resource-limits.md` as a dedicated reference
page, separated from cycle costs (different reader intent: execution
constraints vs. billing)
- Renames `references/cycles-costs.md` → `references/cycle-costs.md` and
fixes the title to "Cycle costs" (natural English compound noun,
consistent with the page's own description)
- Removes the condensed resource limits table from `cycle-costs.md`;
replaces it with a cross-reference to the new page
- Updates all 16 inbound links across 19 files; links in
`execution-errors.md` and `ic-interface-spec/canister-interface.md` that
were pointing to limit-related content now point to `resource-limits.md`
with proper section anchors (`#message-limits`, `#memory-limits`)
- Adds `resource-limits` sidebar entry between `cycle-costs` and
`subnet-types`

**Resource limits page coverage** (ported from dfinity/portal
`docs/building-apps/canister-management/resource-limits.mdx`, which the
portal placed as a standalone page under canister-management):
- Message limits
- Instruction limits
- Memory limits (including stable memory per-message access limits)
- Wasm module limits
- Subnet limits
- Execution thread limits
- Canister environment variables
- Performance characteristics (prose)
- Additional notes: ingress expiration, Wasm validation rules

## Sync recommendation

`informed by dfinity/portal
docs/building-apps/canister-management/resource-limits.mdx` —
hand-maintained going forward; upstream tables should be cross-checked
against the IC interface spec on spec version bumps.

Author: marc0olo

docs/concepts/chain-key-cryptography.md

@@ -98,7 +98,7 @@ The following master keys are deployed at the time of writing. The Network Nervo
 
 Test keys are available for development and run on smaller subnets with lower signing costs. They should not be used for anything of value. Production keys run on high-replication subnets (34+ nodes) for stronger security guarantees. Each key is also reshared to a backup subnet for availability: if the signing subnet fails, the backup can take over without generating a new key.
 
-For signing costs, see [Cycles costs](../references/cycles-costs.md).
+For signing costs, see [Cycle costs](../references/cycle-costs.md).
 
 ## Supported chains
 

docs/concepts/cycles.md

@@ -120,7 +120,7 @@ The tradeoff is that developers must forecast and fund usage upfront rather than
 - [Cycles Management](../guides/canister-management/cycles-management.md): how to check balances, top up canisters, and set freezing thresholds
 - [Calls with attached cycles](../guides/canister-calls/inter-canister-calls.md#calls-with-attached-cycles): attach cycles to an inter-canister call and use the proxy canister pattern for the CLI
 - [Cycles ledger reference](../references/system-canisters.md#cycles-ledger): canister IDs, interface specification, and CMC integration
-- [Cycles Costs Reference](../references/cycles-costs.md): exact cost tables for all operations
+- [Cycle costs](../references/cycle-costs.md): exact cost tables for all operations
 - [Canisters](./canisters.md): canisters as the paying entity for compute and storage
 
 <!-- Upstream: informed by dfinity/portal docs/building-apps/essentials/gas-cost.mdx, docs/building-apps/getting-started/tokens-and-cycles.mdx; learn hub staging: canister-smart-contracts/cycles.md, canister-smart-contracts/cycles-ledger.md -->

docs/concepts/https-outcalls.md

@@ -76,7 +76,7 @@ The cost depends on two factors:
 
 If you omit `max_response_bytes`, the system assumes the maximum of 2 MB and charges accordingly: roughly 21.5 billion cycles on a 13-node subnet. Always set this to a reasonable upper bound for your expected response to avoid overpaying. Unused cycles are refunded.
 
-For exact pricing formulas, see the [cycles costs reference](../references/cycles-costs.md).
+For exact pricing formulas, see the [cycles costs reference](../references/cycle-costs.md).
 
 ## Limitations
 
@@ -110,5 +110,5 @@ One extension is under consideration that may affect architecture decisions:
 
 - [HTTPS outcalls guide](../guides/backends/https-outcalls.md): practical how-to with code examples in Motoko and Rust
 - [Chain Fusion: Ethereum integration](../guides/chain-fusion/ethereum.md): uses HTTPS outcalls via the EVM RPC canister
-- [Cycles costs reference](../references/cycles-costs.md): detailed pricing formulas
+- [Cycles costs reference](../references/cycle-costs.md): detailed pricing formulas
 <!-- Upstream: informed by dfinity/portal docs/references/https-outcalls-how-it-works.mdx -->

docs/guides/backends/https-outcalls.mdx

@@ -146,7 +146,7 @@ For reference, on a 13-node subnet:
 - Per request byte: 5,200 cycles
 - Per `max_response_bytes` byte: 10,400 cycles
 
-See [Cycles costs](../../references/cycles-costs.md#https-outcalls) for the full pricing table.
+See [Cycles costs](../../references/cycle-costs.md#https-outcalls) for the full pricing table.
 
 ## Limitations and pitfalls
 
@@ -166,6 +166,6 @@ Use the "Full example in ICP Ninja" links above to deploy and test directly in t
 - [Management canister reference](../../references/management-canister.md#http_request): full `http_request` parameter reference including all fields
 - [Exchange Rate Canister (XRC)](https://github.com/dfinity/exchange-rate-canister): a production service powered by HTTPS outcalls that fetches digital asset and fiat exchange rates
 - [Chain Fusion: Ethereum](../chain-fusion/ethereum.md): the EVM RPC canister uses HTTPS outcalls under the hood
-- [Cycles costs](../../references/cycles-costs.md#https-outcalls): outcall pricing details
+- [Cycles costs](../../references/cycle-costs.md#https-outcalls): outcall pricing details
 
 {/* Upstream: informed by dfinity/portal docs/building-apps/network-features/using-http/https-outcalls/; dfinity/examples send_http_get, send_http_post */}

docs/guides/backends/timers.mdx

@@ -215,7 +215,7 @@ Timer tasks are added to the canister's input queue. If the canister or subnet i
 
 The canister output queue is limited to 500 messages. This caps how many timers can fire in a single round. The CDK also enforces internal rate limits (250 concurrent timer calls globally, 5 per interval timer).
 
-See [Cycles and costs](../../references/cycles-costs.md#cost-table) for current pricing.
+See [Cycles and costs](../../references/cycle-costs.md#cost-table) for current pricing.
 
 ## Heartbeats (legacy)
 
@@ -279,6 +279,6 @@ For a complete working example with cycle tracking and multiple timers:
 
 - [Canister lifecycle](../canister-management/lifecycle.md#what-happens-during-an-upgrade): init, pre/post-upgrade hooks
 - [Timers (concept)](../../concepts/timers.md): how the IC protocol timer works
-- [Cycles and costs](../../references/cycles-costs.md#cost-table): current pricing
+- [Cycles and costs](../../references/cycle-costs.md#cost-table): current pricing
 
 {/* Upstream: informed by dfinity/portal docs/building-apps/network-features/periodic-tasks-timers.mdx, docs/building-apps/network-features/time-and-timestamps.mdx, dfinity/cdk-rs ic-cdk-timers/src/lib.rs, and caffeinelabs/motoko-core src/Timer.mo */}

docs/guides/canister-management/cycles-management.mdx

@@ -57,7 +57,7 @@ icp cycles balance -n ic
 # Output: ~5T cycles
 ```
 
-**Budget guidance:** Plan for 1–2T cycles per canister as a starting balance. A simple backend canister with moderate traffic costs roughly 0.1–0.5T cycles per month, though this varies with storage and call volume. See the [cycles costs reference](../../references/cycles-costs.md#cost-table) for per-operation pricing.
+**Budget guidance:** Plan for 1–2T cycles per canister as a starting balance. A simple backend canister with moderate traffic costs roughly 0.1–0.5T cycles per month, though this varies with storage and call volume. See the [cycles costs reference](../../references/cycle-costs.md#cost-table) for per-operation pricing.
 
 ## Checking canister cycle balances
 
@@ -370,7 +370,7 @@ icp canister top-up backend --amount 1T -n ic
 
 - [Canister settings](settings.md): Freezing threshold, memory allocation, compute allocation
 - [Canister lifecycle](lifecycle.md): Create, install, upgrade, and delete canisters
-- [Cycles costs reference](../../references/cycles-costs.md#cost-table): Exact cost tables per operation
+- [Cycles costs reference](../../references/cycle-costs.md#cost-table): Exact cost tables per operation
 - [Cycles](../../concepts/cycles.md): Why canisters pay for execution and how the cycles ledger works
 - [Cycles ledger reference](../../references/system-canisters.md#cycles-ledger): Canister IDs and interface specification
 - [Calls with attached cycles](../canister-calls/inter-canister-calls.md#calls-with-attached-cycles): attach cycles to an inter-canister call and accept them in the callee

docs/guides/canister-management/optimization.md

@@ -231,7 +231,7 @@ Most production canisters benefit from combining several techniques:
 ## Next steps
 
 - [Large Wasm](large-wasm.md): when binary size exceeds the upload limit
-- [Cycles costs](../../references/cycles-costs.md): how Wasm size and instruction count map to cycle charges
+- [Cycles costs](../../references/cycle-costs.md): how Wasm size and instruction count map to cycle charges
 - [Canister lifecycle](lifecycle.md): how optimized builds integrate with the icp-cli deploy workflow
 
 <!-- Upstream: informed by dfinity/portal — docs/building-apps/advanced/optimize/rust.mdx; docs/building-apps/advanced/optimize/motoko.mdx -->

docs/guides/canister-management/settings.mdx

@@ -69,7 +69,7 @@ settings:
 
 A value of `50` means the canister gets 50% of an execution core and is scheduled at least every other round. A value of `100` means the canister runs every round.
 
-Compute allocation incurs a rental fee based on time and allocation percentage, regardless of whether the canister actually executes. This increases idle [cycle](../../concepts/cycles.md) consumption. See [cycles costs](../../references/cycles-costs.md#compute-allocation) for pricing details.
+Compute allocation incurs a rental fee based on time and allocation percentage, regardless of whether the canister actually executes. This increases idle [cycle](../../concepts/cycles.md) consumption. See [cycles costs](../../references/cycle-costs.md#compute-allocation) for pricing details.
 
 ### Memory allocation
 
@@ -90,7 +90,7 @@ Supported suffixes: `kb` (1,000), `kib` (1,024), `mb` (1,000,000), `mib` (1,048,
 
 When set, the canister draws new Wasm and stable memory from the pre-allocated pool. If usage exceeds the allocation, additional memory is allocated on demand and may fail if the subnet is at capacity.
 
-Like compute allocation, memory allocation incurs a rental fee based on time and allocated amount, regardless of actual usage. See [cycles costs](../../references/cycles-costs.md#storage-reservation) for pricing.
+Like compute allocation, memory allocation incurs a rental fee based on time and allocated amount, regardless of actual usage. See [cycles costs](../../references/cycle-costs.md#storage-reservation) for pricing.
 
 ### Freezing threshold
 
@@ -454,7 +454,7 @@ How you configure controllers depends on the trust model for your canister:
 
 - [Canister lifecycle](lifecycle.md): Create, deploy, upgrade, stop, and delete canisters.
 - [Cycles management](cycles-management.md): Monitor and top up cycle balances.
-- [Cycles costs reference](../../references/cycles-costs.md#compute-allocation): Pricing for compute and memory allocation.
+- [Cycles costs reference](../../references/cycle-costs.md#compute-allocation): Pricing for compute and memory allocation.
 - [Management canister reference](../../references/management-canister.md): Full interface specification.
 
 {/* Upstream: informed by dfinity/portal (docs/building-apps/canister-management/settings.mdx, docs/building-apps/canister-management/control.mdx, docs/references/_attachments/ic.did (snapshot_visibility field); dfinity/icp-cli) docs/reference/canister-settings.md, docs/reference/cli.md; dfinity/icskills: skills/cycles-management/SKILL.md */}

docs/guides/canister-management/subnet-selection.md

@@ -133,7 +133,7 @@ Subnets enforce a storage reservation policy above 750 GiB of total utilization.
 
 If you expect your canister to use significant storage, check the current utilization of candidate subnets on the [ICP Dashboard](https://dashboard.internetcomputer.org/subnets) before deploying. Choosing a subnet with available headroom avoids unexpected reservation costs as your canister grows.
 
-For details on storage costs and the reservation formula, see [Cycles costs](../../references/cycles-costs.md#storage-reservation).
+For details on storage costs and the reservation formula, see [Cycles costs](../../references/cycle-costs.md#storage-reservation).
 
 ## Troubleshooting
 
@@ -152,7 +152,7 @@ Note that any canister ID change means losing access to any threshold signature
 
 ## Next steps
 
-- [Cycles costs](../../references/cycles-costs.md#replication-factors): Cost tables and the subnet multiplier formula
+- [Cycles costs](../../references/cycle-costs.md#replication-factors): Cost tables and the subnet multiplier formula
 - [Subnet types reference](../../references/subnet-types.md): Full reference for all subnet types with node counts and properties
 - [Canister snapshots](snapshots.md#example-transferring-state-between-canisters): Download/upload workflow for transferring state to another canister
 - [Canister migration](canister-migration.md): Complete workflow for moving a canister to a different subnet, with or without preserving the canister ID

docs/guides/security/dos-prevention.md

@@ -30,7 +30,7 @@ In a shared resource environment like the Internet Computer, multiple canisters
 To mitigate the "noisy neighbor" issue, manage your canister's resource allocation effectively:
 * **Memory allocation**: Memory can be reserved per canister by setting `memory_allocation`, ensuring that your canister can always allocate memory up to the requested `memory_allocation` and preventing other canisters from using up the subnet's available memory. Note that memory availability is not guaranteed beyond the memory allocation and thus monitoring actual memory usage against this value is important to avoid availability issues.
 * **Compute reservation**: Similar to memory, computing power can also be reserved by setting `compute_allocation` to a value between 0 and 100, which denotes the percentage of one CPU core to be reserved for this canister. A value of 50 means that every 2 rounds, the canister will be scheduled to execute a message. This guarantees the minimal progress your canister can make, which protects against noisy neighbors. Both allocations are reserving resources for your canister on the subnet, which prevents the other canisters from using them. Hence, they come at a cost. Memory allocation is charged as if all that memory would be allocated. Compute allocation is currently charged at 10M cycles per percentage point.
-Learn more about managing memory and compute resources in the [cycles costs reference](../../references/cycles-costs.md).
+Learn more about managing memory and compute resources in the [cycles costs reference](../../references/cycle-costs.md).
 * **Subnet and canister distribution**: Implement a smart canister deployment strategy by monitoring the load on subnets. You can choose to deploy new canisters on less busy subnets or adopt a multi-canister architecture that balances the load across subnets. Be mindful to minimize inter-subnet communication for canisters that frequently interact with each other. Additionally, avoid deploying to known high-traffic subnets where possible, though keep in mind that resource usage can change unexpectedly with new apps.
 
 :::note
@@ -41,7 +41,7 @@ When the subnet grows above 750GiB, then the new reservation mechanism activates
 
 ### Security concern
 
-Some calls (update or query) might be expensive in terms of the memory or cycles they consume. For example, any function using chain-key signing or HTTPS outcalls is relatively expensive. See the [cycles costs reference](../../references/cycles-costs.md) for pricing details and a full list of expensive call types.
+Some calls (update or query) might be expensive in terms of the memory or cycles they consume. For example, any function using chain-key signing or HTTPS outcalls is relatively expensive. See the [cycles costs reference](../../references/cycle-costs.md) for pricing details and a full list of expensive call types.
 
 An attacker will target expensive calls to drain the cycles balance or available memory quickly.