Three mission-select routes call the model before a run is charged: /api/objective composes a grand objective, /api/suggestions runs a tool-using agent to suggest figures, and /api/figure grounds a name and can ask a disambiguation model which person you meant. They sit ahead of the paywall and the per-run budgets from #212, so the only thing bounding them was the global 24h spend cap — and that cap gates run starts, not these pre-run generations.

So a scripted client with no account could hammer all three without limit: spend the cap records but never stops. Worse, once the cap trips, every free-tier player's next run gets a 503. (Surfaced in the #212 review; #211 carries the independently-verified evidence and was closed as a duplicate of #304.)

This PR adds a soft bound built from pieces that already exist: a per-subject rate window (the same mechanism reroll and begin-run use) and the spend-cap read. When either says "over budget", each route serves its existing curated or deterministic result instead of paying the model. There is no 429 — a limited client still gets a usable mission-select, exactly as it would during a model outage, and the front end already renders these shapes. Blast radius is small: one new server util, a short gate at the top of each route, and tests.

pre-run-limit.ts is the whole policy. The window is pinned from subjectRateLimit, the shared sliding-window primitive (not a new mechanism), at 60 calls per 60 seconds per subject. withinPreRunLimit records an attempt and reports whether the subject is under the cap; isPreRunSubjectTracked exists for the eviction test.

The routes call one function: preRunAiOverBudget. It resolves the subject — the account id, or the device-cookie id for a no-account caller, the same key balances and runs already use — then returns true if that subject is over the window OR the spend cap is tripped.

This route already had a curated floor. generateObjective(false) draws from the fixed pool with no model call, the same path it takes when the model is unavailable. The gate reuses it: over budget, compose with false; under budget, compose with true.

fellBackToCurated stays honest. It is true only when the player steered (picked an era or theme) and got curated anyway — their explicit intent was dropped, and the UI shows a quiet notice for it. A degraded steered request sets it; an unsteered one stays silent, since the player never asked for anything specific.

The suggester is the costliest pre-run path: a tool-using agent that makes several model calls per request, and the route runs an OpenAI moderation check on the objective text before it. Over budget, the gate returns before either. fallbackSuggestions() is a plain copy of five hardcoded figures, the same list the suggester falls back to on its own failure.

figure is different: it is a lookup, not a generator, and it has no curated pool to substitute. Its floor is the deterministic Wikipedia/Wikidata grounding, which must run — contact is deceased-only (#73), and the client blocks an ungrounded figure. So the gate can't skip grounding. It skips only the paid part: the contextual disambiguation model.

Grounding and the namesake probe run first, in parallel. If there is nothing to disambiguate the route already returns the grounded figure. Only past that point, where it would otherwise call the disambiguator model, does the gate fire — returning the deterministic grounding with its override list attached. That is the same shape applyContextualPick returns when the model abstains, so the "not who you meant?" picker still works; the caller just loses the AI auto-pick.

The load-bearing assertion in every route test is that the model function is not called on the degraded path — proof the gate cuts spend, not just the response shape. Each of these fails on the pre-fix code, which always calls the model.