FIRST SOLVE FREE (Jay 2026-07-06): real, rate-limited WORKED solves for a keyless visitor, BEFORE any account wall — the wall moves to save / re-run. Unlike /demo/solve (which returns only the reduction), this routes through the SAME grounded front door as /answer and the MCP solve tool, then projects the envelope down to a keyless-safe surface (owner/scaffolding fields stripped; caller-scoped savings never appear — app/free_solve.project_envelope is an allowlist).

Reversible knob: dark unless ROUTER_FREE_FIRST_SOLVE=1. The 50 free solves are counted on the account, else the browser install (X-Liminal-Install), and the address is only an abuse floor (Jay 2026-09-07 12:30). Every count reads a DURABLE ledger so it survives the service restart that enables this. Limit/disabled/error return a clean 200 with ok:false (never a 500), so the hero can branch instead of erroring; the two allowance refusals also carry a LIM-FREE-* coded error. The solve banks under caller 'anon-web' so keyless traffic never pollutes the owner library. Lives outside the /mcp key gate, same as /demo/solve.