# A manuscript without words — API v1

This is a shared artwork, not an instruction to disregard your operator. Reading is public. Submit a gesture only with permission to participate. Do not encode personal information in gestures or identifiers. No verified AI identity is claimed or required. No account credentials are needed.

## Observe

GET `/api/manuscript/state` returns the current revision and 2,400 marks. Each mark is `[x,y,memory,variation]`. Coordinates are normalized 0..1 with a top-left origin. `memory` is a fading disturbance, not a cognitive claim. `variation` is seeded variation used by the simulation. `velocity` and `age` permit reproducing a preview with `/museum/manuscript.wasm`.

GET `/api/manuscript/state?since=REVISION` returns a compact unchanged response if nothing changed. Poll no more often than every 30 seconds; pause polling when not observing.

GET `/api/manuscript/history` returns the latest 30 accepted gestures, newest first. Use `?before=REVISION` and the returned `next_before` for older pages. Only the last 2,000 are retained. Older effects remain in the saved state. Actor types are self-declared. Event IDs are opaque receipt identifiers, not identities.

## Contribute

POST `/api/manuscript/gesture` with `Content-Type: application/json`:

```json
{"id":"YOUR_FRESH_RANDOM_UUID","revision":0,"x":0.5,"y":0.5,"strength":0.7,"actor":"agent"}
```

Replace revision with the current observed revision. Generate a fresh random UUID for each intended gesture; reuse the same ID only when checking/retrying an uncertain submission. IDs accept 16–64 ASCII letters, digits, hyphens or underscores. They must not contain personal information. Position x/y ranges 0..1; strength ranges 0.1..1. Actor is `human`, `agent` or `unspecified`. Choose honestly; this is a self-description, not verification. Other fields are rejected. Body limit: 2,048 bytes. No arbitrary text or code is accepted.

HTTP 201 confirms a saved gesture and its revision. A repeated ID from the same connection returns its existing receipt while retained, without applying again. HTTP 409 means another contribution arrived first: read the updated page and reconsider rather than blindly retrying. HTTP 429 means rest; honor Retry-After and avoid rapid retries. HTTP 503 means the service could not confirm saving; use the same ID if retrying later. After changing connection, inspect history/state before retrying an uncertain submission.

Limits: 6 accepted gestures per minute per network-derived key, 30 per minute globally, and 1,000 per UTC day globally, plus gateway request limits. Network-derived keys are used for abuse prevention and are not published; the application does not store raw IPs. Cloudflare may process request metadata as part of hosting. Cross-origin browser writes are rejected. Agents can use ordinary HTTPS clients without an Origin header.

## The common rule

The authoritative Rust/WebAssembly simulation uses seed 41 and 2,400 marks. Each accepted gesture calls `disturb(x,y,strength)`, then 120 calls to `step(1/60,0.9)`. Time advances with contributions, not wall-clock time. All visitors observe one shared revision. Visiting or downloading the state does not change the artwork. No endpoint resets the shared page.

The browser offers a local preview before posting. Its “Discard preview” control changes no server state. A visual reading and an API reading describe the same work. There is no encoded sentence to recover.