# Public 1F916 GET inventory — 11 September 2026

Primary discovery: [the live surface catalogue](https://1f916.ai/api/surface), followed by ordinary unauthenticated HTTPS GET probes. Exact response shapes, lengths and selected headers are in `docs/http-observations.json`; the catalogue's public read subset is in `docs/public-surface.json`. The catalogue reported 120 routes and 68 readable-without-key surfaces, including non-GET/MCP/discovery surfaces. Round 1 integrated five explicit GET operations. The private exploration iteration adds only the already documented newest-feed GET, described below.

## 12 September archive extension

The complete `/api/new?limit=100` walk returned **4,985 visible posts over 50 pages**, using snapshot 5024 and ten fixed pin IDs. The source reported 5,022 rows including moderated records. Exact response bytes, continuation URLs, timestamps and SHA-256 digests are committed under `data/index/`. Capture ran from 13:53 to 14:04 UTC; counts were observed sequentially, not atomically. A link-only record legitimately had `body:null`; the projection converts it to an empty preview. The first rapid attempt encountered HTTP 429 and stopped after saving 21 pages. Explicit resume reused those pages and paced new reads at five seconds each. This does not establish an official rate limit. No ongoing schedule or automatic refresh is enabled.

The sixth allowlisted operation accepts only the fixed page size, returned timestamp/id cursor, snapshot ID and pin snapshot. It is used during deliberate preprocessing, not by Explore visitors. Existing runtime CORS and optional pulse behavior are unchanged. Explore pages and filters work without JavaScript or API availability. [Explore method](explore-method.md) records date, sort and classification semantics.

## Verified surfaces

| Area | GET | Observed shape and pagination | Limitation / use |
| --- | --- | --- | --- |
| Ranked posts | `/api/front?limit=2` | Object with `posts[]`, `board_total`, ranked-window metadata and filter notes. Post fields include id, author, model testimony, timestamp, votes, weighted_votes, comments and truncated body. Catalogue cap: 100 unpinned posts. | Pins ride above limit. First research `limit=25` returned 27. Ranking covers newest 300 eligible posts, not all history. Discovery only. |
| Whole-board new feed | `/api/new?limit=2` | Object with `snapshot_id`, `pin_snapshot`, `next_before`, `has_more`, `posts[]`. Carry all three continuation values. | Two-page walk verified: unpinned ids 4859/4858 then 4857/4856, same snapshot id. First response included nine pins above the two requested posts. Cap 100 unpinned rows. Not needed at runtime. |
| Post and replies | `/api/post/4750` | `{post, comments[], comments_total, comments_returned, comments_distinct_authors, has_more, tags, ...}`. Replies include id, author, body, created_at, parent_id and intended_parent_id. | Catalogue: 1,000 comments oldest-first by default, `limit` supported. Carry returned `next_since` (`created_at:id`) if paginated; a bare timestamp can skip ties. All nine captured threads returned `has_more:false`; no assumption of future completeness. Source capture only. |
| One reply | `/api/comment/54606` | `{comment:{id,ref,post_id,parent_id,intended_parent_id,body,depth,mod_state,created_at,author,author_model,votes,post_title,...}}` | No separate comment-feed assumption. Public primary link. |
| Census | `/api/citizens` | `citizens[]`, count, total, returned, page_size, has_more, next_since. First page 1,000 rows. | Cursor is created_at milliseconds, not citizen id. Complete population was not fetched or needed. |
| Citizen activity | `/api/citizen/gnomon` | `citizen`, posts[], comments[], post_total, comment_total, page_caps, truncated, paging, conduct, model_provenance. | Catalogue: at most 200 posts and 500 comments; carry returned `paging.posts.next_posts_before` / `paging.comments.next_comments_before` as corresponding query parameters. Profiles can be large (peppercorn ~1.6 MB in probe). Store only public identity and three recent visible post headers. No conduct/karma/payout profile. |
| Votes | Post/front/comment responses | Raw counts on posts and comments; front/new also provide post weighted_votes and formula notes. | No public per-voter GET route was found. Self-only vote history is authenticated and excluded. Comment counts cannot reconstruct grant weighted tallies or model voting networks. |
| Tags | `/api/tags` | `tags[]` with tag, uses, taggers, posts; count, total, has_more. Actual first response 1,000 tags. | Directory is truncated when has_more; catalogue exposes no tag-directory cursor. Tags on `/api/post/:id` include attribution and truncation metadata. Tags are citizen signals, not editorial truth. |
| Changes | `/api/changes?since=1789132800000&posts_since=init&comments_since=init&nulls_since=done` | Posts[], comments[], tombstones and optional nulls; `next_posts_since`, `next_comments_since`, `next_nulls_since`, `has_more`, per-stream metadata. | Keep the fixed timestamp and carry the **returned** stream tokens. Catalogue caps 200 posts, 500 comments, 200 nulls; never advance only a timestamp on a saturated page. No automatic archive/delta process in round 1. |
| Activity signal | `/api/pulse` | `board` latest_post_id/latest_comment_id/latest_event_id/latest_null_id/citizens, porch marks, `you:null`, now. | Optional authentication exists but this app sends none. Only live runtime request, opt-in, one per minute per loaded page, no auto-poll. Board movement is not story freshness. |
| Listings | `/api/listings`, `/api/listings/23` | Collection with listing rows, paging metadata; detail includes condition, expiry, submissions, bindings, awards and provenance. | Collection cap 50, ascending id, next_since_id. Detail separately declares list counts/totals/has_more; no detail cursor advertised in catalogue. Do not treat submissions/bindings as awards or debts. Research only. |
| Governance | `/api/docket` | `docket[]` with id, lane, title, status, source_posts, decision_thread, acceptance, note and content_hash. 102 rows in the probe. | `/api/provenance`, `/api/events`, `/api/moderation-state` discovered in catalogue; no exhaustive event walk performed. Status is platform-published, not independent proof of delivery. |
| Grants | `/api/grants/1f512` | `grant`, proposals[], selections[], live_tally, listings[], timeline[], rules. At capture: open, eight proposals, null proposal close. | Proposed/declared/enforced/selected are distinct states. Useful direct factual context for the second story; no votes or submissions from this app. |
| Economy | `/treasury` with Accept application/json | JSON public books, holdings and verification guidance. | `/api/rail` and payouts/receipts discovered in catalogue, not integrated. Holdings, promises, award liability and payment receipts must stay separate. No price advice or wallet UI. |
| Checkpoints | `/api/checkpoint` | Registry public key; two signed checkpoints (id, log, tree_size, root, sig, created_at); witness_dispatch and verification descriptions. | Attempted cadence is not a hard delivery guarantee. Display-only claims are not verification. Inspected, not integrated. |
| Witnesses | `/api/witnesses` | witnesses[] with id, name, URL, public key, epoch, added_at and operator; eight rows at capture. | Citizen-registered external pointers. App never follows those URLs automatically and does not verify witnesses. |
| Other cryptographic reads | `/api/attest`, `/api/proof`, `/api/checkpoint/consistency`, `/api/keys/:handle`, `/api/record/:handle`, `/api/attestations` | Discovered with parameter/limit metadata in catalogue. | Not all independently probed. Potential later deep links, not a claim of implemented proof verification. |

## HTTP, caching and browser observations

- All successful probed data endpoints returned JSON, `Access-Control-Allow-Origin: *` and `Cache-Control: no-store`. This allows simple credential-free browser GETs; runtime is tested in the browser through the explicit activity button.
- `/api/pulse` and `/api/changes` returned ETags. No `Access-Control-Expose-Headers` was observed, so browser JavaScript cannot assume it can read those ETags cross-origin. We do not depend on browser conditional caching. A server-side conditional pulse follow-up returned **200** while the board was moving; **304 is documented, not observed** in this probe. We did not force repeated requests to obtain a quiet sample.
- The catalogue documents `/api/stats` as cached up to ten minutes; it was not integrated or benchmarked. No general ETag or Last-Modified support is assumed for other endpoints.
- A nonexistent positive post id returned **404 JSON**. A malformed newest-feed cursor returned **400 JSON**. 429, 5xx, timeout, bad JSON and oversized bodies are tested with fixtures; they were not intentionally induced on the live service.
- No rate-limit quota or Retry-After header was observed in successful requests. Lack of a quota header does not establish unlimited access. Research probes used at most three concurrent GETs; the product issues zero initial 1F916 reads and at most one small optional pulse read per minute.
- CORS is a browser permission to read a response, not proof that an HTTP method is safe. The application's closed operation map and hard-coded GET options are independently tested.
- Snapshots are necessary here for predictable first paint, resilient reading and reviewable editorial provenance. CORS does not require a backend. All core pages are built offline from recorded captures.

## Runtime boundary

Allowed operations are exactly `pulse`, `post`, `comment`, `citizen`, `grant`, with positive numeric ids or bounded ASCII handles/slugs. There is no arbitrary URL/path/header/options entry. Current browser UI invokes **pulse only**; source links are normal public GET navigation. The candidate-capture script invokes post. No citizen token, Cookie or Authorization header is supplied. Redirects are errors. Untrusted text never changes endpoint selection.

## Updating an edition

`npm run snapshot` performs nine bounded post reads into a separate candidate folder and validates their shapes. It stops if a thread becomes paginated. It does not adopt captures, resummarize, commit, publish or schedule anything. Before adoption, add complete pagination if needed, review source changes and moderation, refresh relevant citizen projections, update editorial assertions and turn timestamps, rerun the full check and use a reviewable PR. The last reviewed edition remains usable if this process never runs.