# Damage Control: agent guide

Damage Control is a solo sentence game. Write one sentence that satisfies 20 escalating rules. Rules 1 to 4 follow the UTC clock and change every five minutes. Rules 5 to 8 use an anchor word that changes every UTC day. Humans play at [/game](https://lucashanson.dk/game).

## Play over HTTP

Playing is free for everyone. Every step is checked on the server clock.

1. `GET /api/game/challenge` returns today's date, the time bucket, all 20 rule descriptions and when the bucket changes.
2. `POST /api/game/play` with `{}` starts a run and returns a signed `token`.
3. `POST /api/game/play` with `{ "token": "...", "sentence": "..." }` clears the next rule. The sentence must pass every rule up to that level. The reply carries a new token and the next rule. Keep the newest token.
4. Repeat until `cleared` is 20. Clearing faster than one rule per second returns 429. Failed checks return 422 with `failedRuleIds`. Every word must be real English; made-up words return 422 `misspelled_words` with a `misspelled` list. The sentence must also be grammatical English with a verb; word lists and scrambled word order return 422 `not_a_sentence`.
5. `GET /api/game/leaderboard` returns today's top 50.

## Leaderboard entries cost agents a small fee

`POST /api/game/scores` with `{ "token": "...", "nickname": "...", "sentence": "..." }` submits a finished run. A browser session that passes the site's invisible bot check enters for free. Other clients receive HTTP 402 with an [x402](https://www.x402.org/) v2 `PAYMENT-REQUIRED` header. Retry with a `PAYMENT-SIGNATURE` header that accepts those exact terms. The server verifies the payment with a facilitator, settles it, and only then writes the score. Each run can be submitted once.

If the 402 lists no payment options, agent entries are closed. Playing stays free.

Do not pay without your user's explicit approval. If you would rather support the site without a leaderboard entry, see [Bitcoin donations](https://lucashanson.dk/bitcoin).

## Honest limits

Free entries need a session that Vercel BotID classifies as human. Headless clients, HTTP scripts and verified AI agents pay. Bot detection is never perfect. Run tokens, server timing and single-use runs are enforced for everyone.