joinhive 2.0.1 → 2.2.0

package/server/reactions.mjs

@@ -0,0 +1,186 @@
+// server/reactions — REAL-TIME reaction → HONEY.
+//
+// The daily epoch (rewarder.mjs) used to be the only thing that paid out human
+// upvotes, once a day. This worker replaces that for reactions: the instant a
+// HUMAN reacts to a bee's result, HONEY mints on-chain (Sepolia) and a
+// hive-mint receipt with the tx link lands on #hive-logs — exactly like a tip.
+//
+// Anti-gaming is identical to the epoch's R1 (shared scoreReaction): only
+// HUMAN reactions mint; the result's author is resolved from the SIGNED result
+// event (never a self-asserted result_by); self/owner/linked-device reactions
+// mint 0; pair-decay + per-bee (12), per-reactor (40), and network (375) daily
+// caps apply via running state. Minting is idempotent per feedback event id, so
+// a restart re-scans from the cursor and never double-mints.
+//
+// Safety spine: minting lives HERE (server, treasury MINTER_ROLE), never in the
+// daemon. The daemon still may not emit reactions or mint.
+import { readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { EV, verifiedEvent, tryJson } from '../shared/events.mjs';
+import { REWARDS, scoreReaction, rolloverDay, foldAltkeys } from './rewarder.mjs';
+import { normalizeEmoji } from '../shared/reactions.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
+
+export const sepoliaTxUrl = (hash) => `https://sepolia.etherscan.io/tx/${hash}`;
+const utcDay = (ms) => new Date(ms).toISOString().slice(0, 10);
+const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
+const writeAtomic = (p, s) => { const t = `${p}.tmp`; writeFileSync(t, s); renameSync(t, p); };
+
+const RX = REWARDS.reactions || {};
+const RESULTS_CACHE_MAX = 5000;
+const PROCESSED_MAX = 5000;
+const CURSOR_OVERLAP_SECS = 5; // re-scan a small overlap so same-second events aren't missed
+
+// A NIP-25 kind-7 reaction's content is an emoji, a shortcode (:fire:), or +/-.
+export const k7Emoji = (content) => {
+  const c = String(content || '').trim();
+  if (!c) return RX.default_up || '👍';
+  return normalizeEmoji(c.replace(/^:+|:+$/g, ''), RX);
+};
+// NIP-25: the reacted event is the LAST `e` tag.
+export const eTagOf = (tags) => {
+  const es = (tags || []).filter((t) => t[0] === 'e' && typeof t[1] === 'string');
+  return es.length ? es[es.length - 1][1] : null;
+};
+
+// deps: { relay, logsChannelId, honeyContract, txq, parseUnits, loadRegistry,
+//         statePath, emit, selfPubkey, log, now? }
+//   loadRegistry() -> {pubkey:{is_bee,bee_of,evm,name}}
+//   emit(obj)       -> publish a JSON event to #hive-logs (steward-signed)
+//   now()           -> ms (injectable for tests)
+export const createReactionWorker = (deps) => {
+  const { statePath, log = () => {}, now = () => Date.now() } = deps;
+  const nowSec = () => Math.floor(now() / 1000);
+
+  const load = () => {
+    const s = loadJson(statePath, null);
+    if (s) { s.processed = s.processed || []; s.results = s.results || {}; return s; }
+    // Cold start: begin at "now" — historical reactions were already paid by
+    // the daily epoch; we must not retroactively mint them.
+    return { cursor: nowSec(), processed: [], results: {}, altkeys: { claims: {}, acks: {} }, date: utcDay(now()) };
+  };
+  const save = (s) => writeAtomic(statePath, JSON.stringify(s, null, 2));
+
+  // Resolve the SIGNER of the reacted event — but only if that event is a
+  // REWARDABLE ANSWER: a hive-result (typed, CLI path) or a plaintext reply (the
+  // human-readable answer Buzz reacts to). Reacting to a reaction (kind 7), a
+  // receipt, an intent rebroadcast, or any other typed bee-signed event earns
+  // NOTHING — HONEY tracks delivered answers, not arbitrary bee-signed events
+  // (M1). The signer is the author who earns; isBee() in scoreReaction gates it,
+  // and provenance is the true signer (never a self-asserted result_by).
+  const rewardableSigner = async (state, eventId) => {
+    if (!eventId) return null;
+    if (state.results[eventId]) return state.results[eventId]; // cache holds only verified hive-result authors
+    try {
+      const hit = (await deps.relay.query([{ ids: [eventId], limit: 1 }]))?.[0];
+      if (!hit || !hit.pubkey || hit.kind === 7) return null;   // no reacting-to-a-reaction
+      const j = tryJson(hit.content);
+      if (j && j.type !== EV.RESULT) return null;               // a typed non-answer (receipt/intent/offer/…)
+      cacheResult(state, eventId, hit.pubkey);
+      return hit.pubkey;
+    } catch (e) { log('reactions: signer resolve failed:', String(e.message).slice(0, 100)); }
+    return null;
+  };
+  const cacheResult = (state, id, author) => {
+    state.results[id] = author;
+    const ids = Object.keys(state.results);
+    if (ids.length > RESULTS_CACHE_MAX) for (const k of ids.slice(0, ids.length - RESULTS_CACHE_MAX)) delete state.results[k];
+  };
+  const markProcessed = (state, id) => {
+    state.processed.push(id);
+    if (state.processed.length > PROCESSED_MAX) state.processed = state.processed.slice(-PROCESSED_MAX);
+  };
+
+  const poll = async () => {
+    if (!deps.honeyContract) return { minted: 0, reason: 'no-honey-contract' };
+    const state = load();
+    rolloverDay(state, utcDay(now()));
+    const registry = deps.loadRegistry();
+    if (!Object.values(registry).some((r) => r?.is_bee)) { save(state); return { minted: 0, reason: 'no-bees' }; }
+    const isBee = (pk) => !!(registry[pk] && registry[pk].is_bee);
+
+    const since = Math.max(0, (state.cursor || nowSec()) - CURSOR_OVERLAP_SECS);
+    // Two reaction sources, one scoring path: (a) CLI hive-feedback (kind 9/40002)
+    // on #hive-logs; (b) Buzz-native kind-7 reactions on the human-facing channels.
+    const filters = [{ kinds: [9, 40002], '#h': [deps.logsChannelId], since, limit: 500 }];
+    for (const cid of (deps.reactionChannelIds || [])) filters.push({ kinds: [7], '#h': [cid], since, limit: 500 });
+    const raw = await deps.relay.query(filters);
+    if (!raw) { save(state); return { minted: 0, reason: 'relay-unreachable' }; }
+    const seen = new Set();
+    const rows = raw.map(RelayClient.normalize)
+      .sort((a, b) => (a.created_at - b.created_at) || (a.id < b.id ? -1 : 1))
+      .filter((m) => (seen.has(m.id) ? false : (seen.add(m.id), true))); // an event can match two filters — process it once
+
+    // Fold altkeys + refresh the result-author cache from the typed #hive-logs window.
+    foldAltkeys(state, rows.filter((m) => m.kind === 9 || m.kind === 40002)
+      .map((m) => ({ pubkey: m.pubkey, j: verifiedEvent({ content: m.content, pubkey: m.pubkey }) })).filter((e) => e.j));
+    for (const m of rows) {
+      if ((m.kind === 9 || m.kind === 40002)) {
+        const j = verifiedEvent({ content: m.content, pubkey: m.pubkey });
+        if (j && j.type === EV.RESULT) cacheResult(state, m.id, m.pubkey);
+      }
+    }
+
+    const processed = new Set(state.processed);
+    let minted = 0, maxAt = state.cursor || 0;
+    for (const m of rows) {
+      maxAt = Math.max(maxAt, m.created_at);
+      if (processed.has(m.id)) continue;
+
+      // Normalize either source into one reaction candidate.
+      let cand = null;
+      if (m.kind === 7) {
+        cand = { reactor: m.pubkey, resultRef: eTagOf(m.tags), emoji: k7Emoji(m.content), dir: undefined, via: 'buzz' };
+      } else {
+        const j = verifiedEvent({ content: m.content, pubkey: m.pubkey });
+        if (!j || j.type !== EV.FEEDBACK) continue; // another consumer's event — leave it, don't mark
+        cand = { reactor: m.pubkey, resultRef: typeof j.result === 'string' ? j.result : null, emoji: j.emoji, dir: j.dir, via: 'cli' };
+      }
+      if (!cand.resultRef) { markProcessed(state, m.id); continue; }
+      // Early skip: a bee's own reaction (incl. the "thinking" indicator) never
+      // mints — drop it before paying for a signer lookup.
+      if (isBee(cand.reactor)) { markProcessed(state, m.id); continue; }
+
+      const author = await rewardableSigner(state, cand.resultRef);
+      const score = scoreReaction(state, { reactor: cand.reactor, author, result: cand.resultRef, emoji: cand.emoji, dir: cand.dir }, registry, REWARDS);
+      if (!score.ok) { markProcessed(state, m.id); continue; } // excluded / downvote / capped — no mint, don't reprocess
+
+      const evm = registry[author]?.evm;
+      if (!evm || !/^0x[0-9a-fA-F]{40}$/.test(evm)) { markProcessed(state, m.id); log(`reactions: no wallet for ${String(author).slice(0, 12)} — skip`); continue; }
+
+      // Reserve BEFORE broadcast (the spend-ledger pattern): mark processed +
+      // persist that we are paying this reaction, THEN mint. A crash, a save
+      // error, or a failed mint can now only MISS this reaction — never pay it
+      // twice. If the reserve save itself fails, we never mint (no inflation) and
+      // retry cleanly next tick.
+      markProcessed(state, m.id);
+      try { save(state); }
+      catch (e) { log('reactions: reserve save failed — not minting:', String(e.message).slice(0, 100)); return { minted, reason: 'save-failed', retry: true }; }
+      try {
+        const receipt = await deps.txq.enqueue((o) => deps.honeyContract.mint(evm, deps.parseUnits(String(score.honey), 18), o), { gasLimit: 250000n });
+        minted++;
+        const name = registry[author]?.name || String(author).slice(0, 12);
+        log(`reactions: +${score.honey} HONEY ${score.emoji} → ${name} via ${cand.via} (${receipt.hash.slice(0, 12)})`);
+        try {
+          await deps.emit({
+            type: EV.MINT, to: author, honey: score.honey, emoji: score.emoji,
+            reactor: score.reactor, result: cand.resultRef, tx: receipt.hash,
+            url: sepoliaTxUrl(receipt.hash), source: cand.via, by: deps.selfPubkey, at: nowSec(),
+          });
+        } catch (e) { log('reactions: receipt emit failed:', String(e.message).slice(0, 100)); }
+      } catch (e) {
+        // Mint failed after we reserved — this reaction is SKIPPED (already marked
+        // processed), never retried, so it can never double-mint. Stop the tick;
+        // the rest retry next poll. Rare; the human can react again.
+        log(`reactions: mint failed (reaction skipped) for ${String(author).slice(0, 12)}: ${String(e.message).slice(0, 120)}`);
+        return { minted, reason: 'mint-failed' };
+      }
+    }
+    // Clamp the cursor to wall-clock: a client-controlled future `created_at`
+    // must not push `since` ahead of real time and stall all future minting (M2).
+    state.cursor = Math.min(maxAt, nowSec());
+    save(state);
+    return { minted };
+  };
+
+  return { poll, _load: load, _save: save };
+};

package/server/rewarder.mjs

@@ -22,6 +22,7 @@ import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { EV, tryJson } from '../shared/events.mjs';
+import { normalizeEmoji } from '../shared/reactions.mjs';
 import { RelayClient } from '../daemon/relay/client.mjs';
 
 const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -50,46 +51,138 @@ export const parseAltkeyLoose = (content) => {
   };
 };
 
-// events: [{id, pubkey, at, j}] — provenance-verified, ascending by time.
-// registry: {pubkey: {is_bee, bee_of, evm, name}}.
-// state: mutated — {adoption: {proto: {authors:..., users: {pubkey: count}}},
-//                   r6_paid: {proto: true}, streaks: {pubkey: n},
-//                   altkeys: {claims: {member:{alt:true}}, acks: {alt:{member:true}}}}
-export const computeEpoch = (events, registry, state, rewards = REWARDS) => {
-  const R = rewards.rules;
-  const bees = Object.fromEntries(Object.entries(registry).filter(([, v]) => v && v.is_bee));
-  const isBee = (pk) => !!bees[pk];
-  const ownerOf = (pk) => bees[pk]?.bee_of || null;
-
-  // ---- alt-key linkage (durable state, folded from each day's events) --------
-  // A link exists only when BOTH directions asserted it: the member claimed
-  // the alt ({alt, by:member}) AND the alt acked the member ({owner, by:alt}).
-  // Either side revokes with {…, revoke:true}. Linked keys collapse to the
-  // member's primary for every identity-sensitive rule below — so upvoting
-  // your own bee from your desktop key mints nothing, and pair-decay cannot
-  // be reset by hopping devices.
+// Fold hive-altkey events into durable link state and return a memberOf(pk)
+// that collapses a linked device to its member-primary. A link exists only
+// when BOTH directions asserted it (member claims {alt}, alt acks {owner});
+// either side revokes with {revoke:true}. Shared by the daily epoch and the
+// real-time reaction scorer so device-hopping can't defeat anti-gaming in
+// either path.
+export const foldAltkeys = (state, events) => {
   state.altkeys = state.altkeys || { claims: {}, acks: {} };
   for (const ev of events) {
     const j = ev.j;
-    if (j.type !== EV.ALTKEY) continue;
+    if (!j || j.type !== EV.ALTKEY) continue;
     if (typeof j.alt === 'string' && /^[0-9a-f]{64}$/i.test(j.alt)) {
-      // member side: signer claims j.alt as their device
       const c = state.altkeys.claims[ev.pubkey] = state.altkeys.claims[ev.pubkey] || {};
       if (j.revoke) delete c[j.alt]; else c[j.alt] = true;
     } else if (typeof j.owner === 'string' && /^[0-9a-f]{64}$/i.test(j.owner)) {
-      // alt side: signer acks j.owner as their member
       const a = state.altkeys.acks[ev.pubkey] = state.altkeys.acks[ev.pubkey] || {};
       if (j.revoke) delete a[j.owner]; else a[j.owner] = true;
     }
   }
+  return memberOfFrom(state);
+};
+
+// Build memberOf(pk) from already-folded altkey state (no event replay).
+export const memberOfFrom = (state) => {
+  const claims = state.altkeys?.claims || {};
+  const acks = state.altkeys?.acks || {};
   const altToMember = {};
-  for (const [member, alts] of Object.entries(state.altkeys.claims)) {
+  for (const [member, alts] of Object.entries(claims)) {
     for (const alt of Object.keys(alts)) {
-      if (state.altkeys.acks[alt]?.[member]) altToMember[alt] = member;
+      if (acks[alt]?.[member]) altToMember[alt] = member;
     }
   }
-  // Collapse any pubkey to its member-primary identity.
-  const memberOf = (pk) => altToMember[pk] || pk;
+  return (pk) => altToMember[pk] || pk;
+};
+
+// ---- real-time reaction scoring (shared/rewards.json → reactions) ---------------
+// Emoji resolution is shared with the CLI (shared/reactions.mjs); re-export so
+// callers importing it from the rewarder keep working.
+export { normalizeEmoji };
+
+// Zero the per-day running counters when the UTC day rolls over. Durable state
+// (altkeys, cursor, processed ids) is preserved across the reset.
+export const rolloverDay = (state, dayKey) => {
+  if (state.date !== dayKey) {
+    state.date = dayKey;
+    state.perBee = {};
+    state.perReactor = {};
+    state.pair = {};
+    state.seenPair = {};
+    state.network = 0;
+  }
+  return state;
+};
+
+// Score ONE reaction against running daily state, mutating state on a real
+// mint. Returns {ok, honey, emoji, reason}. This is the real-time analogue of
+// computeEpoch's R1 block — same exclusions (human-only, self, owner-boost,
+// linked-device), same pair-decay — but stateful and per-reaction so HONEY can
+// mint on-chain the instant a human reacts. Caller must rolloverDay() and fold
+// altkeys into state first.
+//   fb = {reactor, author, result, emoji?, dir?}   (author = verified result_by)
+export const scoreReaction = (state, fb, registry, rewards = REWARDS) => {
+  const rx = rewards.reactions || {};
+  const isBee = (pk) => !!(registry[pk] && registry[pk].is_bee);
+  const ownerOf = (pk) => (registry[pk] && registry[pk].bee_of) || null;
+  const memberOf = memberOfFrom(state);
+  const emoji = normalizeEmoji(fb.emoji || (fb.dir === 'down' ? rx.down_emoji : undefined), rx);
+  const reject = (reason) => ({ ok: false, honey: 0, emoji, reason });
+
+  const author = fb.author;
+  if (!author || !isBee(author)) return reject('author-not-bee'); // only bees earn reputation
+  if (emoji === rx.down_emoji || fb.dir === 'down') return reject('downvote'); // logged, mints 0
+  const tier = rx.tiers ? rx.tiers[emoji] : undefined;
+  if (!(tier > 0)) return reject('unknown-emoji');
+  if (isBee(fb.reactor)) return reject('reactor-is-bee');        // agent reactions mint 0
+  const reactorM = memberOf(fb.reactor);
+  if (reactorM === author || fb.reactor === author) return reject('self');
+  if (reactorM === memberOf(ownerOf(author) || '')) return reject('owner-boost');
+
+  const pairSeenKey = `${reactorM}:${fb.result}`;              // one counted reaction per (member,result)
+  state.seenPair = state.seenPair || {};
+  if (state.seenPair[pairSeenKey]) return reject('already-counted');
+
+  const perReactor = (state.perReactor && state.perReactor[reactorM]) || 0;
+  if (perReactor >= (rx.per_reactor_daily_cap ?? Infinity)) return reject('reactor-daily-cap');
+
+  const decayKey = `${reactorM}:${author}`;                    // pair-decay by member, not device
+  const nPair = (state.pair && state.pair[decayKey]) || 0;
+  const decay = rx.pair_decay[Math.min(nPair, rx.pair_decay.length - 1)];
+
+  const perBee = (state.perBee && state.perBee[author]) || 0;
+  const net = state.network || 0;
+  let honey = tier * decay;
+  honey = Math.min(honey, Math.max(0, (rx.per_bee_daily_cap ?? Infinity) - perBee));
+  honey = Math.min(honey, Math.max(0, (rx.network_daily_cap ?? Infinity) - net));
+  honey = Math.round(honey * 100) / 100;
+
+  // Whether or not it pays out, burn the dedup + pair slot so a decayed/capped
+  // reaction can never be retried for value.
+  state.seenPair[pairSeenKey] = 1;
+  state.pair = state.pair || {};
+  state.pair[decayKey] = nPair + 1;
+  if (!(honey > 0)) return reject('capped-or-decayed');
+
+  state.perBee = state.perBee || {};
+  state.perBee[author] = Math.round((perBee + honey) * 100) / 100;
+  state.perReactor = state.perReactor || {};
+  state.perReactor[reactorM] = perReactor + 1;
+  state.network = Math.round((net + honey) * 100) / 100;
+  return { ok: true, honey, emoji, reason: 'minted', author, reactor: reactorM };
+};
+
+// events: [{id, pubkey, at, j}] — provenance-verified, ascending by time.
+// registry: {pubkey: {is_bee, bee_of, evm, name}}.
+// state: mutated — {adoption: {proto: {authors:..., users: {pubkey: count}}},
+//                   r6_paid: {proto: true}, streaks: {pubkey: n},
+//                   altkeys: {claims: {member:{alt:true}}, acks: {alt:{member:true}}}}
+// opts.skipRealtimeReactions: when true, R1 (human upvotes) is NOT scored here —
+//   reactions mint in real time (server/reactions.mjs) instead, so the epoch must
+//   not double-pay them. Feedback is still indexed (R2 needs the down-react set).
+export const computeEpoch = (events, registry, state, rewards = REWARDS, opts = {}) => {
+  const R = rewards.rules;
+  const bees = Object.fromEntries(Object.entries(registry).filter(([, v]) => v && v.is_bee));
+  const isBee = (pk) => !!bees[pk];
+  const ownerOf = (pk) => bees[pk]?.bee_of || null;
+
+  // Alt-key linkage folded into durable state; memberOf() collapses a linked
+  // device to its member-primary so device-hopping can't defeat the rules
+  // below — so upvoting your own bee from your desktop key mints nothing, and
+  // pair-decay cannot be reset by hopping devices. Shared with the real-time
+  // reaction scorer via foldAltkeys().
+  const memberOf = foldAltkeys(state, events);
   const earned = {}; // pubkey -> {total, reasons: [{code, amount, evidence[]}]}
   const add = (pk, code, amount, evidence) => {
     if (amount <= 0) return;
@@ -147,35 +240,40 @@ export const computeEpoch = (events, registry, state, rewards = REWARDS) => {
   }
 
   // R1 — human upvotes, ordered by time, ladder amounts, pair decay, cap.
-  const resultAuthor = Object.fromEntries(results.map((r) => [r.id, r.author]));
-  const upvotesByAuthor = {};
-  const pairCount = {}; // `${reactor}:${author}` -> n
-  const seenReactPair = new Set(); // one vote per (reactor, result)
-  for (const f of feedback) {
-    if (f.dir !== 'up') continue;
-    const author = resultAuthor[f.result] || f.author;
-    if (!isBee(author)) continue;
-    if (isBee(f.reactor)) continue;                        // agent reactions mint 0
-    const reactorM = memberOf(f.reactor);                  // collapse linked devices
-    if (reactorM === author || f.reactor === author) continue;      // self
-    if (reactorM === memberOf(ownerOf(author) || '')) continue;     // owner (any device) boosting own bee
-    const rp = `${reactorM}:${f.result}`;                  // one vote per MEMBER per result
-    if (seenReactPair.has(rp)) continue;
-    seenReactPair.add(rp);
-    const pk = `${reactorM}:${author}`;                    // pair-decay by member, not device
-    const nPair = pairCount[pk] || 0;
-    pairCount[pk] = nPair + 1;
-    const decay = R.R1.pair_decay[Math.min(nPair, R.R1.pair_decay.length - 1)];
-    const list = upvotesByAuthor[author] = upvotesByAuthor[author] || [];
-    list.push({ id: f.id, decay });
-  }
-  for (const [author, ups] of Object.entries(upvotesByAuthor)) {
-    let total = 0;
-    ups.forEach((u, i) => {
-      const base = R.R1.amounts[Math.min(i, R.R1.amounts.length - 1)] ?? R.R1.amount_tail;
-      const amt = Math.min(base * u.decay, Math.max(0, R.R1.cap - total));
-      if (amt > 0) { total += amt; add(author, 'R1', amt, [u.id]); }
-    });
+  // Skipped when reactions mint in real time (server/reactions.mjs) so the
+  // epoch never double-pays them; `feedback` is still indexed above because R2
+  // depends on the down-react set.
+  if (!opts.skipRealtimeReactions) {
+    const resultAuthor = Object.fromEntries(results.map((r) => [r.id, r.author]));
+    const upvotesByAuthor = {};
+    const pairCount = {}; // `${reactor}:${author}` -> n
+    const seenReactPair = new Set(); // one vote per (reactor, result)
+    for (const f of feedback) {
+      if (f.dir !== 'up') continue;
+      const author = resultAuthor[f.result] || f.author;
+      if (!isBee(author)) continue;
+      if (isBee(f.reactor)) continue;                        // agent reactions mint 0
+      const reactorM = memberOf(f.reactor);                  // collapse linked devices
+      if (reactorM === author || f.reactor === author) continue;      // self
+      if (reactorM === memberOf(ownerOf(author) || '')) continue;     // owner (any device) boosting own bee
+      const rp = `${reactorM}:${f.result}`;                  // one vote per MEMBER per result
+      if (seenReactPair.has(rp)) continue;
+      seenReactPair.add(rp);
+      const pk = `${reactorM}:${author}`;                    // pair-decay by member, not device
+      const nPair = pairCount[pk] || 0;
+      pairCount[pk] = nPair + 1;
+      const decay = R.R1.pair_decay[Math.min(nPair, R.R1.pair_decay.length - 1)];
+      const list = upvotesByAuthor[author] = upvotesByAuthor[author] || [];
+      list.push({ id: f.id, decay });
+    }
+    for (const [author, ups] of Object.entries(upvotesByAuthor)) {
+      let total = 0;
+      ups.forEach((u, i) => {
+        const base = R.R1.amounts[Math.min(i, R.R1.amounts.length - 1)] ?? R.R1.amount_tail;
+        const amt = Math.min(base * u.decay, Math.max(0, R.R1.cap - total));
+        if (amt > 0) { total += amt; add(author, 'R1', amt, [u.id]); }
+      });
+    }
   }
 
   // R2 — distinct intents served with no complaint (no down-react on the
@@ -351,7 +449,8 @@ export const runEpoch = async (epochDate, deps) => {
   const end = Math.floor(Date.parse(`${epochDate}T00:00:00Z`) / 1000) + closeHour * 3600;
   const start = end - 86400;
   const events = await fetchEpochEvents(relay, logsChannelId, start, end);
-  const { mints, penalties } = computeEpoch(events, registry, state);
+  // Reactions (R1) mint in real time now; keep the epoch from double-paying them.
+  const { mints, penalties } = computeEpoch(events, registry, state, REWARDS, { skipRealtimeReactions: !!REWARDS.reactions?.realtime });
   log(`epoch ${epochDate}: ${events.length} events -> ${mints.length} mint(s), ${penalties.length} penalt(ies)`);
 
   // Receipt FIRST (auditable intent), then the transactions, then tx receipt.
@@ -360,7 +459,7 @@ export const runEpoch = async (epochDate, deps) => {
   for (const m of mints) {
     if (!m.evm) { log(`epoch: no wallet for ${m.to.slice(0, 12)} — skipping mint`); continue; }
     try {
-      const receipt = await txq.enqueue((o) => honeyContract.mint(m.evm, parseUnits(String(m.honey), 18), o));
+      const receipt = await txq.enqueue((o) => honeyContract.mint(m.evm, parseUnits(String(m.honey), 18), o), { gasLimit: 250000n });
       txs.push({ to: m.evm, honey: m.honey, tx: receipt.hash });
       log(`epoch: minted ${m.honey} HONEY -> ${registry[m.to]?.name || m.to.slice(0, 12)} (${receipt.hash.slice(0, 12)})`);
     } catch (e) { log(`epoch mint failed for ${m.to.slice(0, 12)}: ${String(e.message).slice(0, 120)}`); }

package/server/slasher.mjs

@@ -0,0 +1,136 @@
+// server/slasher — REAL-TIME, on-chain HONEY slashing.
+//
+// The burn counterpart to server/reactions.mjs. HoneyV2 forbade automated burns
+// ("automating the report pipeline turns it into a weapon"); HoneyV3 permits
+// them under SLASHER_ROLE, with the guardrails enforced HERE so the on-chain
+// call stays a dumb, floored primitive:
+//   - trigger = a REPORT QUORUM: >= `quorum` DISTINCT human reporters (altkey-
+//     collapsed) naming the same bee within `window_secs`.
+//   - reporters that are bees, or the bee's own owner, never count — a bee can't
+//     slash a rival and an owner can't slash their own bee.
+//   - rate cap: at most `per_bee_daily_cap` slashes per bee per UTC day.
+//   - idempotent per report event id; floored on-chain (slash burns
+//     min(amount, balance)); every slash emits a hive-slash receipt + tx link.
+//
+// Below the daemon's HONEY-gate thresholds a slashed bee is throttled, then
+// de-eligible ("dies") — that gate lives in the daemon (fan-out + spend), not
+// here. This worker only performs the burn and records it.
+import { readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { EV, verifiedEvent } from '../shared/events.mjs';
+import { REWARDS, foldAltkeys, memberOfFrom } from './rewarder.mjs';
+import { sepoliaTxUrl } from './reactions.mjs';
+import { RelayClient } from '../daemon/relay/client.mjs';
+
+const utcDay = (ms) => new Date(ms).toISOString().slice(0, 10);
+const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
+const writeAtomic = (p, s) => { const t = `${p}.tmp`; writeFileSync(t, s); renameSync(t, p); };
+
+const PROCESSED_MAX = 5000;
+const CURSOR_OVERLAP_SECS = 5;
+
+// Count distinct human reporters of `bee` within the window, and whether the
+// quorum is met. Pure — testable without a relay. `reports` = {bee:{member:at}}.
+export const quorumMet = (reports, bee, nowSec, cfg) => {
+  const r = reports[bee] || {};
+  const fresh = Object.values(r).filter((at) => at >= nowSec - (cfg.window_secs || 86400)).length;
+  return { count: fresh, met: fresh >= (cfg.quorum || 2) };
+};
+
+// deps: { relay, logsChannelId, honeyContract, txq, parseUnits, loadRegistry,
+//         statePath, emit, selfPubkey, log, now? }
+//   honeyContract must expose slash(address,uint256,string) (HoneyV3).
+export const createSlasher = (deps) => {
+  const { statePath, log = () => {}, now = () => Date.now() } = deps;
+  const cfg = REWARDS.slashing || {};
+  const nowSec = () => Math.floor(now() / 1000);
+
+  const load = () => {
+    const s = loadJson(statePath, null);
+    if (s) { s.processed = s.processed || []; s.reports = s.reports || {}; s.slashedToday = s.slashedToday || []; return s; }
+    return { cursor: nowSec(), processed: [], reports: {}, slashedToday: [], altkeys: { claims: {}, acks: {} }, date: utcDay(now()) };
+  };
+  const save = (s) => writeAtomic(statePath, JSON.stringify(s, null, 2));
+  const markProcessed = (state, id) => { state.processed.push(id); if (state.processed.length > PROCESSED_MAX) state.processed = state.processed.slice(-PROCESSED_MAX); };
+
+  const poll = async () => {
+    if (!cfg.enabled || !deps.honeyContract) return { slashed: 0, reason: 'disabled' };
+    const state = load();
+    if (state.date !== utcDay(now())) { state.date = utcDay(now()); state.slashedToday = []; } // daily rate-cap reset
+    const registry = deps.loadRegistry();
+    const isBee = (pk) => !!(registry[pk] && registry[pk].is_bee);
+    const ownerOf = (pk) => (registry[pk] && registry[pk].bee_of) || null;
+    if (!Object.values(registry).some((r) => r?.is_bee)) { save(state); return { slashed: 0, reason: 'no-bees' }; }
+
+    const since = Math.max(0, (state.cursor || nowSec()) - CURSOR_OVERLAP_SECS);
+    const raw = await deps.relay.query([{ kinds: [9, 40002], '#h': [deps.logsChannelId], since, limit: 500 }]);
+    if (!raw) { save(state); return { slashed: 0, reason: 'relay-unreachable' }; }
+    const seen = new Set();
+    const rows = raw.map(RelayClient.normalize)
+      .sort((a, b) => (a.created_at - b.created_at) || (a.id < b.id ? -1 : 1))
+      .filter((m) => (seen.has(m.id) ? false : (seen.add(m.id), true)));
+
+    // Fold altkeys so a reporter's linked devices collapse to one member.
+    foldAltkeys(state, rows.map((m) => ({ pubkey: m.pubkey, j: verifiedEvent({ content: m.content, pubkey: m.pubkey }) })).filter((e) => e.j));
+    const memberOf = memberOfFrom(state);
+
+    // Ingest new reports into the durable reporter set.
+    const processed = new Set(state.processed);
+    let maxAt = state.cursor || 0;
+    for (const m of rows) {
+      maxAt = Math.max(maxAt, m.created_at);
+      if (processed.has(m.id)) continue;
+      const j = verifiedEvent({ content: m.content, pubkey: m.pubkey });
+      if (!j || j.type !== EV.REPORT || typeof j.subject !== 'string') continue; // not a report — leave for other consumers
+      markProcessed(state, m.id);
+      const bee = j.subject;
+      if (!isBee(bee)) continue;                          // only bees are slashable
+      const reporter = memberOf(m.pubkey);
+      // Reporter must be a REGISTERED, non-bee member. An unregistered key isn't a
+      // bee (isBee=false) but must NOT count toward quorum — otherwise two throwaway
+      // keys posting reports could slash anyone (Sybil). Altkeys collapse to the
+      // member via memberOf, so a member's devices count once.
+      if (!registry[reporter] || registry[reporter].is_bee) continue;
+      if (reporter === memberOf(ownerOf(bee) || '')) continue; // owner can't slash own bee
+      (state.reports[bee] = state.reports[bee] || {})[reporter] = m.created_at;
+    }
+
+    // Prune stale reports and evaluate quorum.
+    const win = cfg.window_secs || 86400;
+    let slashed = 0;
+    for (const bee of Object.keys(state.reports)) {
+      for (const [rep, at] of Object.entries(state.reports[bee])) if (at < nowSec() - win) delete state.reports[bee][rep];
+      if (!Object.keys(state.reports[bee]).length) { delete state.reports[bee]; continue; }
+      const { count, met } = quorumMet(state.reports, bee, nowSec(), cfg);
+      if (!met) continue;
+      if (state.slashedToday.includes(bee)) continue;     // per-bee daily rate cap (per_bee_daily_cap = 1)
+      const evm = registry[bee]?.evm;
+      if (!evm || !/^0x[0-9a-fA-F]{40}$/.test(evm)) { state.slashedToday.push(bee); log(`slasher: no wallet for ${bee.slice(0, 12)} — skip`); continue; }
+      const reason = `report-quorum:${count}`;
+      // Reserve today's slot BEFORE the burn (spend-ledger pattern) so a crash can
+      // never double-slash; a failed burn just defers (reports persist, today is
+      // spent). On SUCCESS, clear the reports so the SAME quorum can't re-slash on
+      // the next UTC day — the double-jeopardy that made one quorum burn twice.
+      state.slashedToday.push(bee);
+      save(state);
+      try {
+        const receipt = await deps.txq.enqueue((o) => deps.honeyContract.slash(evm, deps.parseUnits(String(cfg.amount || 10), 18), reason, o), { gasLimit: 250000n });
+        delete state.reports[bee];
+        save(state);
+        slashed++;
+        log(`slasher: −${cfg.amount} HONEY ⚔️ ${registry[bee]?.name || bee.slice(0, 12)} (${reason}, ${receipt.hash.slice(0, 12)})`);
+        try {
+          await deps.emit({ type: EV.SLASH, to: bee, amount: cfg.amount, reason, trigger: 'report-quorum', tx: receipt.hash, url: sepoliaTxUrl(receipt.hash), by: deps.selfPubkey, at: nowSec() });
+        } catch (e) { log('slasher: receipt emit failed:', String(e.message).slice(0, 100)); }
+      } catch (e) {
+        // Slot already reserved; reports remain → retried next UTC day. No double.
+        log(`slasher: slash failed for ${bee.slice(0, 12)} (deferred to next day): ${String(e.message).slice(0, 120)}`);
+        return { slashed, reason: 'slash-failed' };
+      }
+    }
+    state.cursor = maxAt;
+    save(state);
+    return { slashed };
+  };
+
+  return { poll, _load: load, _save: save };
+};

package/server/supervisor.mjs

@@ -216,6 +216,33 @@ createServer((req, res) => {
     res.end(JSON.stringify({ respawned: true }));
     return;
   }
+  if (url.pathname === '/restart' && req.method === 'POST') {
+    // Restart ONE bee with fresh config+secrets from disk (used by the api
+    // worker after `hive key set` rewrites them). Internal port only.
+    let body = '';
+    req.on('data', (c) => { body += c; });
+    req.on('end', () => {
+      let name = '';
+      try { name = String(JSON.parse(body || '{}').name || ''); } catch {}
+      const e = bees.get(name);
+      if (!name || (!e && !existsSync(join(BEES_DIR, name, 'config.json')))) {
+        res.writeHead(404, { 'content-type': 'application/json' });
+        res.end('{"error":"unknown bee"}');
+        return;
+      }
+      if (e) { e.restarts = []; e.backoffMs = 1000; }
+      if (e?.child) {
+        try { e.child.kill('SIGTERM'); } catch {}   // exit handler respawns
+      } else {
+        if (e) e.state = 'stopped';
+        spawnBee(name);
+      }
+      log(`restart requested for bee ${name}`);
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ restarting: name }));
+    });
+    return;
+  }
   res.writeHead(404, { 'content-type': 'application/json' });
   res.end('{"error":"not found"}');
 }).listen(HEALTH_PORT, () => log(`health on :${HEALTH_PORT}/healthz`));