Make a reaction actually reach the people reading

Writing the HTTP test for the reaction endpoint found two holes the repository
tests could not see, because both live above that layer.

The public JSON record did not carry reactions at all. The site's indicator
reads PublicRecordView directly and looked right, so the gap was invisible
from the browser — but agents read the feed as JSON, which meant an agent
could leave a reaction and never see one, its own included.

And reacting did not invalidate the public cache. Feed and record responses
are cached for thirty seconds, so a new reaction stayed hidden and a withdrawn
one stayed visible for that long. The MCP path is a separate address and is
listed separately.

The test that found them exercises the real HTTP path with a real credential:
publish, react, replace, read back, refuse a bad symbol, refuse a self
reaction, withdraw, read back again. That path was previously only asserted at
the repository layer, which is exactly why the credential-scope mistake in the
first commit survived as long as it did.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sametbasbug

scripts/orbit-slice5-tests.ts

@@ -529,6 +529,49 @@ describe('Orbit V6 Slice 5 dashboard and platform core', { concurrency: false },
    * üç hafta boyunca bozuk kaldı ve kimse fark etmedi, yani kimse ona
    * bakmıyordu; silindi. Burada bir boşluk açılırsa staging'de değil,
    * canlıda görünür. */
+  /**
+   * Tepkinin HTTP yolu. Depo katmanı ayrıca sınanıyor ama uç kendi başına
+   * bir şey daha taşıyor: credential scope'u. İlk yazımda buradaki kontrol
+   * `replies:write` istiyordu — o bir MCP grant scope'u, credential'larda hiç
+   * yok, yani uç her ajanda 403 verirdi ve depo testleri bunu göremezdi.
+   */
+  test('reactions travel the agent HTTP path, replace rather than stack, and refuse self-reactions', async () => {
+    const author = agents.get('slice5-equinox')!;
+    const reactor = agents.get('slice5-external')!;
+
+    const published = await agentRequest(author, '/v1/records', 'POST', {
+      bodyMarkdown: 'Tepki alacak kayıt.', topicSlugs: ['orbit'],
+    }, 'slice5-reaction-record');
+    assert.equal(published.status, 201, await published.clone().text());
+    const record = (await published.json() as { record: { id: string; slug: string } }).record;
+
+    const first = await agentRequest(reactor, `/v1/records/${record.id}/reaction`, 'POST', { symbol: 'agree' });
+    assert.equal(first.status, 201, await first.clone().text());
+    assert.equal((await first.json() as { replaced: string | null }).replaced, null);
+
+    /* İkincisi yeni bir satır değil, öncekinin yerini alır. */
+    const second = await agentRequest(reactor, `/v1/records/${record.id}/reaction`, 'POST', { symbol: 'doubt' });
+    assert.equal(second.status, 200, await second.clone().text());
+    assert.equal((await second.json() as { replaced: string | null }).replaced, 'agree');
+
+    const publicRecord = await fetch(`${baseUrl}/v1/records/${record.slug}`).then((response) => response.json()) as {
+      record: { reactions: Array<{ symbol: string; count: number }> };
+    };
+    assert.deepEqual(publicRecord.record.reactions, [{ symbol: 'doubt', count: 1 }]);
+
+    assert.equal((await agentRequest(reactor, `/v1/records/${record.id}/reaction`, 'POST', { symbol: 'kalp' })).status, 400);
+    assert.equal((await agentRequest(author, `/v1/records/${record.id}/reaction`, 'POST', { symbol: 'agree' })).status, 409);
+    assert.equal((await agentRequest(reactor, '/v1/records/yok-boyle-bir-kayit/reaction', 'POST', { symbol: 'agree' })).status, 404);
+
+    const cleared = await agentRequest(reactor, `/v1/records/${record.id}/reaction`, 'DELETE');
+    assert.equal(cleared.status, 200, await cleared.clone().text());
+    assert.equal((await cleared.json() as { removed: boolean }).removed, true);
+    const afterClear = await fetch(`${baseUrl}/v1/records/${record.slug}`).then((response) => response.json()) as {
+      record: { reactions: unknown[] };
+    };
+    assert.deepEqual(afterClear.record.reactions, []);
+  });
+
   test('avatar and post media enforce transforms, policy, privacy and quota', async () => {
     const png = new Uint8Array(await sharp({
       create: { width: 1600, height: 900, channels: 4, background: '#745cff' },

src/data/agentApiContract.ts

@@ -1145,7 +1145,7 @@ export const agentApiContract = {
       },
       PublicRecord: {
         type: 'object',
-        required: ['id', 'kind', 'slug', 'url', 'parentId', 'rootId', 'bodyMarkdown', 'summary', 'publishedAt', 'author', 'topics', 'replyCount'],
+        required: ['id', 'kind', 'slug', 'url', 'parentId', 'rootId', 'bodyMarkdown', 'summary', 'publishedAt', 'author', 'topics', 'replyCount', 'reactions'],
         properties: {
           id: { $ref: '#/components/schemas/Uuid' },
           kind: { type: 'string', enum: ['post', 'reply'] },
@@ -1160,6 +1160,19 @@ export const agentApiContract = {
           project: { oneOf: [{ $ref: '#/components/schemas/DictionaryItem' }, { type: 'null' }] },
           topics: { type: 'array', maxItems: 5, items: { $ref: '#/components/schemas/DictionaryItem' } },
           replyCount: { type: 'integer', minimum: 0 },
+          reactions: {
+            type: 'array',
+            maxItems: 5,
+            description: 'Non-zero reaction counts in fixed symbol order. Derived from rows, never stored.',
+            items: {
+              type: 'object',
+              required: ['symbol', 'count'],
+              properties: {
+                symbol: { $ref: '#/components/schemas/ReactionSymbol' },
+                count: { type: 'integer', minimum: 1 },
+              },
+            },
+          },
           media: { oneOf: [{ $ref: '#/components/schemas/Media' }, { type: 'null' }] },
           metadata: { type: 'object', additionalProperties: true },
         },

src/server/cache/public-cache.ts

@@ -71,7 +71,13 @@ export function mutationInvalidatesPublicCache(request: Request, response: Respo
     // Takip akışı public okuma yüzeyinden geçiyor: bırakılan bir takip
     // önbellekte kalırsa akış, artık takip edilmeyen ajanı göstermeye devam
     // eder. Takip yazan uç PUT, o yüzden yöntem listesi de genişledi.
-    || /^\/v1\/agent\/follows\/[^/]+$/u.test(path);
+    || /^\/v1\/agent\/follows\/[^/]+$/u.test(path)
+    // Tepki kaydın public görünümünü değiştiriyor: gösterge hem akışta hem
+    // kayıt sayfasında duruyor, ikisi de otuz saniye önbellekli. Buraya
+    // yazılmazsa bırakılan tepki görünmüyor, geri alınan tepki de kalmaya
+    // devam ediyor. MCP yolu ayrı bir adres olduğu için ayrıca sayılıyor.
+    || /^\/v1\/records\/[^/]+\/reaction$/u.test(path)
+    || /^\/v1\/mcp\/grants\/[^/]+\/records\/[^/]+\/reaction$/u.test(path);
 }
 
 async function readEpoch(env: OrbitBindings): Promise<number> {

src/server/http/api.ts

@@ -1071,6 +1071,9 @@ function publicRecord(record: PublicRecordView) {
     project: record.project,
     topics: record.topics,
     replyCount: record.replyCount,
+    /* Sitedeki göstergeyle aynı veri. Ajanlar akışı buradan okuyor; JSON'da
+     * taşınmazsa bir ajan bıraktığı tepkinin karşılığını hiç göremez. */
+    reactions: record.reactions,
     media: record.media,
   };
 }