#351

Reviewed-on: #350

.gitea/ISSUE_TEMPLATE.md

@@ -0,0 +1,35 @@
+## 背景
+
+なぜ必要か。
+
+## 対象範囲
+
+- backend:
+- frontend:
+- docs:
+- migration:
+
+## やること
+
+- [ ] 
+
+## 受け入れ条件
+
+- [ ] 
+
+## 実行すべき確認
+
+- [ ] `cd backend && bundle exec rspec`
+- [ ] `cd frontend && npm run build`
+- [ ] `cd frontend && npm run lint`
+
+## 禁止事項
+
+- unrelated refactor はしない
+- 既存 API response shape を壊さない
+- 認証・認可・BAN を弱めない
+
+## Codex への指示
+
+この issue を読んで実装してください。
+不明点があれば、実装前に調査結果と選択肢を提示してください。

AGENTS.md

@@ -0,0 +1,143 @@
+# AGENTS.md
+
+## Project overview
+
+BTRC Hub / タグ広場 is a split Rails API and React frontend repository.
+
+- Backend: Rails API under `backend/`.
+- Frontend: React + TypeScript + Vite under `frontend/`.
+- Docs: lightweight command notes under `docs/`.
+- There is no README or Makefile at the repository root as of this inspection.
+
+## Stack
+
+- Backend: Ruby `3.2.2` from `backend/.ruby-version`, Rails `~> 8.0.2`.
+- Backend dependencies include `mysql2`, `sqlite3`, `rspec-rails`, `factory_bot_rails`, `rack-cors`, `jwt`, `discard`, `gollum`, `whenever`, `aws-sdk-s3`, `brakeman`, and `rubocop-rails-omakase`.
+- Frontend: React `^19.1.0`, TypeScript `~5.8.3`, Vite `^6.3.5`.
+- Frontend data/UI dependencies include Axios, TanStack Query, Tailwind CSS, Framer Motion, Radix UI components, lucide-react, MDX/Markdown tooling, and Zustand.
+
+## Main directories
+
+- `backend/app/controllers`: Rails API controllers.
+- `backend/app/models`: Active Record models.
+- `backend/app/representations`: API response representation classes.
+- `backend/app/services`: domain services such as version recording, wiki commit, YouTube sync, and similarity calculation.
+- `backend/config/routes.rb`: API routes.
+- `backend/db/migrate`: migrations.
+- `backend/db/schema.rb`: current schema snapshot.
+- `backend/lib/tasks`: custom Rake tasks.
+- `backend/spec`: RSpec tests.
+- `backend/test`: Rails minitest files that still exist in the tree.
+- `frontend/src/App.tsx`: frontend route definitions and initial user setup.
+- `frontend/src/pages`: page-level React components.
+- `frontend/src/components`: shared and feature components.
+- `frontend/src/lib`: API client helpers, query keys, prefetchers, and domain helpers.
+- `frontend/src/stores`: Zustand stores.
+- `docs/commands.md`: command notes.
+
+## Commands
+
+Only list commands that are backed by files inspected in this repository.
+
+### Backend
+
+The following binstubs exist under `backend/bin`:
+
+```sh
+cd backend
+bin/setup
+bin/dev
+bin/rails
+bin/rake
+bin/rubocop
+bin/brakeman
+bin/kamal
+bin/thrust
+```
+
+Common Rails/Rake usage through existing binstubs:
+
+```sh
+cd backend
+bin/rails db:prepare
+bin/rails db:migrate
+bin/rails routes
+bin/rails server
+bin/rake
+bin/rubocop
+bin/brakeman
+```
+
+RSpec is present in `Gemfile` and `.rspec` exists:
+
+```sh
+cd backend
+bundle exec rspec
+```
+
+### Frontend
+
+The following npm scripts exist in `frontend/package.json`:
+
+```sh
+cd frontend
+npm run dev
+npm run build
+npm run lint
+npm run preview
+```
+
+`npm run build` runs `tsc -b && vite build`, then `postbuild` runs `node scripts/generate-sitemap.js`.
+
+Do not write or report `npm test` as a repository command unless a `test` script is added to `frontend/package.json`.
+
+## Coding style
+
+- Prefer precise, minimal changes.
+- Do not flatter or over-explain.
+- Explain risks directly.
+- Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
+- Ruby: never put a space before method-call parentheses.
+- Ruby: do not use `%w` or `%i`.
+- TypeScript and Python: use GNU-style spacing before parentheses where syntactically valid.
+- Do not add production dependencies without explicit approval.
+
+## Backend rules
+
+- Inspect existing routes, controllers, models, services, and specs before editing backend behavior.
+- For API behavior changes, add or update request specs under `backend/spec/requests`.
+- Prefer RSpec for new backend tests; existing minitest files under `backend/test` do not make minitest the default for new coverage.
+- Do not weaken authentication, BAN user checks, or IP BAN checks.
+- Preserve the `X-Transfer-Code` user identification flow unless the task explicitly changes authentication.
+- Be careful with version tables, `version_no`, optimistic concurrency, wiki revisions, and restore/diff behavior.
+- Be careful with tag names, tag normalization, implications, similarities, and discard behavior.
+- Keep migration files and `backend/db/schema.rb` consistent when changing schema.
+
+## Frontend rules
+
+- Use `frontend/src/lib/api.ts` for API calls so headers and camelCase conversion stay consistent.
+- Add or reuse TanStack Query keys through `frontend/src/lib/queryKeys.ts`; avoid ad hoc query key arrays.
+- Encode URL path-segment values with `encodeURIComponent`.
+- React hooks must be called unconditionally.
+- Keep page-level code under `frontend/src/pages` and shared UI/feature code under `frontend/src/components` unless existing patterns point elsewhere.
+- Match existing Tailwind, component, and import alias conventions.
+
+## Codex workflow
+
+- First inspect existing patterns; do not invent new architecture when a local convention exists.
+- Keep changes scoped to the requested issue.
+- Do not scan or summarize dependency/generated/runtime directories such as `node_modules`, `dist`, `tmp`, `log`, and `storage` unless explicitly needed.
+- Before touching wiki, tag, versioning, BAN, IP BAN, or authentication behavior, inspect the related request specs and service objects.
+- If frontend code changes, run the existing frontend verification commands that apply: `npm run build` and `npm run lint`.
+- If backend code changes, run the relevant RSpec command; for broad backend changes, run `bundle exec rspec`.
+- If a verification command cannot be run or fails, report the exact command and failure.
+
+## Completion criteria
+
+A task is complete only when:
+
+- implementation is complete,
+- relevant verification commands pass, or failures are clearly explained,
+- unrelated files are not changed,
+- migrations and schema are consistent when schema changes are made,
+- user-facing behavior is documented when needed.

backend/AGENTS.md

@@ -0,0 +1,147 @@
+# backend/AGENTS.md
+
+## Scope
+
+These rules apply to work under `backend/`.
+
+This is a Rails API app using Active Record, RSpec, request specs, service objects, representation classes, and version tables for post/tag/wiki history.
+
+## Commands
+
+Use commands backed by files and dependencies in this directory:
+
+```sh
+bin/setup
+bin/dev
+bin/rails
+bin/rake
+bin/rubocop
+bin/brakeman
+bundle exec rspec
+```
+
+Common checks:
+
+```sh
+bundle exec rspec
+bin/rubocop
+bin/brakeman
+```
+
+Common Rails commands:
+
+```sh
+bin/rails db:prepare
+bin/rails db:migrate
+bin/rails routes
+bin/rails server
+```
+
+After backend behavior changes, run the relevant RSpec files. For broad backend changes, run:
+
+```sh
+bundle exec rspec
+```
+
+If a command cannot be run or fails, report the exact command and failure.
+
+## Rails structure
+
+- `app/controllers`: API controllers.
+- `app/models`: Active Record models and concerns.
+- `app/representations`: JSON response shaping.
+- `app/services`: domain services such as version recorders, wiki commit, YouTube sync, and similarity calculation.
+- `config/routes.rb`: public API routes.
+- `db/migrate`: migrations.
+- `db/schema.rb`: schema snapshot.
+- `lib/tasks`: custom Rake tasks.
+- `spec`: RSpec tests.
+
+Before changing behavior, inspect the matching route, controller, model, service, representation, and spec.
+
+## Ruby style
+
+- Prefer precise, minimal changes.
+- Use single quotes unless interpolation or escaping makes double quotes better.
+- Do not put a space before Ruby method-call parentheses.
+- Do not use `%w` or `%i` in new Ruby code.
+- Keep comments short and useful; avoid narrating obvious code.
+- Do not add production dependencies without approval.
+
+## Authentication and authorization
+
+- Authentication is handled through the `X-Transfer-Code` header in `ApplicationController#authenticate_user`.
+- `current_user` is set by looking up `User.inheritance_code`.
+- Do not bypass or weaken the `X-Transfer-Code` flow unless the task explicitly changes authentication.
+- Unauthenticated write actions should return `:unauthorized` consistently with existing controllers.
+- Role checks use `User` enum roles: `guest`, `member`, and `admin`.
+- Use `current_user.gte_member?` for member-or-admin write permissions where existing controllers do so.
+- Use `current_user.admin?` only for admin-only paths, such as tag child relationship changes.
+- Do not replace role checks with looser presence checks.
+
+## BAN and IP BAN
+
+- `ApplicationController` runs these before actions in order:
+  - `reject_banned_ip_address!`
+  - `authenticate_user`
+  - `reject_banned_user!`
+- User and IP bans use `banned_at`, not a boolean `banned` column.
+- `User#banned?` and `IpAddress#banned?` check `banned_at.present?`.
+- Do not weaken BAN or IP BAN behavior.
+- If changing request authentication or controller before actions, add or update request specs covering banned users and banned IP addresses.
+
+## RSpec
+
+- Prefer RSpec for new backend tests.
+- Put API behavior coverage under `spec/requests`.
+- Put model behavior under `spec/models`.
+- Put service behavior under `spec/services`.
+- Put Rake task coverage under `spec/tasks`.
+- `spec/rails_helper.rb` loads `spec/support/**/*.rb`.
+- Request specs include `AuthHelper` and `JsonHelper`.
+- `AuthHelper#sign_in_as(user)` stubs `ApplicationController#current_user`; use it when matching existing request spec style.
+- Add or update request specs for API behavior changes, especially status codes, permissions, response shape, and version conflict behavior.
+
+## Migrations
+
+- Keep migrations and `db/schema.rb` consistent.
+- Use reversible migrations where practical; otherwise define explicit `up` and `down`.
+- For data backfills inside migrations, follow the existing pattern of defining migration-local `ActiveRecord::Base` classes with `self.table_name`.
+- Preserve existing indexes, foreign keys, check constraints, and null constraints.
+- Be careful with MySQL-specific options already present in migrations, such as `after:`.
+- Do not edit old migrations just to change current behavior unless explicitly requested; add a new migration.
+
+## Version tables
+
+- Versioned records include posts, tags, nico tags, and wiki pages.
+- Current records have `version_no`; version tables have positive `version_no` with unique indexes scoped to the parent record.
+- Version event types are `create`, `update`, `discard`, and `restore`.
+- Version rows are readonly through the `VersionRecord` concern.
+- Use the existing recorder services instead of manually inserting version rows in application code:
+  - `PostVersionRecorder`
+  - `TagVersionRecorder`
+  - `NicoTagVersionRecorder`
+  - `WikiVersionRecorder`
+  - `TagVersioning`
+- `VersionRecorder` locks the current record, validates sequence consistency, skips unchanged update snapshots, creates the next version row, and updates the record `version_no`.
+- Do not update versioned records without considering whether a version snapshot must be created.
+- For optimistic concurrency paths, preserve `base_version_no`, `force`, and `merge` semantics and cover conflicts in request specs.
+
+## Domain cautions
+
+- Posts have tag snapshots, parent post implications, original-created ranges, viewed state, and version conflict behavior.
+- Tags have canonical names, aliases through `TagName`, categories, parent implications, discard behavior, and version snapshots.
+- Nico tags have separate relation/version behavior; do not treat them like normal editable tags without checking existing code.
+- Wiki pages involve page content, revisions/history, version rows, title/tag-name behavior, and diff/restore paths.
+- Materials, theatres, and comments have user and permission checks; inspect the controller before changing them.
+
+## API responses
+
+- Use representation classes under `app/representations` when existing endpoints do.
+- Keep response keys consistent with existing JSON contracts; frontend code expects camelCase conversion client-side, while Rails params and JSON keys are generally snake_case.
+- Preserve existing HTTP status conventions: `:unauthorized` for no user, `:forbidden` for insufficient role or banned user, `:not_found` for missing records, and `:unprocessable_entity` for validation failures.
+
+## Files to avoid in routine work
+
+- Do not inspect or edit `tmp/`, `log/`, `storage/`, `vendor/`, or dependency directories unless explicitly needed.
+- Do not modify generated schema or migration output without the corresponding migration when schema changes are made.

backend/app/controllers/posts_controller.rb

@@ -44,7 +44,7 @@ class PostsController < ApplicationController
         filtered_posts
         .joins("LEFT JOIN (#{ pt_max_sql }) pt_max ON pt_max.post_id = posts.id")
         .reselect('posts.*', Arel.sql("#{ updated_at_all_sql } AS updated_at_all"))
-        .preload(tags: [:materials, { tag_name: :wiki_page }])
+        .preload(tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
         .with_attached_thumbnail
 
     q = q.where('posts.url LIKE ?', "%#{ url }%") if url
@@ -95,7 +95,8 @@ class PostsController < ApplicationController
   end
 
   def random
-    post = filtered_posts.preload(tags: [:materials, { tag_name: :wiki_page }])
+    post = filtered_posts
+           .preload(tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
            .order('RAND()')
            .first
     return head :not_found unless post
@@ -104,11 +105,11 @@ class PostsController < ApplicationController
   end
 
   def show
-    post = Post.includes(tags: [:materials, { tag_name: :wiki_page }]).find_by(id: params[:id])
+    post = Post.includes(tags: [:deerjikists, :materials, { tag_name: :wiki_page }]).find_by(id: params[:id])
     return head :not_found unless post
 
     render json: PostRepr.base(post, current_user)
-                         .merge(tags: build_tag_tree_for(post.tags),
+                         .merge(tags: build_tag_tree_for(post),
                                 related: PostRepr.many(post.related(limit: 20)))
   end
 
@@ -132,11 +133,11 @@ class PostsController < ApplicationController
     ApplicationRecord.transaction do
       post.save!
 
-      tags = Tag.normalise_tags!(tag_names)
+      Tag.normalise_tags!(tag_names, with_sections: true) => { tags:, sections: }
       TagVersioning.record_tag_snapshots!(tags, created_by_user: current_user)
 
       tags = Tag.expand_parent_tags(tags)
-      sync_post_tags!(post, tags)
+      sync_post_tags!(post, tags, sections)
 
       sync_parent_posts!(post, parent_post_ids)
 
@@ -173,34 +174,69 @@ class PostsController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
+    force = bool?(:force)
+    merge = bool?(:merge)
+    return head :bad_request if force && merge
+
+    base_version_no = parse_base_version_no
+    return head :bad_request if !(force) && !(base_version_no)
+
     title = params[:title].presence
     tag_names = params[:tags].to_s.split
     original_created_from = params[:original_created_from]
     original_created_before = params[:original_created_before]
     parent_post_ids = parse_parent_post_ids
 
-    post = Post.find(params[:id].to_i)
+    post = nil
+    conflict_json = nil
 
     ApplicationRecord.transaction do
-      PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
+      post = Post.lock.find(params[:id].to_i)
 
-      post.update!(title:, original_created_from:, original_created_before:)
+      base_version = nil
+      base_snapshot = nil
+      current_snapshot = nil
+      unless force
+        base_version = post.post_versions.find_by!(version_no: base_version_no)
 
-      normalised_tags = Tag.normalise_tags!(tag_names, with_tagme: false)
-      TagVersioning.record_tag_snapshots!(normalised_tags, created_by_user: current_user)
+        base_snapshot = post_snapshot_from_version(base_version)
+        current_snapshot = post_snapshot_from_record(post)
+      end
+      incoming_snapshot = post_incoming_snapshot(title:,
+                                                 original_created_from:,
+                                                 original_created_before:,
+                                                 tag_names:,
+                                                 parent_post_ids:)
 
-      tags = post.tags.nico.to_a + normalised_tags
-      tags = Tag.expand_parent_tags(tags)
-      sync_post_tags!(post, tags)
+      snapshot_to_apply =
+          if force || post.version_no == base_version_no || current_snapshot == base_snapshot
+            incoming_snapshot
+          else
+            changes = post_snapshot_changes(base_snapshot, current_snapshot, incoming_snapshot)
+            conflicts = changes.select { |change| change[:conflict] }
 
-      sync_parent_posts!(post, parent_post_ids)
-
-      PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
+            if merge && conflicts.empty?
+              merge_post_snapshots(base_snapshot, current_snapshot, incoming_snapshot)
+            else
+              conflict_json = post_conflict_json(post:,
+                                                 base_version_no:,
+                                                 base_snapshot:,
+                                                 current_snapshot:,
+                                                 incoming_snapshot:,
+                                                 changes:,
+                                                 conflicts:)
+              raise ActiveRecord::Rollback
+            end
           end
 
+      apply_post_snapshot!(post, snapshot_to_apply)
+    end
+
+    return render json: conflict_json, status: :conflict if conflict_json
+
     post.reload
-    json = post.as_json
-    json['tags'] = build_tag_tree_for(post.tags)
+    json = PostRepr.base(post, current_user)
+    json['tags'] = build_tag_tree_for(post)
     render json:, status: :ok
   rescue Tag::NicoTagNormalisationError
     head :bad_request
@@ -225,7 +261,7 @@ class PostsController < ApplicationController
     pts = pts.where(post_id: id) if id.present?
     pts = pts.where(tag_id:) if tag_id.present?
     pts = pts.includes(:post, :created_user, :deleted_user,
-                       tag: [:materials, { tag_name: :wiki_page }])
+                       tag: [:deerjikists, :materials, { tag_name: :wiki_page }])
 
     events = []
     pts.each do |pt|
@@ -302,7 +338,7 @@ class PostsController < ApplicationController
   def tagged_post_ids_for(name) =
       Post.joins(tags: :tag_name).where(tag_names: { name: }).select(:id)
 
-  def sync_post_tags! post, desired_tags
+  def sync_post_tags! post, desired_tags, sections
     desired_tags.each do |t|
       t.save! if t.new_record?
     end
@@ -321,13 +357,20 @@ class PostsController < ApplicationController
       end
     end
 
+    PostTagSection.where(post_id: post.id).destroy_all
+    sections.each do |tag_id, ranges|
+      ranges.each do |begin_ms, end_ms|
+        PostTagSection.create!(post_id: post.id, tag_id:, begin_ms:, end_ms:)
+      end
+    end
+
     PostTag.where(post_id: post.id, tag_id: to_remove.to_a).kept.find_each do |pt|
       pt.discard_by!(current_user)
     end
   end
 
-  def build_tag_tree_for tags
-    tags = tags.to_a
+  def build_tag_tree_for post
+    tags = post.tags.to_a
     tag_ids = tags.map(&:id)
 
     implications = TagImplication.where(parent_tag_id: tag_ids, tag_id: tag_ids)
@@ -349,8 +392,11 @@ class PostsController < ApplicationController
       tag = tags_by_id[tag_id]
       return nil unless tag
 
+      sections = PostTagSection.where(post_id: post.id, tag_id:)
+                 .as_json(only: [:begin_ms, :end_ms])
+
       if path.include?(tag_id)
-        return TagRepr.base(tag).merge(children: [])
+        return TagRepr.base(tag).merge(children: [], sections:)
       end
 
       if memo.key?(tag_id)
@@ -362,7 +408,7 @@ class PostsController < ApplicationController
 
       children = child_ids.filter_map { |cid| build_node.(cid, new_path) }
 
-      memo[tag_id] = TagRepr.base(tag).merge(children:)
+      memo[tag_id] = TagRepr.base(tag).merge(children:, sections:)
     end
 
     root_ids.filter_map { |id| build_node.call(id, []) }
@@ -373,7 +419,7 @@ class PostsController < ApplicationController
 
     params[:parent_post_ids].to_s.split.map { |token|
       id = Integer(token, exception: false)
-      raise ArgumentError, "親投稿 Id. が不正です: #{ token }" if id.nil? || id <= 0
+      raise ArgumentError, "親投稿 Id. が不正です: #{ token }" if !(id) || id <= 0
 
       id
     }.uniq
@@ -404,4 +450,227 @@ class PostsController < ApplicationController
       PostImplication.create_or_find_by!(post_id: post.id, parent_post_id:)
     end
   end
+
+  def parse_base_version_no
+    version_no = Integer(params[:base_version_no], exception: false)
+    if version_no&.positive?
+      version_no
+    else
+      nil
+    end
+  end
+
+  def post_snapshot_from_version version
+    { title: version.title,
+      original_created_from: snapshot_time(version.original_created_from),
+      original_created_before: snapshot_time(version.original_created_before),
+      tag_names: editable_tag_names_from_version(version),
+      parent_post_ids: snapshot_parent_post_ids_from_version(version) }
+  end
+
+  def editable_tag_names_from_version version
+    version.tags.to_s.split.reject { |name| name.downcase.start_with?('nico:') }.sort
+  end
+
+  def post_snapshot_from_record post
+    { title: post.title,
+      original_created_from: snapshot_time(post.original_created_from),
+      original_created_before: snapshot_time(post.original_created_before),
+      tag_names: editable_tag_names_from_post(post),
+      parent_post_ids: post.parent_posts.order(:id).pluck(:id) }
+  end
+
+  def editable_tag_names_from_post post
+    post
+        .post_tags
+        .kept
+        .joins(tag: :tag_name)
+        .merge(Tag.not_nico)
+        .includes(:sections, tag: :tag_name)
+        .order('tag_names.name')
+        .map do |post_tag|
+      name = post_tag.tag.tag_name.name
+      sections = post_tag.sections.sort_by(&:begin_ms)
+
+      next name if sections.empty?
+
+      "#{ name }#{ sections.map { Post.section_literal(_1) }.join }"
+    end
+  end
+
+  def post_incoming_snapshot title:, original_created_from:, original_created_before:,
+                             tag_names:, parent_post_ids:
+    { title:,
+      original_created_from: snapshot_time(original_created_from),
+      original_created_before: snapshot_time(original_created_before),
+      tag_names: incoming_tag_names_for_snapshot(tag_names),
+      parent_post_ids: parent_post_ids.sort }
+  end
+
+  def snapshot_parent_post_ids_from_version version
+    if version.respond_to?(:parent_post_ids)
+      version.parent_post_ids.to_s.split.map { |id| id.to_i }.sort
+    elsif version.respond_to?(:parent_id) && version.parent_id
+      [version.parent_id]
+    else
+      []
+    end
+  end
+
+  def snapshot_time value
+    return nil if value.blank?
+
+    value = Time.zone.parse(value.to_s) if value in String
+    value&.in_time_zone&.iso8601(6)
+  rescue ArgumentError, TypeError
+    value.to_s
+  end
+
+  def incoming_tag_names_for_snapshot raw_tag_names
+    Tag.normalise_tags!(raw_tag_names, with_tagme: false, with_sections: true) =>
+        { tags:, sections: }
+
+    Tag.expand_parent_tags(tags).uniq(&:id).map { |tag|
+      "#{ tag.name }#{ sections[tag.id].to_a.map { section_literal(_1) }.join }"
+    }.sort
+  end
+
+  def section_literal section
+    "[#{ Post.ms_to_time(section[0]) }-#{ Post.ms_to_time(section[1]) }]"
+  end
+
+  def post_conflict_json post:, base_version_no:, base_snapshot:,
+                         current_snapshot:, incoming_snapshot:, changes:, conflicts:
+    { error: 'conflict',
+      message: '競合が発生しました．',
+      post_id: post.id,
+      base_version_no:,
+      current_version_no: post.version_no,
+      base: base_snapshot,
+      current: current_snapshot,
+      mine: incoming_snapshot,
+      changes:,
+      conflicts:,
+      mergeable: conflicts.empty? }
+  end
+
+  def post_snapshot_changes base_snapshot, current_snapshot, incoming_snapshot
+    [scalar_snapshot_change(:title, 'タイトル',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     scalar_snapshot_change(:original_created_from, 'オリジナルの作成日時（以降）',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     scalar_snapshot_change(:original_created_before, 'オリジナルの作成日時（より前）',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     set_snapshot_change(:tag_names, 'タグ',
+                         base_snapshot, current_snapshot, incoming_snapshot),
+     set_snapshot_change(:parent_post_ids, '親投稿',
+                         base_snapshot, current_snapshot, incoming_snapshot)].compact
+  end
+
+  def scalar_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
+    base = base_snapshot[field]
+    current = current_snapshot[field]
+    mine = incoming_snapshot[field]
+
+    return nil if current == base && mine == base
+
+    { field:, label:, base:, current:, mine:,
+      changed_by_current: current != base,
+      changed_by_me: mine != base,
+      conflict: scalar_snapshot_conflict?(base, current, mine) }
+  end
+
+  def scalar_snapshot_conflict? base, current, mine
+    current != base && mine != base && current != mine
+  end
+
+  def set_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
+    base = base_snapshot[field].to_a
+    current = current_snapshot[field].to_a
+    mine = incoming_snapshot[field].to_a
+
+    added_by_current = current - base
+    removed_by_current = base - current
+    added_by_me = mine - base
+    removed_by_me = base - mine
+
+    if (added_by_current.empty? &&
+        removed_by_current.empty? &&
+        added_by_me.empty? &&
+        removed_by_me.empty?)
+      return nil
+    end
+
+    { field:, label:, base:, current:, mine:, added_by_current:, removed_by_current:,
+      added_by_me:, removed_by_me:,
+      changed_by_current: added_by_current.present? || removed_by_current.present?,
+      changed_by_me: added_by_me.present? || removed_by_me.present?,
+      conflict: set_snapshot_conflict?(added_by_current:,
+                                       removed_by_current:,
+                                       added_by_me:,
+                                       removed_by_me:) }
+  end
+
+  def set_snapshot_conflict? added_by_current:, removed_by_current:,
+                             added_by_me:, removed_by_me:
+    (added_by_current & removed_by_me).present? || (removed_by_current & added_by_me).present?
+  end
+
+  def apply_post_snapshot! post, snapshot
+    PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
+
+    post.update!(title: snapshot[:title],
+                 original_created_from: snapshot[:original_created_from],
+                 original_created_before: snapshot[:original_created_before])
+
+    Tag.normalise_tags!(snapshot[:tag_names], with_tagme: false, with_sections: true) =>
+        { tags: editable_tags, sections: }
+    TagVersioning.record_tag_snapshots!(editable_tags, created_by_user: current_user)
+
+    readonly_tags = post.tags.nico.to_a
+
+    tags = readonly_tags + editable_tags
+    tags = Tag.expand_parent_tags(tags)
+
+    sync_post_tags!(post, tags, sections)
+    sync_parent_posts!(post, snapshot[:parent_post_ids])
+
+    PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
+  end
+
+  def merge_post_snapshots base_snapshot, current_snapshot, incoming_snapshot
+    [:title, :original_created_from, :original_created_before].map {
+      [_1, merge_scalar_snapshot_value(base_snapshot[_1],
+                                       current_snapshot[_1],
+                                       incoming_snapshot[_1])]
+    }.to_h.merge([:tag_names, :parent_post_ids].map {
+      [_1, merge_set_snapshot_value(base_snapshot[_1],
+                                    current_snapshot[_1],
+                                    incoming_snapshot[_1])]
+    }.to_h)
+  end
+
+  def merge_scalar_snapshot_value base, current, mine
+    return mine if current == base
+    return current if mine == base || current == mine
+
+    raise ArgumentError, '競合してゐる項目はマージできません．'
+  end
+
+  def merge_set_snapshot_value base, current, mine
+    base = base.to_a
+    current = current.to_a
+    mine = mine.to_a
+
+    added_by_current = current - base
+    removed_by_current = base - current
+    added_by_me = mine - base
+    removed_by_me = base - mine
+
+    merged = base + added_by_current + added_by_me
+    merged -= removed_by_current
+    merged -= removed_by_me
+
+    merged.uniq.sort
+  end
 end

backend/app/controllers/users_controller.rb

@@ -1,8 +1,5 @@
 class UsersController < ApplicationController
   def create
-    return head :unprocessable_entity if request.remote_ip.blank?
-    return head :forbidden if ip_address_banned?
-
     user = nil
     User.transaction do
       user = User.create!(inheritance_code: SecureRandom.uuid, role: :guest)
@@ -15,9 +12,6 @@ class UsersController < ApplicationController
   end
 
   def verify
-    return head :unprocessable_entity if request.remote_ip.blank?
-    return head :forbidden if ip_address_banned?
-
     user = User.find_by(inheritance_code: params[:code])
     return render json: { valid: false } unless user
     return head :forbidden if user.banned?
@@ -65,11 +59,4 @@ class UsersController < ApplicationController
 
     UserIp.create_or_find_by!(user:, ip_address:)
   end
-
-  def ip_address_banned?
-    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
-    return false unless ip_address
-
-    ip_address.banned?
-  end
 end

backend/app/models/ip_address.rb

@@ -5,6 +5,6 @@ class IpAddress < ApplicationRecord
   has_many :users, through: :user_ips
 
   def banned? = banned_at.present?
-  def ban! = banned? or update!(banned_at: Time.current)
+  def ban! = banned? || update!(banned_at: Time.current)
   def unban! = update!(banned_at: nil)
 end

backend/app/models/post.rb

@@ -28,6 +28,8 @@ class Post < ApplicationRecord
 
   has_one_attached :thumbnail
 
+  attribute :version_no, :integer, default: 1
+
   before_validation :normalise_url
 
   validates :url, presence: true, uniqueness: true
@@ -54,7 +56,38 @@ class Post < ApplicationRecord
     super(options).merge(thumbnail: nil)
   end
 
-  def snapshot_tag_names = tags.joins(:tag_name).order('tag_names.name').pluck('tag_names.name')
+  def snapshot_tag_names
+    post_tags
+        .kept
+        .joins(tag: :tag_name)
+        .includes(:sections, tag: :tag_name)
+        .order('tag_names.name')
+        .map do |post_tag|
+      name = post_tag.tag.tag_name.name
+      sections = post_tag.sections.sort_by(&:begin_ms)
+
+      next name if sections.empty?
+
+      "#{ name }#{ sections.map { Post.section_literal(_1) }.join }"
+    end
+  end
+
+  def self.section_literal section
+    "[#{ Post.ms_to_time(section.begin_ms) }-#{ Post.ms_to_time(section.end_ms) }]"
+  end
+
+  def self.ms_to_time ms
+    total_s = ms / 1_000
+    s = total_s % 60
+    min = (total_s / 60) % 60
+    h = total_s / 3_600
+
+    if h.positive?
+      '%d:%02d:%02d' % [h, min, s]
+    else
+      '%d:%02d' % [min, s]
+    end
+  end
 
   def snapshot_parent_post_ids = parents.order(:id).pluck(:id)
 

backend/app/models/post_tag.rb

@@ -10,6 +10,12 @@ class PostTag < ApplicationRecord
   belongs_to :created_user, class_name: 'User', optional: true
   belongs_to :deleted_user, class_name: 'User', optional: true
 
+  has_many :sections, -> { order(:begin_ms) }, class_name: 'PostTagSection',
+                                               foreign_key: [:post_id, :tag_id],
+                                               primary_key: [:post_id, :tag_id],
+                                               dependent: :delete_all,
+                                               inverse_of: :post_tag
+
   validates :post_id, presence: true
   validates :tag_id, presence: true
   validates :post_id, uniqueness: {

backend/app/models/post_tag_section.rb

@@ -0,0 +1,20 @@
+class PostTagSection < ApplicationRecord
+  self.primary_key = :post_id, :tag_id, :begin_ms
+
+  belongs_to :post
+  belongs_to :tag
+
+  belongs_to :post_tag, -> { kept }, foreign_key: [:post_id, :tag_id],
+                                     primary_key: [:post_id, :tag_id],
+                                     inverse_of: :sections,
+                                     optional: true
+
+  validates :post_id, presence: true
+  validates :tag_id, presence: true
+
+  validates :begin_ms, presence: true,
+                       numericality: { only_integer: true, greater_than_or_equal_to: 0 }
+
+  validates :end_ms, presence: true,
+                     numericality: { only_integer: true, greater_than: :begin_ms }
+end

backend/app/models/tag.rb

@@ -40,6 +40,8 @@ class Tag < ApplicationRecord
   belongs_to :tag_name
   delegate :wiki_page, to: :tag_name
 
+  attribute :version_no, :integer, default: 1
+
   delegate :name, to: :tag_name, allow_nil: true
   validates :tag_name, presence: true
 
@@ -90,22 +92,50 @@ class Tag < ApplicationRecord
 
   def self.normalise_tags! tag_names, with_tagme: true,
                                       with_no_deerjikist: true,
-                                      deny_nico: true
+                                      deny_nico: true,
+                                      with_sections: false
     if deny_nico && tag_names.any? { |n| n.downcase.start_with?('nico:') }
       raise NicoTagNormalisationError
     end
 
+    sections = { }
     tags = tag_names.map do |name|
       pf, cat = CATEGORY_PREFIXES.find { |p, _| name.downcase.start_with?(p) } || ['', nil]
-      name = TagName.canonicalise(name.sub(/\A#{ pf }/i, '')).first
+
+      name = name.sub(/\A#{ pf }/i, '')
+
+      sections_by_tag = []
+      while n = name.sub!(/^(\S*?)\[([0-9:.]*?)-([0-9:.]*?)\](\S*?)$/, '\1\4 \2 \3')
+        name, *section_raw = n.split
+
+        begin_ms, end_ms = section_raw.map { time_to_ms(_1) }
+        next if begin_ms == end_ms
+
+        begin_ms, end_ms = end_ms, begin_ms if begin_ms > end_ms
+
+        sections_by_tag << [begin_ms, end_ms]
+      end
+
+      name = TagName.canonicalise(name).first
+
       find_or_create_by_tag_name!(name, category: (cat || :general)).tap do |tag|
         tag.update!(category: cat) if cat && tag.category != cat
+        next if sections_by_tag.empty?
+
+        sections[tag.id] ||= []
+        sections[tag.id].concat(sections_by_tag)
       end
     end
 
     tags << Tag.tagme if with_tagme && tags.size < 10 && tags.none?(Tag.tagme)
     tags << Tag.no_deerjikist if with_no_deerjikist && tags.all? { |t| !(t.deerjikist?) }
-    tags.uniq(&:id)
+    tags.uniq!(&:id)
+
+    if with_sections
+      { tags:, sections: }
+    else
+      tags
+    end
   end
 
   def self.expand_parent_tags tags
@@ -226,4 +256,23 @@ class Tag < ApplicationRecord
       errors.add :category, 'ニジラーと紐づいてゐるタグはニジラー・カテゴリである必要があります．'
     end
   end
+
+  def self.time_to_ms str
+    parts = str.split(':')
+
+    s_part = parts.pop
+    s, ms = s_part.split('.')
+
+    total_s = s.to_i
+
+    if parts.length >= 1
+      total_s += parts.pop.to_i * 60
+    end
+
+    if parts.length >= 1
+      total_s += parts.pop.to_i * 3_600
+    end
+
+    total_s * 1_000 + ms.to_s.ljust(3, '0')[0, 3].to_i
+  end
 end

backend/app/models/user.rb

@@ -22,6 +22,6 @@ class User < ApplicationRecord
   def gte_member? = member? || admin?
 
   def banned? = banned_at.present?
-  def ban! = banned? or update!(banned_at: Time.current)
+  def ban! = banned? || update!(banned_at: Time.current)
   def unban! = update!(banned_at: nil)
 end

backend/app/models/wiki_page.rb

@@ -15,6 +15,8 @@ class WikiPage < ApplicationRecord
 
   has_many :wiki_versions
 
+  attribute :version_no, :integer, default: 1
+
   belongs_to :tag_name
   validates :tag_name, presence: true
   validates :body, presence: true

backend/app/services/version_recorder.rb

@@ -16,19 +16,20 @@ class VersionRecorder
       @record = record_class.unscoped.lock.find(@record.id)
       latest = latest_version
 
-      if !(latest) && @event_type != 'create'
-        raise "#{ version_class.name } first event must be create"
-      end
-
-      if @event_type == 'create' && latest
-        raise "#{ version_class.name } create event already exists"
-      end
+      validate_version_sequence!(latest)
 
       attrs = snapshot_attributes
 
-      return latest if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
+      if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
+        return latest
+      end
 
-      version_class.create!(base_attributes(latest).merge(record_key => @record).merge(attrs))
+      version = version_class.create!(
+          base_attributes(latest).merge(record_key => @record).merge(attrs))
+
+      update_record_version_no!(version.version_no)
+
+      version
     end
   end
 
@@ -45,7 +46,31 @@ class VersionRecorder
       created_by_user: @created_by_user }
   end
 
-  def same_snapshot?(version, attrs) = attrs.all? { |k, v| version.public_send(k) == v }
+  def update_record_version_no! version_no
+    @record.update_columns(version_no:)
+    @record.version_no = version_no
+  end
+
+  def validate_version_sequence! latest
+    if !(latest) && @event_type != 'create'
+      raise "#{ version_class.name } first event must be create"
+    end
+
+    if @event_type == 'create' && latest
+      raise "#{ version_class.name } create event already exists"
+    end
+
+    return unless latest
+
+    if @record.version_no != latest.version_no
+      raise ("#{ record_class.name }##{ @record.id } version_no is #{ @record.version_no }, " +
+             "but latest #{ version_class.name } version_no is #{ latest.version_no }")
+    end
+  end
+
+  def same_snapshot? version, attrs
+    attrs.all? { |k, v| version.public_send(k) == v }
+  end
 
   def validate_event_type!
     return if EVENT_TYPES.include?(@event_type)

backend/db/migrate/20260507124000_add_version_no_to_posts.rb

@@ -0,0 +1,27 @@
+class AddVersionNoToPosts < ActiveRecord::Migration[8.0]
+  def up
+    add_column :posts, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        posts
+      SET
+        version_no = (
+          SELECT
+            MAX(version_no)
+          FROM
+            post_versions
+          WHERE
+            post_id = posts.id)
+    SQL
+
+    change_column_null :posts, :version_no, false
+
+    add_check_constraint :posts, 'version_no > 0', name: 'chk_posts_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :posts, name: 'chk_posts_version_no_positive'
+    remove_column :posts, :version_no
+  end
+end

backend/db/migrate/20260507211600_add_version_no_to_tags.rb

@@ -0,0 +1,37 @@
+class AddVersionNoToTags < ActiveRecord::Migration[8.0]
+  def up
+    add_column :tags, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        tags
+      SET
+        version_no = (
+          CASE category
+          WHEN 'nico' THEN
+            (SELECT
+               MAX(version_no)
+             FROM
+               nico_tag_versions
+             WHERE
+               tag_id = tags.id)
+          ELSE
+            (SELECT
+               MAX(version_no)
+             FROM
+               tag_versions
+             WHERE
+               tag_id = tags.id)
+          END)
+    SQL
+
+    change_column_null :tags, :version_no, false
+
+    add_check_constraint :tags, 'version_no > 0', name: 'chk_tags_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :tags, name: 'chk_tags_version_no_positive'
+    remove_column :tags, :version_no
+  end
+end

backend/db/migrate/20260507213300_add_version_no_to_wiki_pages.rb

@@ -0,0 +1,27 @@
+class AddVersionNoToWikiPages < ActiveRecord::Migration[8.0]
+  def up
+    add_column :wiki_pages, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        wiki_pages
+      SET
+        version_no = (
+          SELECT
+            MAX(version_no)
+          FROM
+            wiki_versions
+          WHERE
+            wiki_page_id = wiki_pages.id)
+    SQL
+
+    change_column_null :wiki_pages, :version_no, false
+
+    add_check_constraint :wiki_pages, 'version_no > 0', name: 'chk_wiki_pages_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :wiki_pages, name: 'chk_wiki_pages_version_no_positive'
+    remove_column :wiki_pages, :version_no
+  end
+end

backend/db/migrate/20260518235300_create_post_tag_sections.rb

@@ -0,0 +1,19 @@
+class CreatePostTagSections < ActiveRecord::Migration[8.0]
+  def change
+    create_table :post_tag_sections, primary_key: [:post_id, :tag_id, :begin_ms] do |t|
+      t.references :post, null: false, foreign_key: true, index: false
+      t.references :tag, null: false, foreign_key: true, index: false
+      t.integer :begin_ms, null: false
+      t.integer :end_ms, null: false
+      t.timestamps
+
+      t.index [:post_id, :begin_ms], name: 'idx_post_tag_sections_post_id_begin_ms'
+
+      t.check_constraint 'begin_ms >= 0',
+                         name: 'chk_post_tag_sections_begin_ms_natural'
+
+      t.check_constraint 'begin_ms < end_ms',
+                         name: 'chk_post_tag_sections_end_ms_after_begin_ms'
+    end
+  end
+end

backend/db/migrate/20260519013100_add_video_ms_to_posts.rb

@@ -0,0 +1,9 @@
+class AddVideoMsToPosts < ActiveRecord::Migration[8.0]
+  def change
+    add_column :posts, :video_ms, :integer
+    add_index :posts, [:video_ms, :id], name: 'idx_posts_video_ms_id'
+
+    add_check_constraint :posts, 'video_ms IS NULL OR video_ms > 0',
+                         name: 'chk_posts_video_ms_positive'
+  end
+end

backend/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
+ActiveRecord::Schema[8.0].define(version: 2026_05_19_013100) do
   create_table "active_storage_attachments", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
@@ -137,6 +137,19 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.index ["target_post_id"], name: "index_post_similarities_on_target_post_id"
   end
 
+  create_table "post_tag_sections", primary_key: ["post_id", "tag_id", "begin_ms"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "post_id", null: false
+    t.bigint "tag_id", null: false
+    t.integer "begin_ms", null: false
+    t.integer "end_ms", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["post_id", "begin_ms"], name: "idx_post_tag_sections_post_id_begin_ms"
+    t.index ["tag_id"], name: "fk_rails_8be3847903"
+    t.check_constraint "`begin_ms` < `end_ms`", name: "chk_post_tag_sections_end_ms_after_begin_ms"
+    t.check_constraint "`begin_ms` >= 0", name: "chk_post_tag_sections_begin_ms_natural"
+  end
+
   create_table "post_tags", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "post_id", null: false
     t.bigint "tag_id", null: false
@@ -186,8 +199,13 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "original_created_from"
     t.datetime "original_created_before"
     t.datetime "updated_at", null: false
+    t.integer "version_no", null: false
+    t.integer "video_ms"
     t.index ["uploaded_user_id"], name: "index_posts_on_uploaded_user_id"
     t.index ["url"], name: "index_posts_on_url", unique: true
+    t.index ["video_ms", "id"], name: "idx_posts_video_ms_id"
+    t.check_constraint "(`video_ms` is null) or (`video_ms` > 0)", name: "chk_posts_video_ms_positive"
+    t.check_constraint "`version_no` > 0", name: "chk_posts_version_no_positive"
   end
 
   create_table "settings", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -262,8 +280,10 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "updated_at", null: false
     t.integer "post_count", default: 0, null: false
     t.datetime "discarded_at"
+    t.integer "version_no", null: false
     t.index ["discarded_at"], name: "index_tags_on_discarded_at"
     t.index ["tag_name_id"], name: "index_tags_on_tag_name_id", unique: true
+    t.check_constraint "`version_no` > 0", name: "chk_tags_version_no_positive"
   end
 
   create_table "theatre_comments", primary_key: ["theatre_id", "no"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -286,6 +306,7 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.index ["expires_at"], name: "index_theatre_watching_users_on_expires_at"
+    t.index ["theatre_id", "expires_at"], name: "idx_on_theatre_id_skip_expires_at_4c8de1dd42"
     t.index ["theatre_id", "expires_at"], name: "index_theatre_watching_users_on_theatre_id_and_expires_at"
     t.index ["theatre_id"], name: "index_theatre_watching_users_on_theatre_id"
     t.index ["user_id"], name: "index_theatre_watching_users_on_user_id"
@@ -369,10 +390,12 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "updated_at", null: false
     t.datetime "discarded_at"
     t.integer "next_asset_no", default: 1, null: false
+    t.integer "version_no", null: false
     t.index ["created_user_id"], name: "index_wiki_pages_on_created_user_id"
     t.index ["discarded_at"], name: "index_wiki_pages_on_discarded_at"
     t.index ["tag_name_id"], name: "index_wiki_pages_on_tag_name_id", unique: true
     t.index ["updated_user_id"], name: "index_wiki_pages_on_updated_user_id"
+    t.check_constraint "`version_no` > 0", name: "chk_wiki_pages_version_no_positive"
   end
 
   create_table "wiki_revision_lines", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -440,6 +463,8 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
   add_foreign_key "post_implications", "posts", column: "parent_post_id"
   add_foreign_key "post_similarities", "posts"
   add_foreign_key "post_similarities", "posts", column: "target_post_id"
+  add_foreign_key "post_tag_sections", "posts"
+  add_foreign_key "post_tag_sections", "tags"
   add_foreign_key "post_tags", "posts"
   add_foreign_key "post_tags", "tags"
   add_foreign_key "post_tags", "users", column: "created_user_id"

backend/spec/factories/ip_addresses.rb

@@ -0,0 +1,10 @@
+FactoryBot.define do
+  factory :ip_address do
+    ip_address { IPAddr.new('203.0.113.10').hton }
+    banned_at { nil }
+
+    trait :banned do
+      banned_at { Time.current }
+    end
+  end
+end

backend/spec/factories/post_tag_sections.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :post_tag_section do
+    association :post
+    association :tag
+    begin_ms { 1_000 }
+    end_ms { 2_000 }
+  end
+end

backend/spec/factories/post_tags.rb

@@ -0,0 +1,6 @@
+FactoryBot.define do
+  factory :post_tag do
+    association :post
+    association :tag
+  end
+end

backend/spec/factories/posts.rb

@@ -0,0 +1,8 @@
+FactoryBot.define do
+  factory :post do
+    sequence(:url) { |n| "https://example.com/factory-post-#{ n }" }
+    title { 'factory post' }
+    thumbnail_base { nil }
+    uploaded_user { nil }
+  end
+end

backend/spec/factories/users.rb

@@ -1,15 +1,24 @@
 FactoryBot.define do
   factory :user do
-    name { "test-user" }
+    name { nil }
     inheritance_code { SecureRandom.uuid }
-    role { "guest" }
+    role { 'guest' }
+    banned_at { nil }
+
+    trait :guest do
+      role { 'guest' }
+    end
 
     trait :member do
-      role { "member" }
+      role { 'member' }
     end
 
     trait :admin do
       role { 'admin' }
     end
+
+    trait :banned do
+      banned_at { Time.current }
+    end
   end
 end

backend/spec/models/post_tag_spec.rb

@@ -0,0 +1,29 @@
+RSpec.describe PostTag, type: :model do
+  describe '#sections' do
+    it 'loads sections by post_id and tag_id' do
+      post_tag = create(:post_tag)
+      section = create(:post_tag_section,
+                       post: post_tag.post,
+                       tag: post_tag.tag,
+                       begin_ms: 1000,
+                       end_ms: 2000)
+
+      expect(post_tag.sections).to contain_exactly(section)
+    end
+
+    it 'does not load sections for another tag on the same post' do
+      post = create(:post)
+      tag = create(:tag)
+      other_tag = create(:tag)
+
+      post_tag = create(:post_tag, post:, tag:)
+      create(:post_tag_section,
+             post:,
+             tag: other_tag,
+             begin_ms: 1000,
+             end_ms: 2000)
+
+      expect(post_tag.sections).to be_empty
+    end
+  end
+end

backend/spec/requests/posts_spec.rb

@@ -10,6 +10,10 @@ RSpec.describe 'Posts API', type: :request do
     allow_any_instance_of(Post).to receive(:resized_thumbnail!).and_return(true)
   end
 
+  def create_nico_tag!(name)
+    Tag.find_or_create_by_tag_name!(name, category: :nico)
+  end
+
   def dummy_upload
     # 中身は何でもいい（加工処理はスタブしてる）
     Rack::Test::UploadedFile.new(StringIO.new('dummy'), 'image/jpeg', original_filename: 'dummy.jpg')
@@ -23,7 +27,8 @@ RSpec.describe 'Posts API', type: :request do
     Post.create!(title:, url:)
   end
 
-  def create_post_version_for! post
+  def create_post_version_for!(post)
+    version =
         PostVersion.create!(
             post:,
             version_no: 1,
@@ -36,8 +41,20 @@ RSpec.describe 'Posts API', type: :request do
             original_created_from: post.original_created_from,
             original_created_before: post.original_created_before,
             created_at: post.created_at,
-      created_by_user: post.uploaded_user
-    )
+            created_by_user: post.uploaded_user)
+
+    post.update_columns(version_no: version.version_no) if post.has_attribute?(:version_no)
+    post.version_no = version.version_no if post.respond_to?(:version_no=)
+
+    version
+  end
+
+  def post_update_params(post, params = { })
+    base_version =
+        post.post_versions.order(version_no: :desc).first ||
+        create_post_version_for!(post.reload)
+
+    post_write_params({ base_version_no: base_version.version_no }.merge(params))
   end
 
   let!(:tag_name) { TagName.create!(name: 'spec_tag') }
@@ -806,24 +823,26 @@ RSpec.describe 'Posts API', type: :request do
 
     it '401 when not logged in' do
       sign_out
-      put "/posts/#{post_record.id}", params: post_write_params(title: 'updated', tags: 'spec_tag')
+      put "/posts/#{post_record.id}", params: post_update_params(
+          post_record, title: 'updated', tags: 'spec_tag')
       expect(response).to have_http_status(:unauthorized)
     end
 
     it '403 when not member' do
       sign_in_as(create(:user, role: 'guest'))
-      put "/posts/#{post_record.id}", params: post_write_params(title: 'updated', tags: 'spec_tag')
+      put "/posts/#{post_record.id}", params: post_update_params(
+          post_record, title: 'updated', tags: 'spec_tag')
       expect(response).to have_http_status(:forbidden)
     end
 
     it '200 and updates title + resync tags when member' do
       sign_in_as(member)
 
-      # 追加で別タグも作って、更新時に入れ替わることを見る
       tn2 = TagName.create!(name: 'spec_tag_2')
       Tag.create!(tag_name: tn2, category: :general)
 
-      put "/posts/#{post_record.id}", params: post_write_params(
+      put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag_2')
 
@@ -831,7 +850,6 @@ RSpec.describe 'Posts API', type: :request do
       expect(json).to have_key('tags')
       expect(json['tags']).to be_an(Array)
 
-      # show と同様、update 後レスポンスもツリー形式
       names = json['tags'].map { |n| n['name'] }
       expect(names).to include('spec_tag_2')
     end
@@ -846,10 +864,10 @@ RSpec.describe 'Posts API', type: :request do
       it 'return 400' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+            post_record,
             title: 'updated title',
-          tags: 'nico:nico_tag'
-        )
+            tags: 'nico:nico_tag')
 
         expect(response).to have_http_status(:bad_request), response.body
       end
@@ -887,11 +905,11 @@ RSpec.describe 'Posts API', type: :request do
       it 'replaces parent posts' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+            post_record,
             title: 'updated title',
             tags: 'spec_tag',
-          parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}"
-        )
+            parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}")
 
         expect(response).to have_http_status(:ok)
 
@@ -908,7 +926,8 @@ RSpec.describe 'Posts API', type: :request do
       it 'clears parent posts when parent_post_ids is blank' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: ''
@@ -922,7 +941,8 @@ RSpec.describe 'Posts API', type: :request do
         sign_in_as(member)
         create_post_version_for!(post_record.reload)
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: "#{new_parent_post_1.id} #{new_parent_post_2.id}"
@@ -943,7 +963,10 @@ RSpec.describe 'Posts API', type: :request do
       it 'returns 422' do
         sign_in_as(member)
 
+        base_version = create_post_version_for!(post_record.reload)
+
         put "/posts/#{post_record.id}", params: {
+            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag' }
 
@@ -966,7 +989,8 @@ RSpec.describe 'Posts API', type: :request do
           parent_post:
         )
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: 'abc'
@@ -991,7 +1015,8 @@ RSpec.describe 'Posts API', type: :request do
           parent_post:
         )
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: '999999999'
@@ -1006,7 +1031,8 @@ RSpec.describe 'Posts API', type: :request do
       it 'returns 422 and does not create self implication' do
         sign_in_as(member)
 
-        put "/posts/#{post_record.id}", params: post_write_params(
+        put "/posts/#{post_record.id}", params: post_update_params(
+          post_record,
           title: 'updated title',
           tags: 'spec_tag',
           parent_post_ids: post_record.id.to_s
@@ -1020,6 +1046,221 @@ RSpec.describe 'Posts API', type: :request do
         )).to be(false)
       end
     end
+
+    context 'with optimistic locking' do
+      let!(:no_deerjikist_tag) { Tag.no_deerjikist }
+
+      before do
+        PostTag.create!(post: post_record, tag: no_deerjikist_tag)
+      end
+
+      it '400 when base_version_no is missing without force' do
+        sign_in_as(member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            title: 'updated title',
+            tags: 'spec_tag')
+
+        expect(response).to have_http_status(:bad_request)
+      end
+
+      it '400 when force and merge are both true' do
+        sign_in_as(member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            title: 'updated title',
+            tags: 'spec_tag',
+            force: '1',
+            merge: '1')
+
+        expect(response).to have_http_status(:bad_request)
+      end
+
+      it '409 when scalar fields are changed both by current and incoming updates' do
+        sign_in_as(member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        post_record.update!(title: 'updated by other user')
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: 'updated by me',
+            tags: "spec_tag #{Tag.no_deerjikist.name}")
+
+        expect(response).to have_http_status(:conflict)
+
+        expect(json.fetch('error')).to eq('conflict')
+        expect(json.fetch('base_version_no')).to eq(base_version.version_no)
+        expect(json.fetch('current_version_no')).to eq(2)
+        expect(json.fetch('mergeable')).to be(false)
+
+        conflict_fields = json.fetch('conflicts').map { |change| change.fetch('field') }
+        expect(conflict_fields).to include('title')
+
+        expect(post_record.reload.title).to eq('updated by other user')
+      end
+
+      it 'returns 409 with mergeable true when stale tag changes do not conflict but merge is not requested' do
+        sign_in_as(member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        current_tag = Tag.find_or_create_by_tag_name!('current_added_tag', category: :general)
+        PostTag.create!(post: post_record, tag: current_tag, created_user: member)
+
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: post_record.title,
+            tags: "spec_tag #{Tag.no_deerjikist.name} incoming_added_tag")
+
+        expect(response).to have_http_status(:conflict)
+
+        expect(json.fetch('mergeable')).to be(true)
+
+        tag_change = json.fetch('changes').find { |change| change.fetch('field') == 'tag_names' }
+        expect(tag_change).to be_present
+        expect(tag_change.fetch('conflict')).to be(false)
+        expect(tag_change.fetch('added_by_current')).to include('current_added_tag')
+        expect(tag_change.fetch('added_by_me')).to include('incoming_added_tag')
+      end
+
+      it 'merges non-conflicting stale tag changes when merge is true' do
+        sign_in_as(member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        current_tag = Tag.find_or_create_by_tag_name!('current_merge_tag', category: :general)
+        PostTag.create!(post: post_record, tag: current_tag, created_user: member)
+
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: post_record.title,
+            tags: "spec_tag #{Tag.no_deerjikist.name} incoming_merge_tag",
+            merge: '1')
+
+        expect(response).to have_http_status(:ok)
+
+        names = post_record.reload.tags.map(&:name)
+
+        expect(names).to include('spec_tag')
+        expect(names).to include(Tag.no_deerjikist.name)
+        expect(names).to include('current_merge_tag')
+        expect(names).to include('incoming_merge_tag')
+      end
+
+      it 'does not conflict when only nico tags changed after the base version' do
+        sign_in_as(member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        nico_tag = create_nico_tag!('nico:optimistic_lock_nico')
+        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
+
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+        expect(post_record.reload.version_no).to eq(2)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: post_record.title,
+            tags: "spec_tag #{ Tag.no_deerjikist.name }")
+
+        expect(response).to have_http_status(:ok)
+
+        names = post_record.reload.tags.map(&:name)
+
+        expect(names).to include('spec_tag')
+        expect(names).to include(Tag.no_deerjikist.name)
+        expect(names).to include(nico_tag.name)
+      end
+
+      it 'keeps nico tags even when they are not included in PUT tags' do
+        sign_in_as(member)
+
+        nico_tag = create_nico_tag!('nico:readonly_update_nico')
+        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: 'updated title',
+            tags: "spec_tag #{ Tag.no_deerjikist.name }")
+
+        expect(response).to have_http_status(:ok)
+
+        names = post_record.reload.tags.map(&:name)
+
+        expect(names).to include('spec_tag')
+        expect(names).to include(Tag.no_deerjikist.name)
+        expect(names).to include(nico_tag.name)
+      end
+
+      it 'allows non-nico tags linked from nico tags to be removed by normal post update' do
+        sign_in_as(member)
+
+        nico_tag = create_nico_tag!('nico:relation_source')
+        linked_tag = Tag.find_or_create_by_tag_name!('relation_linked_tag', category: :general)
+
+        NicoTagRelation.create!(nico_tag:, tag: linked_tag)
+        PostTag.create!(post: post_record, tag: nico_tag, created_user: member)
+        PostTag.create!(post: post_record, tag: linked_tag, created_user: member)
+
+        base_version = create_post_version_for!(post_record.reload)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
+            title: post_record.title,
+            tags: "spec_tag #{ Tag.no_deerjikist.name }")
+
+        expect(response).to have_http_status(:ok)
+
+        names = post_record.reload.tags.map(&:name)
+
+        expect(names).to include(nico_tag.name)
+        expect(names).to include('spec_tag')
+        expect(names).to include(Tag.no_deerjikist.name)
+        expect(names).not_to include(linked_tag.name)
+      end
+
+      it 'force-updates stale posts without base_version_no' do
+        sign_in_as(member)
+
+        create_post_version_for!(post_record.reload)
+
+        post_record.update!(title: 'updated by other user')
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+        put "/posts/#{post_record.id}", params: post_write_params(
+            title: 'forced title',
+            tags: "spec_tag #{Tag.no_deerjikist.name}",
+            force: '1')
+
+        expect(response).to have_http_status(:ok)
+        expect(post_record.reload.title).to eq('forced title')
+      end
+    end
   end
 
   describe 'GET /posts/random' do
@@ -1434,13 +1675,14 @@ RSpec.describe 'Posts API', type: :request do
 
     it 'creates next version on PUT /posts/:id when snapshot changes' do
       sign_in_as(member)
-      create_post_version_for!(post_record)
+      base_version = create_post_version_for!(post_record)
 
       tag_name2 = TagName.create!(name: 'spec_tag_2')
       Tag.create!(tag_name: tag_name2, category: :general)
 
       expect do
         put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag_2')
       end.to change(PostVersion, :count).by(1)
@@ -1459,13 +1701,15 @@ RSpec.describe 'Posts API', type: :request do
       sign_in_as(member)
 
       PostTag.create!(post: post_record, tag: Tag.no_deerjikist)
-      create_post_version_for!(post_record.reload)
+      base_version = create_post_version_for!(post_record.reload)
 
       expect {
         put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
             title: post_record.title,
             tags: 'spec_tag')
       }.not_to change(PostVersion, :count)
+
       expect(response).to have_http_status(:ok)
 
       version = post_record.reload.post_versions.order(:version_no).last
@@ -1490,10 +1734,11 @@ RSpec.describe 'Posts API', type: :request do
 
     it 'does not create a version when PUT /posts/:id is invalid' do
       sign_in_as(member)
-      create_post_version_for!(post_record)
+      base_version = create_post_version_for!(post_record)
 
       expect do
         put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag',
             original_created_from: Time.zone.local(2020, 1, 2, 0, 0, 0).iso8601,
@@ -1507,46 +1752,22 @@ RSpec.describe 'Posts API', type: :request do
   describe 'tag versioning from post write actions' do
     let(:member) { create(:user, :member) }
 
-    it 'creates tag snapshot for normalised tags on POST /posts' do
-      sign_in_as(member)
-
-      expect {
-        post '/posts', params: post_write_params(
-            title: 'tag versioned post',
-            url: 'https://example.com/tag-versioned-post',
-            tags: 'spec_tag',
-            thumbnail: dummy_upload)
-      }.to change { tag.reload.tag_versions.count }.by(1)
-
-      expect(response).to have_http_status(:created)
-
-      version = tag.reload.tag_versions.order(:version_no).last
-      expect(version.version_no).to eq(1)
-      expect(version.event_type).to eq('create')
-      expect(version.name).to eq('spec_tag')
-      expect(version.category).to eq('general')
-      expect(version.created_by_user_id).to eq(member.id)
-    end
-
     it 'creates tag snapshot for normalised tags on PUT /posts/:id' do
       sign_in_as(member)
 
+      base_version = create_post_version_for!(post_record.reload)
+
       tag_name2 = TagName.create!(name: 'spec_tag_2')
       tag2 = Tag.create!(tag_name: tag_name2, category: :general)
 
       expect {
         put "/posts/#{post_record.id}", params: post_write_params(
+            base_version_no: base_version.version_no,
             title: 'updated title',
             tags: 'spec_tag_2')
       }.to change { tag2.reload.tag_versions.count }.by(1)
 
-      expect(response).to have_http_status(:ok)
-
-      version = tag2.reload.tag_versions.order(:version_no).last
-      expect(version.version_no).to eq(1)
-      expect(version.event_type).to eq('create')
-      expect(version.name).to eq('spec_tag_2')
-      expect(version.created_by_user_id).to eq(member.id)
+      expect(response).to have_http_status(:ok), response.body
     end
   end
 end

backend/spec/requests/tag_versions_spec.rb

@@ -26,6 +26,7 @@ RSpec.describe 'TagVersions API', type: :request do
     created_by_user:,
     created_at:
   )
+    version =
         TagVersion.create!(
             tag: tag,
             version_no: version_no,
@@ -35,8 +36,12 @@ RSpec.describe 'TagVersions API', type: :request do
             aliases: Array(aliases).join(' '),
             parent_tag_ids: Array(parent_tags).map(&:id).join(' '),
             created_by_user: created_by_user,
-      created_at: created_at
-    )
+            created_at: created_at)
+
+    tag.update_columns(version_no: version_no) if tag.has_attribute?(:version_no)
+    tag.version_no = version_no if tag.respond_to?(:version_no=)
+
+    version
   end
 
   let!(:v1) do

backend/spec/requests/users_spec.rb

@@ -1,109 +1,266 @@
-require "rails_helper"
+require 'rails_helper'
+
+RSpec.describe 'Users', type: :request do
+  let(:remote_ip) { '203.0.113.10' }
+
+  before do
+    allow_any_instance_of(ActionDispatch::Request)
+      .to receive(:remote_ip)
+      .and_return(remote_ip)
+  end
+
+  def auth_headers(user)
+    { 'X-Transfer-Code' => user.inheritance_code }
+  end
+
+  describe 'POST /users' do
+    it 'creates guest user, IpAddress and UserIp, and returns code' do
+      expect {
+        post '/users'
+      }.to change(User, :count).by(1)
+        .and change(IpAddress, :count).by(1)
+        .and change(UserIp, :count).by(1)
 
-RSpec.describe "Users", type: :request do
-  describe "POST /users" do
-    it "creates guest user and returns code" do
-      post "/users"
       expect(response).to have_http_status(:created)
-      expect(json["code"]).to be_present
-      expect(json["user"]["role"]).to eq("guest")
+      expect(json['code']).to be_present
+      expect(json['user']['role']).to eq('guest')
+
+      user = User.last
+      ip_address = IpAddress.find_by(ip_address: IPAddr.new(remote_ip).hton)
+
+      expect(user.role).to eq('guest')
+      expect(ip_address).to be_present
+      expect(UserIp.exists?(user:, ip_address:)).to eq(true)
+    end
+
+    it 'returns 403 and does not create user when current IP address is banned' do
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      expect {
+        post '/users'
+      }.not_to change(User, :count)
+
+      expect(response).to have_http_status(:forbidden)
+      expect(UserIp.count).to eq(0)
     end
   end
 
-  describe "POST /users/code/renew" do
-    it "returns 401 when not logged in" do
-      sign_out
-      post "/users/code/renew"
-      expect(response).to have_http_status(:unauthorized)
-    end
-  end
+  describe 'POST /users/code/renew' do
+    it 'returns 401 when not logged in' do
+      post '/users/code/renew'
 
-  describe "PUT /users/:id" do
-    let(:user) { create(:user, name: "old-name", role: "guest") }
-
-    it "returns 401 when current_user id mismatch" do
-      sign_in_as(create(:user))
-      put "/users/#{user.id}", params: { name: "new-name" }
       expect(response).to have_http_status(:unauthorized)
     end
 
-    it "returns 400 when name is blank" do
-      sign_in_as(user)
-      put "/users/#{user.id}", params: { name: "   " }
+    it 'returns 403 when current user is banned' do
+      user = create(:user, :banned)
+
+      post '/users/code/renew', headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user)
+
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      post '/users/code/renew', headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  describe 'PUT /users/:id' do
+    let(:user) { create(:user, name: 'old-name', role: 'guest') }
+
+    it 'returns 401 when current_user id mismatch' do
+      other_user = create(:user)
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(other_user)
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns 400 when name is blank' do
+      put "/users/#{user.id}",
+          params: { name: '   ' },
+          headers: auth_headers(user)
+
       expect(response).to have_http_status(:bad_request)
     end
 
-    it "updates name and returns 201 with user slice" do
-      sign_in_as(user)
-      put "/users/#{user.id}", params: { name: "new-name" }
+    it 'updates name and returns user slice' do
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
 
       expect(response).to have_http_status(:ok)
-      expect(json["id"]).to eq(user.id)
-      expect(json["name"]).to eq("new-name")
+      expect(json['id']).to eq(user.id)
+      expect(json['name']).to eq('new-name')
 
       user.reload
-      expect(user.name).to eq("new-name")
+      expect(user.name).to eq('new-name')
+    end
+
+    it 'returns 403 when current user is banned' do
+      user.update!(banned_at: Time.current)
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+
+      user.reload
+      expect(user.name).to eq('old-name')
+    end
+
+    it 'returns 403 when current IP address is banned' do
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+
+      user.reload
+      expect(user.name).to eq('old-name')
     end
   end
 
-  describe "POST /users/verify" do
-    it "returns valid:false when code not found" do
-      post "/users/verify", params: { code: "nope" }
+  describe 'POST /users/verify' do
+    it 'returns valid:false when code not found' do
+      post '/users/verify', params: { code: 'nope' }
+
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(false)
+      expect(json['valid']).to eq(false)
     end
 
-    it "creates IpAddress and UserIp, and returns valid:true with user slice" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, role: "guest")
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
 
-      # request.remote_ip を固定
-      allow_any_instance_of(ActionDispatch::Request).to receive(:remote_ip).and_return("203.0.113.10")
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
 
       expect {
-        post "/users/verify", params: { code: user.inheritance_code }
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 when verified user is banned' do
+      user = create(
+        :user,
+        :banned,
+        inheritance_code: SecureRandom.uuid,
+        role: 'guest'
+      )
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'creates IpAddress and UserIp, and returns valid:true with user slice' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
       }.to change(UserIp, :count).by(1)
+        .and change(IpAddress, :count).by(1)
 
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(true)
-      expect(json["user"]["id"]).to eq(user.id)
-      expect(json["user"]["inheritance_code"]).to eq(user.inheritance_code)
-      expect(json["user"]["role"]).to eq("guest")
+      expect(json['valid']).to eq(true)
+      expect(json['user']['id']).to eq(user.id)
+      expect(json['user']['inheritance_code']).to eq(user.inheritance_code)
+      expect(json['user']['role']).to eq('guest')
 
-      # ついでに IpAddress もできてることを確認（ipの保存形式がバイナリでも count で見れる）
-      expect(IpAddress.count).to be >= 1
+      ip_address = IpAddress.find_by(ip_address: IPAddr.new(remote_ip).hton)
+      expect(ip_address).to be_present
+      expect(UserIp.exists?(user:, ip_address:)).to eq(true)
     end
 
-    it "is idempotent for same user+ip (does not create duplicate UserIp)" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, role: "guest")
-      allow_any_instance_of(ActionDispatch::Request).to receive(:remote_ip).and_return("203.0.113.10")
+    it 'is idempotent for same user and same IP address' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
 
-      post "/users/verify", params: { code: user.inheritance_code }
+      post '/users/verify', params: { code: user.inheritance_code }
       expect(response).to have_http_status(:ok)
 
       expect {
-        post "/users/verify", params: { code: user.inheritance_code }
+        post '/users/verify', params: { code: user.inheritance_code }
       }.not_to change(UserIp, :count)
 
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(true)
+      expect(json['valid']).to eq(true)
+    end
+
+    it 'creates another UserIp for same user and different IP address' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
+
+      post '/users/verify', params: { code: user.inheritance_code }
+      expect(response).to have_http_status(:ok)
+
+      allow_any_instance_of(ActionDispatch::Request)
+        .to receive(:remote_ip)
+        .and_return('203.0.113.11')
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.to change(UserIp, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json['valid']).to eq(true)
     end
   end
 
-  describe "GET /users/me" do
-    it "returns 404 when code not found" do
-      get "/users/me", params: { code: "nope" }
+  describe 'GET /users/me' do
+    it 'returns 404 when code not found' do
+      get '/users/me', params: { code: 'nope' }
+
       expect(response).to have_http_status(:not_found)
     end
 
-    it "returns user slice when found" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, name: "me", role: "guest")
-      get "/users/me", params: { code: user.inheritance_code }
+    it 'returns user slice when found' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, name: 'me', role: 'guest')
+
+      get '/users/me', params: { code: user.inheritance_code }
 
       expect(response).to have_http_status(:ok)
-      expect(json["id"]).to eq(user.id)
-      expect(json["name"]).to eq("me")
-      expect(json["inheritance_code"]).to eq(user.inheritance_code)
-      expect(json["role"]).to eq("guest")
+      expect(json['id']).to eq(user.id)
+      expect(json['name']).to eq('me')
+      expect(json['inheritance_code']).to eq(user.inheritance_code)
+      expect(json['role']).to eq('guest')
+    end
+
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user, inheritance_code: SecureRandom.uuid)
+
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      get '/users/me', params: { code: user.inheritance_code }
+
+      expect(response).to have_http_status(:forbidden)
     end
   end
 end

backend/spec/services/version_recorder_spec.rb

@@ -0,0 +1,85 @@
+require 'rails_helper'
+
+RSpec.describe VersionRecorder do
+  let(:member) { create(:user, :member) }
+
+  let(:post_record) do
+    Post.create!(
+        title: 'version recorder post',
+        url: 'https://example.com/version-recorder-post')
+  end
+
+  it 'updates record version_no when creating the first version' do
+    version =
+        PostVersionRecorder.record!(
+            post: post_record,
+            event_type: :create,
+            created_by_user: member)
+
+    expect(version.version_no).to eq(1)
+    expect(post_record.reload.version_no).to eq(1)
+  end
+
+  it 'updates record version_no when creating the next version' do
+    PostVersionRecorder.record!(
+        post: post_record,
+        event_type: :create,
+        created_by_user: member)
+
+    post_record.update!(title: 'updated version recorder post')
+
+    version =
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+    expect(version.version_no).to eq(2)
+    expect(post_record.reload.version_no).to eq(2)
+  end
+
+  it 'does not create a new version or advance version_no when snapshot is unchanged' do
+    first =
+        PostVersionRecorder.record!(
+            post: post_record,
+            event_type: :create,
+            created_by_user: member)
+
+    expect {
+      version =
+          PostVersionRecorder.record!(
+              post: post_record.reload,
+              event_type: :update,
+              created_by_user: member)
+
+      expect(version).to eq(first)
+    }.not_to change(PostVersion, :count)
+
+    expect(post_record.reload.version_no).to eq(1)
+  end
+
+  it 'raises when record version_no is older than the latest version' do
+    PostVersionRecorder.record!(
+        post: post_record,
+        event_type: :create,
+        created_by_user: member)
+
+    post_record.update!(title: 'updated once')
+
+    PostVersionRecorder.record!(
+        post: post_record.reload,
+        event_type: :update,
+        created_by_user: member)
+
+    post_record.update_columns(version_no: 1)
+
+    post_record.update!(title: 'updated with stale version_no')
+
+    expect {
+      PostVersionRecorder.record!(
+          post: post_record.reload,
+          event_type: :update,
+          created_by_user: member)
+    }.to raise_error(RuntimeError, /version_no/)
+  end
+end

backend/spec/support/test_records.rb

@@ -2,14 +2,12 @@ module TestRecords
   def create_member_user!
     User.create!(name: 'spec user',
                  inheritance_code: SecureRandom.hex(16),
-                 role: 'member',
-                 banned: false)
+                 role: 'member')
   end
 
   def create_admin_user!
     User.create!(name: 'spec admin',
                  inheritance_code: SecureRandom.hex(16),
-                 role: 'admin',
-                 banned: false)
+                 role: 'admin')
   end
 end

docs/codex-handoff.md

@@ -0,0 +1,646 @@
+# Codex handoff for BTRC Hub / タグ広場
+
+This document transfers project-specific context from prior ChatGPT-assisted design and review work to Codex.
+
+Use this file as project background.
+Use `AGENTS.md`, `backend/AGENTS.md`, and `frontend/AGENTS.md` for concrete coding rules and verification commands.
+
+## Project identity
+
+BTRC Hub / タグ広場 is a collaborative knowledge base for collecting, tagging, explaining, and rediscovering Bocchi the Rock creature-related works.
+
+It is not a generic SNS.
+It is not a comment board.
+It is not a service for rehosting external content.
+It is primarily a structured link, tag, wiki, material, and viewing-party system.
+
+Core domains:
+
+1. Posts
+2. Tags
+3. Wiki pages
+4. Materials
+5. Theatre / watch-party features
+
+The project is already publicly accessible and indexed by search engines, but it has not been broadly announced. Treat it as a small public production system, not a private prototype.
+
+## Current stack
+
+Backend:
+
+- Ruby 3.2.2
+- Rails 8.0.2 API
+- MySQL 8
+- Active Storage
+- Cloudflare R2 / S3-compatible storage is expected for uploaded files
+- RSpec
+
+Frontend:
+
+- React 19.1
+- Vite 6.3
+- TypeScript 5.8
+- Axios
+- TanStack Query
+- Tailwind CSS
+- Framer Motion
+- shadcn-like local components
+- react-markdown
+- react-markdown-editor-lite
+- remark-wiki-autolink
+
+Batch / background-like tasks:
+
+- Rake tasks
+- Nico sync
+- YouTube sync
+- Similarity calculation tasks
+
+## Repository working principle
+
+Before editing, inspect the existing implementation.
+
+Do not invent a new architecture when the current repo already has an established convention.
+
+Keep changes scoped to the requested issue.
+
+Prefer small, reviewable changes over broad rewrites.
+
+Do not perform unrelated cleanup in the same patch.
+
+When a task has design ambiguity, first produce a short investigation and recommended plan. Do not silently choose a risky design.
+
+## User coding preferences
+
+General:
+
+- Prefer single quotes for strings unless interpolation, escaping, or framework convention makes double quotes better.
+- Do not add production dependencies without explicit approval.
+- Do not perform broad formatting churn.
+- Do not convert unrelated files to a different style.
+
+Ruby:
+
+- Do not put a space before method-call parentheses.
+- Do not use `%w`.
+- Do not use `%i`.
+- Keep Rails code idiomatic, but preserve the user's style where the repo already uses it.
+
+TypeScript / Python:
+
+- The user prefers GNU-style spacing before parentheses where syntactically valid.
+- Preserve existing project formatting if a formatter or nearby code dictates otherwise.
+
+## Current authentication model
+
+The system does not use normal email/password authentication.
+
+Users are authenticated by inheritance code.
+
+Frontend:
+
+- Stores the code in `localStorage.user_code`.
+- Sends it as the `X-Transfer-Code` header.
+
+Backend:
+
+- Looks up `users.inheritance_code`.
+- Sets `current_user`.
+
+Roles:
+
+- `guest`
+- `member`
+- `admin`
+
+Important helper:
+
+- `User#gte_member?` returns true for `member` and `admin`.
+
+Never introduce a conventional login assumption unless the issue explicitly asks for it.
+
+## BAN / abuse-control model
+
+The backend currently enforces BAN at API level.
+
+The relevant before_action order is conceptually:
+
+1. Reject banned IP address.
+2. Authenticate user if transfer code exists.
+3. Reject banned user.
+
+Entities:
+
+- `users.banned_at`
+- `ip_addresses.banned_at`
+- `user_ips`
+
+IP addresses are stored as binary values using `IPAddr#hton`.
+
+Do not weaken BAN behavior.
+
+Do not move BAN checks behind optional authentication.
+
+Do not make preview, theatre, verify, user creation, or public-looking endpoints bypass BAN without an explicit design decision.
+
+## Public-operation assumptions
+
+Current practical operation:
+
+- A few editor accounts exist.
+- Meaningful editing is mostly done by the owner.
+- Read access is already public.
+- Search engines have indexed the site.
+- Future editor applications are expected through Discord.
+- Prospective editors are likely people known in the Bocchi creature community.
+
+This means security and moderation issues matter even if traffic is still small.
+
+## Core domain summary
+
+### Posts
+
+Posts are external URL-based link records.
+
+Important properties:
+
+- `url` is required and unique.
+- URLs are normalized.
+- Only HTTP / HTTPS are allowed.
+- Posts can have thumbnails through Active Storage.
+- `uploaded_user_id` may be NULL for synced or bot-created posts.
+- `original_created_from` and `original_created_before` represent a time range for original content creation.
+- When both original time bounds exist, `from < before` is required.
+
+Parent/child posts:
+
+- Current implementation uses `post_implications`.
+- It is many-to-many.
+- Do not assume `posts.parent_id`.
+- Frontend/API clients must send `parent_post_ids`, even when empty.
+- `parent_post_ids` is parsed as a space-separated ID string.
+- Self-parenting is invalid.
+- Missing parent IDs are invalid.
+
+Versions:
+
+- `post_versions` stores snapshots.
+- `version_no` is a per-post sequence.
+- Snapshot includes title, URL, thumbnail base, tags, parent post IDs, original time bounds, event type, and actor.
+- Optimistic locking for posts is planned / important, but do not assume it is fully implemented unless the code proves it.
+
+### Tags
+
+Tags are central.
+
+There is separation between tag names and tag entities:
+
+- `tag_names`
+- `tags`
+
+Categories:
+
+- `deerjikist`
+- `meme`
+- `character`
+- `general`
+- `material`
+- `nico`
+- `meta`
+
+Alias model:
+
+- `tag_names.canonical_id` expresses aliases.
+- `canonical_id = NULL` means canonical name.
+- `canonical_id != NULL` means alias.
+- An alias must not point to another alias.
+- A tag name that already has a tag or wiki page generally must not be aliasified.
+
+Tag normalization:
+
+- User-entered tags are normalized through existing backend logic.
+- Known aliases are canonicalized.
+- Parent tags are expanded recursively.
+- `nico:` is normally rejected for manual entry.
+- Special tags such as tag-request / bot / unknown-deerjikist / video / niconico / youtube must be protected.
+
+Do not casually change tag normalization, alias resolution, or parent expansion. These affect search, wiki, sync, and historical data.
+
+### Nico tags
+
+Nico tags use the `nico` category and have separate versioning.
+
+Important relation:
+
+- `nico_tag_relations` maps external Nico tags to internal tags.
+- `nico_tag_id` must be a Nico category tag.
+- `tag_id` must not be Nico category.
+
+Do not allow ordinary manual tag editing to create or corrupt Nico tags.
+
+### Deerjikists
+
+Deerjikists map external platform identities to internal `deerjikist` tags.
+
+Known platforms include:
+
+- `nico`
+- `youtube`
+
+YouTube handles may be normalized to `UC...` channel IDs.
+
+Do not treat user-facing handles and canonical channel IDs as interchangeable without checking existing code.
+
+### Wiki
+
+Wiki pages are a major knowledge layer.
+
+Important points:
+
+- Wiki pages are tied to tag-like titles.
+- Title handling, aliases, and canonical tag names matter.
+- There is line-level storage / revision-oriented behavior in the current implementation.
+- There has been design tension between wiki revisions and wiki versions.
+- Wiki conflict detection using `base_revision_id` exists on the backend side.
+- Frontend support for conflict detection must be verified before assuming it is complete.
+
+Do not redesign Wiki storage casually.
+
+Do not add a second competing history system.
+
+Do not break existing wiki URLs.
+
+### Materials
+
+Materials connect files or reference URLs to `material` or `character` tags.
+
+Important properties:
+
+- A material has a `tag_id`.
+- The tag must be `material` or `character`.
+- A material requires either `url` or attached `file`.
+- Active Storage is involved.
+- Upload/security policy matters more than plain link posting.
+
+Important unresolved/risky area:
+
+- Material creation permissions have historically been risky because upload endpoints can be abused.
+- Prefer `member` or higher for material creation unless the issue explicitly says otherwise.
+
+### Theatre
+
+Theatre is an experimental watch-party style feature.
+
+Known pieces include:
+
+- Display
+- Presence
+- Next post
+- Comments
+- Host-like control
+
+Do not assume theatre has complete CRUD/admin support unless the code proves it.
+
+Theatre may become expensive if next-item selection uses random DB ordering.
+
+## Current high-risk areas
+
+Treat these areas with extra care.
+
+### Security
+
+- Preview API SSRF protection.
+- External iframe / embed CSP.
+- Markdown link safety.
+- BAN / IP BAN bypass.
+- Transfer-code leakage.
+- Guest write access.
+- Upload endpoints.
+- Admin-only tag operations.
+- System tag mutation.
+
+### Data integrity
+
+- Tag alias canonicalization.
+- Tag parent expansion.
+- Post parent many-to-many relationships.
+- Version tables.
+- `version_no` synchronization.
+- Schema drift from branch migration contamination.
+- Wiki revision/version split.
+- Material version recording.
+
+### Frontend correctness
+
+- React Hooks must not be called conditionally.
+- Role guards are currently spread across components/pages.
+- TanStack Query keys must not collide between ID/name or ID/title variants.
+- URL path segments containing tag names or wiki titles must use `encodeURIComponent`.
+- API response types may allow `null` users for bot or migration data.
+- Tag autocomplete has had duplicated logic and stale state hazards.
+
+### Performance
+
+- Avoid unbounded `limit`.
+- Avoid `order('RAND()')` for growing tables.
+- Avoid loading full relations just to count.
+- Avoid Ruby-side sorting/paging for large histories.
+- Tag sidebar client-side aggregation can become expensive.
+- Wiki full-text search needs deliberate indexing/design.
+
+## Current priority order
+
+Use this as the default priority unless an issue says otherwise.
+
+### P0: Safety before broad announcement
+
+1. Preview API SSRF hardening.
+2. Material creation permission tightening.
+3. System tag mutation holes.
+4. `GET /users/me` transfer-code leakage through query params.
+5. Limit caps for index/history/comment APIs.
+6. CSP / iframe sandbox policy.
+7. Confirm BAN enforcement remains global.
+
+### P1: Core correctness
+
+1. Post optimistic locking with `version_no`.
+2. Wiki edit conflict handling.
+3. Wiki history/revision model clarification.
+4. Wiki search truthfulness: implement body search or remove false UI.
+5. Tag alias/canonical/wiki interaction.
+6. Tag URL encoding.
+7. TanStack Query key separation.
+8. Frontend null-user handling.
+9. React Hooks rule fixes.
+10. Material version policy.
+
+### P2: Operational/admin usability
+
+1. Admin screens for users, IPs, bans, aliases, and settings.
+2. Settings table and user settings usage.
+3. Better tag sidebar.
+4. Better role guard helpers.
+5. Better frontend tests.
+6. Better issue triage and closure of already-implemented issues.
+
+### P3: Future features
+
+1. Theatre list/create/edit/admin flow.
+2. Muted/hidden tags.
+3. Tag category custom colors.
+4. Responsive refinements.
+5. Watch-party improvements.
+6. Broader embed support.
+
+## Known issue triage notes
+
+Some existing issues may already be partially or mostly implemented.
+
+Before implementing an issue, check code first.
+
+Examples:
+
+- Tag search and OR/NOT search may already be mostly implemented.
+- BAN enforcement may have been implemented after earlier issue drafts.
+- YouTube sync exists and should not be treated as purely planned.
+- Parent posts are many-to-many in current schema, even if older issues mention one-to-many.
+- Some issues may reflect old schema or old branch state.
+
+When in doubt:
+
+1. Inspect current code.
+2. Inspect schema.
+3. Inspect routes.
+4. Inspect frontend usage.
+5. Report whether the issue is implemented, partially implemented, not implemented, or obsolete.
+6. Only then edit.
+
+## Verification expectations
+
+Backend changes:
+
+- Run RSpec when possible.
+- Add request specs for API behavior changes.
+- Add model specs for validation / normalization changes.
+- Check migrations and schema consistency.
+- Do not silently ignore pending migrations.
+
+Frontend changes:
+
+- Run build.
+- Run lint if configured.
+- Run tests if configured.
+- Add tests for important behavior when the test framework exists.
+- If frontend tests are not yet installed, state that clearly.
+
+Full-stack changes:
+
+- Verify both backend and frontend compile/test paths where possible.
+- Confirm API response shapes match TypeScript types.
+- Confirm authorization behavior on both server and UI.
+
+If commands cannot be run because dependencies are missing, report that explicitly. Do not pretend verification passed.
+
+## Branch / migration caution
+
+The project has previously suffered from schema contamination caused by running migrations from another branch.
+
+Be careful when touching:
+
+- `db/schema.rb`
+- migration files
+- parent post schema
+- banned / banned_at schema
+- version_no migrations
+- wiki asset schema
+
+Before changing migrations:
+
+1. Inspect current schema.
+2. Inspect existing migrations.
+3. Confirm whether the intended branch already includes related migrations.
+4. Prefer additive migrations for shared branches.
+5. Do not edit already-applied production migrations unless explicitly instructed.
+
+## API design principles
+
+Prefer explicit server-side authorization.
+
+Do not rely only on frontend hiding.
+
+Do not return sensitive codes unnecessarily.
+
+Use 403 for authorization failures.
+
+Use 422 for validation failures.
+
+Use 409 for edit conflicts.
+
+Do not expose internal exception messages to users.
+
+Clamp or reject abusive limits consistently.
+
+Keep response shape stable unless the issue explicitly includes a breaking API change.
+
+## Frontend design principles
+
+Use existing route and query-key conventions.
+
+Use TanStack Query `enabled` rather than conditional hook calls.
+
+Do not let role-based early returns change hook order.
+
+Centralize repeated tag autocomplete logic when touching it.
+
+Use `encodeURIComponent` for tag names and wiki titles in URL path segments.
+
+Prefer graceful fallback for nullable actors:
+
+- bot operation
+- deleted user
+- migration-created data
+- external sync
+
+Do not assume all API user fields are non-null.
+
+## Testing priorities to add over time
+
+Frontend tests are especially important because the backend already has more mature RSpec coverage.
+
+Suggested first frontend tests:
+
+1. Tag autocomplete.
+2. Post form tag editing.
+3. Tag URL encoding.
+4. Wiki edit conflict UI.
+5. Role guard behavior.
+6. Null-user history rendering.
+7. Dialog behavior.
+8. Top navigation responsive behavior.
+
+Backend test priorities:
+
+1. BAN enforcement across public-looking endpoints.
+2. Material permissions.
+3. Preview SSRF rejection.
+4. System tag protection.
+5. Post optimistic locking.
+6. Wiki conflict detection.
+7. Tag alias/canonical behavior.
+8. Limit caps.
+9. Parent post parsing.
+10. Version recorder behavior.
+
+## What Codex should not do without explicit approval
+
+Do not:
+
+- Replace Rails.
+- Replace React.
+- Replace TanStack Query.
+- Redesign the database.
+- Rewrite Wiki storage.
+- Remove version tables.
+- Change authentication model.
+- Change role names.
+- Change tag category names.
+- Add background job infrastructure.
+- Add a new UI framework.
+- Add a new test framework if one already exists.
+- Add major dependencies.
+- Change public URL design.
+- Change production storage configuration.
+- Remove historical data behavior.
+- Simplify BAN/security checks.
+- Treat the site as private-only.
+
+## Good first Codex tasks
+
+Start with investigation-only tasks.
+
+Example:
+
+```txt
+Inspect the repository and summarize the Rails, React, TypeScript, and test setup.
+Do not modify files.
+List commands that actually exist in this repository.
+List risks Codex should know before editing.
+```
+
+Then small safe patches:
+
+```txt
+Fix a React Hooks rule violation in one file.
+Keep behavior unchanged.
+Run the relevant frontend verification commands.
+```
+
+```txt
+Add encodeURIComponent around one tag-name URL path segment.
+Add or update a test if the project has a frontend test setup.
+Run build/lint.
+```
+
+```txt
+Add a request spec for a known authorization rule.
+Do not change implementation unless the spec fails for the expected reason.
+```
+
+Avoid starting with:
+
+- Wiki history redesign.
+- Post versioning redesign.
+- Full admin screen suite.
+- Broad frontend refactor.
+- Database cleanup.
+- Authentication rewrite.
+
+## Relationship with ChatGPT
+
+ChatGPT has been used for:
+
+- Design review.
+- Risk analysis.
+- Prioritization.
+- Specification reconstruction.
+- Migration/locking discussions.
+- Codex migration planning.
+
+Codex should be used mainly for:
+
+- Repository inspection.
+- Localized implementation.
+- Test addition.
+- Running verification commands.
+- Producing small reviewable diffs.
+
+For ambiguous architecture, Codex should stop and present options rather than implement a guessed design.
+
+## Current strategic stance
+
+The project should not be rewritten from scratch.
+
+The current Rails + React system is acceptable.
+
+The immediate goal is not elegance.
+The immediate goal is safe public operation, data integrity, and maintainable incremental improvement.
+
+Priority is:
+
+1. Prevent abuse/security incidents.
+2. Preserve data correctness.
+3. Make editing safe for multiple users.
+4. Add tests around fragile frontend behavior.
+5. Improve admin/operation workflows.
+6. Optimize performance after obvious dangerous patterns are removed.
+
+## Final rule
+
+When current code, old specs, issue drafts, and memory disagree, current code wins.
+
+When current code is unsafe, write that explicitly and propose a small safe fix.
+
+When the task is too broad, split it.
+
+When verification cannot be performed, say exactly what was not verified.

docs/commands.md

@@ -0,0 +1,30 @@
+# Commands
+
+## Backend
+
+```sh
+cd backend
+bundle install
+bundle exec rails db:migrate
+bundle exec rspec
+bundle exec rails routes
+```
+
+## Frontend
+
+```sh
+cd frontend
+npm install
+npm run dev
+npm run build
+npm run lint
+npm run test
+npm run test:run
+```
+
+### Full verification
+
+```sh
+cd backend && bundle exec rspec
+cd ../frontend && npm run test:run && npm run build && npm run lint
+```

docs/issue-workflow.md

@@ -0,0 +1,80 @@
+# Issue workflow
+
+## Source of truth
+
+Gitea Issues are the source of truth for tasks, discussions, labels, milestones, and status.
+
+Do not copy the full backlog into git.
+
+Repository documents may define:
+
+- issue templates
+- triage rules
+- Codex task format
+- verification rules
+- release checklist
+
+## Labels
+
+Recommended labels:
+
+- `P0`
+- `P1`
+- `P2`
+- `P3`
+- `security`
+- `data-integrity`
+- `backend`
+- `frontend`
+- `wiki`
+- `tags`
+- `materials`
+- `theatre`
+- `codex-ready`
+- `needs-design`
+- `blocked`
+- `good-first-codex-task`
+
+## Codex-ready criteria
+
+An issue can be labeled `codex-ready` only when it has:
+
+- clear background
+- target area
+- concrete tasks
+- acceptance criteria
+- verification commands
+- explicit non-goals
+- no unresolved architecture decision
+
+## Workflow
+
+1. Create or refine the issue in Gitea.
+2. Add labels and milestone.
+3. If design is unclear, label `needs-design`.
+4. Discuss design before implementation.
+5. When scoped enough, label `codex-ready`.
+6. Give Codex the issue URL or copied issue body.
+7. Codex creates a branch.
+8. Codex implements a small patch.
+9. Codex runs verification commands.
+10. Human reviews the diff.
+11. Merge.
+12. Close the issue from the PR/commit message.
+
+## Commit message
+
+Use issue references when possible:
+
+```txt
+fix: prevent preview SSRF
+
+Refs: #123
+```
+or
+```
+fix: prevent preview SSRF
+
+Closes: #123
+```
+depending on whether the change fully resolves the issue.

docs/release-checklist.md

@@ -0,0 +1,8 @@
+# Release checklist
+
+- [ ] Backend specs pass
+- [ ] Frontend build passes
+- [ ] No pending migrations
+- [ ] Preview API SSRF checked
+- [ ] BAN behavior checked
+- [ ] CSP checked

docs/roadmap.md

@@ -0,0 +1,8 @@
+# Roadmap
+
+## Public announcement readiness
+
+- Harden preview API
+- Tighten material creation permission
+- Add admin MVP
+- Improve frontend tests

frontend/AGENTS.md

@@ -0,0 +1,95 @@
+# frontend/AGENTS.md
+
+## Scope
+
+These rules apply to work under `frontend/`.
+
+This is a Vite + React + TypeScript app using TanStack Query, Tailwind CSS, Framer Motion, Radix UI-style components, MDX, and Zustand.
+
+## Commands
+
+Use only scripts that exist in `package.json`:
+
+```sh
+npm run dev
+npm run build
+npm run lint
+npm run preview
+```
+
+`npm run build` runs `tsc -b && vite build`, and `postbuild` runs `node scripts/generate-sitemap.js`.
+
+There is currently no `test` script in `package.json`. Do not run or report `npm test` unless a test script is added.
+
+After frontend changes, run:
+
+```sh
+npm run build
+npm run lint
+```
+
+If either command cannot be run or fails, report the exact command and failure.
+
+## TypeScript
+
+- TypeScript is strict. `tsconfig.app.json` enables `strict`, `noUnusedLocals`, `noUnusedParameters`, `erasableSyntaxOnly`, `noFallthroughCasesInSwitch`, and `noUncheckedSideEffectImports`.
+- Keep types explicit at module boundaries, API helpers, and exported utilities.
+- Use `import type` for type-only imports.
+- Prefer existing shared types from `src/types.ts` before adding local duplicate types.
+- Preserve the repository's existing spacing style in TypeScript, including GNU-style spacing before call parentheses where it is already used.
+- Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
+
+## React
+
+- Use function components.
+- Existing page components commonly export an anonymous function satisfying `FC`; match nearby file style when editing.
+- React hooks must be called unconditionally and at the top level of components or custom hooks.
+- Keep page-level components under `src/pages`.
+- Keep shared and feature components under `src/components`.
+- Use `react-router-dom` route params and navigation patterns already present in `src/App.tsx`.
+- Encode URL path-segment values with `encodeURIComponent`.
+
+## TanStack Query
+
+- Use `@tanstack/react-query` for server state.
+- Query keys should come from `src/lib/queryKeys.ts`; add key builders there instead of using ad hoc arrays in components.
+- Fetch functions should live in domain helpers under `src/lib`, such as `posts.ts`, `tags.ts`, or `wiki.ts`.
+- Use `useQueryClient().invalidateQueries` with the shared root keys when mutations affect cached lists or detail views.
+- The app-wide `QueryClient` is configured in `src/main.tsx`; do not create additional clients in feature code.
+
+## API calls
+
+- Use `src/lib/api.ts` for HTTP calls.
+- The API wrapper attaches `X-Transfer-Code` from `localStorage` and converts non-blob responses to camelCase.
+- Send Rails snake_case params and request body keys where the backend expects them.
+- Do not bypass the API wrapper unless there is a specific reason, such as a third-party request outside the Rails API.
+- For blob responses, pass `responseType: 'blob'` so the wrapper does not camelCase the body.
+
+## Imports and aliases
+
+- The `@` alias points to `frontend/src`.
+- Prefer `@/...` imports for app code instead of long relative paths.
+- Keep type imports separate with `import type`.
+- Match existing import grouping: external packages, app modules, then type imports.
+
+## Tailwind and UI
+
+- Tailwind scans `src/**/*.{html,js,ts,jsx,tsx,mdx}`.
+- Use `cn` from `src/lib/utils.ts` for conditional class names and class merging.
+- Reuse components from `src/components/common`, `src/components/layout`, and `src/components/ui` before adding new primitives.
+- Keep Tailwind classes consistent with nearby components.
+- When adding dynamic tag color classes, update `tailwind.config.js` safelist if the class cannot be statically detected.
+- Do not introduce new UI libraries or production dependencies without approval.
+
+## Lint and build constraints
+
+- ESLint uses `@eslint/js`, `typescript-eslint`, `eslint-plugin-react-hooks`, and `eslint-plugin-react-refresh`.
+- The hooks rules are enforced; fix hook ordering instead of disabling the rule.
+- `react-refresh/only-export-components` is enabled as a warning with `allowConstantExport`.
+- Build failures from unused locals or unused parameters are TypeScript errors, not lint-only issues.
+
+## Files to avoid in routine work
+
+- Do not edit `dist/` output directly.
+- Do not inspect or modify `node_modules/` unless explicitly needed.
+- Keep generated build artifacts out of source changes unless the user asks for them.

frontend/eslint.config.js

@@ -5,7 +5,7 @@ import reactRefresh from 'eslint-plugin-react-refresh'
 import tseslint from 'typescript-eslint'
 
 export default tseslint.config(
-  { ignores: ['dist'] },
+  { ignores: ['dist', 'tailwind.config.js'] },
   {
     extends: [js.configs.recommended, ...tseslint.configs.recommended],
     files: ['**/*.{ts,tsx}'],

frontend/package.json

@@ -8,6 +8,8 @@
     "build": "tsc -b && vite build",
     "postbuild": "node scripts/generate-sitemap.js",
     "lint": "eslint .",
+    "test": "vitest",
+    "test:run": "vitest run",
     "preview": "vite preview"
   },
   "dependencies": {
@@ -45,6 +47,10 @@
   "devDependencies": {
     "@eslint/js": "^9.25.0",
     "@tailwindcss/typography": "^0.5.19",
+    "@testing-library/dom": "^10.4.1",
+    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.1",
     "@types/axios": "^0.14.4",
     "@types/markdown-it": "^14.1.2",
     "@types/mdx": "^2.0.13",
@@ -58,11 +64,13 @@
     "eslint-plugin-react-hooks": "^5.2.0",
     "eslint-plugin-react-refresh": "^0.4.19",
     "globals": "^16.0.0",
+    "jsdom": "^26.1.0",
     "postcss": "^8.5.3",
     "tailwindcss": "^3.4.13",
     "typescript": "~5.8.3",
     "typescript-eslint": "^8.30.1",
-    "vite": "^6.3.5"
+    "vite": "^6.3.5",
+    "vitest": "^4.1.5"
   },
   "description": "This template provides a minimal setup to get React working in Vite with HMR and some ESLint rules.",
   "main": "eslint.config.js",

frontend/src/App.tsx

@@ -8,6 +8,7 @@ import { BrowserRouter,
 
 import RouteBlockerOverlay from '@/components/RouteBlockerOverlay'
 import TopNav from '@/components/TopNav'
+import DialogueProvider from '@/components/dialogues/DialogueProvider'
 import { Toaster } from '@/components/ui/toaster'
 import { apiPost, isApiError } from '@/lib/api'
 import DeerjikistDetailPage from '@/pages/deerjikists/DeerjikistDetailPage'
@@ -92,7 +93,7 @@ const PostDetailRoute = ({ user }: { user: User | null }) => {
 }
 
 
-export default (() => {
+const App: FC = () => {
   const [user, setUser] = useState<User | null> (null)
   const [status, setStatus] = useState (200)
 
@@ -138,7 +139,9 @@ export default (() => {
   return (
       <>
 	<RouteBlockerOverlay/>
+
 	<BrowserRouter>
+	  <DialogueProvider>
 	    <LayoutGroup>
 	      <motion.div
 		  layout="position"
@@ -148,7 +151,11 @@ export default (() => {
 		<RouteTransitionWrapper user={user} setUser={setUser}/>
 	      </motion.div>
 	    </LayoutGroup>
+
 	    <Toaster/>
+	  </DialogueProvider>
 	</BrowserRouter>
       </>)
-}) satisfies FC
+}
+
+export default App

frontend/src/components/DraggableDroppableTagRow.tsx

@@ -19,7 +19,7 @@ type Props = {
     sp?:              boolean }
 
 
-export default (({ tag, nestLevel, pathKey, parentTagId, suppressClickRef, sp }: Props) => {
+const DraggableDroppableTagRow: FC<Props> = ({ tag, nestLevel, pathKey, parentTagId, suppressClickRef, sp }) => {
   const dndId = `tag-node:${ pathKey }`
 
   const downPosRef = useRef<{ x: number; y: number } | null> (null)
@@ -96,4 +96,6 @@ export default (({ tag, nestLevel, pathKey, parentTagId, suppressClickRef, sp }:
 	  <TagLink tag={tag} nestLevel={nestLevel}/>
 	</motion.div>
       </div>)
-}) satisfies FC<Props>
+}
+
+export default DraggableDroppableTagRow

frontend/src/components/ErrorScreen.test.tsx

@@ -0,0 +1,32 @@
+import { render, screen } from '@testing-library/react'
+import { HelmetProvider } from 'react-helmet-async'
+import { describe, expect, it } from 'vitest'
+
+import ErrorScreen from '@/components/ErrorScreen'
+
+describe ('ErrorScreen', () => {
+  it.each ([
+    [403, '権限ないよ（笑）'],
+    [404, 'ページないよ（笑）'],
+    [500, '鯖でエラー出たって（嘲笑）'],
+    [503, '鯖死んでるよ（泣）'],
+  ]) ('renders status %s', (status, message) => {
+    render (
+        <HelmetProvider>
+          <ErrorScreen status={status}/>
+        </HelmetProvider>,
+    )
+
+    expect (screen.getByText (String (status))).toBeInTheDocument ()
+    expect (screen.getByText (message)).toBeInTheDocument ()
+    expect (screen.getByAltText ('逃げたギター')).toBeInTheDocument ()
+  })
+
+  it ('throws for unsupported statuses', () => {
+    expect (() => render (
+        <HelmetProvider>
+          <ErrorScreen status={418}/>
+        </HelmetProvider>,
+    )).toThrow ()
+  })
+})

frontend/src/components/ErrorScreen.tsx

@@ -10,7 +10,7 @@ import type { FC } from 'react'
 type Props = { status: number }
 
 
-export default (({ status }: Props) => {
+const ErrorScreen: FC<Props> = ({ status }) => {
   const [message, rightMsg, leftMsg]: [string, string, string] = (() => {
     switch (status)
     {
@@ -58,4 +58,6 @@ export default (({ status }: Props) => {
 	  <p className="mr-[-.5em]">{message}</p>
 	</div>
       </MainArea>)
-}) satisfies FC<Props>
+}
+
+export default ErrorScreen

frontend/src/components/MaterialSidebar.tsx

@@ -31,7 +31,7 @@ const setChildrenById = (
     }))
 
 
-export default (() => {
+const MaterialSidebar: FC = () => {
   const [tags, setTags] = useState<TagWithDepth[]> ([])
   const [openTags, setOpenTags] = useState<Record<number, boolean>> ({ })
   const [tagFetchedFlags, setTagFetchedFlags] = useState<Record<number, boolean>> ({ })
@@ -94,4 +94,6 @@ export default (() => {
 	  {renderTags (tags)}
 	</ul>
       </SidebarComponent>)
-}) satisfies FC
+}
+
+export default MaterialSidebar

frontend/src/components/MenuSeparator.tsx

@@ -1,9 +1,11 @@
 import type { FC } from 'react'
 
 
-export default (() => (
+const MenuSeparator: FC = () => (
     <>
       <span className="hidden md:inline flex items-center px-2">|</span>
       <hr className="block md:hidden w-full opacity-25
 		     border-t border-black dark:border-white"/>
-    </>)) satisfies FC
+    </>)
+
+export default MenuSeparator

frontend/src/components/PostEditForm.test.tsx

@@ -0,0 +1,69 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import PostEditForm from '@/components/PostEditForm'
+import { buildPost, buildTag } from '@/test/factories'
+
+const postsApi = vi.hoisted (() => ({
+  updatePost: vi.fn (),
+}))
+
+const api = vi.hoisted (() => ({
+  isApiError: vi.fn (() => false),
+}))
+
+const toastApi = vi.hoisted (() => ({
+  toast: vi.fn (),
+}))
+
+vi.mock ('@/lib/posts', () => postsApi)
+vi.mock ('@/lib/api', () => api)
+vi.mock ('@/components/ui/use-toast', () => toastApi)
+vi.mock ('@/components/dialogues/DialogueProvider', () => ({
+  useDialogue: () => ({
+    choice: vi.fn (),
+  }),
+}))
+
+describe ('PostEditForm', () => {
+  it ('submits edited post fields with the current base version', async () => {
+    const onSave = vi.fn ()
+    const post = buildPost ({
+      id:        8,
+      versionNo: 4,
+      title:     'old',
+      tags:      [
+        buildTag ({ name: 'general-tag', category: 'general' }),
+        buildTag ({ id: 2, name: 'nico-tag', category: 'nico' }),
+      ],
+      parentPosts: [buildPost ({ id: 2, title: 'parent' })],
+    })
+    postsApi.updatePost.mockResolvedValueOnce ({
+      ...post,
+      versionNo: 5,
+      title:     'new',
+      tags:      [buildTag ({ name: 'new-tag' })],
+    })
+
+    render (<PostEditForm post={post} onSave={onSave}/>)
+
+    const [title, parentIds] = screen.getAllByRole ('textbox')
+    fireEvent.change (title, { target: { value: 'new' } })
+    fireEvent.change (parentIds, { target: { value: '3 4' } })
+    fireEvent.submit (screen.getByRole ('button', { name: '更新' }).closest ('form')!)
+
+    await waitFor (() => {
+      expect (postsApi.updatePost).toHaveBeenCalledWith (
+          expect.objectContaining ({
+            id:            8,
+            title:         'new',
+            parentPostIds: '3 4',
+            tags:          'general-tag',
+          }),
+          { baseVersionNo: 4 },
+      )
+    })
+    expect (onSave).toHaveBeenCalledWith (expect.objectContaining ({ versionNo: 5 }))
+    expect (toastApi.toast).toHaveBeenCalledWith ({ description: '更新しました．' })
+  })
+})

frontend/src/components/PostEditForm.tsx

@@ -3,27 +3,33 @@ import { useEffect, useState } from 'react'
 import PostFormTagsArea from '@/components/PostFormTagsArea'
 import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
 import Label from '@/components/common/Label'
+import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { toast } from '@/components/ui/use-toast'
-import { apiPut } from '@/lib/api'
+import { isApiError } from '@/lib/api'
+import { updatePost } from '@/lib/posts'
+import { msToTime } from '@/lib/utils'
 
-import type { FC } from 'react'
+import type { FC, FormEvent } from 'react'
 
-import type { Post, Tag } from '@/types'
+import type { Post, TagWithSections } from '@/types'
 
 
-const tagsToStr = (tags: Tag[]): string => {
-  const result: Tag[] = []
+const tagsToStr = (tags: TagWithSections[]): string => {
+  const result: Omit<TagWithSections, 'children'>[] = []
 
-  const walk = (tag: Tag) => {
+  const walk = (tag: TagWithSections) => {
     const { children, ...rest } = tag
     result.push (rest)
-    children?.forEach (walk)
+    children.forEach (walk)
   }
 
   tags.filter (t => t.category !== 'nico').forEach (walk)
 
-  return [...(new Set (result.map (t => t.name)))].join (' ')
+  return [...(new Set (result.map (t =>
+      `${ t.name }${ t.sections
+		     .map (s => `[${ msToTime (s.beginMs) }-${ msToTime (s.endMs) }]`)
+		     .join ('') }`)))].join (' ')
 }
 
 
@@ -31,7 +37,8 @@ type Props = { post:    Post
 	       onSave:  (newPost: Post) => void }
 
 
-export default (({ post, onSave }: Props) => {
+const PostEditForm: FC<Props> = ({ post, onSave }) => {
+  const [disabled, setDisabled] = useState (false)
   const [originalCreatedBefore, setOriginalCreatedBefore] =
       useState<string | null> (post.originalCreatedBefore)
   const [originalCreatedFrom, setOriginalCreatedFrom] =
@@ -41,16 +48,14 @@ export default (({ post, onSave }: Props) => {
   const [tags, setTags] = useState<string> ('')
   const [title, setTitle] = useState (post.title)
 
-  const handleSubmit = async () => {
+  const dialogue = useDialogue ()
+
+  const update = async (...args: Parameters<typeof updatePost>) => {
     try
     {
-      const data = await apiPut<Post> (
-	  `/posts/${ post.id }`,
-	  { title, tags, parent_post_ids: parentPostIds,
-	    original_created_from: originalCreatedFrom,
-	    original_created_before: originalCreatedBefore },
-	  { headers: { 'Content-Type': 'multipart/form-data' } })
+      const data = await updatePost (...args)
       onSave ({ ...post,
+		versionNo:              data.versionNo,
 		title:                  data.title,
 		tags:                   data.tags,
 		parentPosts:            data.parentPosts,
@@ -60,9 +65,58 @@ export default (({ post, onSave }: Props) => {
 		originalCreatedBefore:  data.originalCreatedBefore } as Post)
       toast ({ description: '更新しました．' })
     }
-    catch
+    catch (e)
+    {
+      const response = isApiError<{ mergeable?: boolean }> (e) ? e.response : undefined
+
+      if (response?.status !== 409)
 	{
 	  toast ({ description: '更新はできなかったよ……' })
+	  return
+	}
+
+      const action = await dialogue.choice ({
+	  title: '競合が発生しました．',
+	  description: (
+	      <div>
+		<p>ほかの耕作員が先に更新してゐます．</p>
+		<p>現在の変更をどう扱ひますか?</p>
+	      </div>),
+	  choices: [...(response?.data?.mergeable ? [{ value: 'merge', label: '差分をマージ' }] : []),
+		    { value: 'overwrite', label: '強制上書き', variant: 'danger' }] })
+
+      if (action === 'merge')
+	{
+	  // TODO: 差分 UI
+	  await update ({ id: post.id, title, tags, parentPostIds,
+			  originalCreatedFrom, originalCreatedBefore },
+			{ baseVersionNo: post.versionNo, merge: true })
+	  return
+	}
+
+      if (action === 'overwrite')
+	{
+	  await update ({ id: post.id, title, tags, parentPostIds,
+			  originalCreatedFrom, originalCreatedBefore },
+			{ baseVersionNo: post.versionNo, force: true })
+	  return
+	}
+    }
+  }
+
+  const handleSubmit = async (e: FormEvent) => {
+    e.preventDefault ()
+
+    setDisabled (true)
+    try
+    {
+      await update ({ id: post.id, title, tags, parentPostIds,
+		      originalCreatedFrom, originalCreatedBefore },
+		    { baseVersionNo: post.versionNo })
+    }
+    finally
+    {
+      setDisabled (false)
     }
   }
 
@@ -71,11 +125,13 @@ export default (({ post, onSave }: Props) => {
   }, [post])
 
   return (
-      <div className="max-w-xl pt-2 space-y-4">
+      <form onSubmit={handleSubmit} className="max-w-xl pt-2 space-y-4">
 	{/* タイトル */}
 	<div>
 	  <Label>タイトル</Label>
-	  <input type="text"
+	  <input
+	      type="text"
+	      disabled={disabled}
 	      className="w-full border rounded p-2"
 	      value={title ?? ''}
 	      onChange={ev => setTitle (ev.target.value)}/>
@@ -86,25 +142,33 @@ export default (({ post, onSave }: Props) => {
 	  <Label>親投稿</Label>
 	  <input
 	      type="text"
+	      disabled={disabled}
 	      value={parentPostIds}
 	      onChange={e => setParentPostIds (e.target.value)}
 	      className="w-full border p-2 rounded"/>
 	</div>
 
 	{/* タグ */}
-	<PostFormTagsArea tags={tags} setTags={setTags}/>
+	<PostFormTagsArea
+	    disabled={disabled}
+	    tags={tags}
+	    setTags={setTags}/>
 
 	{/* オリジナルの作成日時 */}
 	<PostOriginalCreatedTimeField
+	    disabled={disabled}
 	    originalCreatedFrom={originalCreatedFrom}
 	    setOriginalCreatedFrom={setOriginalCreatedFrom}
 	    originalCreatedBefore={originalCreatedBefore}
 	    setOriginalCreatedBefore={setOriginalCreatedBefore}/>
 
 	{/* 送信 */}
-	<Button onClick={handleSubmit}
-		className="px-4 py-2 bg-blue-600 text-white rounded disabled:bg-gray-400">
+	<Button
+	    type="submit"
+	    disabled={disabled}>
 	  更新
 	</Button>
-      </div>)
-}) satisfies FC<Props>
+      </form>)
+}
+
+export default PostEditForm

frontend/src/components/PostEmbed.test.tsx

@@ -0,0 +1,63 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import PostEmbed from '@/components/PostEmbed'
+import { buildPost } from '@/test/factories'
+
+const dialogue = vi.hoisted (() => ({
+  confirm: vi.fn (),
+}))
+
+vi.mock ('@/components/dialogues/DialogueProvider', () => ({
+  useDialogue: () => dialogue,
+}))
+
+vi.mock ('@/components/NicoViewer', () => ({
+  default: ({ id }: { id: string }) => <div>Nico:{id}</div>,
+}))
+
+vi.mock ('react-youtube', () => ({
+  default: ({ videoId }: { videoId: string }) => <div>YouTube:{videoId}</div>,
+}))
+
+describe ('PostEmbed', () => {
+  beforeEach (() => {
+    vi.clearAllMocks ()
+  })
+
+  it ('embeds nicovideo watch URLs', () => {
+    render (<PostEmbed post={buildPost ({ url: 'https://www.nicovideo.jp/watch/sm12345' })}/>)
+
+    expect (screen.getByText ('Nico:sm12345')).toBeInTheDocument ()
+  })
+
+  it ('embeds x/twitter status URLs', () => {
+    render (<PostEmbed post={buildPost ({ url: 'https://x.com/someone/status/12345' })}/>)
+
+    expect (screen.getByRole ('link', { name: '@someone' })).toBeInTheDocument ()
+  })
+
+  it ('embeds youtube watch URLs', () => {
+    render (<PostEmbed post={buildPost ({ url: 'https://www.youtube.com/watch?v=abc123' })}/>)
+
+    expect (screen.getByText ('YouTube:abc123')).toBeInTheDocument ()
+  })
+
+  it ('asks before framing unknown external pages', async () => {
+    dialogue.confirm.mockResolvedValueOnce (true)
+    render (
+        <PostEmbed
+            post={buildPost ({ url: 'https://example.com/page', title: 'external' })}/>,
+    )
+
+    fireEvent.click (screen.getByRole ('link', { name: '外部ページを表示' }))
+
+    await waitFor (() => {
+      expect (dialogue.confirm).toHaveBeenCalled ()
+    })
+    expect (await screen.findByTitle ('external')).toHaveAttribute (
+        'src',
+        'https://example.com/page',
+    )
+  })
+})

frontend/src/components/PostEmbed.tsx

@@ -3,6 +3,7 @@ import YoutubeEmbed from 'react-youtube'
 
 import NicoViewer from '@/components/NicoViewer'
 import TwitterEmbed from '@/components/TwitterEmbed'
+import { useDialogue } from '@/components/dialogues/DialogueProvider'
 
 import type { FC, RefObject } from 'react'
 
@@ -15,7 +16,10 @@ type Props = {
     onMetadataChange?:  (meta: NiconicoMetadata) => void }
 
 
-export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
+const PostEmbed: FC<Props> = ({ ref, post, onLoadComplete, onMetadataChange }) => {
+  const dialogue = useDialogue ()
+  const [framed, setFramed] = useState (false)
+
   const url = new URL (post.url)
 
   switch (url.hostname.split ('.').slice (-2).join ('.'))
@@ -41,7 +45,7 @@ export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
   case 'twitter.com':
   case 'x.com':
     {
-      const mUserId = url.pathname.match (/(?<=\/)[^\/]+?(?=\/|$|\?)/)
+      const mUserId = url.pathname.match (/(?<=\/)[^/]+?(?=\/|$|\?)/)
       const mStatusId = url.pathname.match (/(?<=\/status\/)\d+?(?=\/|$|\?)/)
       if (!(mUserId) || !(mStatusId))
 	break
@@ -69,8 +73,6 @@ export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
     }
   }
 
-  const [framed, setFramed] = useState (false)
-
   return (
       <>
 	{framed
@@ -82,15 +84,22 @@ export default (({ ref, post, onLoadComplete, onMetadataChange }: Props) => {
 		height={360}/>)
 	 : (
 	    <div>
-	      <a href="#" onClick={e => {
+	      <a href="#" onClick={async e => {
 		e.preventDefault ()
-		setFramed (confirm ('未確認の外部ページを表示します。\n'
-				    + '悪意のあるスクリプトが実行される可能性があります。\n'
-				    + '表示しますか?'))
-		return
+
+		setFramed (await dialogue.confirm ({
+		    title: '未確認の外部ページを表示します。',
+		    description: (
+			<div>
+			  <p>悪意のあるスクリプトが実行される可能性があります。</p>
+			  <p>表示しますか?</p>
+			</div>),
+		    confirmText: '表示' }))
 	      }}>
 		外部ページを表示
 	      </a>
 	    </div>)}
       </>)
-}) satisfies FC<Props>
+}
+
+export default PostEmbed

frontend/src/components/PostFormTagsArea.test.tsx

@@ -0,0 +1,34 @@
+import { fireEvent, screen, waitFor } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import PostFormTagsArea from '@/components/PostFormTagsArea'
+import { buildTag } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+const api = vi.hoisted (() => ({
+  apiGet: vi.fn (),
+}))
+
+vi.mock ('@/lib/api', () => api)
+
+describe ('PostFormTagsArea', () => {
+  it ('updates text and fetches autocomplete for the selected token', async () => {
+    const setTags = vi.fn ()
+    api.apiGet.mockResolvedValueOnce ([buildTag ({ name: '虹夏', postCount: 3 })])
+
+    renderWithProviders (<PostFormTagsArea tags="虹" setTags={setTags}/>)
+
+    const textarea = screen.getByRole ('textbox')
+    fireEvent.focus (textarea)
+    fireEvent.select (textarea, { target: { selectionStart: 1, selectionEnd: 1 } })
+    fireEvent.change (textarea, { target: { value: '虹夏' } })
+
+    await waitFor (() => {
+      expect (api.apiGet).toHaveBeenCalledWith (
+          '/tags/autocomplete',
+          { params: { q: '虹', nico: '0' } },
+      )
+    })
+    expect (setTags).toHaveBeenCalledWith ('虹夏')
+  })
+})

frontend/src/components/PostFormTagsArea.tsx

@@ -7,7 +7,7 @@ import Label from '@/components/common/Label'
 import TextArea from '@/components/common/TextArea'
 import { apiGet } from '@/lib/api'
 
-import type { FC, SyntheticEvent } from 'react'
+import type { ComponentPropsWithoutRef, FC, SyntheticEvent } from 'react'
 
 import type { Tag } from '@/types'
 
@@ -31,12 +31,12 @@ const replaceToken = (value: string, start: number, end: number, text: string) =
     `${ value.slice (0, start) }${ text }${ value.slice (end) }`
 
 
-type Props = {
+type Props = Omit<ComponentPropsWithoutRef<'textarea'>, 'value' | 'onChange' | 'onBlur'> & {
     tags:     string
     setTags:  (tags: string) => void }
 
 
-export default (({ tags, setTags }: Props) => {
+const PostFormTagsArea: FC<Props> = ({ tags, setTags, ...rest }) => {
   const ref = useRef<HTMLTextAreaElement> (null)
 
   const [bounds, setBounds] = useState<{ start: number; end: number }> ({ start: 0, end: 0 })
@@ -76,6 +76,7 @@ export default (({ tags, setTags }: Props) => {
       <div className="relative w-full">
 	<Label>タグ</Label>
 	<TextArea
+	    {...rest}
 	    ref={ref}
 	    value={tags}
 	    onChange={ev => setTags (ev.target.value)}
@@ -96,4 +97,6 @@ export default (({ tags, setTags }: Props) => {
 		activeIndex={-1}
 		onSelect={handleTagSelect}/>)}
       </div>)
-}) satisfies FC<Props>
+}
+
+export default PostFormTagsArea

frontend/src/components/PostList.test.tsx

@@ -0,0 +1,44 @@
+import { fireEvent, screen } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import PostList from '@/components/PostList'
+import { buildPost } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+const prefetchers = vi.hoisted (() => ({
+  prefetchForURL: vi.fn (),
+}))
+
+vi.mock ('@/lib/prefetchers', () => prefetchers)
+
+describe ('PostList', () => {
+  beforeEach (() => {
+    prefetchers.prefetchForURL.mockResolvedValue (undefined)
+  })
+
+  it ('renders post thumbnails as links to post details', () => {
+    renderWithProviders (
+        <PostList posts={[
+          buildPost ({ id: 1, title: 'First', thumbnail: 'first.jpg' }),
+          buildPost ({ id: 2, title: null, url: 'https://example.com/second' }),
+        ]}/>,
+    )
+
+    expect (screen.getByRole ('link', { name: 'First' })).toHaveAttribute (
+        'href',
+        '/posts/1',
+    )
+    expect (
+        screen.getByRole ('link', { name: 'https://example.com/second' }),
+    ).toHaveAttribute ('href', '/posts/2')
+  })
+
+  it ('calls the optional click handler', () => {
+    const onClick = vi.fn ()
+    renderWithProviders (<PostList posts={[buildPost ()]} onClick={onClick}/>)
+
+    fireEvent.click (screen.getByRole ('link', { name: 'テスト投稿' }))
+
+    expect (onClick).toHaveBeenCalledTimes (1)
+  })
+})

frontend/src/components/PostList.tsx

@@ -14,7 +14,7 @@ type Props = { posts:     Post[]
 	       onClick?:  (event: MouseEvent<HTMLElement>) => void }
 
 
-export default (({ posts, onClick }: Props) => {
+const PostList: FC<Props> = ({ posts, onClick }) => {
   const location = useLocation ()
 
   const setForLocationKey = useSharedTransitionStore (s => s.setForLocationKey)
@@ -42,7 +42,7 @@ export default (({ posts, onClick }: Props) => {
 		    layoutId={layoutId}
 		    className={cn ('w-full h-full overflow-hidden rounded-xl shadow',
 				   'transform-gpu will-change-transform',
-				   (post.childPosts ?? []).length > 0 && 'outline-4 outline-green-500',
+				   (post.childPosts ?? []).length > 0 && 'ring-4 ring-green-500',
 				   (post.parentPosts ?? []).length > 0 && 'ring-4 ring-yellow-500')}
 		    whileHover={{ scale: 1.02 }}
 		    onLayoutAnimationStart={() => {
@@ -70,4 +70,6 @@ export default (({ posts, onClick }: Props) => {
 	      </PrefetchLink>)
 	})}
       </div>)
-}) satisfies FC<Props>
+}
+
+export default PostList

frontend/src/components/PostOriginalCreatedTimeField.test.tsx

@@ -0,0 +1,63 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
+
+describe ('PostOriginalCreatedTimeField', () => {
+  it ('updates from and before values', () => {
+    const setFrom = vi.fn ()
+    const setBefore = vi.fn ()
+
+    render (
+        <PostOriginalCreatedTimeField
+            originalCreatedFrom={null}
+            setOriginalCreatedFrom={setFrom}
+            originalCreatedBefore={null}
+            setOriginalCreatedBefore={setBefore}/>,
+    )
+
+    const inputs = screen.getAllByDisplayValue ('')
+    fireEvent.change (inputs[0], { target: { value: '2026-01-02T03:04' } })
+    fireEvent.change (inputs[1], { target: { value: '2026-01-03T03:04' } })
+
+    expect (setFrom).toHaveBeenCalledWith (expect.any (String))
+    expect (setBefore).toHaveBeenCalledWith (expect.any (String))
+  })
+
+  it ('infers an exclusive before value on blur', () => {
+    const setBefore = vi.fn ()
+
+    render (
+        <PostOriginalCreatedTimeField
+            originalCreatedFrom={null}
+            setOriginalCreatedFrom={vi.fn ()}
+            originalCreatedBefore={null}
+            setOriginalCreatedBefore={setBefore}/>,
+    )
+
+    const input = screen.getAllByDisplayValue ('')[0]
+    fireEvent.blur (input, { target: { value: '2026-01-02T03:04' } })
+
+    expect (setBefore).toHaveBeenCalledWith (expect.any (String))
+  })
+
+  it ('resets both values', () => {
+    const setFrom = vi.fn ()
+    const setBefore = vi.fn ()
+
+    render (
+        <PostOriginalCreatedTimeField
+            originalCreatedFrom="2026-01-01T00:00:00Z"
+            setOriginalCreatedFrom={setFrom}
+            originalCreatedBefore="2026-01-02T00:00:00Z"
+            setOriginalCreatedBefore={setBefore}/>,
+    )
+
+    const buttons = screen.getAllByRole ('button', { name: 'リセット' })
+    fireEvent.click (buttons[0])
+    fireEvent.click (buttons[1])
+
+    expect (setFrom).toHaveBeenCalledWith (null)
+    expect (setBefore).toHaveBeenCalledWith (null)
+  })
+})

frontend/src/components/PostOriginalCreatedTimeField.tsx

@@ -5,22 +5,25 @@ import { Button } from '@/components/ui/button'
 import type { FC } from 'react'
 
 type Props = {
+    disabled?:                boolean
     originalCreatedFrom:      string | null
     setOriginalCreatedFrom:   (x: string | null) => void
     originalCreatedBefore:    string | null
     setOriginalCreatedBefore: (x: string | null) => void }
 
 
-export default (({ originalCreatedFrom,
+const PostOriginalCreatedTimeField: FC<Props> = ({ disabled,
+		   originalCreatedFrom,
 		   setOriginalCreatedFrom,
 		   originalCreatedBefore,
-		   setOriginalCreatedBefore }: Props) => (
+		   setOriginalCreatedBefore }) => (
     <div>
       <Label>オリジナルの作成日時</Label>
       <div className="my-1 flex">
 	<div className="w-80">
 	  <DateTimeField
 	      className="mr-2"
+	      disabled={disabled ?? false}
 	      value={originalCreatedFrom ?? undefined}
 	      onChange={setOriginalCreatedFrom}
 	      onBlur={ev => {
@@ -40,6 +43,7 @@ export default (({ originalCreatedFrom,
 	<div>
 	  <Button
 	      className="bg-gray-600 text-white rounded"
+	      disabled={disabled}
 	      onClick={() => {
 		setOriginalCreatedFrom (null)
 	      }}>
@@ -51,6 +55,7 @@ export default (({ originalCreatedFrom,
 	<div className="w-80">
 	  <DateTimeField
 	      className="mr-2"
+	      disabled={disabled}
 	      value={originalCreatedBefore ?? undefined}
 	      onChange={setOriginalCreatedBefore}/>
 	  より前
@@ -58,6 +63,7 @@ export default (({ originalCreatedFrom,
 	<div>
 	  <Button
 	      className="bg-gray-600 text-white rounded"
+	      disabled={disabled}
 	      onClick={() => {
 		setOriginalCreatedBefore (null)
 	      }}>
@@ -65,4 +71,6 @@ export default (({ originalCreatedFrom,
 	  </Button>
 	</div>
       </div>
-    </div>)) satisfies FC<Props>
+    </div>)
+
+export default PostOriginalCreatedTimeField

frontend/src/components/RouteBlockerOverlay.test.tsx

@@ -0,0 +1,30 @@
+import { render, screen } from '@testing-library/react'
+import { afterEach, describe, expect, it } from 'vitest'
+
+import RouteBlockerOverlay, { useOverlayStore } from '@/components/RouteBlockerOverlay'
+
+describe ('RouteBlockerOverlay', () => {
+  afterEach (() => {
+    useOverlayStore.setState ({ active: false })
+    document.body.style.overflow = ''
+    document.body.removeAttribute ('aria-busy')
+  })
+
+  it ('renders nothing while inactive', () => {
+    useOverlayStore.setState ({ active: false })
+
+    const { container } = render (<RouteBlockerOverlay/>)
+
+    expect (container).toBeEmptyDOMElement ()
+  })
+
+  it ('renders a blocking progressbar and marks the body busy while active', () => {
+    useOverlayStore.setState ({ active: true })
+
+    render (<RouteBlockerOverlay/>)
+
+    expect (screen.getByRole ('progressbar', { name: 'Loading' })).toBeInTheDocument ()
+    expect (document.body).toHaveAttribute ('aria-busy', 'true')
+    expect (document.body.style.overflow).toBe ('hidden')
+  })
+})

frontend/src/components/RouteBlockerOverlay.tsx

@@ -13,7 +13,7 @@ export const useOverlayStore = create<OverlayStore> (set => ({
     setActive:  v => set ({ active: v }) }))
 
 
-export default (() => {
+const RouteBlockerOverlay: FC = () => {
   const active = useOverlayStore (s => s.active)
 
   useEffect (() => {
@@ -43,4 +43,6 @@ export default (() => {
 	  </div>
 	</div>
       </div>)
-}) satisfies FC
+}
+
+export default RouteBlockerOverlay

frontend/src/components/SortHeader.test.tsx

@@ -0,0 +1,39 @@
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import SortHeader from '@/components/SortHeader'
+import { renderWithProviders } from '@/test/render'
+
+describe ('SortHeader', () => {
+  it ('toggles the active sort direction and resets the page', () => {
+    renderWithProviders (
+        <SortHeader
+            by="title"
+            label="タイトル"
+            currentOrder="title:asc"
+            defaultDirection={{ title: 'asc' }}/>,
+        { route: '/posts?tags=x&page=4&order=title%3Aasc' },
+    )
+
+    expect (screen.getByRole ('link', { name: 'タイトル ▲' })).toHaveAttribute (
+        'href',
+        '/posts?tags=x&page=1&order=title%3Adesc',
+    )
+  })
+
+  it ('uses default direction for inactive fields', () => {
+    renderWithProviders (
+        <SortHeader
+            by="updated_at"
+            label="更新"
+            currentOrder="title:desc"
+            defaultDirection={{ title: 'asc', updated_at: 'desc' }}/>,
+        { route: '/posts?page=2' },
+    )
+
+    expect (screen.getByRole ('link', { name: '更新' })).toHaveAttribute (
+        'href',
+        '/posts?page=1&order=updated_at%3Adesc',
+    )
+  })
+})

frontend/src/components/TagDetailSidebar.tsx

@@ -26,13 +26,13 @@ import { dateString, originalCreatedAtString } from '@/lib/utils'
 import type { DragEndEvent } from '@dnd-kit/core'
 import type { FC, MutableRefObject, ReactNode } from 'react'
 
-import type { Category, Post, Tag } from '@/types'
+import type { Category, Post, TagWithSections } from '@/types'
 
-type TagByCategory = { [key in Category]: Tag[] }
+type TagByCategory = { [key in Category]: TagWithSections[] }
 
 
 const renderTagTree = (
-    tag:              Tag,
+    tag:              TagWithSections,
     nestLevel:        number,
     path:             string,
     suppressClickRef: MutableRefObject<boolean>,
@@ -63,7 +63,7 @@ const renderTagTree = (
 
 
 const isDescendant = (
-    root:     Tag,
+    root:     TagWithSections,
     targetId: number,
 ): boolean => {
   if (!(root.children))
@@ -84,8 +84,8 @@ const isDescendant = (
 const findTag = (
     byCat:  TagByCategory,
     id:     number,
-): Tag | undefined => {
-  const walk = (nodes: Tag[]): Tag | undefined => {
+): TagWithSections | undefined => {
+  const walk = (nodes: TagWithSections[]): TagWithSections | undefined => {
     for (const t of nodes)
       {
 	if (t.id === id)
@@ -151,7 +151,7 @@ const DropSlot = ({ cat }: { cat: Category }) => {
 type Props = { post: Post; sp?: boolean }
 
 
-export default (({ post, sp }: Props) => {
+const TagDetailSidebar: FC<Props> = ({ post, sp }) => {
   sp = Boolean (sp)
 
   const qc = useQueryClient ()
@@ -167,7 +167,7 @@ export default (({ post, sp }: Props) => {
       }
 
     for (const cat of Object.keys (tagsTmp) as (keyof typeof tagsTmp)[])
-      tagsTmp[cat].sort ((tagA: Tag, tagB: Tag) => tagA.name < tagB.name ? -1 : 1)
+      tagsTmp[cat].sort ((tagA: TagWithSections, tagB: TagWithSections) => tagA.name < tagB.name ? -1 : 1)
 
     return tagsTmp
   }, [post])
@@ -376,4 +376,6 @@ export default (({ post, sp }: Props) => {
 	  </DragOverlay>
 	</DndContext>
       </SidebarComponent>)
-}) satisfies FC<Props>
+}
+
+export default TagDetailSidebar

frontend/src/components/TagLink.test.tsx

@@ -0,0 +1,45 @@
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import TagLink from '@/components/TagLink'
+import { buildTag } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+describe ('TagLink', () => {
+  it ('links tag names to post search and shows counts', () => {
+    renderWithProviders (
+        <TagLink tag={buildTag ({ name: '虹 夏', postCount: 4 })}/>,
+    )
+
+    expect (screen.getByRole ('link', { name: '虹 夏' })).toHaveAttribute (
+        'href',
+        '/posts?tags=%E8%99%B9+%E5%A4%8F',
+    )
+    expect (screen.getByText ('4')).toBeInTheDocument ()
+  })
+
+  it ('links wiki markers to the correct detail route', () => {
+    renderWithProviders (
+        <TagLink tag={buildTag ({ hasWiki: true, name: 'a/b' })}/>,
+    )
+
+    expect (screen.getByRole ('link', { name: '?' })).toHaveAttribute (
+        'href',
+        '/wiki/a%2Fb',
+    )
+  })
+
+  it ('renders aliases and non-link tags when requested', () => {
+    renderWithProviders (
+        <TagLink
+            tag={buildTag ({ matchedAlias: '別名', name: '正式名' })}
+            linkFlg={false}
+            withWiki={false}
+            withCount={false}/>,
+    )
+
+    expect (screen.getByText ('別名')).toBeInTheDocument ()
+    expect (screen.getByText ('正式名')).toBeInTheDocument ()
+    expect (screen.queryByRole ('link')).not.toBeInTheDocument ()
+  })
+})

frontend/src/components/TagLink.tsx

@@ -27,12 +27,12 @@ type Props =
     | PropsWithoutLink
 
 
-export default (({ tag,
+const TagLink: FC<Props> = ({ tag,
 		   nestLevel = 0,
 		   linkFlg   = true,
 		   withWiki  = true,
 		   withCount = true,
-		   ...props }: Props) => {
+		   ...props }) => {
   const spanClass = cn (
       `text-${ TAG_COLOUR[tag.category] }-${ LIGHT_COLOUR_SHADE }`,
       `dark:text-${ TAG_COLOUR[tag.category] }-${ DARK_COLOUR_SHADE }`)
@@ -126,4 +126,6 @@ export default (({ tag,
 	{withCount && (
 	    <span className="ml-1">{tag.postCount}</span>)}
       </>)
-}) satisfies FC<Props>
+}
+
+export default TagLink

frontend/src/components/TagSearch.tsx

@@ -12,7 +12,7 @@ import type { ChangeEvent, FC, KeyboardEvent } from 'react'
 import type { Tag } from '@/types'
 
 
-export default (() => {
+const TagSearch: FC = () => {
   const location = useLocation ()
   const navigate = useNavigate ()
 
@@ -115,4 +115,6 @@ export default (() => {
 		      activeIndex={activeIndex}
 		      onSelect={handleTagSelect}/>
       </div>)
-}) satisfies FC
+}
+
+export default TagSearch

frontend/src/components/TagSearchBox.test.tsx

@@ -0,0 +1,30 @@
+import { fireEvent, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import TagSearchBox from '@/components/TagSearchBox'
+import { buildTag } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+describe ('TagSearchBox', () => {
+  it ('renders suggestions and selects tags on mouse down', () => {
+    const handleSelect = vi.fn ()
+    const tag = buildTag ({ id: 9, name: '候補', postCount: 2 })
+
+    renderWithProviders (
+        <TagSearchBox suggestions={[tag]} activeIndex={0} onSelect={handleSelect}/>,
+    )
+
+    fireEvent.mouseDown (screen.getByText ('候補'))
+
+    expect (handleSelect).toHaveBeenCalledWith (tag)
+    expect (screen.getByText ('2')).toBeInTheDocument ()
+  })
+
+  it ('renders nothing when suggestions are empty', () => {
+    const { container } = renderWithProviders (
+        <TagSearchBox suggestions={[]} activeIndex={-1} onSelect={vi.fn ()}/>,
+    )
+
+    expect (container).toBeEmptyDOMElement ()
+  })
+})

frontend/src/components/TagSearchBox.tsx

@@ -10,7 +10,7 @@ type Props = { suggestions: Tag[]
 	       onSelect:    (tag: Tag) => void }
 
 
-export default (({ suggestions, activeIndex, onSelect }: Props) => {
+const TagSearchBox: FC<Props> = ({ suggestions, activeIndex, onSelect }) => {
   if (suggestions.length === 0)
     return
 
@@ -26,4 +26,6 @@ export default (({ suggestions, activeIndex, onSelect }: Props) => {
 	      <TagLink tag={tag} linkFlg={false} withWiki={false}/>
 	    </li>))}
       </ul>)
-}) satisfies FC<Props>
+}
+
+export default TagSearchBox

frontend/src/components/TagSidebar.tsx

@@ -19,7 +19,7 @@ type Props = { posts:     Post[]
 	       onClick?:  (event: MouseEvent<HTMLElement>) => void }
 
 
-export default (({ posts, onClick }: Props) => {
+const TagSidebar: FC<Props> = ({ posts, onClick }) => {
   const navigate = useNavigate ()
 
   const [tagsVsbl, setTagsVsbl] = useState (false)
@@ -126,4 +126,6 @@ export default (({ posts, onClick }: Props) => {
 	  {tagsVsbl ? '▲▲▲ タグ一覧を閉じる ▲▲▲' : '▼▼▼ タグ一覧を表示 ▼▼▼'}
 	</a>
       </SidebarComponent>)
-}) satisfies FC<Props>
+}
+
+export default TagSidebar

frontend/src/components/TopNav.tsx

@@ -26,7 +26,7 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
     pathName: string }): Menu => {
   const postCount = tag?.postCount ?? 0
 
-  const wikiPageFlg = Boolean (/^\/wiki\/(?!new|changes)[^\/]+/.test (pathName) && wikiId)
+  const wikiPageFlg = Boolean (/^\/wiki\/(?!new|changes)[^/]+/.test (pathName) && wikiId)
   const wikiTitle = pathName.split ('/')[2] ?? ''
 
   const tagFlg = /^\/tags\/\d+/.test (pathName)
@@ -36,12 +36,12 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
 	  { name: '一覧', to: '/posts' },
 	  { name: '検索', to: '/posts/search' },
 	  { name: '追加', to: '/posts/new' },
-	  { name: '履歴', to: '/posts/changes' },
+	  { name: '全体履歴', to: '/posts/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:広場' }] },
       { name: 'タグ', to: '/tags', subMenu: [
 	  { name: 'マスタ', to: '/tags' },
 	  { name: 'ニコニコ連携', to: '/tags/nico' },
-	  { name: '履歴', to: '/tags/changes' },
+	  { name: '全体履歴', to: '/tags/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:タグ' },
 	  { component: <Separator/>, visible: tagFlg },
 	  { name: `広場 (${ postCount || 0 })`,
@@ -53,7 +53,7 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
 	  { name: '一覧', to: '/materials' },
 	  { name: '検索', to: '/materials/search', visible: false }, 
 	  { name: '追加', to: '/materials/new' },
-	  { name: '履歴', to: '/materials/changes', visible: false },
+	  { name: '全体履歴', to: '/materials/changes', visible: false },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:素材集' }] },
       { name: '上映会', to: '/theatres/1', base: '/theatres', subMenu: [
 	  { name: <>第&thinsp;1&thinsp;会場</>, to: '/theatres/1' },
@@ -80,7 +80,7 @@ export const menuOutline = ({ tag, wikiId, user, pathName }: {
 }
 
 
-export default (({ user }: Props) => {
+const TopNav: FC<Props> = ({ user }) => {
   const location = useLocation ()
 
   const dirRef = useRef<(-1) | 1> (1)
@@ -159,12 +159,12 @@ export default (({ user }: Props) => {
   useEffect (() => {
     const unsubscribe = WikiIdBus.subscribe (setWikiId)
     return () => unsubscribe ()
-  }, [activeIdx])
+  }, [])
 
   useEffect (() => {
     setMenuOpen (false)
     setOpenItemIdx (activeIdx)
-  }, [location])
+  }, [activeIdx, location])
 
   return (
       <>
@@ -433,4 +433,6 @@ export default (({ user }: Props) => {
 	      </motion.div>)}
 	</AnimatePresence>
       </>)
-}) satisfies FC<Props>
+}
+
+export default TopNav

frontend/src/components/TopNavUser.test.tsx

@@ -0,0 +1,29 @@
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import TopNavUser from '@/components/TopNavUser'
+import { buildUser } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+describe ('TopNavUser', () => {
+  it ('renders nothing without a user', () => {
+    const { container } = renderWithProviders (<TopNavUser user={null}/>)
+
+    expect (container).toBeEmptyDOMElement ()
+  })
+
+  it ('links named users to settings', () => {
+    renderWithProviders (<TopNavUser user={buildUser ({ name: '山田' })}/>)
+
+    expect (screen.getByRole ('link', { name: '山田' })).toHaveAttribute (
+        'href',
+        '/users/settings',
+    )
+  })
+
+  it ('uses the anonymous display name', () => {
+    renderWithProviders (<TopNavUser user={buildUser ({ name: null })}/>)
+
+    expect (screen.getByRole ('link', { name: '名もなきニジラー' })).toBeInTheDocument ()
+  })
+})

frontend/src/components/TopNavUser.tsx

@@ -10,7 +10,7 @@ type Props = { user:  User | null,
 	       sp?:   boolean }
 
 
-export default (({ user, sp }: Props) => {
+const TopNavUser: FC<Props> = ({ user, sp }) => {
   if (!(user))
     return
 
@@ -28,4 +28,6 @@ export default (({ user, sp }: Props) => {
 	  {user.name || '名もなきニジラー'}
 	</PrefetchLink>
       </>)
-}) satisfies FC<Props>
+}
+
+export default TopNavUser

frontend/src/components/TwitterEmbed.test.tsx

@@ -0,0 +1,19 @@
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import TwitterEmbed from '@/components/TwitterEmbed'
+
+describe ('TwitterEmbed', () => {
+  it ('renders tweet and user links', () => {
+    render (<TwitterEmbed userId="user_name" statusId="12345"/>)
+
+    expect (screen.getByRole ('link', { name: '@user_name' })).toHaveAttribute (
+        'href',
+        'https://twitter.com/user_name?ref_src=twsrc%3Etfw',
+    )
+    expect (screen.getByRole ('link', { name: /\d/ })).toHaveAttribute (
+        'href',
+        'https://twitter.com/user_name/status/12345?ref_src=twsrc%5Etfw',
+    )
+  })
+})

frontend/src/components/TwitterEmbed.tsx

@@ -5,7 +5,7 @@ type Props = {
     statusId: string }
 
 
-export default (({ userId, statusId }: Props) => {
+const TwitterEmbed: FC<Props> = ({ userId, statusId }) => {
   const now = (new Date).toLocaleDateString ()
 
   return (
@@ -18,4 +18,6 @@ export default (({ userId, statusId }: Props) => {
 	</blockquote>
 	<script async src="https://platform.twitter.com/widgets.js" charSet="utf-8"/>
       </div>)
-}) satisfies FC<Props>
+}
+
+export default TwitterEmbed

frontend/src/components/WikiBody.tsx

@@ -25,7 +25,7 @@ const mdComponents = { a: (({ href, children }) => (
 				  </a>))) } as const satisfies Components
 
 
-export default (({ title, body }: Props) => {
+const WikiBody: FC<Props> = ({ title, body }) => {
   const { data } = useQuery ({
       enabled: Boolean (body),
       queryKey: wikiKeys.index ({ }),
@@ -39,4 +39,6 @@ export default (({ title, body }: Props) => {
       <ReactMarkdown components={mdComponents} remarkPlugins={remarkPlugins}>
 	{body || `このページは存在しません。[新規作成してください](/wiki/new?title=${ encodeURIComponent (title) })。`}
       </ReactMarkdown>)
-}) satisfies FC<Props>
+}
+
+export default WikiBody

frontend/src/components/common/DateTimeField.test.tsx

@@ -0,0 +1,27 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import DateTimeField from '@/components/common/DateTimeField'
+
+describe ('DateTimeField', () => {
+  it ('renders an ISO value as a datetime-local value', () => {
+    render (<DateTimeField aria-label="日時" value="2026-01-02T03:04:05.000Z"/>)
+
+    const input = screen.getByLabelText ('日時')
+
+    expect (input).toHaveValue ('2026-01-02T12:04')
+  })
+
+  it ('reports local changes as ISO strings and empty values as null', () => {
+    const handleChange = vi.fn ()
+    render (<DateTimeField aria-label="日時" onChange={handleChange}/>)
+
+    const input = screen.getByLabelText ('日時')
+    fireEvent.change (input, { target: { value: '2026-01-02T03:04' } })
+    fireEvent.change (input, { target: { value: '' } })
+
+    const first = handleChange.mock.calls[0]?.[0]
+    expect (new Date (first).getFullYear ()).toBe (2026)
+    expect (handleChange).toHaveBeenLastCalledWith (null)
+  })
+})

frontend/src/components/common/DateTimeField.tsx

@@ -2,7 +2,7 @@ import { useEffect, useState } from 'react'
 
 import { cn } from '@/lib/utils'
 
-import type { FC, FocusEvent } from 'react'
+import type { ComponentPropsWithoutRef, FC, FocusEvent } from 'react'
 
 
 const pad = (n: number): string => n.toString ().padStart (2, '0')
@@ -18,14 +18,14 @@ const toDateTimeLocalValue = (d: Date) => {
 }
 
 
-type Props = {
+type Props = Omit<ComponentPropsWithoutRef<'input'>, 'onChange'> & {
     value?:     string
     onChange?:  (isoUTC: string | null) => void
     className?: string
     onBlur?:    (ev: FocusEvent<HTMLInputElement>) => void }
 
 
-export default (({ value, onChange, className, onBlur }: Props) => {
+const DateTimeField: FC<Props> = ({ value, onChange, className, onBlur, ...rest }) => {
   const [local, setLocal] = useState ('')
 
   useEffect (() => {
@@ -34,6 +34,7 @@ export default (({ value, onChange, className, onBlur }: Props) => {
 
   return (
       <input
+	  {...rest}
 	  className={cn ('border rounded p-2', className)}
 	  type="datetime-local"
 	  value={local}
@@ -43,4 +44,6 @@ export default (({ value, onChange, className, onBlur }: Props) => {
 	    onChange?.(v ? (new Date (v)).toISOString () : null)
 	  }}
 	  onBlur={onBlur}/>)
-}) satisfies FC<Props>
+}
+
+export default DateTimeField

frontend/src/components/common/Form.tsx

@@ -3,7 +3,9 @@ import type { FC, ReactNode } from 'react'
 type Props = { children: ReactNode }
 
 
-export default (({ children }: Props) => (
+const Form: FC<Props> = ({ children }) => (
     <div className="max-w-xl mx-auto p-4 space-y-4">
       {children}
-    </div>)) satisfies FC<Props>
+    </div>)
+
+export default Form

frontend/src/components/common/Label.test.tsx

@@ -0,0 +1,26 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import Label from '@/components/common/Label'
+
+describe ('Label', () => {
+  it ('renders a plain label', () => {
+    render (<Label>名前</Label>)
+
+    expect (screen.getByText ('名前')).toBeInTheDocument ()
+  })
+
+  it ('renders and toggles the optional checkbox', () => {
+    const handleChange = vi.fn ()
+
+    render (
+        <Label checkBox={{ label: '不明', checked: false, onChange: handleChange }}>
+          日時
+        </Label>,
+    )
+
+    fireEvent.click (screen.getByRole ('checkbox', { name: '不明' }))
+
+    expect (handleChange).toHaveBeenCalledTimes (1)
+  })
+})

frontend/src/components/common/Label.tsx

@@ -1,12 +1,14 @@
 import React from 'react'
 
+import type { FC } from 'react'
+
 type Props = { children:  React.ReactNode
                checkBox?: { label:    string
                             checked:  boolean
                             onChange: (event: React.ChangeEvent<HTMLInputElement>) => void } }
 
 
-export default ({ children, checkBox }: Props) => {
+const Label: FC<Props> = ({ children, checkBox }) => {
   if (!(checkBox))
     {
       return (
@@ -26,3 +28,5 @@ export default ({ children, checkBox }: Props) => {
         </label>
       </div>)
 }
+
+export default Label

frontend/src/components/common/PageTitle.test.tsx

@@ -0,0 +1,15 @@
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import PageTitle from '@/components/common/PageTitle'
+
+
+describe ('PageTitle', () => {
+  it ('renders children as a level 1 heading', () => {
+    render (<PageTitle>Test title</PageTitle>)
+
+    const heading = screen.getByRole ('heading', { level: 1 })
+
+    expect (heading.textContent).toBe ('Test title')
+  })
+})

frontend/src/components/common/PageTitle.tsx

@@ -1,9 +1,13 @@
 import React from 'react'
 
+import type { FC } from 'react'
+
 type Props = { children: React.ReactNode }
 
 
-export default ({ children }: Props) => (
+const PageTitle: FC<Props> = ({ children }) => (
     <h1 className="text-2xl font-bold mb-2">
       {children}
     </h1>)
+
+export default PageTitle

frontend/src/components/common/Pagination.test.tsx

@@ -0,0 +1,38 @@
+import { screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import Pagination from '@/components/common/Pagination'
+import { renderWithProviders } from '@/test/render'
+
+describe ('Pagination', () => {
+  it ('builds page links while preserving existing query parameters', () => {
+    renderWithProviders (
+        <Pagination page={3} totalPages={5} siblingCount={1}/>,
+        { route: '/posts?tags=abc&page=3' },
+    )
+
+    expect (screen.getByLabelText ('前のページ')).toHaveAttribute (
+        'href',
+        '/posts?tags=abc&page=2',
+    )
+    expect (screen.getByLabelText ('次のページ')).toHaveAttribute (
+        'href',
+        '/posts?tags=abc&page=4',
+    )
+    expect (screen.getByText ('3')).toHaveAttribute ('aria-current', 'page')
+  })
+
+  it ('does not render active previous and next controls at the edges', () => {
+    const { rerender } = renderWithProviders (
+        <Pagination page={1} totalPages={1}/>,
+        { route: '/tags' },
+    )
+
+    expect (screen.queryByLabelText ('前のページ')).not.toBeInTheDocument ()
+    expect (screen.queryByLabelText ('次のページ')).not.toBeInTheDocument ()
+
+    rerender (<Pagination page={1} totalPages={2}/>)
+
+    expect (screen.getByLabelText ('次のページ')).toHaveAttribute ('href', '/tags?page=2')
+  })
+})

frontend/src/components/common/Pagination.tsx

@@ -48,7 +48,7 @@ const getPages = (
 }
 
 
-export default (({ page, totalPages, siblingCount = 3 }) => {
+const Pagination: FC<Props> = ({ page, totalPages, siblingCount = 3 }) => {
   const location = useLocation ()
 
   const buildTo = (p: number) => {
@@ -124,4 +124,6 @@ export default (({ page, totalPages, siblingCount = 3 }) => {
 	      </>)}
 	</div>
       </nav>)
-}) satisfies FC<Props>
+}
+
+export default Pagination

frontend/src/components/common/SectionTitle.tsx

@@ -5,7 +5,9 @@ import type { ComponentPropsWithoutRef, FC } from 'react'
 type Props = ComponentPropsWithoutRef<'h2'>
 
 
-export default (({ children, className, ...rest }: Props) => (
+const SectionTitle: FC<Props> = ({ children, className, ...rest }) => (
     <h2 {...rest} className={cn ('text-xl my-4', className)}>
       {children}
-    </h2>)) satisfies FC<Props>
+    </h2>)
+
+export default SectionTitle

frontend/src/components/common/SubsectionTitle.tsx

@@ -1,9 +1,13 @@
 import React from 'react'
 
+import type { FC } from 'react'
+
 type Props = { children: React.ReactNode }
 
 
-export default ({ children }: Props) => (
+const SubsectionTitle: FC<Props> = ({ children }) => (
     <h3 className="my-2">
       {children}
     </h3>)
+
+export default SubsectionTitle

frontend/src/components/common/TabGroup.test.tsx

@@ -0,0 +1,23 @@
+import { fireEvent, render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import TabGroup, { Tab } from '@/components/common/TabGroup'
+
+describe ('TabGroup', () => {
+  it ('uses the init tab and switches tabs when clicked', () => {
+    render (
+        <TabGroup>
+          <Tab name="A">Alpha</Tab>
+          <Tab name="B" init>Beta</Tab>
+        </TabGroup>,
+    )
+
+    expect (screen.queryByText ('Alpha')).not.toBeInTheDocument ()
+    expect (screen.getByText ('Beta')).toBeInTheDocument ()
+
+    fireEvent.click (screen.getByText ('A'))
+
+    expect (screen.getByText ('Alpha')).toBeInTheDocument ()
+    expect (screen.queryByText ('Beta')).not.toBeInTheDocument ()
+  })
+})

frontend/src/components/common/TabGroup.tsx

@@ -1,3 +1,5 @@
+import type { FC } from 'react'
+
 import React, { useState } from 'react'
 import { cn } from '@/lib/utils'
 
@@ -10,7 +12,7 @@ type Props = { children: React.ReactNode }
 export const Tab = ({ children }: TabProps) => <>{children}</>
 
 
-export default ({ children }: Props) => {
+const TabGroup: FC<Props> = ({ children }) => {
   const tabs = React.Children.toArray (children) as React.ReactElement<TabProps>[]
 
   const [current, setCurrent] = useState<number> (() => {
@@ -37,3 +39,5 @@ export default ({ children }: Props) => {
 	</div>
       </div>)
 }
+
+export default TabGroup

frontend/src/components/common/TagInput.test.tsx

@@ -0,0 +1,44 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import TagInput from '@/components/common/TagInput'
+import { buildTag } from '@/test/factories'
+
+const api = vi.hoisted (() => ({
+  apiGet: vi.fn (),
+}))
+
+vi.mock ('@/lib/api', () => api)
+
+describe ('TagInput', () => {
+  beforeEach (() => {
+    vi.clearAllMocks ()
+  })
+
+  it ('updates value and fetches autocomplete for the last token', async () => {
+    const setValue = vi.fn ()
+    api.apiGet.mockResolvedValueOnce ([buildTag ({ name: '虹夏', postCount: 2 })])
+
+    render (<TagInput value="ぼっち 虹" setValue={setValue}/>)
+
+    fireEvent.change (screen.getByRole ('textbox'), { target: { value: 'ぼっち 虹夏' } })
+
+    await waitFor (() => {
+      expect (api.apiGet).toHaveBeenCalledWith (
+          '/tags/autocomplete',
+          { params: { q: '虹夏' } },
+      )
+    })
+    expect (setValue).toHaveBeenCalledWith ('ぼっち 虹夏')
+  })
+
+  it ('does not fetch when the last token is blank', () => {
+    const setValue = vi.fn ()
+    render (<TagInput value="" setValue={setValue}/>)
+
+    fireEvent.change (screen.getByRole ('textbox'), { target: { value: ' ' } })
+
+    expect (api.apiGet).not.toHaveBeenCalled ()
+    expect (setValue).toHaveBeenCalledWith (' ')
+  })
+})

frontend/src/components/common/TagInput.tsx

@@ -12,7 +12,7 @@ type Props = {
     value:      string
     setValue:   (value: string) => void }
 
-export default (({ value, setValue }: Props) => {
+const TagInput: FC<Props> = ({ value, setValue }) => {
   const [activeIndex, setActiveIndex] = useState (-1)
   const [suggestions, setSuggestions] = useState<Tag[]> ([])
   const [suggestionsVsbl, setSuggestionsVsbl] = useState (false)
@@ -62,9 +62,12 @@ export default (({ value, setValue }: Props) => {
     case 'Enter':
       if (activeIndex < 0)
 	break
+      {
 	ev.preventDefault ()
 	const selected = suggestions[activeIndex]
-      selected && handleTagSelect (selected)
+	if (selected)
+	  handleTagSelect (selected)
+      }
       break
 
     case 'Escape':
@@ -94,4 +97,6 @@ export default (({ value, setValue }: Props) => {
 	    activeIndex={activeIndex}
 	    onSelect={handleTagSelect}/>
       </div>)
-}) satisfies FC<Props>
+}
+
+export default TagInput

frontend/src/components/common/TypographyAndForm.test.tsx

@@ -0,0 +1,37 @@
+import { createRef } from 'react'
+import { render, screen } from '@testing-library/react'
+import { describe, expect, it } from 'vitest'
+
+import Form from '@/components/common/Form'
+import SectionTitle from '@/components/common/SectionTitle'
+import SubsectionTitle from '@/components/common/SubsectionTitle'
+import TextArea from '@/components/common/TextArea'
+
+describe ('common typography and form components', () => {
+  it ('renders Form children inside the standard container', () => {
+    render (<Form><span>Content</span></Form>)
+
+    expect (screen.getByText ('Content')).toBeInTheDocument ()
+  })
+
+  it ('renders SectionTitle as an h2', () => {
+    render (<SectionTitle>Section</SectionTitle>)
+
+    expect (screen.getByRole ('heading', { level: 2, name: 'Section' })).toBeInTheDocument ()
+  })
+
+  it ('renders SubsectionTitle as an h3', () => {
+    render (<SubsectionTitle>Subsection</SubsectionTitle>)
+
+    expect (screen.getByRole ('heading', { level: 3, name: 'Subsection' })).toBeInTheDocument ()
+  })
+
+  it ('forwards refs and props to TextArea', () => {
+    const ref = createRef<HTMLTextAreaElement> ()
+
+    render (<TextArea ref={ref} aria-label="Body" defaultValue="text"/>)
+
+    expect (ref.current).toBe (screen.getByLabelText ('Body'))
+    expect (screen.getByLabelText ('Body')).toHaveValue ('text')
+  })
+})

frontend/src/components/dialogues/DialogueProvider.tsx

@@ -0,0 +1,189 @@
+import { createContext, useCallback, useContext, useMemo, useState } from 'react'
+
+import { Button } from '@/components/ui/button'
+import { Dialog,
+	 DialogContent,
+	 DialogDescription,
+	 DialogFooter,
+	 DialogHeader,
+	 DialogTitle } from '@/components/ui/dialog'
+
+import type { FC, ReactNode } from 'react'
+
+type DialogueVariant = 'default' | 'danger'
+
+type ConfirmOptions = { title:        string
+			description?: ReactNode
+			confirmText?: string
+			cancelText?:  string
+			variant?:     DialogueVariant }
+
+type AlertOptions = { title:        string
+		      description?: ReactNode
+		      okText?:      string }
+
+type Choice<T extends string> = { value:    T
+				  label:    string
+				  variant?: DialogueVariant }
+
+type ChoiceOptions<T extends string> = { title:         string
+					 description?:  ReactNode
+					 choices:       Choice<T>[]
+					 cancelText?:   string }
+
+type DialogueRequest =
+    | { id:       number
+	kind:     'confirm'
+	options:  ConfirmOptions
+	resolve:  (value: boolean) => void }
+    | { id:       number
+	kind:     'alert'
+	options:  AlertOptions
+	resolve:  () => void }
+    | { id:       number
+	kind:     'choice'
+	options:  ChoiceOptions<string>
+	resolve:  (value: string | null) => void }
+
+type DialogueAPI =
+    { confirm:  (options: ConfirmOptions) => Promise<boolean>
+      alert:    (options: AlertOptions) => Promise<void>
+      choice:   <T extends string> (options: ChoiceOptions<T>) => Promise<T | null> }
+
+const DialogueContext = createContext<DialogueAPI | null> (null)
+
+let nextDialogueId = 1
+
+type Props = { children: ReactNode }
+
+
+const DialogueProvider: FC<Props> = ({ children }) => {
+  const [queue, setQueue] = useState<DialogueRequest[]> ([])
+
+  const push = useCallback ((request: Omit<DialogueRequest, 'id'>) => {
+    const id = nextDialogueId
+    ++nextDialogueId
+
+    setQueue (q => [...q, { ...request, id } as DialogueRequest])
+  }, [])
+
+  const closeActive = useCallback ((result?: unknown) => {
+    setQueue (q => {
+      const [active, ...rest] = q
+
+      if (!(active))
+	return rest
+
+      switch (active.kind)
+      {
+      case 'confirm':
+	active.resolve (Boolean (result))
+	break
+
+      case 'alert':
+	active.resolve ()
+	break
+
+      case 'choice':
+	active.resolve ((result ?? null) as string | null)
+	break
+      }
+
+      return rest
+    })
+  }, [])
+
+  const api = useMemo<DialogueAPI> (() => ({
+      confirm: options => new Promise<boolean> (resolve => {
+	push ({ kind: 'confirm', options, resolve })
+      }),
+      alert: options => new Promise<void> (resolve => {
+	push ({ kind: 'alert', options, resolve })
+      }),
+      choice: options => new Promise (resolve => {
+	push ({ kind: 'choice',
+		options: options as ChoiceOptions<string>,
+		resolve: resolve as (value: string | null) => void })
+      }) }), [push])
+
+  const active = queue[0]
+
+  return (
+      <DialogueContext.Provider value={api}>
+	{children}
+
+	<Dialog
+	    open={Boolean (active)}
+	    onOpenChange={open => {
+	      if (!(open))
+		closeActive (active?.kind !== 'confirm' && null)
+	    }}>
+	  {active && (
+	      <DialogContent className="px-6 pb-6 pt-7">
+		<DialogHeader className="pl-8">
+		  <DialogTitle>{active.options.title}</DialogTitle>
+
+		  {active.options.description && (
+		      <DialogDescription asChild>
+			<div>{active.options.description}</div>
+		      </DialogDescription>)}
+		</DialogHeader>
+
+		<DialogFooter>
+		  {active.kind === 'confirm' && (
+		      <>
+			<Button
+			    variant="outline"
+			    onClick={() => closeActive (false)}>
+			  {active.options.cancelText ?? '取消'}
+			</Button>
+
+			<Button
+			    variant={(active.options.variant === 'danger')
+				     ? 'destructive'
+				     : 'default'}
+			    onClick={() => closeActive (true)}>
+			  {active.options.confirmText ?? '確定'}
+			</Button>
+		      </>)}
+
+		  {active.kind === 'alert' && (
+		      <Button onClick={() => closeActive ()}>
+			{active.options.okText ?? '確定'}
+		      </Button>)}
+
+		  {active.kind === 'choice' && (
+		      <>
+			<Button
+			    variant="outline"
+			    onClick={() => closeActive (null)}>
+			  {active.options.cancelText ?? '取消'}
+			</Button>
+
+			{active.options.choices.map (choice => (
+			    <Button
+				key={choice.value}
+				variant={(choice.variant === 'danger')
+					 ? 'destructive'
+					 : 'default'}
+				onClick={() => closeActive (choice.value)}>
+			      {choice.label}
+			    </Button>))}
+		      </>)}
+		</DialogFooter>
+	      </DialogContent>)}
+	</Dialog>
+      </DialogueContext.Provider>)
+}
+
+
+export const useDialogue = () => {
+  const dialogue = useContext (DialogueContext)
+
+  if (!(dialogue))
+    throw new Error ('useDialogue must be used inside DialogueProvider')
+
+  return dialogue
+}
+
+export default DialogueProvider

frontend/src/components/layout/MainArea.tsx

@@ -9,10 +9,12 @@ type Props = {
     className?: string }
 
 
-export default (({ children, className }: Props) => (
+const MainArea: FC<Props> = ({ children, className }) => (
     <motion.main
 	transition={{ layout: { duration: .2, ease: 'easeOut' } }}
 	className={cn ('flex-1 overflow-y-auto p-4', className)}
 	layout="position">
       {children}
-    </motion.main>)) satisfies FC<Props>
+    </motion.main>)
+
+export default MainArea

frontend/src/components/layout/SidebarComponent.tsx

@@ -6,7 +6,7 @@ import type { FC, ReactNode } from 'react'
 type Props = { children: ReactNode }
 
 
-export default (({ children }: Props) => (
+const SidebarComponent: FC<Props> = ({ children }) => (
     <motion.div
 	layout="position"
 	transition={{ layout: { duration: .2, ease: 'easeOut' } }}
@@ -27,4 +27,6 @@ export default (({ children }: Props) => (
       </Helmet>
 
       {children}
-    </motion.div>)) satisfies FC<Props>
+    </motion.div>)
+
+export default SidebarComponent

frontend/src/components/ui/button.tsx

@@ -5,33 +5,46 @@ import { cva, type VariantProps } from "class-variance-authority"
 import { cn } from "@/lib/utils"
 
 const buttonVariants = cva (
-  "inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-md text-sm font-medium ring-offset-background transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0",
+  [
+    'inline-flex items-center justify-center gap-2 whitespace-nowrap',
+    'rounded-md text-sm font-medium transition-colors',
+    'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-slate-400',
+    'disabled:pointer-events-none disabled:opacity-50',
+    '[&_svg]:pointer-events-none [&_svg]:size-4 [&_svg]:shrink-0',
+  ].join (' '),
   {
     variants: {
       variant: {
-        default: "bg-primary text-primary-foreground hover:bg-primary/90",
+        default:
+          'bg-slate-900 text-white hover:bg-slate-700 dark:bg-slate-100 dark:text-slate-900 dark:hover:bg-slate-300',
+
         destructive:
-          "bg-destructive text-destructive-foreground hover:bg-destructive/90",
+          'bg-red-600 text-white hover:bg-red-700 dark:bg-red-700 dark:hover:bg-red-600',
+
         outline:
-          "border border-input bg-background hover:bg-accent hover:text-accent-foreground",
+          'border border-slate-300 bg-white text-slate-900 hover:bg-slate-100 dark:border-slate-700 dark:bg-slate-900 dark:text-slate-100 dark:hover:bg-slate-800',
+
         secondary:
-          "bg-secondary text-secondary-foreground hover:bg-secondary/80",
-        ghost: "hover:bg-accent hover:text-accent-foreground",
-        link: "text-primary underline-offset-4 hover:underline",
+          'bg-slate-100 text-slate-900 hover:bg-slate-200 dark:bg-slate-800 dark:text-slate-100 dark:hover:bg-slate-700',
+
+        ghost:
+          'text-slate-900 hover:bg-slate-100 dark:text-slate-100 dark:hover:bg-slate-800',
+
+        link:
+          'text-blue-700 underline-offset-4 hover:underline dark:text-blue-300',
       },
       size: {
-        default: "h-10 px-4 py-2",
-        sm: "h-9 rounded-md px-3",
-        lg: "h-11 rounded-md px-8",
-        icon: "h-10 w-10",
+        default: 'h-10 px-4 py-2',
+        sm:      'h-9 rounded-md px-3',
+        lg:      'h-11 rounded-md px-8',
+        icon:    'h-10 w-10',
       },
     },
     defaultVariants: {
-      variant: "default",
-      size: "default",
+      variant: 'default',
+      size:    'default',
     },
-  }
-)
+  })
 
 export interface ButtonProps
   extends React.ButtonHTMLAttributes<HTMLButtonElement>,

frontend/src/components/ui/dialog.tsx

@@ -38,24 +38,28 @@ const DialogContent = React.forwardRef<
     <DialogPrimitive.Content
       ref={ref}
       className={cn (
-	  'fixed left-[50%] top-[50%] z-50 w-[90%] grid max-w-lg',
+	  'fixed left-[50%] top-[50%] z-50 grid w-[calc(100%-2rem)] max-w-lg',
 	  'translate-x-[-50%] translate-y-[-50%]',
-	  'gap-4 border bg-gray-300/80 dark:bg-gray-700/80',
-	  'p-6 shadow-lg duration-200',
+	  'gap-5 rounded-2xl border border-border',
+	  'bg-background p-6 text-foreground shadow-2xl',
+	  'duration-200',
 	  'data-[state=open]:animate-in data-[state=closed]:animate-out',
 	  'data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0',
 	  'data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95',
-	  'data-[state=closed]:slide-out-to-left-1/2',
-	  'data-[state=closed]:slide-out-to-top-[48%]',
-	  'data-[state=open]:slide-in-from-left-1/2',
-	  'data-[state=open]:slide-in-from-top-[48%] rounded-lg',
 	  className)}
       {...props}
     >
       {children}
-      <DialogPrimitive.Close className="absolute right-4 top-4 bg-red-500 rounded-sm opacity-70 ring-offset-background transition-opacity hover:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 disabled:pointer-events-none data-[state=open]:bg-accent data-[state=open]:text-muted-foreground">
-        <X className="h-3 w-3" />
-        <span className="sr-only">Close</span>
+
+      <DialogPrimitive.Close
+	  className={cn (
+	      'absolute left-4 top-4 rounded-full p-1',
+	      'text-slate-500 transition-colors',
+	      'hover:bg-slate-200 hover:text-slate-900',
+	      'dark:text-slate-400 dark:hover:bg-slate-700 dark:hover:text-slate-50',
+	      'focus:outline-none focus:ring-2 focus:ring-slate-400')}>
+	<X className="h-4 w-4"/>
+	<span className="sr-only">閉ぢる</span>
       </DialogPrimitive.Close>
     </DialogPrimitive.Content>
   </DialogPortal>

frontend/src/components/ui/use-toast.tsx

@@ -18,13 +18,6 @@ type ToasterToast = ToastProps & {
   action?: ToastActionElement
 }
 
-const actionTypes = {
-  ADD_TOAST: "ADD_TOAST",
-  UPDATE_TOAST: "UPDATE_TOAST",
-  DISMISS_TOAST: "DISMISS_TOAST",
-  REMOVE_TOAST: "REMOVE_TOAST",
-} as const
-
 let count = 0
 
 function genId() {
@@ -32,23 +25,21 @@ function genId() {
   return count.toString()
 }
 
-type ActionType = typeof actionTypes
-
 type Action =
   | {
-      type: ActionType["ADD_TOAST"]
+      type: "ADD_TOAST"
       toast: ToasterToast
     }
   | {
-      type: ActionType["UPDATE_TOAST"]
+      type: "UPDATE_TOAST"
       toast: Partial<ToasterToast>
     }
   | {
-      type: ActionType["DISMISS_TOAST"]
+      type: "DISMISS_TOAST"
       toastId?: ToasterToast["id"]
     }
   | {
-      type: ActionType["REMOVE_TOAST"]
+      type: "REMOVE_TOAST"
       toastId?: ToasterToast["id"]
     }
 

frontend/src/components/users/InheritDialogue.tsx

@@ -1,8 +1,13 @@
+import type { FC } from 'react'
+
 import { useState } from 'react'
 
+import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { Dialog,
 	 DialogContent,
+	 DialogDescription,
+	 DialogHeader,
 	 DialogTitle } from '@/components/ui/dialog'
 import { Input } from '@/components/ui/input'
 import { toast } from '@/components/ui/use-toast'
@@ -15,11 +20,17 @@ type Props = { visible:         boolean
 	       setUser:         (user: User) => void }
 
 
-export default ({ visible, onVisibleChange, setUser }: Props) => {
+const InheritDialogue: FC<Props> = ({ visible, onVisibleChange, setUser }) => {
+  const dialogue = useDialogue ()
+
   const [inputCode, setInputCode] = useState ('')
 
   const handleTransfer = async () => {
-    if (!(confirm ('引継ぎを行ってもよろしいですか?\n現在のアカウントからはログアウトされます．')))
+    if (!(await dialogue.confirm ({
+	title: '引継ぎを行ってもよろしいですか?',
+	description: '現在のアカウントからはログアウトされます．',
+	confirmText: '引継ぐ',
+	variant: 'danger' })))
       return
 
     try
@@ -44,14 +55,20 @@ export default ({ visible, onVisibleChange, setUser }: Props) => {
 
   return (
       <Dialog open={visible} onOpenChange={onVisibleChange}>
-	<DialogContent>
+	<DialogContent className="px-6 pp-6 pt-7">
+	  <DialogHeader className="pl-8">
 	    <DialogTitle>ほかのブラウザから引継ぐ</DialogTitle>
+	    <DialogDescription asChild>
 	      <div className="flex gap-2">
 		<Input placeholder="引継ぎコードを入力"
 		       value={inputCode}
 		       onChange={ev => setInputCode (ev.target.value)}/>
 		<Button onClick={handleTransfer}>引継ぐ</Button>
 	      </div>
+	    </DialogDescription>
+	  </DialogHeader>
 	</DialogContent>
       </Dialog>)
 }
+
+export default InheritDialogue

frontend/src/components/users/UserCodeDialogue.tsx

@@ -1,6 +1,12 @@
+import type { FC } from 'react'
+
+import { useDialogue } from '@/components/dialogues/DialogueProvider'
 import { Button } from '@/components/ui/button'
 import { Dialog,
 	 DialogContent,
+	 DialogDescription,
+	 DialogFooter,
+	 DialogHeader,
 	 DialogTitle } from '@/components/ui/dialog'
 import { toast } from '@/components/ui/use-toast'
 import { apiPost } from '@/lib/api'
@@ -13,12 +19,21 @@ type Props = { visible:         boolean
 	       setUser:         React.Dispatch<React.SetStateAction<User | null>> }
 
 
-export default ({ visible, onVisibleChange, user, setUser }: Props) => {
+const UserCodeDialogue: FC<Props> = ({ visible, onVisibleChange, user, setUser }) => {
+  const dialogue = useDialogue ()
+
   const handleChange = async () => {
     if (!(user))
       return
 
-    if (!(confirm ('引継ぎコードを再発行しますか?\n再発行するとほかのブラウザからはログアウトされます．')))
+    if (!(await dialogue.confirm ({
+	title: '引継ぎコードを再発行しますか?',
+	description: (
+	    <div>
+	      <p>再発行するとほかのブラウザからはログアウトされます．</p>
+	    </div>),
+	confirmText: '再発行',
+	variant: 'danger' })))
       return
 
     const data = await apiPost<{ code: string }> ('/users/code/renew', { },
@@ -33,21 +48,28 @@ export default ({ visible, onVisibleChange, user, setUser }: Props) => {
 
   return (
       <Dialog open={visible} onOpenChange={onVisibleChange}>
-	<DialogContent>
+	<DialogContent className="px-6 pb-6 pt-7">
+	  <DialogHeader className="pl-8">
 	    <DialogTitle>引継ぎコード</DialogTitle>
+
+	    <DialogDescription asChild>
 	      <div>
 		<p>あなたの引継ぎコードはこちらです：</p>
 		<div className="m-2">{user?.inheritanceCode}</div>
-	    <p className="mt-1 text-sm text-red-500">
+		<p className="mt-1 text-sm text-destructive">
 		  このコードはほかの人には教えないでください!
 		</p>
-	    <div className="my-4">
-	      <Button onClick={handleChange}
-		      className="px-4 py-2 bg-red-600 text-white rounded disabled:bg-gray-400">
+	      </div>
+	    </DialogDescription>
+	  </DialogHeader>
+
+	  <DialogFooter>
+	    <Button onClick={handleChange} variant="destructive">
 	      引継ぎコード再発行
 	    </Button>
-	    </div>
-	  </div>
+	  </DialogFooter>
 	</DialogContent>
       </Dialog>)
 }
+
+export default UserCodeDialogue

frontend/src/index.css

@@ -6,6 +6,56 @@
 
 @layer base
 {
+  :root
+  {
+    --background: 0 0% 100%;
+    --foreground: 222.2 84% 4.9%;
+
+    --primary: 222.2 47.4% 11.2%;
+    --primary-foreground: 210 40% 98%;
+
+    --secondary: 210 40% 96.1%;
+    --secondary-foreground: 222.2 47.4% 11.2%;
+
+    --destructive: 0 72.2% 50.6%;
+    --destructive-foreground: 210 40% 98%;
+
+    --muted: 210 40% 96.1%;
+    --muted-foreground: 215.4 16.3% 46.9%;
+
+    --accent: 210 40% 96.1%;
+    --accent-foreground: 222.2 47.4% 11.2%;
+
+    --border: 214.3 31.8% 91.4%;
+    --input: 214.3 31.8% 91.4%;
+    --ring: 222.2 84% 4.9%;
+  }
+
+  .dark
+  {
+    --background: 222.2 84% 4.9%;
+    --foreground: 210 40% 98%;
+
+    --primary: 210 40% 98%;
+    --primary-foreground: 222.2 47.4% 11.2%;
+
+    --secondary: 217.2 32.6% 17.5%;
+    --secondary-foreground: 210 40% 98%;
+
+    --destructive: 0 62.8% 45%;
+    --destructive-foreground: 210 40% 98%;
+
+    --muted: 217.2 32.6% 17.5%;
+    --muted-foreground: 215 20.2% 65.1%;
+
+    --accent: 217.2 32.6% 17.5%;
+    --accent-foreground: 210 40% 98%;
+
+    --border: 217.2 32.6% 17.5%;
+    --input: 217.2 32.6% 17.5%;
+    --ring: 212.7 26.8% 83.9%;
+  }
+
   body
   {
     @apply overflow-x-clip;
@@ -54,34 +104,6 @@ body
   min-height: 100dvh;
 }
 
-h1
-{
-  font-size: 3.2em;
-  line-height: 1.1;
-}
-
-button
-{
-  border-radius: 8px;
-  border: 1px solid transparent;
-  padding: 0.6em 1.2em;
-  font-size: 1em;
-  font-weight: 500;
-  font-family: inherit;
-  background-color: #1a1a1a;
-  cursor: pointer;
-  transition: border-color 0.25s;
-}
-button:hover
-{
-  border-color: #646cff;
-}
-button:focus,
-button:focus-visible
-{
-  outline: 4px auto -webkit-focus-ring-color;
-}
-
 @media (prefers-color-scheme: light)
 {
   :root

frontend/src/lib/api.test.ts

@@ -0,0 +1,96 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted (() => {
+  const client = {
+    delete: vi.fn (),
+    get:    vi.fn (),
+    patch:  vi.fn (),
+    post:   vi.fn (),
+    put:    vi.fn (),
+  }
+
+  return {
+    client,
+    isAxiosError: vi.fn (),
+  }
+})
+
+vi.mock ('axios', () => ({
+  default: {
+    create:       vi.fn (() => mocks.client),
+    isAxiosError: mocks.isAxiosError,
+  },
+}))
+
+vi.mock ('@/config', () => ({
+  API_BASE_URL: '/api',
+}))
+
+describe ('api helpers', () => {
+  beforeEach (() => {
+    vi.clearAllMocks ()
+    localStorage.clear ()
+  })
+
+  it ('adds the transfer code header and camelizes get responses', async () => {
+    localStorage.setItem ('user_code', 'abc123')
+    mocks.client.get.mockResolvedValueOnce ({
+      data: { post_id: 1, nested_value: { created_at: 'now' } },
+    })
+
+    const { apiGet } = await import ('@/lib/api')
+    const data = await apiGet<{ postId: number; nestedValue: { createdAt: string } }> (
+        '/posts/1',
+        { headers: { 'X-Extra': '1' }, params: { page: 2 } },
+    )
+
+    expect (mocks.client.get).toHaveBeenCalledWith (
+        '/posts/1',
+        {
+          headers: { 'X-Transfer-Code': 'abc123', 'X-Extra': '1' },
+          params:  { page: 2 },
+        },
+    )
+    expect (data).toEqual ({ postId: 1, nestedValue: { createdAt: 'now' } })
+  })
+
+  it ('passes an empty body for post-like requests when body is omitted', async () => {
+    mocks.client.patch.mockResolvedValueOnce ({ data: { ok_value: true } })
+
+    const { apiPatch } = await import ('@/lib/api')
+    const data = await apiPatch<{ okValue: boolean }> ('/posts/1')
+
+    expect (mocks.client.patch).toHaveBeenCalledWith (
+        '/posts/1',
+        {},
+        { headers: { 'X-Transfer-Code': '' } },
+    )
+    expect (data.okValue).toBe (true)
+  })
+
+  it ('does not camelize blob responses', async () => {
+    const blob = new Blob (['csv'])
+    mocks.client.get.mockResolvedValueOnce ({ data: blob })
+
+    const { apiGet } = await import ('@/lib/api')
+    const data = await apiGet<Blob> ('/exports', { responseType: 'blob' })
+
+    expect (data).toBe (blob)
+  })
+
+  it ('delegates deletes and exposes axios error detection', async () => {
+    const err = new Error ('bad')
+    mocks.client.delete.mockResolvedValueOnce ({})
+    mocks.isAxiosError.mockReturnValueOnce (true)
+
+    const { apiDelete, isApiError } = await import ('@/lib/api')
+    await apiDelete ('/posts/1')
+
+    expect (mocks.client.delete).toHaveBeenCalledWith (
+        '/posts/1',
+        { headers: { 'X-Transfer-Code': '' } },
+    )
+    expect (isApiError (err)).toBe (true)
+    expect (mocks.isAxiosError).toHaveBeenCalledWith (err)
+  })
+})

frontend/src/lib/api.ts

@@ -28,7 +28,7 @@ const apiP = async <T> (
   const res = await client[method] (path, body ?? { }, withUserCode (opt))
   if (opt?.responseType === 'blob')
     return res.data as T
-  return toCamel (res.data as any, { deep: true }) as T
+  return toCamel (res.data as Record<string, unknown>, { deep: true }) as T
 }
 
 
@@ -39,7 +39,7 @@ export const apiGet = async <T> (
   const res = await client.get (path, withUserCode (opt))
   if (opt?.responseType === 'blob')
     return res.data as T
-  return toCamel (res.data as any, { deep: true }) as T
+  return toCamel (res.data as Record<string, unknown>, { deep: true }) as T
 }
 
 
@@ -72,4 +72,5 @@ export const apiDelete = async (
 }
 
 
-export const isApiError = (err: unknown): err is AxiosError => axios.isAxiosError (err)
+export const isApiError = <T = unknown> (err: unknown): err is AxiosError<T> =>
+    axios.isAxiosError (err)

frontend/src/lib/posts.test.ts

@@ -0,0 +1,117 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import { fetchPostChanges, fetchPosts, toggleViewedFlg, updatePost } from '@/lib/posts'
+
+import type { FetchPostsParams } from '@/types'
+
+const api = vi.hoisted (() => ({
+  apiDelete: vi.fn (),
+  apiGet:    vi.fn (),
+  apiPost:   vi.fn (),
+  apiPut:    vi.fn (),
+}))
+
+vi.mock ('@/lib/api', () => api)
+
+const baseParams: FetchPostsParams = {
+  url:                 '',
+  title:               '',
+  tags:                '',
+  match:               'all',
+  originalCreatedFrom: '',
+  originalCreatedTo:   '',
+  createdFrom:         '',
+  createdTo:           '',
+  updatedFrom:         '',
+  updatedTo:           '',
+  page:                1,
+  limit:               20,
+  order:               'updated_at:desc',
+}
+
+describe ('posts API functions', () => {
+  beforeEach (() => {
+    vi.clearAllMocks ()
+  })
+
+  it ('maps post search parameters to backend snake_case names', async () => {
+    api.apiGet.mockResolvedValueOnce ({ posts: [], count: 0 })
+
+    await fetchPosts ({
+      ...baseParams,
+      title:               'title',
+      tags:                'a b',
+      originalCreatedFrom: '2026-01-01',
+      updatedTo:           '2026-02-01',
+    })
+
+    expect (api.apiGet).toHaveBeenCalledWith (
+        '/posts',
+        {
+          params: {
+            title:                 'title',
+            tags:                  'a b',
+            match:                 'all',
+            original_created_from: '2026-01-01',
+            updated_to:            '2026-02-01',
+            page:                  1,
+            limit:                 20,
+            order:                 'updated_at:desc',
+          },
+        },
+    )
+  })
+
+  it ('updates posts with version and merge controls', async () => {
+    api.apiPut.mockResolvedValueOnce ({ id: 5 })
+
+    await updatePost (
+        {
+          id:                    5,
+          title:                 'new title',
+          tags:                  'tag',
+          parentPostIds:         '1 2',
+          originalCreatedFrom:   null,
+          originalCreatedBefore: '2026-01-02T00:00:00Z',
+        },
+        { baseVersionNo: 7, force: true, merge: false },
+    )
+
+    expect (api.apiPut).toHaveBeenCalledWith (
+        '/posts/5',
+        {
+          title:                   'new title',
+          tags:                    'tag',
+          parent_post_ids:         '1 2',
+          original_created_from:   null,
+          original_created_before: '2026-01-02T00:00:00Z',
+        },
+        {
+          params: {
+            base_version_no: '7',
+            force:           '1',
+            merge:           '0',
+          },
+        },
+    )
+  })
+
+  it ('uses the viewed endpoint method matching the requested state', async () => {
+    await toggleViewedFlg ('9', true)
+    await toggleViewedFlg ('9', false)
+
+    expect (api.apiPost).toHaveBeenCalledWith ('/posts/9/viewed')
+    expect (api.apiDelete).toHaveBeenCalledWith ('/posts/9/viewed')
+  })
+
+  it ('keeps optional post history filters out when blank', async () => {
+    api.apiGet.mockResolvedValueOnce ({ versions: [], count: 0 })
+
+    await fetchPostChanges ({ page: 2, limit: 50 })
+
+    expect (api.apiGet).toHaveBeenCalledWith (
+        '/posts/versions',
+        { params: { page: 2, limit: 50 } },
+    )
+  })
+})

frontend/src/lib/posts.ts

@@ -1,4 +1,4 @@
-import { apiDelete, apiGet, apiPost } from '@/lib/api'
+import { apiDelete, apiGet, apiPost, apiPut } from '@/lib/api'
 
 import type { FetchPostsParams, Post, PostVersion } from '@/types'
 
@@ -42,6 +42,30 @@ export const fetchPostChanges = async (
 						     page, limit } })
 
 
+export const updatePost = async (
+    post: { id:                     number
+	    title:                  string | null
+	    tags:                   string
+	    parentPostIds:          string
+	    originalCreatedFrom:    string | null
+	    originalCreatedBefore:  string | null },
+    { baseVersionNo, force, merge }: {
+	baseVersionNo?: number
+	force?:         boolean
+	merge?:         boolean }
+) =>
+    await apiPut<Post> (
+	`/posts/${ post.id }`,
+	{ title: post.title,
+	  tags: post.tags,
+	  parent_post_ids: post.parentPostIds,
+	  original_created_from: post.originalCreatedFrom,
+	  original_created_before: post.originalCreatedBefore },
+	{ params: { ...(baseVersionNo && { base_version_no: String (baseVersionNo) }),
+	            force: force ? '1' : '0',
+		    merge: merge ? '1' : '0' } })
+
+
 export const toggleViewedFlg = async (id: string, viewed: boolean): Promise<void> => {
   await (viewed ? apiPost : apiDelete) (`/posts/${ id }/viewed`)
 }