Merge remote-tracking branch 'origin/main' into feature/361

Reviewed-on: #368
Co-authored-by: miteruzo <miteruzo@naver.com>
Co-committed-by: miteruzo <miteruzo@naver.com>

.gitea/ISSUE_TEMPLATE.md

@@ -0,0 +1,35 @@
+## 背景
+
+なぜ必要か。
+
+## 対象範囲
+
+- backend:
+- frontend:
+- docs:
+- migration:
+
+## やること
+
+- [ ] 
+
+## 受け入れ条件
+
+- [ ] 
+
+## 実行すべき確認
+
+- [ ] `cd backend && bundle exec rspec`
+- [ ] `cd frontend && npm run build`
+- [ ] `cd frontend && npm run lint`
+
+## 禁止事項
+
+- unrelated refactor はしない
+- 既存 API response shape を壊さない
+- 認証・認可・BAN を弱めない
+
+## Codex への指示
+
+この issue を読んで実装してください。
+不明点があれば、実装前に調査結果と選択肢を提示してください。

AGENTS.md

@@ -0,0 +1,244 @@
+# AGENTS.md
+
+## Project overview
+
+BTRC Hub / タグ広場 is a split Rails API and React frontend repository.
+
+- Backend: Rails API under `backend/`.
+- Frontend: React + TypeScript + Vite under `frontend/`.
+- Docs: lightweight command notes under `docs/`.
+- There is no README or Makefile at the repository root as of this inspection.
+
+## Stack
+
+- Backend: Ruby `3.2.2` from `backend/.ruby-version`, Rails `~> 8.0.2`.
+- Backend dependencies include `mysql2`, `sqlite3`, `rspec-rails`,
+  `factory_bot_rails`, `rack-cors`, `jwt`, `discard`, `gollum`, `whenever`,
+  `aws-sdk-s3`, `brakeman`, and `rubocop-rails-omakase`.
+- Frontend: React `^19.1.0`, TypeScript `~5.8.3`, Vite `^6.3.5`.
+- Frontend data/UI dependencies include Axios, TanStack Query, Tailwind CSS,
+  Framer Motion, Radix UI components, lucide-react, MDX/Markdown tooling, and
+  Zustand.
+
+## Main directories
+
+- `backend/app/controllers`: Rails API controllers.
+- `backend/app/models`: Active Record models.
+- `backend/app/representations`: API response representation classes.
+- `backend/app/services`: domain services such as version recording,
+  wiki commit, YouTube sync, and similarity calculation.
+- `backend/config/routes.rb`: API routes.
+- `backend/db/migrate`: migrations.
+- `backend/db/schema.rb`: current schema snapshot.
+- `backend/lib/tasks`: custom Rake tasks.
+- `backend/spec`: RSpec tests.
+- `backend/test`: Rails minitest files that still exist in the tree.
+- `frontend/src/App.tsx`: frontend route definitions and initial user setup.
+- `frontend/src/pages`: page-level React components.
+- `frontend/src/components`: shared and feature components.
+- `frontend/src/lib`: API client helpers, query keys, prefetchers, and domain helpers.
+- `frontend/src/stores`: Zustand stores.
+- `docs/commands.md`: command notes.
+
+## Commands
+
+Only list commands that are backed by files inspected in this repository.
+
+### Backend
+
+The following binstubs exist under `backend/bin`:
+
+```sh
+cd backend
+bin/setup
+bin/dev
+bin/rails
+bin/rake
+bin/rubocop
+bin/brakeman
+bin/kamal
+bin/thrust
+```
+
+Common Rails/Rake usage through existing binstubs:
+
+```sh
+cd backend
+bin/rails db:prepare
+bin/rails db:migrate
+bin/rails routes
+bin/rails server
+bin/rake
+bin/rubocop
+bin/brakeman
+```
+
+RSpec is present in `Gemfile` and `.rspec` exists:
+
+```sh
+cd backend
+bundle exec rspec
+```
+
+### Frontend
+
+The following npm scripts exist in `frontend/package.json`:
+
+```sh
+cd frontend
+npm run dev
+npm run build
+npm run lint
+npm run test
+npm run test:run
+npm run preview
+```
+
+`npm run build` runs `tsc -b && vite build`, then `postbuild` runs
+`node scripts/generate-sitemap.js`.
+
+`npm run test` runs Vitest in watch mode. Use `npm run test:run` for a non-watch frontend test run.
+
+## Coding style
+
+- Prefer precise, minimal changes.
+- Do not flatter or over-explain.
+- Explain risks directly.
+- Prefer single quotes for strings unless interpolation or escaping makes
+  double quotes better.
+- Ruby: never put a space before method-call parentheses.
+- Ruby: never put a line break immediately before `)`.
+- Ruby: do not use `%w` or `%i`.
+- Ruby hashes are not blocks; keep `}` on the same line as the final pair.
+- Ruby hashes keep the first pair on the same line as `{` unless line length
+  requires a break.
+- Ruby blocks use separate `{ ... }` rules from hashes, with 2-space body
+  indentation.
+- For arrays, never put whitespace or a line break immediately before `]`.
+- Keep the first element on the same line as `[` by default.
+- If an array would exceed the line limit, break after `[` and indent
+  elements by 4 spaces.
+- TypeScript and Python: use GNU-style spacing before parentheses where
+  syntactically valid.
+- Never write Ruby, TypeScript, or TSX lines longer than 99 characters.
+- Aim to keep Ruby, TypeScript, and TSX lines within 79 characters where practical.
+- TypeScript and TSX use 4-space logical indentation.
+- In TypeScript and TSX only, replace every leading run of 8 spaces with a tab.
+- Tabs are only for leading indentation, never for spaces after non-space text.
+- Do not add production dependencies without explicit approval.
+- Do not create, modify, or run tests unless the user explicitly asks for
+  test work. When the user asks for tests, keep working and rerun them until
+  they pass or the remaining failure is clearly blocked.
+
+## Backend rules
+
+- Inspect existing routes, controllers, models, services, and specs before
+  editing backend behavior.
+- For API behavior changes, add or update request specs under
+  `backend/spec/requests` only when the user explicitly asks for tests.
+- Prefer RSpec for new backend tests; existing minitest files under
+  `backend/test` do not make minitest the default for new coverage.
+- Do not weaken authentication, BAN user checks, or IP BAN checks.
+- Preserve the `X-Transfer-Code` user identification flow unless the task
+  explicitly changes authentication.
+- Be careful with version tables, `version_no`, optimistic concurrency,
+  wiki revisions, and restore/diff behavior.
+- Be careful with tag names, tag normalization, implications, similarities, and discard behavior.
+- Be sensitive to N+1 queries; avoid introducing them and proactively fix
+  existing N+1 issues in the code path being edited.
+- Keep migration files and `backend/db/schema.rb` consistent when changing schema.
+
+## Frontend rules
+
+- Use `frontend/src/lib/api.ts` for API calls so headers and camelCase conversion stay consistent.
+- Add or reuse TanStack Query keys through `frontend/src/lib/queryKeys.ts`;
+  avoid ad hoc query key arrays.
+- Encode URL path-segment values with `encodeURIComponent`.
+- React hooks must be called unconditionally.
+- Keep page-level code under `frontend/src/pages` and shared UI/feature code
+  under `frontend/src/components` unless existing patterns point elsewhere.
+- Match existing Tailwind, component, and import alias conventions.
+- In TypeScript and TSX, prefer direct comparison operators such as `===` and
+  `!==` over negating a comparison like `!(a === b)`.
+- In TypeScript and TSX, prefer `++i` or `--i` over `i += 1` or `i -= 1` for
+  simple unit-step counter updates.
+- For user-facing Japanese text, prefer modern kana usage and natural current
+  phrasing over historical spellings or awkward literal wording.
+- For user-facing Japanese ellipses, prefer `……` over ASCII `...`.
+
+### Frontend TSX style
+
+- Preserve the local TSX formatting style.
+- Do not normalize TSX to common Prettier-style React formatting unless
+  explicitly asked.
+- Prefer `const` arrow functions for TypeScript/TSX component and helper declarations.
+- Put two blank lines before and after top-level `const` function
+  declarations, unless imports, exports, or file boundaries make that awkward.
+- In TSX, indent with 4-space logical indentation.
+- A leading tab is exactly equivalent to 8 leading spaces.
+- Keep a tag's closing marker on the same line as the final prop when the tag
+  spans multiple lines.
+- Do not put `/>` or `>` on its own line unless the existing surrounding code
+  does so.
+- Keep JSX closing parentheses in the existing compact style, for example
+  `</div>)` rather than moving `)` onto a separate line.
+- Do not add braces around `if`, `else`, or `for` bodies when the body is a
+  single physical line.
+- Always add braces around `if`, `else`, or `for` bodies when the body spans
+  two or more physical lines, even if it is one statement.
+- Do not use a leading semicolon for expression statements such as
+  `;([...]).forEach(...)`; rewrite the expression to avoid ASI hazards
+  explicitly, for example with `void`.
+
+Preferred:
+
+```tsx
+const PostFormTagsArea: FC<Props> = ({ tags, setTags, errors, ...rest }) => {
+  return (
+      <TextArea
+	  {...rest}
+	  ref={ref}
+	  value={tags}
+	  invalid={errors && errors.length > 0}
+	  onChange={ev => setTags (ev.target.value)}/>)
+}
+```
+
+Avoid:
+
+```tsx
+function PostFormTagsArea ({ tags, setTags }: Props) {
+  return (
+    <TextArea
+      value={tags}
+      onChange={ev => setTags (ev.target.value)}
+    />
+  )
+}
+```
+
+## Codex workflow
+
+- First inspect existing patterns; do not invent new architecture when a local convention exists.
+- Keep changes scoped to the requested issue.
+- Do not scan or summarize dependency/generated/runtime directories such as
+  `node_modules`, `dist`, `tmp`, `log`, and `storage` unless explicitly needed.
+- Before touching wiki, tag, versioning, BAN, IP BAN, or authentication
+  behavior, inspect the related request specs and service objects.
+- If frontend code changes, run only non-test verification commands that
+  apply, such as `npm run build` and `npm run lint`. Run `npm run test:run`
+  only when the user explicitly asks for tests.
+- If backend code changes, do not run RSpec unless the user explicitly asks
+  for tests.
+- If a verification command cannot be run or fails, report the exact command and failure.
+
+## Completion criteria
+
+A task is complete only when:
+
+- implementation is complete,
+- relevant non-test verification commands pass, or failures are clearly
+  explained,
+- unrelated files are not changed,
+- migrations and schema are consistent when schema changes are made,
+- user-facing behavior is documented when needed.

backend/AGENTS.md

@@ -0,0 +1,219 @@
+# backend/AGENTS.md
+
+## Scope
+
+These rules apply to work under `backend/`.
+
+This is a Rails API app using Active Record, RSpec, request specs,
+service objects, representation classes, and version tables for post/tag/wiki
+history.
+
+## Commands
+
+Use commands backed by files and dependencies in this directory:
+
+```sh
+bin/setup
+bin/dev
+bin/rails
+bin/rake
+bin/rubocop
+bin/brakeman
+bundle exec rspec
+```
+
+Common checks:
+
+```sh
+bundle exec rspec
+bin/rubocop
+bin/brakeman
+```
+
+Common Rails commands:
+
+```sh
+bin/rails db:prepare
+bin/rails db:migrate
+bin/rails routes
+bin/rails server
+```
+
+After backend behavior changes, run the relevant RSpec files. For broad backend changes, run:
+
+```sh
+bundle exec rspec
+```
+
+If a command cannot be run or fails, report the exact command and failure.
+
+Do not create, modify, or run tests unless the user explicitly asks for test
+work. When the user asks for tests, keep working and rerun them until they
+pass or the remaining failure is clearly blocked.
+
+## Rails structure
+
+- `app/controllers`: API controllers.
+- `app/models`: Active Record models and concerns.
+- `app/representations`: JSON response shaping.
+- `app/services`: domain services such as version recorders, wiki commit,
+  YouTube sync, and similarity calculation.
+- `config/routes.rb`: public API routes.
+- `db/migrate`: migrations.
+- `db/schema.rb`: schema snapshot.
+- `lib/tasks`: custom Rake tasks.
+- `spec`: RSpec tests.
+
+Before changing behavior, inspect the matching route, controller, model,
+service, representation, and spec.
+
+## Ruby style
+
+- Prefer precise, minimal changes.
+- Use single quotes unless interpolation or escaping makes double quotes better.
+- Do not put a space before Ruby method-call parentheses.
+- Never put a line break immediately before `)` in Ruby.
+- Do not use `%w` or `%i` in new Ruby code.
+- Never write a Ruby line longer than 99 characters.
+- Aim to keep Ruby lines within 79 characters where practical.
+- For small Ruby method definitions that take keyword arguments, match the
+  local no-parentheses style when nearby code uses it.
+- Treat Ruby hash `{ ... }` style and Ruby block `{ ... }` style as separate
+  rules.
+- Do not format Ruby hashes like Ruby blocks.
+- For Ruby hashes, keep the closing `}` on the same line as the final pair.
+- Keep the first pair on the same line as `{` by default.
+- If the hash would exceed the line limit, break after `{` and indent pairs
+  by 4 spaces.
+- Put one logical pair per line when the expression would otherwise become
+  dense.
+- For Ruby arrays, never put whitespace or a line break immediately before `]`.
+- Keep the first element on the same line as `[` by default.
+- If an array would exceed the line limit, break after `[` and indent
+  elements by 4 spaces.
+- For Ruby blocks, use 2-space indentation for the block body.
+- Keep comments short and useful; avoid narrating obvious code.
+- Do not add production dependencies without approval.
+
+## Authentication and authorization
+
+- Authentication is handled through the `X-Transfer-Code` header in
+  `ApplicationController#authenticate_user`.
+- `current_user` is set by looking up `User.inheritance_code`.
+- Do not bypass or weaken the `X-Transfer-Code` flow unless the task
+  explicitly changes authentication.
+- Unauthenticated write actions should return `:unauthorized` consistently
+  with existing controllers.
+- Role checks use `User` enum roles: `guest`, `member`, and `admin`.
+- Use `current_user.gte_member?` for member-or-admin write permissions where
+  existing controllers do so.
+- Use `current_user.admin?` only for admin-only paths, such as tag child relationship changes.
+- Do not replace role checks with looser presence checks.
+
+## BAN and IP BAN
+
+- `ApplicationController` runs these before actions in order:
+  - `reject_banned_ip_address!`
+  - `authenticate_user`
+  - `reject_banned_user!`
+- User and IP bans use `banned_at`, not a boolean `banned` column.
+- `User#banned?` and `IpAddress#banned?` check `banned_at.present?`.
+- Do not weaken BAN or IP BAN behavior.
+- If changing request authentication or controller before actions, add or
+  update request specs covering banned users and banned IP addresses only when
+  the user explicitly asks for tests.
+
+## RSpec
+
+- Prefer RSpec for new backend tests.
+- Put API behavior coverage under `spec/requests`.
+- Put model behavior under `spec/models`.
+- Put service behavior under `spec/services`.
+- Put Rake task coverage under `spec/tasks`.
+- `spec/rails_helper.rb` loads `spec/support/**/*.rb`.
+- Request specs include `AuthHelper` and `JsonHelper`.
+- `AuthHelper#sign_in_as(user)` stubs
+  `ApplicationController#current_user`; use it when matching existing
+  request spec style.
+- Add or update request specs for API behavior changes only when the user
+  explicitly asks for tests, especially status codes, permissions, response
+  shape, and version conflict behavior.
+
+## Migrations
+
+- Keep migrations and `db/schema.rb` consistent.
+- Use reversible migrations where practical; otherwise define explicit `up` and `down`.
+- For data backfills inside migrations, follow the existing pattern of
+  defining migration-local `ActiveRecord::Base` classes with
+  `self.table_name`.
+- Preserve existing indexes, foreign keys, check constraints, and null constraints.
+- Be careful with MySQL-specific options already present in migrations, such as `after:`.
+- Do not edit old migrations just to change current behavior unless
+  explicitly requested; add a new migration.
+
+## Version tables
+
+- Versioned records include posts, tags, nico tags, and wiki pages.
+- Current records have `version_no`; version tables have positive
+  `version_no` with unique indexes scoped to the parent record.
+- Version event types are `create`, `update`, `discard`, and `restore`.
+- Version rows are readonly through the `VersionRecord` concern.
+- Use the existing recorder services instead of manually inserting version
+  rows in application code:
+  - `PostVersionRecorder`
+  - `TagVersionRecorder`
+  - `NicoTagVersionRecorder`
+  - `WikiVersionRecorder`
+  - `TagVersioning`
+- `VersionRecorder` locks the current record, validates sequence consistency,
+  skips unchanged update snapshots, creates the next version row, and updates
+  the record `version_no`.
+- Do not update versioned records without considering whether a version snapshot must be created.
+- For optimistic concurrency paths, preserve `base_version_no`, `force`, and
+  `merge` semantics. Cover conflicts in request specs only when the user
+  explicitly asks for tests.
+
+## Domain cautions
+
+- Posts have tag snapshots, parent post implications, original-created ranges,
+  viewed state, and version conflict behavior.
+- Tags have canonical names, aliases through `TagName`, categories, parent
+  implications, discard behavior, and version snapshots.
+- Nico tags have separate relation/version behavior; do not treat them like
+  normal editable tags without checking existing code.
+- Wiki pages involve page content, revisions/history, version rows,
+  title/tag-name behavior, and diff/restore paths.
+- Materials, theatres, and comments have user and permission checks; inspect
+  the controller before changing them.
+
+## API responses
+
+- Use representation classes under `app/representations` when existing endpoints do.
+- Keep response keys consistent with existing JSON contracts.
+- Frontend code expects camelCase conversion client-side, while Rails params
+  and JSON keys are generally snake_case.
+- Preserve existing HTTP status conventions:
+  `:unauthorized` for no user, `:forbidden` for insufficient role or banned
+  user, `:not_found` for missing records, and `:unprocessable_entity` for
+  validation failures.
+- For diagnostic or internal helper JSON, prefer a deliberately light response
+  shape over full representation classes when callers only need identifiers,
+  labels, URLs, or weights.
+
+## Active Record performance
+
+- When a controller action serializes nested associations, preload the
+  associations it will touch instead of allowing N+1 queries.
+- Be sensitive to N+1 queries in all backend work.
+- Avoid introducing N+1 queries, and proactively fix existing N+1 issues when
+  you find them in the code path you are editing.
+- When an association may already be preloaded, prefer loaded-association
+  checks that reuse the preloaded data without losing the efficient database
+  path.
+
+## Files to avoid in routine work
+
+- Do not inspect or edit `tmp/`, `log/`, `storage/`, `vendor/`, or dependency
+  directories unless explicitly needed.
+- Do not modify generated schema or migration output without the corresponding
+  migration when schema changes are made.

backend/Gemfile

@@ -69,3 +69,5 @@ gem 'discard'
 gem "rspec-rails", "~> 8.0", :groups => [:development, :test]
 
 gem 'aws-sdk-s3', require: false
+
+gem 'rails-i18n', '~> 8.0.0'

backend/Gemfile.lock

@@ -306,6 +306,9 @@ GEM
     rails-html-sanitizer (1.6.2)
       loofah (~> 2.21)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    rails-i18n (8.0.2)
+      i18n (>= 0.7, < 2)
+      railties (>= 8.0.0, < 9)
     railties (8.0.2)
       actionpack (= 8.0.2)
       activesupport (= 8.0.2)
@@ -477,6 +480,7 @@ DEPENDENCIES
   puma (>= 5.0)
   rack-cors
   rails (~> 8.0.2)
+  rails-i18n (~> 8.0.0)
   rspec-rails (~> 8.0)
   rubocop-rails-omakase
   sprockets-rails

backend/app/controllers/application_controller.rb

@@ -1,14 +1,19 @@
 class ApplicationController < ActionController::API
-  before_action :authenticate_user
+  rescue_from ActiveRecord::RecordInvalid, with: :render_record_invalid
+  rescue_from ActiveRecord::RecordNotUnique, with: :render_record_not_unique
 
-  def current_user
-    @current_user
-  end
+  before_action :reject_banned_ip_address!
+  before_action :authenticate_user
+  before_action :reject_banned_user!
+
+  def current_user = @current_user
 
   private
 
   def authenticate_user
     code = request.headers['X-Transfer-Code'] || request.headers['HTTP_X_TRANSFER_CODE']
+    return if code.blank?
+
     @current_user = User.find_by(inheritance_code: code)
   end
 
@@ -22,4 +27,62 @@ class ApplicationController < ActionController::API
       s.in?(['', '1', 'true', 'on', 'yes'])
     end
   end
+
+  def render_bad_request message = 'リクエストが不正です．'
+    render json: { type: 'bad_request',
+                   message:,
+                   errors: { },
+                   base_errors: [message] },
+           status: :bad_request
+  end
+
+  def render_unprocessable_entity message = '入力を確認してください．', field: nil
+    render_validation_error(fields: field ? { field => [message] } : { },
+                            base: field ? [] : [message])
+  end
+
+  def render_record_invalid error
+    render_validation_error error.record
+  end
+
+  def render_record_not_unique _error = nil
+    render_validation_error base: ['すでに存在してゐます．']
+  end
+
+  def reject_banned_ip_address!
+    ip_address = IpAddress.find_by(ip_address: IPAddr.new(request.remote_ip).hton)
+    return unless ip_address&.banned?
+
+    head :forbidden
+  end
+
+  def reject_banned_user!
+    return unless current_user&.banned?
+
+    head :forbidden
+  end
+
+  def render_validation_error record = nil, fields: { }, base: [], status: :unprocessable_entity
+    errors = { }
+
+    if record
+      record.errors.each do |error|
+        errors[error.attribute] ||= []
+        errors[error.attribute] << error.message
+      end
+    end
+
+    fields.each do |attr, messages|
+      errors[attr.to_sym] ||= []
+      errors[attr.to_sym].concat(Array(messages))
+    end
+
+    base_errors = Array(base) + Array(errors.delete(:base))
+
+    render json: { type: 'validation_error',
+                   message: '入力内容を確認してください．',
+                   errors:,
+                   base_errors: },
+           status:
+  end
 end

backend/app/controllers/deerjikists_controller.rb

@@ -2,7 +2,8 @@ class DeerjikistsController < ApplicationController
   def show
     platform = params[:platform].to_s.strip
     code = params[:code].to_s.strip
-    return head :bad_request if platform.blank? || code.blank?
+    return render_bad_request('platform は必須です．') if platform.blank?
+    return render_bad_request('code は必須です．') if code.blank?
 
     deerjikist = Deerjikist
                  .joins(:tag)
@@ -22,7 +23,9 @@ class DeerjikistsController < ApplicationController
     platform = params[:platform].to_s.strip
     code = params[:code].to_s.strip
     tag_id = params[:tag_id].to_i
-    return head :bad_request if platform.blank? || code.blank? || tag_id <= 0
+    return render_bad_request('platform は必須です．') if platform.blank?
+    return render_bad_request('code は必須です．') if code.blank?
+    return render_bad_request('tag_id が不正です．') if tag_id <= 0
 
     deerjikist = Deerjikist.find_or_initialize_by(platform:, code:).tap do |d|
       d.tag_id = tag_id
@@ -38,7 +41,8 @@ class DeerjikistsController < ApplicationController
 
     platform = params[:platform].to_s.strip
     code = params[:code].to_s.strip
-    return head :bad_request if platform.blank? || code.blank?
+    return render_bad_request('platform は必須です．') if platform.blank?
+    return render_bad_request('code は必須です．') if code.blank?
 
     Deerjikist.find([platform, code]).destroy!
 

backend/app/controllers/gekanator_games_controller.rb

@@ -0,0 +1,148 @@
+class GekanatorGamesController < ApplicationController
+  def create
+    return head :unauthorized unless current_user
+
+    guessed_post_id = params.require(:guessed_post_id)
+    correct_post_id = params[:correct_post_id].presence
+    answers = params.require(:answers).as_json
+
+    game = GekanatorGame.new(
+        user: current_user,
+        guessed_post_id:,
+        correct_post_id:,
+        won: correct_post_id.present? && guessed_post_id.to_i == correct_post_id.to_i,
+        question_count: answers.length,
+        answers:)
+
+    if game.save
+      render json: { id: game.id }, status: :created
+    else
+      render json: { errors: game.errors.full_messages }, status: :unprocessable_entity
+    end
+  end
+
+  def extra_questions
+    game = find_owned_game
+    return if performed?
+
+    questions =
+        GekanatorQuestion
+        .accepted
+        .includes(:gekanator_question_examples)
+        .where(kind: 'post_similarity', source: 'user_suggested')
+        .to_a
+
+    selected = weighted_sample_questions(
+        questions,
+        post_id: game.correct_post_id,
+        limit: 2)
+
+    render json: {
+      questions: selected.map { |question| extra_question_json(question) }
+    }
+  end
+
+  def extra_question_answers
+    game = find_owned_game
+    return if performed?
+
+    answer_params = params.require(:answers)
+    if !answer_params.is_a?(Array)
+      return render_validation_error fields: { answers: ['配列で指定してください．'] }
+    end
+
+    answers = answer_params.map { |answer|
+      {
+        question_id: answer.require(:question_id).to_i,
+        answer: answer.require(:answer)
+      }
+    }
+    questions = GekanatorQuestion.where(id: answers.map { _1[:question_id] })
+    question_by_id = questions.index_by(&:id)
+    if questions.length != answers.length
+      return render_validation_error fields: { answers: ['質問が見つかりません．'] }
+    end
+    if questions.any? { |question| question.status != 'accepted' || question.kind != 'post_similarity' }
+      return render_validation_error fields: { answers: ['質問が不正です．'] }
+    end
+
+    ActiveRecord::Base.transaction do
+      answers.each do |item|
+        question = question_by_id[item[:question_id]]
+        example =
+            GekanatorQuestionExample.find_or_initialize_by(
+                gekanator_question: question,
+                post: game.correct_post,
+                user: current_user)
+        example.record_answer!(
+            answer: item[:answer],
+            source: 'post_game_extra',
+            gekanator_game: game)
+        example.save!
+      end
+    end
+
+    render json: { count: answers.length }, status: :created
+  end
+
+  private
+
+  def extra_question_json question
+    {
+      id: question.id,
+      text: question.text,
+      source: question.source,
+      priority_weight: question.priority_weight
+    }
+  end
+
+  def weighted_sample_questions questions, post_id:, limit:
+    remaining = questions.uniq(&:id)
+    selected = []
+
+    while selected.length < limit && remaining.any?
+      weighted =
+          remaining.map { |question|
+            [question, selection_weight_for(question, post_id: post_id)]
+          }
+      total_weight = weighted.sum { |_question, weight| weight }
+      break if total_weight <= 0
+
+      target = rand * total_weight
+      cumulative = 0.0
+      chosen =
+          weighted.find do |_question, weight|
+            cumulative += weight
+            cumulative >= target
+          end&.first || weighted.first.first
+
+      selected << chosen
+      remaining.reject! { |question| question.id == chosen.id }
+    end
+
+    selected
+  end
+
+  def selection_weight_for question, post_id:
+    sample_count =
+        question.gekanator_question_examples.sum { |example|
+          next 0 unless example.post_id == post_id
+
+          example.sample_count.presence || 1
+        }
+
+    question.priority_weight.to_f / (1.0 + sample_count * 0.15)
+  end
+
+  def find_owned_game
+    return head :unauthorized unless current_user
+
+    game = GekanatorGame.find_by(id: params[:id])
+    return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
+
+    game
+  end
+end

backend/app/controllers/gekanator_posts_controller.rb

@@ -0,0 +1,44 @@
+class GekanatorPostsController < ApplicationController
+  def index
+    posts =
+        Post
+        .preload(tags: :tag_name)
+        .with_attached_thumbnail
+        .order(Arel.sql(
+            'COALESCE(posts.original_created_before - INTERVAL 1 MINUTE, ' \
+            'posts.original_created_from, posts.created_at) DESC, posts.id DESC'))
+
+    render json: { posts: posts.map { |post| post_json(post) } }
+  end
+
+  private
+
+  def post_json post
+    {
+      id: post.id,
+      url: post.url,
+      title: post.title,
+      thumbnail: thumbnail_url(post),
+      thumbnail_base: post.thumbnail_base,
+      original_created_from: post.original_created_from,
+      original_created_before: post.original_created_before,
+      tags: post.tags.map { |tag| tag_json(tag) }
+    }
+  end
+
+  def tag_json tag
+    {
+      id: tag.id,
+      name: tag.name,
+      category: tag.category
+    }
+  end
+
+  def thumbnail_url post
+    return nil unless post.thumbnail.attached?
+
+    rails_storage_proxy_url(post.thumbnail, only_path: false)
+  rescue
+    nil
+  end
+end

backend/app/controllers/gekanator_question_suggestions_controller.rb

@@ -0,0 +1,56 @@
+class GekanatorQuestionSuggestionsController < ApplicationController
+  def create
+    return head :unauthorized unless current_user
+
+    game = GekanatorGame.find_by(id: params.require(:gekanator_game_id))
+    return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
+
+    suggestion = GekanatorQuestionSuggestion.new(
+        gekanator_game: game,
+        user: current_user,
+        question_text: params.require(:question_text),
+        answer: params.require(:answer))
+
+    if suggestion.valid?
+      ActiveRecord::Base.transaction do
+        suggestion.save!
+        Gekanator::QuestionSuggestionPromoter.call(
+            suggestion: suggestion,
+            user: current_user)
+      end
+
+      render json: {
+        id: suggestion.id,
+        count: game.question_suggestions.count
+      }, status: :created
+    else
+      render_validation_error suggestion
+    end
+  end
+
+  def ai_convert
+    return head :not_found unless current_user&.admin?
+
+    suggestion = GekanatorQuestionSuggestion.find_by(id: params[:id])
+    return head :not_found unless suggestion
+    if Gekanator::AiRunBudget.exceeded_after_next_run?
+      suggestion.gekanator_ai_runs.create!(
+          model: 'budget_guard',
+          status: 'blocked_budget',
+          input_tokens: 0,
+          output_tokens: 0,
+          estimated_cost_jpy: 0)
+      return head :payment_required
+    end
+
+    Gekanator::QuestionSuggestionAiConverter.call(
+        suggestion: suggestion,
+        user: current_user)
+    head :no_content
+  rescue NotImplementedError
+    head :not_implemented
+  end
+end

backend/app/controllers/gekanator_questions_controller.rb

@@ -0,0 +1,102 @@
+class GekanatorQuestionsController < ApplicationController
+  def index
+    questions =
+        GekanatorQuestion
+        .accepted
+        .includes(:gekanator_question_examples)
+        .order(priority_weight: :desc, id: :asc)
+
+    render json: {
+      questions: questions.map { |question| question_json(question) }
+    }
+  end
+
+  private
+
+  def question_json question
+    condition = condition_json(question.condition).deep_symbolize_keys
+    json = {
+      id: question_id_for(question, condition),
+      text: question_text_for(question, condition),
+      kind: question.kind,
+      condition: condition,
+      source: question.source,
+      priority_weight: question.priority_weight
+    }
+    if question.kind == 'post_similarity'
+      json[:example_answers] = example_answers_json(question)
+    end
+    json
+  end
+
+  def question_id_for question, condition
+    case condition[:type]
+    when 'tag'
+      "tag:#{ condition[:key] }"
+    when 'source'
+      "source:#{ condition[:host] }"
+    when 'original-year'
+      "original-year:#{ condition[:year] }"
+    when 'original-month'
+      "original-month:#{ condition[:month] }"
+    when 'original-month-day'
+      "original-month-day:#{ condition[:monthDay] || condition[:month_day] }"
+    when 'title-length-at-least'
+      "title:length-at-least:#{ condition[:length] }"
+    when 'title-length-greater-than'
+      "title:length-at-least:#{ condition[:length].to_i + 1 }"
+    when 'title-has-ascii'
+      'title:ascii'
+    when 'title-contains'
+      "title:contains:#{ condition[:text] }"
+    when 'post-similarity'
+      "post-similarity:#{ question.id }"
+    else
+      "catalog:#{ question.id }"
+    end
+  end
+
+  def condition_json condition
+    json = condition.deep_dup.as_json
+
+    if json['type'] == 'original-month-day' && json['monthDay'].blank?
+      json['monthDay'] = json.delete('month_day')
+    end
+
+    if json['type'] == 'title-length-greater-than'
+      json['type'] = 'title-length-at-least'
+      json['length'] = json['length'].to_i + 1
+    end
+
+    json
+  end
+
+  def question_text_for question, condition
+    return question.text unless question.kind == 'title'
+
+    case condition[:type]
+    when 'title-length-at-least'
+      "タイトルは #{ condition[:length] } 文字以上?"
+    when 'title-contains'
+      "題名に「#{ condition[:text] }」が含まれる?"
+    else
+      question.text
+    end
+  end
+
+  def example_answers_json question
+    question
+        .gekanator_question_examples
+        .group_by(&:post_id)
+        .transform_values { |examples| aggregate_answer(examples) }
+  end
+
+  def aggregate_answer examples
+    examples
+        .group_by(&:answer)
+        .map { |answer, grouped| [answer, grouped.sum(&:weight), grouped.max_by(&:updated_at)&.updated_at] }
+        .sort_by { |(_answer, weight, updated_at)| [-weight, -(updated_at&.to_f || 0)] }
+        .first
+        &.first
+  end
+end

backend/app/controllers/materials_controller.rb

@@ -40,7 +40,11 @@ class MaterialsController < ApplicationController
     tag_name_raw = params[:tag].to_s.strip
     file = params[:file]
     url = params[:url].to_s.strip.presence
-    return head :bad_request if tag_name_raw.blank? || (file.blank? && url.blank?)
+    return render_unprocessable_entity('タグは必須です．', field: :tag) if tag_name_raw.blank?
+    if file.blank? && url.blank?
+      return render_validation_error fields: { file: ['ファイルまたは URL は必須です．'],
+                                               url: ['ファイルまたは URL は必須です．'] }
+    end
 
     tag_name = TagName.find_undiscard_or_create_by!(name: tag_name_raw)
     tag = tag_name.tag
@@ -54,7 +58,7 @@ class MaterialsController < ApplicationController
     if material.save
       render json: MaterialRepr.base(material, host: request.base_url), status: :created
     else
-      render json: { errors: material.errors.full_messages }, status: :unprocessable_entity
+      render_validation_error material
     end
   end
 
@@ -68,7 +72,11 @@ class MaterialsController < ApplicationController
     tag_name_raw = params[:tag].to_s.strip
     file = params[:file]
     url = params[:url].to_s.strip.presence
-    return head :bad_request if tag_name_raw.blank? || (file.blank? && url.blank?)
+    return render_unprocessable_entity('タグは必須です．', field: :tag) if tag_name_raw.blank?
+    if file.blank? && url.blank?
+      return render_validation_error fields: { file: ['ファイルまたは URL は必須です．'],
+                                               url: ['ファイルまたは URL は必須です．'] }
+    end
 
     tag_name = TagName.find_undiscard_or_create_by!(name: tag_name_raw)
     tag = tag_name.tag
@@ -84,7 +92,7 @@ class MaterialsController < ApplicationController
     if material.save
       render json: MaterialRepr.base(material, host: request.base_url)
     else
-      render json: { errors: material.errors.full_messages }, status: :unprocessable_entity
+      render_validation_error material
     end
   end
 

backend/app/controllers/nico_tags_controller.rb

@@ -1,26 +1,69 @@
 class NicoTagsController < ApplicationController
   def index
-    limit = (params[:limit] || 20).to_i
-    cursor = params[:cursor].presence
+    name = params[:name].presence
+    linked_tag = params[:linked_tag].presence
+    link_status = params[:link_status].presence
+    order = params[:order].to_s.split(':', 2).map(&:strip)
+    order[0] = 'updated_at' unless order[0].in?(['name', 'created_at', 'updated_at'])
+    unless order[1].in?(['asc', 'desc'])
+      order[1] = order[0] == 'name' ? 'asc' : 'desc'
+    end
+    page = (params[:page].presence || 1).to_i
+    limit = (params[:limit].presence || 20).to_i
+
+    page = 1 if page < 1
+    limit = 1 if limit < 1
+
+    post_tag_max_sql =
+        PostTag
+        .select('tag_id, MAX(created_at) AS max_created_at')
+        .group('tag_id')
+        .to_sql
 
     q = Tag.nico_tags
+           .joins(:tag_name)
+           .joins("LEFT JOIN (#{ post_tag_max_sql }) post_tag_max " \
+                  'ON post_tag_max.tag_id = tags.id')
            .includes(:tag_name, tag_name: :wiki_page, linked_tags: { tag_name: :wiki_page })
-           .order(updated_at: :desc)
-    q = q.where('tags.updated_at < ?', Time.iso8601(cursor)) if cursor
-
-    tags = q.limit(limit + 1).to_a
-
-    next_cursor = nil
-    if tags.size > limit
-      next_cursor = tags.last.updated_at.iso8601(6)
-      tags = tags.first(limit)
+    q = q.where('tag_names.name LIKE ?', "%#{ name }%") if name
+    if linked_tag
+      linked_tag_ids =
+        Tag
+        .joins(:tag_name)
+        .where('tag_names.name LIKE ?', "%#{ linked_tag }%")
+        .pluck(:id)
+      linked_nico_tag_ids = NicoTagRelation.where(tag_id: linked_tag_ids).pluck(:nico_tag_id)
+      q = q.where(id: linked_nico_tag_ids)
+    end
+    if link_status.in?(['linked', 'unlinked'])
+      exists_sql =
+          'EXISTS (SELECT 1 FROM nico_tag_relations ' \
+          'WHERE nico_tag_relations.nico_tag_id = tags.id)'
+      q = link_status == 'linked' ? q.where(exists_sql) : q.where("NOT #{ exists_sql }")
     end
 
+    count = q.count
+    sort_sql =
+        case order[0]
+        when 'name'
+          'tag_names.name'
+        when 'updated_at'
+          'post_tag_max.max_created_at'
+        else
+          "tags.#{ order[0] }"
+        end
+    tags = q.reselect('tags.*',
+                      Arel.sql('post_tag_max.max_created_at AS recent_post_tag_created_at'))
+            .order(Arel.sql("#{ sort_sql } #{ order[1] }, tags.id #{ order[1] }"))
+            .limit(limit)
+            .offset((page - 1) * limit)
+            .to_a
+
     render json: { tags: tags.map { |tag|
-      TagRepr.base(tag).merge(linked_tags: tag.linked_tags.map { |lt|
-        TagRepr.base(lt)
-      })
-    }, next_cursor: }
+      TagRepr.base(tag).merge(
+          recent_post_tag_created_at: tag.recent_post_tag_created_at,
+          linked_tags: tag.linked_tags.map { |lt| TagRepr.base(lt) })
+    }, count: }
   end
 
   def update
@@ -30,14 +73,18 @@ class NicoTagsController < ApplicationController
     id = params[:id].to_i
 
     tag = Tag.find(id)
-    return head :bad_request unless tag.nico?
+    return render_bad_request('ニコニコ・タグを指定してください．') unless tag.nico?
 
     linked_tag_names = params[:tags].to_s.split
-    linked_tags = Tag.normalise_tags(linked_tag_names, with_tagme: false,
-                                                       with_no_deerjikist: false)
-    return head :bad_request if linked_tags.any? { |t| t.nico? }
+    linked_tags = nil
 
     ApplicationRecord.transaction do
+      linked_tags = Tag.normalise_tags!(linked_tag_names, with_tagme: false,
+                                                          with_no_deerjikist: false)
+      if linked_tags.any? { |t| t.nico? }
+        raise Tag::NicoTagNormalisationError
+      end
+
       TagVersioning.record_tag_snapshots!(linked_tags, created_by_user: current_user)
 
       tag.linked_tags = linked_tags
@@ -47,5 +94,21 @@ class NicoTagsController < ApplicationController
     end
 
     render json: tag.linked_tags.map { |t| TagRepr.base(t) }, status: :ok
+  rescue Tag::NicoTagNormalisationError
+    render_validation_error fields: { tags: ['ニコニコ・タグ同士は連携できません．'] }
+  rescue ActiveRecord::RecordInvalid => e
+    render_nico_tag_form_record_invalid e.record
+  end
+
+  private
+
+  def render_nico_tag_form_record_invalid record
+    if record.is_a?(TagName) || record.is_a?(Tag)
+      render_validation_error fields: { tags: record.errors.full_messages.map { |message|
+        "タグ名 “#{ record.name }”: #{ message }"
+      } }
+    else
+      render_validation_error record
+    end
   end
 end

backend/app/controllers/posts_controller.rb

@@ -44,7 +44,8 @@ class PostsController < ApplicationController
         filtered_posts
         .joins("LEFT JOIN (#{ pt_max_sql }) pt_max ON pt_max.post_id = posts.id")
         .reselect('posts.*', Arel.sql("#{ updated_at_all_sql } AS updated_at_all"))
-        .preload(tags: [:materials, { tag_name: :wiki_page }])
+        .preload(:uploaded_user, :parents, :children,
+                 tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
         .with_attached_thumbnail
 
     q = q.where('posts.url LIKE ?', "%#{ url }%") if url
@@ -95,7 +96,9 @@ class PostsController < ApplicationController
   end
 
   def random
-    post = filtered_posts.preload(tags: [:materials, { tag_name: :wiki_page }])
+    post = filtered_posts.preload(:uploaded_user, :parents, :children,
+                                  tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
+                         .with_attached_thumbnail
                          .order('RAND()')
                          .first
     return head :not_found unless post
@@ -104,12 +107,25 @@ class PostsController < ApplicationController
   end
 
   def show
-    post = Post.includes(tags: [:materials, { tag_name: :wiki_page }]).find_by(id: params[:id])
+    post =
+        Post
+        .includes(:uploaded_user, :parents, :children,
+                  tags: [:deerjikists, :materials, { tag_name: :wiki_page }])
+        .with_attached_thumbnail
+        .find_by(id: params[:id])
     return head :not_found unless post
 
-    render json: PostRepr.base(post, current_user)
-                         .merge(tags: build_tag_tree_for(post.tags),
-                                related: post.related(limit: 20))
+    parent_posts = post.parents.with_attached_thumbnail.order(:id).to_a
+    child_posts = post.children.with_attached_thumbnail.order(:id).to_a
+    sibling_posts = sibling_posts_by_parent(parent_posts.map(&:id))
+    related = post.related(limit: 20).to_a
+
+    render json: PostRepr.detail(post, current_user,
+                                 parent_posts:,
+                                 child_posts:,
+                                 sibling_posts:,
+                                 related:)
+                         .merge(tags: build_tag_tree_for(post.tags))
   end
 
   def create
@@ -123,28 +139,36 @@ class PostsController < ApplicationController
     tag_names = params[:tags].to_s.split
     original_created_from = params[:original_created_from]
     original_created_before = params[:original_created_before]
+    parent_post_ids = parse_parent_post_ids
 
     post = Post.new(title:, url:, thumbnail_base: nil, uploaded_user: current_user,
                     original_created_from:, original_created_before:)
-    post.thumbnail.attach(thumbnail)
+    post.thumbnail.attach(thumbnail) if thumbnail.present?
 
     ApplicationRecord.transaction do
       post.save!
-      tags = Tag.normalise_tags(tag_names)
+
+      tags = Tag.normalise_tags!(tag_names)
       TagVersioning.record_tag_snapshots!(tags, created_by_user: current_user)
 
       tags = Tag.expand_parent_tags(tags)
       sync_post_tags!(post, tags)
+
+      sync_parent_posts!(post, parent_post_ids)
+
       post.resized_thumbnail!
+
       PostVersionRecorder.record!(post:, event_type: :create, created_by_user: current_user)
     end
 
     post.reload
     render json: PostRepr.base(post), status: :created
-  rescue ActiveRecord::RecordInvalid
-    render json: { errors: post.errors.full_messages }, status: :unprocessable_entity
   rescue Tag::NicoTagNormalisationError
-    head :bad_request
+    render_validation_error fields: { tags: 'ニコニコ・タグは直接指定できません．' }
+  rescue ArgumentError => e
+    render_validation_error fields: { parent_post_ids: [e.message] }
+  rescue ActiveRecord::RecordInvalid => e
+    render_post_form_record_invalid e.record
   end
 
   def viewed
@@ -165,35 +189,76 @@ class PostsController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
+    force = bool?(:force)
+    merge = bool?(:merge)
+    return render_bad_request('force と merge は同時に指定できません．') if force && merge
+
+    base_version_no = parse_base_version_no
+    return render_bad_request('base_version_no は必須です．') if !(force) && !(base_version_no)
+
     title = params[:title].presence
     tag_names = params[:tags].to_s.split
     original_created_from = params[:original_created_from]
     original_created_before = params[:original_created_before]
+    parent_post_ids = parse_parent_post_ids
 
-    post = Post.find(params[:id].to_i)
+    post = nil
+    conflict_json = nil
 
     ApplicationRecord.transaction do
-      PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
+      post = Post.lock.find(params[:id].to_i)
 
-      post.update!(title:, original_created_from:, original_created_before:)
+      base_version = nil
+      base_snapshot = nil
+      current_snapshot = nil
+      unless force
+        base_version = post.post_versions.find_by!(version_no: base_version_no)
 
-      normalised_tags = Tag.normalise_tags(tag_names, with_tagme: false)
-      TagVersioning.record_tag_snapshots!(normalised_tags, created_by_user: current_user)
+        base_snapshot = post_snapshot_from_version(base_version)
+        current_snapshot = post_snapshot_from_record(post)
+      end
+      incoming_snapshot = post_incoming_snapshot(title:,
+                                                 original_created_from:,
+                                                 original_created_before:,
+                                                 tag_names:,
+                                                 parent_post_ids:)
 
-      tags = post.tags.nico.to_a + normalised_tags
-      tags = Tag.expand_parent_tags(tags)
-      sync_post_tags!(post, tags)
-      PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
+      snapshot_to_apply =
+          if force || post.version_no == base_version_no || current_snapshot == base_snapshot
+            incoming_snapshot
+          else
+            changes = post_snapshot_changes(base_snapshot, current_snapshot, incoming_snapshot)
+            conflicts = changes.select { |change| change[:conflict] }
+
+            if merge && conflicts.empty?
+              merge_post_snapshots(base_snapshot, current_snapshot, incoming_snapshot)
+            else
+              conflict_json = post_conflict_json(post:,
+                                                 base_version_no:,
+                                                 base_snapshot:,
+                                                 current_snapshot:,
+                                                 incoming_snapshot:,
+                                                 changes:,
+                                                 conflicts:)
+              raise ActiveRecord::Rollback
+            end
           end
 
+      apply_post_snapshot!(post, snapshot_to_apply)
+    end
+
+    return render json: conflict_json, status: :conflict if conflict_json
+
     post.reload
-    json = post.as_json
+    json = PostRepr.base(post, current_user)
     json['tags'] = build_tag_tree_for(post.tags)
     render json:, status: :ok
-  rescue ActiveRecord::RecordInvalid
-    render json: post.errors, status: :unprocessable_entity
   rescue Tag::NicoTagNormalisationError
-    head :bad_request
+    render_validation_error fields: { tags: ['ニコニコ・タグは直接指定できません．'] }
+  rescue ArgumentError => e
+    render_validation_error fields: { parent_post_ids: [e.message] }
+  rescue ActiveRecord::RecordInvalid => e
+    render_post_form_record_invalid e.record
   end
 
   def changes
@@ -211,7 +276,7 @@ class PostsController < ApplicationController
     pts = pts.where(post_id: id) if id.present?
     pts = pts.where(tag_id:) if tag_id.present?
     pts = pts.includes(:post, :created_user, :deleted_user,
-                       tag: [:materials, { tag_name: :wiki_page }])
+                       tag: [:deerjikists, :materials, { tag_name: :wiki_page }])
 
     events = []
     pts.each do |pt|
@@ -336,7 +401,7 @@ class PostsController < ApplicationController
       return nil unless tag
 
       if path.include?(tag_id)
-        return TagRepr.base(tag).merge(children: [])
+        return TagRepr.inline(tag).merge(children: [])
       end
 
       if memo.key?(tag_id)
@@ -348,9 +413,272 @@ class PostsController < ApplicationController
 
       children = child_ids.filter_map { |cid| build_node.(cid, new_path) }
 
-      memo[tag_id] = TagRepr.base(tag).merge(children:)
+      memo[tag_id] = TagRepr.inline(tag).merge(children:)
     end
 
     root_ids.filter_map { |id| build_node.call(id, []) }
   end
+
+  def sibling_posts_by_parent parent_post_ids
+    return { } if parent_post_ids.blank?
+
+    implications =
+        PostImplication
+        .where(parent_post_id: parent_post_ids)
+        .includes(post: { thumbnail_attachment: :blob })
+        .order(:parent_post_id, :post_id)
+
+    implications.group_by(&:parent_post_id).transform_values { |items|
+      items.map(&:post)
+    }
+  end
+
+  def parse_parent_post_ids
+    raise ArgumentError, 'parent_post_ids は必須です．' unless params.key?(:parent_post_ids)
+
+    params[:parent_post_ids].to_s.split.map { |token|
+      id = Integer(token, exception: false)
+      raise ArgumentError, "親投稿 Id. が不正です: #{ token }" if id.nil? || id <= 0
+
+      id
+    }.uniq
+  end
+
+  def sync_parent_posts! post, parent_post_ids
+    if parent_post_ids.include?(post.id)
+      post.errors.add :parent_post_ids, '自分自身を親投稿にはできません．'
+      raise ActiveRecord::RecordInvalid, post
+    end
+
+    existing_ids = Post.where(id: parent_post_ids).pluck(:id)
+    missing_ids = parent_post_ids - existing_ids
+
+    if missing_ids.present?
+      post.errors.add :parent_post_ids,
+                      "存在しない親投稿 Id. があります: #{ missing_ids.join(' ') }"
+      raise ActiveRecord::RecordInvalid, post
+    end
+
+    current_ids = post.parent_posts.pluck(:id)
+
+    ids_to_add = parent_post_ids - current_ids
+    ids_to_remove = current_ids - parent_post_ids
+
+    PostImplication.where(post_id: post.id, parent_post_id: ids_to_remove).delete_all
+
+    ids_to_add.each do |parent_post_id|
+      PostImplication.create_or_find_by!(post_id: post.id, parent_post_id:)
+    end
+  end
+
+  def parse_base_version_no
+    version_no = Integer(params[:base_version_no], exception: false)
+    if version_no&.positive?
+      version_no
+    else
+      nil
+    end
+  end
+
+  def post_snapshot_from_version version
+    { title: version.title,
+      original_created_from: snapshot_time(version.original_created_from),
+      original_created_before: snapshot_time(version.original_created_before),
+      tag_names: editable_tag_names_from_version(version),
+      parent_post_ids: snapshot_parent_post_ids_from_version(version) }
+  end
+
+  def editable_tag_names_from_version version
+    version.tags.to_s.split.reject { |name| name.downcase.start_with?('nico:') }.sort
+  end
+
+  def post_snapshot_from_record post
+    { title: post.title,
+      original_created_from: snapshot_time(post.original_created_from),
+      original_created_before: snapshot_time(post.original_created_before),
+      tag_names: editable_tag_names_from_post(post),
+      parent_post_ids: post.parent_posts.order(:id).pluck(:id) }
+  end
+
+  def editable_tag_names_from_post post
+    post.tags.not_nico.joins(:tag_name).order('tag_names.name').pluck('tag_names.name')
+  end
+
+  def post_incoming_snapshot title:, original_created_from:, original_created_before:,
+                             tag_names:, parent_post_ids:
+    { title:,
+      original_created_from: snapshot_time(original_created_from),
+      original_created_before: snapshot_time(original_created_before),
+      tag_names: incoming_tag_names_for_snapshot(tag_names),
+      parent_post_ids: parent_post_ids.sort }
+  end
+
+  def snapshot_parent_post_ids_from_version version
+    if version.respond_to?(:parent_post_ids)
+      version.parent_post_ids.to_s.split.map { |id| id.to_i }.sort
+    elsif version.respond_to?(:parent_id) && version.parent_id
+      [version.parent_id]
+    else
+      []
+    end
+  end
+
+  def snapshot_time value
+    return nil if value.blank?
+
+    value = Time.zone.parse(value.to_s) if value in String
+    value&.in_time_zone&.iso8601(6)
+  rescue ArgumentError, TypeError
+    value.to_s
+  end
+
+  def incoming_tag_names_for_snapshot raw_tag_names
+    tags = Tag.normalise_tags!(raw_tag_names, with_tagme: false)
+
+    Tag.expand_parent_tags(tags).map(&:name).uniq.sort
+  end
+
+  def post_conflict_json post:, base_version_no:, base_snapshot:,
+                         current_snapshot:, incoming_snapshot:, changes:, conflicts:
+    { error: 'conflict',
+      message: '競合が発生しました．',
+      post_id: post.id,
+      base_version_no:,
+      current_version_no: post.version_no,
+      base: base_snapshot,
+      current: current_snapshot,
+      mine: incoming_snapshot,
+      changes:,
+      conflicts:,
+      mergeable: conflicts.empty? }
+  end
+
+  def post_snapshot_changes base_snapshot, current_snapshot, incoming_snapshot
+    [scalar_snapshot_change(:title, 'タイトル',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     scalar_snapshot_change(:original_created_from, 'オリジナルの作成日時（以降）',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     scalar_snapshot_change(:original_created_before, 'オリジナルの作成日時（より前）',
+                            base_snapshot, current_snapshot, incoming_snapshot),
+     set_snapshot_change(:tag_names, 'タグ',
+                         base_snapshot, current_snapshot, incoming_snapshot),
+     set_snapshot_change(:parent_post_ids, '親投稿',
+                         base_snapshot, current_snapshot, incoming_snapshot)].compact
+  end
+
+  def scalar_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
+    base = base_snapshot[field]
+    current = current_snapshot[field]
+    mine = incoming_snapshot[field]
+
+    return nil if current == base && mine == base
+
+    { field:, label:, base:, current:, mine:,
+      changed_by_current: current != base,
+      changed_by_me: mine != base,
+      conflict: scalar_snapshot_conflict?(base, current, mine) }
+  end
+
+  def scalar_snapshot_conflict? base, current, mine
+    current != base && mine != base && current != mine
+  end
+
+  def set_snapshot_change field, label, base_snapshot, current_snapshot, incoming_snapshot
+    base = base_snapshot[field].to_a
+    current = current_snapshot[field].to_a
+    mine = incoming_snapshot[field].to_a
+
+    added_by_current = current - base
+    removed_by_current = base - current
+    added_by_me = mine - base
+    removed_by_me = base - mine
+
+    if (added_by_current.empty? &&
+        removed_by_current.empty? &&
+        added_by_me.empty? &&
+        removed_by_me.empty?)
+      return nil
+    end
+
+    { field:, label:, base:, current:, mine:, added_by_current:, removed_by_current:,
+      added_by_me:, removed_by_me:,
+      changed_by_current: added_by_current.present? || removed_by_current.present?,
+      changed_by_me: added_by_me.present? || removed_by_me.present?,
+      conflict: set_snapshot_conflict?(added_by_current:,
+                                       removed_by_current:,
+                                       added_by_me:,
+                                       removed_by_me:) }
+  end
+
+  def set_snapshot_conflict? added_by_current:, removed_by_current:,
+                             added_by_me:, removed_by_me:
+    (added_by_current & removed_by_me).present? || (removed_by_current & added_by_me).present?
+  end
+
+  def apply_post_snapshot! post, snapshot
+    PostVersionRecorder.ensure_snapshot!(post, created_by_user: current_user)
+
+    post.update!(title: snapshot[:title],
+                 original_created_from: snapshot[:original_created_from],
+                 original_created_before: snapshot[:original_created_before])
+
+    editable_tags = Tag.normalise_tags!(snapshot[:tag_names], with_tagme: false)
+    TagVersioning.record_tag_snapshots!(editable_tags, created_by_user: current_user)
+
+    readonly_tags = post.tags.nico.to_a
+
+    tags = readonly_tags + editable_tags
+    tags = Tag.expand_parent_tags(tags)
+
+    sync_post_tags!(post, tags)
+    sync_parent_posts!(post, snapshot[:parent_post_ids])
+
+    PostVersionRecorder.record!(post:, event_type: :update, created_by_user: current_user)
+  end
+
+  def merge_post_snapshots base_snapshot, current_snapshot, incoming_snapshot
+    [:title, :original_created_from, :original_created_before].map {
+      [_1, merge_scalar_snapshot_value(base_snapshot[_1],
+                                       current_snapshot[_1],
+                                       incoming_snapshot[_1])]
+    }.to_h.merge([:tag_names, :parent_post_ids].map {
+      [_1, merge_set_snapshot_value(base_snapshot[_1],
+                                    current_snapshot[_1],
+                                    incoming_snapshot[_1])]
+    }.to_h)
+  end
+
+  def merge_scalar_snapshot_value base, current, mine
+    return mine if current == base
+    return current if mine == base || current == mine
+
+    raise ArgumentError, '競合してゐる項目はマージできません．'
+  end
+
+  def merge_set_snapshot_value base, current, mine
+    base = base.to_a
+    current = current.to_a
+    mine = mine.to_a
+
+    added_by_current = current - base
+    removed_by_current = base - current
+    added_by_me = mine - base
+    removed_by_me = base - mine
+
+    merged = base + added_by_current + added_by_me
+    merged -= removed_by_current
+    merged -= removed_by_me
+
+    merged.uniq.sort
+  end
+
+  def render_post_form_record_invalid record
+    if record.is_a?(TagName) || record.is_a?(Tag)
+      render_validation_error fields: { tags: record.errors.full_messages.map { |message|
+        "タグ名 “#{ record.name }”: #{ message }"
+      } }
+    else
+      render_validation_error record
+    end
+  end
 end

backend/app/controllers/preview_controller.rb

@@ -4,7 +4,7 @@ class PreviewController < ApplicationController
     return head :unauthorized unless current_user
 
     url = params[:url]
-    return head :bad_request unless url.present?
+    return render_bad_request('URL は必須です．') unless url.present?
 
     unless url.start_with?(/http(s)?:\/\//)
       url = 'http://' + url
@@ -16,7 +16,7 @@ class PreviewController < ApplicationController
 
     render json: { title: title }
   rescue => e
-    render json: { error: e.message }, status: :bad_request
+    render_bad_request(e.message)
   end
 
   def thumbnail
@@ -25,7 +25,7 @@ class PreviewController < ApplicationController
     return head :unauthorized unless current_user
 
     url = params[:url]
-    return head :bad_request if url.blank?
+    return render_bad_request('URL は必須です．') if url.blank?
 
     unless url.start_with?(/http(s)?:\/\//)
       url = 'http://' + url
@@ -40,7 +40,11 @@ class PreviewController < ApplicationController
       File.delete(path) rescue nil
       send_file image.path, type: 'image/png', disposition: 'inline'
     else
-      render json: { error: 'Failed to generate thumbnail' }, status: :internal_server_error
+      render json: { type: 'internal_server_error',
+                     message: 'サムネールを生成できませんでした．',
+                     errors: { },
+                     base_errors: ['サムネールを生成できませんでした．'] },
+             status: :internal_server_error
     end
   end
 end

backend/app/controllers/tag_children_controller.rb

@@ -5,11 +5,12 @@ class TagChildrenController < ApplicationController
 
     parent_id = params[:parent_id]
     child_id = params[:child_id]
-    return head :bad_request if parent_id.blank? || child_id.blank?
+    return render_bad_request('parent_id は必須です．') if parent_id.blank?
+    return render_bad_request('child_id は必須です．') if child_id.blank?
 
     parent = Tag.find(parent_id)
     child = Tag.find(child_id)
-    return head :bad_request if parent.nico? || child.nico?
+    return render_bad_request('ニコニコ・タグの階層は変更できません．') if parent.nico? || child.nico?
 
     ApplicationRecord.transaction do
       TagVersioning.ensure_snapshot!(child, created_by_user: current_user)
@@ -27,11 +28,12 @@ class TagChildrenController < ApplicationController
 
     parent_id = params[:parent_id]
     child_id = params[:child_id]
-    return head :bad_request if parent_id.blank? || child_id.blank?
+    return render_bad_request('parent_id は必須です．') if parent_id.blank?
+    return render_bad_request('child_id は必須です．') if child_id.blank?
 
     parent = Tag.find(parent_id)
     child = Tag.find(child_id)
-    return head :bad_request if parent.nico? || child.nico?
+    return render_bad_request('ニコニコ・タグの階層は変更できません．') if parent.nico? || child.nico?
 
     ApplicationRecord.transaction do
       TagVersioning.ensure_snapshot!(child, created_by_user: current_user)

backend/app/controllers/tags_controller.rb

@@ -1,3 +1,7 @@
+require 'net/http'
+require 'uri'
+
+
 class TagsController < ApplicationController
   def index
     post_id = params[:post]
@@ -164,7 +168,7 @@ class TagsController < ApplicationController
 
   def show_by_name
     name = params[:name].to_s.strip
-    return head :bad_request if name.blank?
+    return render_bad_request('name は必須です．') if name.blank?
 
     tag = Tag.joins(:tag_name)
              .includes(:tag_name, :materials, tag_name: :wiki_page)
@@ -182,24 +186,52 @@ class TagsController < ApplicationController
              .find_by(id: params[:id])
     return head :not_found unless tag
 
-    render json: DeerjikistRepr.many(tag.deerjikists)
+    render json: { tag: TagRepr.base(tag),
+                   deerjikists: DeerjikistRepr.many(tag.deerjikists) }
   end
 
   def deerjikists_by_name
     name = params[:name].to_s.strip
-    return head :bad_request if name.blank?
+    return render_bad_request('name は必須です．') if name.blank?
 
     tag = Tag.joins(:tag_name)
              .includes(:tag_name, tag_name: :wiki_page)
              .find_by(tag_names: { name: })
     return head :not_found unless tag
 
-    render json: DeerjikistRepr.many(tag.deerjikists)
+    render json: { tag: TagRepr.base(tag),
+                   deerjikists: DeerjikistRepr.many(tag.deerjikists) }
+  end
+
+  def update_deerjikists
+    return head :unauthorized unless current_user
+    return head :forbidden unless current_user.gte_member?
+
+    tag = Tag.joins(:tag_name)
+             .includes(:tag_name, tag_name: :wiki_page)
+             .find_by(id: params[:id])
+    return head :not_found unless tag
+
+    ApplicationRecord.transaction do
+      tag.deerjikists = []
+      params[:_json].each.with_index do |item, i|
+        platform = item[:platform]
+        code = normalise_deerjikist_code(platform, item[:code])
+        deerjikist = Deerjikist.find_or_initialize_by(platform:, code:)
+        deerjikist.tag = tag
+        render_deerjikist_form_record_invalid(deerjikist, i) unless deerjikist.save
+        raise ActiveRecord::Rollback if performed?
+      end
+    end
+
+    return if performed?
+
+    render json: DeerjikistRepr.many(tag.reload.deerjikists)
   end
 
   def materials_by_name
     name = params[:name].to_s.strip
-    return head :bad_request if name.blank?
+    return render_bad_request('name は必須です．') if name.blank?
 
     tag = Tag.joins(:tag_name)
              .includes(:tag_name, :materials, tag_name: :wiki_page)
@@ -218,17 +250,16 @@ class TagsController < ApplicationController
 
     name = params[:name].to_s.strip
     category = params[:category].to_s.strip
-    return head :unprocessable_entity if name.blank? || category.blank?
+    return render_unprocessable_entity('名前は必須です．', field: :name) if name.blank?
+    return render_unprocessable_entity('カテゴリは必須です．', field: :category) if category.blank?
 
     if name != tag.name &&
         tag.in?([Tag.tagme, Tag.bot, Tag.no_deerjikist, Tag.video, Tag.niconico])
-      return render json: { error: 'システム・タグの名称は変更できません．' },
-                    status: :unprocessable_entity
+      return render_unprocessable_entity('システム・タグの名称は変更できません．', field: :name)
     end
 
     if tag.nico? || category == 'nico'
-      return render json: { error: 'ニコタグは変更できません．' },
-                    status: :unprocessable_entity
+      return render_unprocessable_entity('ニコタグは変更できません．', field: :category)
     end
 
     alias_names = params[:aliases].to_s.split.uniq
@@ -273,8 +304,7 @@ class TagsController < ApplicationController
     tag = Tag.find(params[:id])
 
     if tag.nico? || (category.present? && category == 'nico')
-      return render json: { error: 'ニコタグは変更できません．' },
-                    status: :unprocessable_entity
+      return render_unprocessable_entity('ニコタグは変更できません．', field: :category)
     end
 
     ApplicationRecord.transaction do
@@ -374,7 +404,7 @@ class TagsController < ApplicationController
   end
 
   def update_parent_tags! tag, parent_names
-    parent_tags = Tag.normalise_tags(parent_names, with_tagme: false,
+    parent_tags = Tag.normalise_tags!(parent_names, with_tagme: false,
                                                     with_no_deerjikist: false,
                                                     deny_nico: true)
 
@@ -391,4 +421,40 @@ class TagsController < ApplicationController
       TagImplication.create!(tag:, parent_tag:)
     end
   end
+
+  def normalise_deerjikist_code platform, code
+    return code if platform != 'youtube' || code[0] != '@'
+
+    url = "https://www.youtube.com/#{ code }"
+
+    html = Net::HTTP.get(URI(url))
+
+    canonical = html[
+        /<link rel="canonical" href="https:\/\/www\.youtube\.com\/channel\/(UC[a-zA-Z0-9_-]{22})"/,
+        1]
+    return canonical if canonical
+
+    html[/"channelId":"(UC[a-zA-Z0-9_-]{22})"/, 1] || html[/\bUC[a-zA-Z0-9_-]{22}\b/]
+  rescue
+    nil
+  end
+
+  def render_deerjikist_form_record_invalid deerjikist, index
+    fields = { }
+
+    deerjikist.errors.each do |error|
+      field =
+          case error.attribute
+          when :platform, :code
+            "deerjikists.#{ index }.#{ error.attribute }"
+          else
+            :deerjikists
+          end
+
+      fields[field] ||= []
+      fields[field] << error.full_message
+    end
+
+    render_validation_error fields:
+  end
 end

backend/app/controllers/theatre_comments_controller.rb

@@ -1,21 +1,28 @@
 class TheatreCommentsController < ApplicationController
   def index
+    limit = params[:limit].to_i
+    limit = 20 if limit <= 0
+
     no_gt = params[:no_gt].to_i
-    no_gt = 0 if no_gt.negative?
+    no_gt = 0 if no_gt < 0
 
     comments = TheatreComment
                .where(theatre_id: params[:theatre_id])
                .where('no > ?', no_gt)
                .order(no: :desc)
+               .limit(limit)
 
-    render json: comments.as_json(include: { user: { only: [:id, :name] } })
+    render json: comments.map {
+      _1.as_json(include: { user: { only: [:id, :name] } })
+          .merge(content: _1.discarded? ? nil : _1.content, deleted: _1.discarded?)
+    }
   end
 
   def create
     return head :unauthorized unless current_user
 
     content = params[:content]
-    return head :unprocessable_entity if content.blank?
+    return render_unprocessable_entity('本文は必須です．', field: :content) if content.blank?
 
     theatre = Theatre.find_by(id: params[:theatre_id])
     return head :not_found unless theatre
@@ -29,4 +36,19 @@ class TheatreCommentsController < ApplicationController
 
     render json: comment, status: :created
   end
+
+  def destroy
+    return head :unauthorized unless current_user
+
+    theatre_id = params[:theatre_id].to_i
+    no = params[:id].to_i
+
+    comment = TheatreComment.find_by(theatre_id:, no:)
+    return head :not_found unless comment
+    return head :forbidden unless comment.user == current_user
+
+    comment.discard!
+
+    head :no_content
+  end
 end

backend/app/controllers/theatre_programmes_controller.rb

@@ -0,0 +1,22 @@
+class TheatreProgrammesController < ApplicationController
+  def index
+    limit = params[:limit].to_i
+    limit = 100 if limit <= 0
+
+    position_gt = params[:position_gt].to_i
+    position_gt = 0 if position_gt < 0
+
+    programmes = TheatreProgramme
+                 .where(theatre_id: params[:theatre_id])
+                 .where('position > ?', position_gt)
+                 .includes(:post)
+                 .order(position: :desc).limit(100)
+                 .limit(limit)
+
+    render json: programmes.map { |programme|
+      programme.as_json.merge(post: { id: programme.post.id,
+                                      title: programme.post.title,
+                                      url: programme.post.url })
+    }
+  end
+end

backend/app/controllers/theatre_skip_events_controller.rb

@@ -0,0 +1,22 @@
+class TheatreSkipEventsController < ApplicationController
+  def index
+    limit = params[:limit].to_i
+    limit = 50 if limit <= 0
+
+    events =
+        TheatreSkipEvent
+        .where(theatre_id: params[:theatre_id])
+        .includes(:post, tags: :tag_name)
+        .order(created_at: :desc)
+        .limit(limit)
+
+    render json: events.map { |event|
+      { id: event.id,
+        theatre_id: event.theatre_id,
+        post: { id: event.post.id, title: event.post.title, url: event.post.url },
+        tags: event.tags.map { |tag| { id: tag.id, name: tag.name } },
+        programme_position: event.programme_position,
+        created_at: event.created_at }
+    }
+  end
+end

backend/app/controllers/theatres_controller.rb

@@ -31,9 +31,7 @@ class TheatresController < ApplicationController
       post_started_at = theatre.current_post_started_at
     end
 
-    render json: {
-        host_flg:, post_id:, post_started_at:,
-        watching_users: theatre.watching_users.as_json(only: [:id, :name]) }
+    render json: theatre_info_json(theatre, host_flg:, post_id:, post_started_at:)
   end
 
   def next_post
@@ -43,12 +41,119 @@ class TheatresController < ApplicationController
     return head :not_found unless theatre
     return head :forbidden if theatre.host_user != current_user
 
-    post = Post.where("url LIKE '%nicovideo.jp%'")
-           .or(Post.where("url LIKE '%youtube.com%'"))
-           .order('RAND()')
-           .first
-    theatre.update!(current_post: post, current_post_started_at: Time.current)
+    ApplicationRecord.transaction do
+      theatre.lock!
+      TheatrePostAdvancer.call(theatre:)
+    end
 
     head :no_content
   end
+
+  def skip_vote
+    return head :unauthorized unless current_user
+
+    theatre = Theatre.find_by(id: params[:id])
+    return head :not_found unless theatre
+    requested_post_id = params[:post_id].to_i
+    return head :unprocessable_entity if requested_post_id <= 0
+
+    skipped = false
+    conflicted = false
+
+    ApplicationRecord.transaction do
+      theatre.lock!
+      if theatre.current_post
+        TheatreWatchingUser.find_or_initialize_by(theatre:, user: current_user).tap {
+          _1.expires_at = 30.seconds.from_now
+        }.save!
+
+        if theatre.current_post_id != requested_post_id
+          conflicted = true
+          next
+        end
+
+        TheatreSkipVote.find_or_create_by!(theatre:, post_id: requested_post_id, user: current_user)
+
+        vote_status = skip_vote_status(theatre)
+        if vote_status[:votes_count] >= vote_status[:required_count]
+          TheatreSkipFinalizer.call(theatre:, user: current_user)
+          TheatrePostAdvancer.call(theatre:)
+          skipped = true
+        end
+      end
+    end
+
+    theatre.reload
+    return render json: theatre_info_json(theatre, skipped: false), status: :conflict if conflicted
+
+    render json: theatre_info_json(theatre, skipped:)
+  end
+
+  def unskip_vote
+    return head :unauthorized unless current_user
+
+    theatre = Theatre.find_by(id: params[:id])
+    return head :not_found unless theatre
+    requested_post_id = params[:post_id].to_i
+    return head :unprocessable_entity if requested_post_id <= 0
+
+    conflicted = false
+
+    theatre.with_lock do
+      if theatre.current_post
+        if theatre.current_post_id != requested_post_id
+          conflicted = true
+        else
+          TheatreSkipVote.where(theatre:, post_id: requested_post_id, user: current_user).delete_all
+        end
+      end
+    end
+
+    theatre.reload
+    return render json: theatre_info_json(theatre, skipped: false), status: :conflict if conflicted
+
+    render json: theatre_info_json(theatre, skipped: false)
+  end
+
+  def post_selection_weights
+    theatre = Theatre.find_by(id: params[:id])
+    return head :not_found unless theatre
+
+    render json: TheatrePostSelector.new(theatre:).weight_json
+  end
+
+  private
+
+  def theatre_info_json(theatre, host_flg: nil, post_id: nil, post_started_at: nil, skipped: nil)
+    host_flg = theatre.host_user_id == current_user&.id if host_flg.nil?
+    post_id = theatre.current_post_id if post_id.nil?
+    post_started_at = theatre.current_post_started_at if post_started_at.nil?
+
+    json = { host_flg:,
+             post_id:,
+             post_started_at:,
+             post_elapsed_ms: post_started_at ? ((Time.current - post_started_at) * 1000).floor : nil,
+             watching_users: theatre.watching_users.as_json(only: [:id, :name]),
+             skip_vote: skip_vote_status(theatre) }
+    json[:skipped] = skipped unless skipped.nil?
+    json
+  end
+
+  def skip_vote_status(theatre)
+    watching_user_ids = theatre.watching_users.ids
+    watching_users_count = watching_user_ids.size
+    required_count = (watching_users_count / 2) + 1
+    post = theatre.current_post
+    votes =
+        if post
+          TheatreSkipVote.where(theatre:, post:, user_id: watching_user_ids)
+        else
+          TheatreSkipVote.none
+        end
+
+    { votes_count: post ? votes.count : 0,
+      required_count:,
+      watching_users_count:,
+      voted: post && current_user ? votes.exists?(user_id: current_user.id) : false }
+  end
 end

backend/app/controllers/users_controller.rb

@@ -1,9 +1,6 @@
 class UsersController < ApplicationController
   def create
-    return head :unprocessable_entity if request.remote_ip.blank?
-
     user = nil
-
     User.transaction do
       user = User.create!(inheritance_code: SecureRandom.uuid, role: :guest)
       attach_ip_address!(user)
@@ -17,8 +14,7 @@ class UsersController < ApplicationController
   def verify
     user = User.find_by(inheritance_code: params[:code])
     return render json: { valid: false } unless user
-
-    return head :unprocessable_entity if request.remote_ip.blank?
+    return head :forbidden if user.banned?
 
     attach_ip_address!(user)
 
@@ -46,12 +42,12 @@ class UsersController < ApplicationController
     return head :unauthorized if user&.id != params[:id].to_i
 
     name = params[:name]
-    return head :bad_request if name.blank?
+    return render_unprocessable_entity('名前は必須です．', field: :name) if name.blank?
 
     if user.update(name:)
       render json: user.slice(:id, :name, :inheritance_code, :role), status: :ok
     else
-      render json: user.errors, status: :unprocessable_entity
+      render_validation_error user
     end
   end
 

backend/app/controllers/wiki_assets_controller.rb

@@ -1,39 +0,0 @@
-require 'digest'
-
-
-class WikiAssetsController < ApplicationController
-  def index
-    page_id = params[:wiki_page_id].to_i
-    page = WikiPage.find_by(id: page_id)
-    return head :not_found unless page
-
-    render json: WikiAssetRepr.many(page.assets)
-  end
-
-  def create
-    return head :unauthorized unless current_user
-    return head :forbidden unless current_user.gte_member?
-
-    wiki_page_id = params[:wiki_page_id].to_i
-    page = WikiPage.find_by(id: wiki_page_id)
-    return head :not_found unless page
-
-    file = params[:file]
-    return head :bad_request if file.blank?
-
-    asset = nil
-    page.with_lock do
-      no = page.next_asset_no
-      alt_text = params[:alt_text].presence
-      sha256 = Digest::SHA256.file(file.tempfile.path).digest
-
-      asset = WikiAsset.new(wiki_page_id:, no:, alt_text:, sha256:, created_by_user: current_user)
-      asset.file.attach(file)
-      asset.save!
-
-      page.update!(next_asset_no: no + 1)
-    end
-
-    render json: WikiAssetRepr.base(asset)
-  end
-end

backend/app/controllers/wiki_pages_controller.rb

@@ -46,7 +46,7 @@ class WikiPagesController < ApplicationController
 
   def diff
     id = params[:id]
-    return head :bad_request if id.blank?
+    return render_bad_request('id は必須です．') if id.blank?
 
     from = params[:from].presence
     to = params[:to].presence
@@ -56,7 +56,7 @@ class WikiPagesController < ApplicationController
     from_rev = from && page.wiki_revisions.find(from)
     to_rev = to ? page.wiki_revisions.find(to) : page.current_revision
     if ((from_rev && !(from_rev.content?)) || !(to_rev&.content?))
-      return head :unprocessable_entity
+      return render_unprocessable_entity('差分を表示できない版です．')
     end
 
     diffs = Diff::LCS.sdiff(from_rev&.body&.lines || [], to_rev.body.lines)
@@ -89,7 +89,8 @@ class WikiPagesController < ApplicationController
     body = params[:body].to_s
     message = params[:message].presence
 
-    return head :unprocessable_entity if title.blank? || body.blank?
+    return render_unprocessable_entity('タイトルは必須です．', field: :title) if title.blank?
+    return render_unprocessable_entity('本文は必須です．', field: :body) if body.blank?
 
     tag_name = TagName.find_undiscard_or_create_by!(name: title)
 
@@ -101,18 +102,21 @@ class WikiPagesController < ApplicationController
             message:)
 
     render json: WikiPageRepr.base(page), status: :created
-  rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotUnique
-    head :unprocessable_entity
+  rescue ActiveRecord::RecordInvalid => e
+    render_validation_error e.record
+  rescue ActiveRecord::RecordNotUnique
+    render_record_not_unique
   end
 
   def update
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
-    title = params[:title].to_s.strip
+    title = params[:title]&.strip
     body = params[:body].to_s
 
-    return head :unprocessable_entity if title.blank? || body.blank?
+    return render_unprocessable_entity('タイトルは必須です．', field: :title) if title.blank?
+    return render_unprocessable_entity('本文は必須です．', field: :body) if body.blank?
 
     page = WikiPage.find(params[:id])
     base_revision_id = params[:base_revision_id].presence
@@ -143,14 +147,7 @@ class WikiPagesController < ApplicationController
       end
     end
 
-    message = params[:message].presence
-    Wiki::Commit.content!(page:,
-                          body:,
-                          created_user: current_user,
-                          message:,
-                          base_revision_id:)
-
-    render json: WikiPageRepr.base(page).merge(body:)
+    head :ok
   end
 
   def search

backend/app/models/gekanator_ai_run.rb

@@ -0,0 +1,21 @@
+class GekanatorAiRun < ApplicationRecord
+  STATUSES = ['pending', 'running', 'succeeded', 'failed', 'blocked_budget'].freeze
+
+  belongs_to :gekanator_question_suggestion
+
+  validates :model, presence: true, length: { maximum: 255 }
+  validates :status, presence: true, inclusion: { in: STATUSES }
+  validates :input_tokens,
+            presence: true,
+            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
+  validates :output_tokens,
+            presence: true,
+            numericality: { only_integer: true, greater_than_or_equal_to: 0 }
+  validates :estimated_cost_jpy,
+            presence: true,
+            numericality: { greater_than_or_equal_to: 0 }
+
+  scope :this_month, lambda {
+    where(created_at: Time.current.beginning_of_month..Time.current.end_of_month)
+  }
+end

backend/app/models/gekanator_game.rb

@@ -0,0 +1,15 @@
+class GekanatorGame < ApplicationRecord
+  belongs_to :user
+  belongs_to :guessed_post, class_name: 'Post'
+  belongs_to :correct_post, class_name: 'Post'
+  has_many :question_suggestions,
+           class_name: 'GekanatorQuestionSuggestion',
+           dependent: :delete_all
+  has_many :question_examples,
+           class_name: 'GekanatorQuestionExample',
+           dependent: :delete_all
+
+  validates :answers, presence: true
+  validates :question_count, numericality: { greater_than_or_equal_to: 0 }
+  validates :won, inclusion: { in: [true, false] }
+end

backend/app/models/gekanator_question.rb

@@ -0,0 +1,23 @@
+class GekanatorQuestion < ApplicationRecord
+  KINDS = ['tag', 'source', 'title', 'original_date', 'post_similarity'].freeze
+  SOURCES = ['user_suggested', 'ai_generated', 'admin_curated'].freeze
+  STATUSES = ['pending', 'accepted', 'rejected', 'disabled'].freeze
+
+  belongs_to :gekanator_question_suggestion, optional: true
+  belongs_to :created_by, class_name: 'User', optional: true
+  has_many :gekanator_question_examples, dependent: :delete_all
+
+  validates :kind, presence: true, inclusion: { in: KINDS }
+  validates :source, presence: true, inclusion: { in: SOURCES }
+  validates :status, presence: true, inclusion: { in: STATUSES }
+  validates :text, presence: true, length: { maximum: 1000 }
+  validates :condition, presence: true
+  validates :priority_weight,
+            presence: true,
+            numericality: {
+              greater_than: 0,
+              less_than_or_equal_to: 3
+            }
+
+  scope :accepted, -> { where(status: 'accepted') }
+end

backend/app/models/gekanator_question_example.rb

@@ -0,0 +1,97 @@
+class GekanatorQuestionExample < ApplicationRecord
+  ANSWERS = GekanatorQuestionSuggestion::ANSWERS
+  NON_UNKNOWN_ANSWERS = ANSWERS - ['unknown']
+  SOURCES = ['initial_suggestion', 'post_game_extra'].freeze
+
+  belongs_to :gekanator_question
+  belongs_to :post
+  belongs_to :user
+  belongs_to :gekanator_game, optional: true
+
+  validates :answer, presence: true, inclusion: { in: ANSWERS }
+  validates :answer_counts, presence: true
+  validates :sample_count,
+            presence: true,
+            numericality: {
+              only_integer: true,
+              greater_than: 0
+            }
+  validates :source, presence: true, inclusion: { in: SOURCES }
+  validates :weight,
+            presence: true,
+            numericality: {
+              greater_than: 0
+            }
+
+  before_validation :normalize_learning_state
+
+  def record_answer!(answer:, source:, gekanator_game: nil)
+    answer = answer.to_s
+    raise ArgumentError, 'invalid answer' unless ANSWERS.include?(answer)
+
+    counts = normalized_answer_counts
+    counts[answer] += 1
+
+    self.answer_counts = counts
+    self.sample_count = counts.values.sum
+    self.gekanator_game = gekanator_game if gekanator_game.present?
+    self.source = source if new_record?
+
+    apply_aggregated_answer!(preferred_answer: answer)
+    self
+  end
+
+  private
+
+  def normalize_learning_state
+    counts = normalized_answer_counts
+
+    if counts.values.sum.zero? && answer.present?
+      counts[answer] = 1
+    end
+
+    self.answer_counts = counts
+    self.sample_count = counts.values.sum
+
+    apply_aggregated_answer!
+  end
+
+  def apply_aggregated_answer!(preferred_answer: nil)
+    counts = normalized_answer_counts
+    known_counts = counts.slice(*NON_UNKNOWN_ANSWERS)
+    known_total = known_counts.values.sum
+
+    if known_total.zero?
+      self.answer = 'unknown'
+      self.weight = 0.1
+      return
+    else
+      max_count = known_counts.values.max
+      candidates = known_counts.select { |_answer, count| count == max_count }.keys
+      self.answer =
+          if preferred_answer.present? && candidates.include?(preferred_answer)
+            preferred_answer
+          elsif answer.present? && candidates.include?(answer)
+            answer
+          else
+            candidates.first
+          end
+    end
+
+    consensus = max_count.to_f / known_total
+    self.weight = Math.sqrt(known_total) * consensus
+  end
+
+  def normalized_answer_counts
+    base = ANSWERS.index_with(0)
+
+    answer_counts.to_h.each do |key, value|
+      answer_key = key.to_s
+      next unless ANSWERS.include?(answer_key)
+
+      base[answer_key] = value.to_i
+    end
+
+    base
+  end
+end

backend/app/models/gekanator_question_suggestion.rb

@@ -0,0 +1,25 @@
+class GekanatorQuestionSuggestion < ApplicationRecord
+  MAX_QUESTIONS_PER_GAME = 3
+  ANSWERS = ['yes', 'no', 'partial', 'probably_no', 'unknown'].freeze
+
+  belongs_to :gekanator_game
+  belongs_to :user
+  has_many :gekanator_questions, dependent: :nullify
+  has_many :gekanator_ai_runs, dependent: :destroy
+
+  validates :question_text, presence: true, length: { maximum: 1000 }
+  validates :answer, presence: true, inclusion: { in: ANSWERS }
+  validates :processed, inclusion: { in: [true, false] }
+  validate :question_suggestion_limit_per_game, on: :create
+
+  private
+
+  def question_suggestion_limit_per_game
+    return if gekanator_game_id.blank?
+
+    count = GekanatorQuestionSuggestion.where(gekanator_game_id:).count
+    if count >= MAX_QUESTIONS_PER_GAME
+      errors.add(:base, '質問追加数を超えてゐます．')
+    end
+  end
+end

backend/app/models/ip_address.rb

@@ -4,11 +4,7 @@ class IpAddress < ApplicationRecord
   has_many :user_ips, dependent: :destroy
   has_many :users, through: :user_ips
 
-  def banned? = banned_at?
-  def banned = banned?
-
-  def banned= value
-    bool = ActiveModel::Type::Boolean.new.cast(value)
-    self.banned_at = bool ? banned_at || Time.current : nil
-  end
+  def banned? = banned_at.present?
+  def ban! = banned? || update!(banned_at: Time.current)
+  def unban! = update!(banned_at: nil)
 end

backend/app/models/post.rb

@@ -11,9 +11,36 @@ class Post < ApplicationRecord
   has_many :user_post_views, dependent: :delete_all
   has_many :post_similarities, dependent: :delete_all
   has_many :post_versions
+  has_many :gekanator_guessed_games,
+           class_name: 'GekanatorGame',
+           foreign_key: :guessed_post_id,
+           dependent: :delete_all,
+           inverse_of: :guessed_post
+  has_many :gekanator_correct_games,
+           class_name: 'GekanatorGame',
+           foreign_key: :correct_post_id,
+           dependent: :delete_all,
+           inverse_of: :correct_post
+  has_many :gekanator_question_examples, dependent: :delete_all
+
+  has_many :parent_post_implications,
+           class_name: 'PostImplication',
+           foreign_key: :post_id,
+           dependent: :destroy,
+           inverse_of: :post
+  has_many :parents, through: :parent_post_implications, source: :parent_post
+
+  has_many :child_post_implications,
+           class_name: 'PostImplication',
+           foreign_key: :parent_post_id,
+           dependent: :destroy,
+           inverse_of: :parent_post
+  has_many :children, through: :child_post_implications, source: :post
 
   has_one_attached :thumbnail
 
+  attribute :version_no, :integer, default: 1
+
   before_validation :normalise_url
 
   validates :url, presence: true, uniqueness: true
@@ -21,17 +48,29 @@ class Post < ApplicationRecord
   validate :validate_original_created_range
   validate :url_must_be_http_url
 
+  def parent_posts = parents
+
+  def child_posts = children
+
+  def sibling_posts
+    parent_post_ids = parent_posts.order(:id).pluck(:id)
+
+    parent_post_ids.to_h { [_1, PostImplication.where(parent_post: _1).map(&:post)] }
+  end
+
   def as_json options = { }
-    super(options).merge({ thumbnail: thumbnail.attached? ?
+    super(options).merge(thumbnail: thumbnail.attached? ?
                                     Rails.application.routes.url_helpers.rails_blob_url(
                                         thumbnail, only_path: false) :
-                                      nil })
+                                    nil)
   rescue
     super(options).merge(thumbnail: nil)
   end
 
   def snapshot_tag_names = tags.joins(:tag_name).order('tag_names.name').pluck('tag_names.name')
 
+  def snapshot_parent_post_ids = parents.order(:id).pluck(:id)
+
   def related limit: nil
     ids = post_similarities.order(cos: :desc)
     ids = ids.limit(limit) if limit
@@ -66,7 +105,7 @@ class Post < ApplicationRecord
     return if !(f) || !(b)
 
     if f >= b
-      errors.add :original_created_before, 'オリジナルの作成日時の順番がをかしぃです．'
+      errors.add :original_created_at, 'オリジナルの作成日時の順番がをかしぃです．'
     end
   end
 

backend/app/models/post_implication.rb

@@ -0,0 +1,19 @@
+class PostImplication < ApplicationRecord
+  self.primary_key = :post_id, :parent_post_id
+
+  belongs_to :post, inverse_of: :parent_post_implications
+  belongs_to :parent_post, class_name: 'Post', inverse_of: :child_post_implications
+
+  validates :post_id, presence: true, uniqueness: { scope: :parent_post_id }
+  validates :parent_post_id, presence: true
+
+  validate :parent_post_mustnt_be_itself
+
+  private
+
+  def parent_post_mustnt_be_itself
+    if parent_post_id == post_id
+      errors.add :parent_post_id, '親投稿に同じ投稿を設定することはできません．'
+    end
+  end
+end

backend/app/models/post_version.rb

@@ -2,6 +2,7 @@ class PostVersion < ApplicationRecord
   include VersionRecord
 
   belongs_to :post
+  belongs_to :parent, class_name: 'Post', optional: true
 
   validates :url, presence: true
 

backend/app/models/tag.rb

@@ -40,6 +40,8 @@ class Tag < ApplicationRecord
   belongs_to :tag_name
   delegate :wiki_page, to: :tag_name
 
+  attribute :version_no, :integer, default: 1
+
   delegate :name, to: :tag_name, allow_nil: true
   validates :tag_name, presence: true
 
@@ -79,6 +81,8 @@ class Tag < ApplicationRecord
 
   def material_id = materials.first&.id
 
+  def has_deerjikists = deerjikists.loaded? ? deerjikists.any? : deerjikists.exists?
+
   def self.tagme = find_or_create_by_tag_name!('タグ希望', category: :meta)
   def self.bot = find_or_create_by_tag_name!('bot操作', category: :meta)
   def self.no_deerjikist = find_or_create_by_tag_name!('ニジラー情報不詳', category: :meta)
@@ -86,7 +90,7 @@ class Tag < ApplicationRecord
   def self.niconico = find_or_create_by_tag_name!('ニコニコ', category: :meta)
   def self.youtube = find_or_create_by_tag_name!('YouTube', category: :meta)
 
-  def self.normalise_tags tag_names, with_tagme: true,
+  def self.normalise_tags! tag_names, with_tagme: true,
                                       with_no_deerjikist: true,
                                       deny_nico: true
     if deny_nico && tag_names.any? { |n| n.downcase.start_with?('nico:') }

backend/app/models/theatre.rb

@@ -7,6 +7,10 @@ class Theatre < ApplicationRecord
            class_name: 'TheatreWatchingUser', inverse_of: :theatre
   has_many :watching_users, through: :active_theatre_watching_users, source: :user
 
+  has_many :programmes, class_name: 'TheatreProgramme'
+  has_many :skip_votes, class_name: 'TheatreSkipVote', dependent: :delete_all
+  has_many :skip_events, class_name: 'TheatreSkipEvent', dependent: :delete_all
+
   belongs_to :host_user, class_name: 'User', optional: true
   belongs_to :current_post, class_name: 'Post', optional: true
   belongs_to :created_by_user, class_name: 'User'

backend/app/models/theatre_programme.rb

@@ -0,0 +1,6 @@
+class TheatreProgramme < ApplicationRecord
+  self.primary_key = :theatre_id, :position
+
+  belongs_to :theatre
+  belongs_to :post
+end

backend/app/models/theatre_skip_event.rb

@@ -0,0 +1,10 @@
+class TheatreSkipEvent < ApplicationRecord
+  belongs_to :theatre
+  belongs_to :post
+  belongs_to :skipped_by_user, class_name: 'User'
+
+  has_many :voters, class_name: 'TheatreSkipEventVoter', dependent: :delete_all
+  has_many :event_tags, class_name: 'TheatreSkipEventTag', dependent: :delete_all
+  has_many :users, through: :voters
+  has_many :tags, through: :event_tags
+end

backend/app/models/theatre_skip_event_tag.rb

@@ -0,0 +1,6 @@
+class TheatreSkipEventTag < ApplicationRecord
+  self.primary_key = :theatre_skip_event_id, :tag_id
+
+  belongs_to :theatre_skip_event
+  belongs_to :tag
+end

backend/app/models/theatre_skip_event_voter.rb

@@ -0,0 +1,6 @@
+class TheatreSkipEventVoter < ApplicationRecord
+  self.primary_key = :theatre_skip_event_id, :user_id
+
+  belongs_to :theatre_skip_event
+  belongs_to :user
+end

backend/app/models/theatre_skip_vote.rb

@@ -0,0 +1,7 @@
+class TheatreSkipVote < ApplicationRecord
+  self.primary_key = :theatre_id, :post_id, :user_id
+
+  belongs_to :theatre
+  belongs_to :post
+  belongs_to :user
+end

backend/app/models/user.rb

@@ -17,14 +17,11 @@ class User < ApplicationRecord
   has_many :updated_wiki_pages,
            class_name: 'WikiPage', foreign_key: :updated_user_id, dependent: :nullify
 
-  def banned? = banned_at?
-  def banned = banned?
-
-  def banned= value
-    bool = ActiveModel::Type::Boolean.new.cast(value)
-    self.banned_at = bool ? (banned_at || Time.current) : nil
-  end
-
   def viewed?(post) = user_post_views.exists?(post_id: post.id)
+
   def gte_member? = member? || admin?
+
+  def banned? = banned_at.present?
+  def ban! = banned? || update!(banned_at: Time.current)
+  def unban! = update!(banned_at: nil)
 end

backend/app/models/wiki_asset.rb

@@ -1,12 +0,0 @@
-class WikiAsset < ApplicationRecord
-  belongs_to :wiki_page
-  belongs_to :created_by_user, class_name: 'User'
-
-  has_one_attached :file
-
-  validates :file, presence: true
-
-  def url
-    Rails.application.routes.url_helpers.rails_blob_url(file, only_path: true)
-  end
-end

backend/app/models/wiki_page.rb

@@ -13,10 +13,10 @@ class WikiPage < ApplicationRecord
            foreign_key: :redirect_page_id,
            dependent: :nullify
 
-  has_many :assets, class_name: 'WikiAsset', dependent: :destroy
-
   has_many :wiki_versions
 
+  attribute :version_no, :integer, default: 1
+
   belongs_to :tag_name
   validates :tag_name, presence: true
   validates :body, presence: true

backend/app/representations/post_repr.rb

@@ -2,19 +2,65 @@
 
 
 module PostRepr
-  BASE = { include: { tags: TagRepr::BASE, uploaded_user: UserRepr::BASE } }.freeze
+  BASE_FIELDS = [
+      :id,
+      :version_no,
+      :url,
+      :title,
+      :thumbnail_base,
+      :original_created_from,
+      :original_created_before,
+      :created_at,
+      :updated_at
+  ].freeze
 
   module_function
 
   def base post, current_user = nil
-    json = post.as_json(BASE)
-    return json.merge(viewed: false) unless current_user
+    json = common(post)
+    json['tags'] = tag_json(post.tags)
+    json['uploaded_user'] = post.uploaded_user && UserRepr.base(post.uploaded_user)
+    json['viewed'] = current_user ? current_user.viewed?(post) : false
+    json
+  end
 
-    viewed = current_user.viewed?(post)
-    json.merge(viewed:)
+  def detail post, current_user = nil, parent_posts: [], child_posts: [],
+             sibling_posts: { }, related: []
+    base(post, current_user).merge(
+        'parent_posts' => cards(parent_posts),
+        'child_posts' => cards(child_posts),
+        'sibling_posts' => sibling_posts.transform_keys(&:to_s).transform_values { |posts|
+          cards(posts)
+        },
+        'related' => cards(related))
+  end
+
+  def card post
+    common(post).merge('parent_posts' => [], 'child_posts' => [])
+  end
+
+  def cards posts
+    posts.map { |post| card(post) }
   end
 
   def many posts, current_user = nil
     posts.map { |p| base(p, current_user) }
   end
+
+  def common post
+    BASE_FIELDS.to_h { |field| [field.to_s, post.public_send(field)] }
+               .merge('thumbnail' => thumbnail_url(post))
+  end
+
+  def tag_json tags
+    tags.map { |tag| TagRepr.inline(tag) }
+  end
+
+  def thumbnail_url post
+    return nil unless post.thumbnail.attached?
+
+    Rails.application.routes.url_helpers.rails_blob_url(post.thumbnail, only_path: false)
+  rescue
+    nil
+  end
 end

backend/app/representations/tag_repr.rb

@@ -3,7 +3,7 @@
 
 module TagRepr
   BASE = { only: [:id, :category, :post_count, :created_at, :updated_at],
-           methods: [:name, :has_wiki, :material_id] }.freeze
+           methods: [:name, :has_wiki, :material_id, :has_deerjikists] }.freeze
 
   module_function
 
@@ -12,5 +12,9 @@ module TagRepr
                             parents: tag.parents.map { _1.as_json(BASE) })
   end
 
+  def inline tag
+    tag.as_json(BASE).merge(aliases: [], parents: [])
+  end
+
   def many(tags) = tags.map { |t| base(t) }
 end

backend/app/representations/wiki_asset_repr.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-
-module WikiAssetRepr
-  BASE = { only: [:wiki_page_id, :no], methods: [:url] }.freeze
-
-  module_function
-
-  def base wiki_asset
-    wiki_asset.as_json(BASE)
-  end
-
-  def many wiki_assets
-    wiki_assets.map { |a| base(a) }
-  end
-end

backend/app/services/gekanator/ai_run_budget.rb

@@ -0,0 +1,22 @@
+module Gekanator
+  class AiRunBudget
+    MONTHLY_LIMIT_JPY = BigDecimal('450').freeze
+    MAX_RUN_ESTIMATED_COST_JPY = BigDecimal('5').freeze
+
+    def self.remaining_monthly_budget_jpy
+      MONTHLY_LIMIT_JPY - monthly_cost_jpy
+    end
+
+    def self.monthly_cost_jpy
+      GekanatorAiRun.this_month.sum(:estimated_cost_jpy)
+    end
+
+    def self.exceeded?
+      monthly_cost_jpy >= MONTHLY_LIMIT_JPY
+    end
+
+    def self.exceeded_after_next_run?
+      monthly_cost_jpy + MAX_RUN_ESTIMATED_COST_JPY >= MONTHLY_LIMIT_JPY
+    end
+  end
+end

backend/app/services/gekanator/question_suggestion_ai_converter.rb

@@ -0,0 +1,168 @@
+module Gekanator
+  class QuestionSuggestionAiConverter
+    # Temporary heuristic converter for #361.
+    # This creates pending ai_generated questions without external LLM calls;
+    # accepted questions are still distributed only after admin approval.
+    TITLE_LENGTH_RE = /\Aタイトルは\s*(\d+)\s*文字以上[？?]\z/
+    ORIGINAL_YEAR_RE = /\Aオリジナルの投稿年は\s*(\d{4})\s*年[？?]\z/
+    ORIGINAL_MONTH_RE = /\Aオリジナルの投稿月は\s*(\d{1,2})\s*月[？?]\z/
+    ORIGINAL_MONTH_DAY_RE = /\Aオリジナルの投稿日は\s*(\d{1,2})\s*月\s*(\d{1,2})\s*日[？?]\z/
+    TITLE_CONTAINS_RE = /\A題名に「(.+?)」が含まれる[？?]\z/
+    SOURCE_RE = /\A(.+?)\s+の投稿を思[ひい]浮かべて[ゐい]る[？?]\z/
+
+    def self.call(...) = new(...).call
+
+    def initialize suggestion:, user:
+      @suggestion = suggestion
+      @user = user
+    end
+
+    def call
+      suggestion.with_lock do
+        existing = existing_generated_question
+        return existing if existing
+
+        run = suggestion.gekanator_ai_runs.create!(
+            model: 'heuristic_converter_v1',
+            status: 'running',
+            input_tokens: 0,
+            output_tokens: 0,
+            estimated_cost_jpy: 0)
+
+        question_attributes = build_question
+        question =
+            question_attributes &&
+            GekanatorQuestion.create!(
+                **question_attributes,
+                source: 'ai_generated',
+                status: 'pending',
+                gekanator_question_suggestion: suggestion,
+                created_by: user)
+
+        run.update!(status: question ? 'succeeded' : 'failed')
+        question
+      end
+    rescue => error
+      run&.update!(status: 'failed') if run&.persisted? && run.status != 'failed'
+      raise error
+    end
+
+    private
+
+    attr_reader :suggestion, :user
+
+    def existing_generated_question
+      suggestion
+          .gekanator_questions
+          .where(source: 'ai_generated')
+          .order(id: :desc)
+          .first
+    end
+
+    def build_question
+      text = normalized_text
+      return nil if text.blank?
+
+      structured_question_for(text) || post_similarity_question_for(text)
+    end
+
+    def normalized_text
+      suggestion.question_text.to_s.gsub(/[[:space:]]+/, ' ').strip
+    end
+
+    def structured_question_for text
+      case text
+      when TITLE_LENGTH_RE
+        length = Regexp.last_match(1).to_i
+        return nil if length <= 0
+
+        {
+          text:,
+          kind: 'title',
+          condition: {
+            type: 'title-length-at-least',
+            length:
+          },
+          priority_weight: 0.95
+        }
+      when /\A題名に英数字が混じって[ゐい]る[？?]\z/
+        {
+          text: '題名に英数字が混じってゐる?',
+          kind: 'title',
+          condition: { type: 'title-has-ascii' },
+          priority_weight: 0.95
+        }
+      when ORIGINAL_YEAR_RE
+        year = Regexp.last_match(1).to_i
+        {
+          text:,
+          kind: 'original_date',
+          condition: { type: 'original-year', year: },
+          priority_weight: 0.95
+        }
+      when ORIGINAL_MONTH_RE
+        month = Regexp.last_match(1).to_i
+        return nil unless month.between?(1, 12)
+
+        {
+          text:,
+          kind: 'original_date',
+          condition: { type: 'original-month', month: },
+          priority_weight: 0.95
+        }
+      when ORIGINAL_MONTH_DAY_RE
+        month = Regexp.last_match(1).to_i
+        day = Regexp.last_match(2).to_i
+        return nil unless month.between?(1, 12) && day.between?(1, 31)
+
+        {
+          text:,
+          kind: 'original_date',
+          condition: {
+            type: 'original-month-day',
+            monthDay: "#{ month }-#{ day }"
+          },
+          priority_weight: 0.95
+        }
+      when TITLE_CONTAINS_RE
+        title_text = Regexp.last_match(1).to_s.strip
+        return nil if title_text.blank?
+
+        {
+          text: "題名に「#{ title_text }」が含まれる?",
+          kind: 'title',
+          condition: { type: 'title-contains', text: title_text },
+          priority_weight: 0.95
+        }
+      when SOURCE_RE
+        host = Regexp.last_match(1).to_s.strip
+        return nil if host.blank?
+
+        {
+          text:,
+          kind: 'source',
+          condition: { type: 'source', host: },
+          priority_weight: 0.95
+        }
+      else
+        nil
+      end
+    end
+
+    def post_similarity_question_for text
+      return nil if suggestion.answer == 'unknown'
+
+      {
+        text:,
+        kind: 'post_similarity',
+        condition: {
+          type: 'post-similarity',
+          postId: suggestion.gekanator_game.correct_post_id,
+          answer: suggestion.answer,
+          threshold: 0.65
+        },
+        priority_weight: 1.0
+      }
+    end
+  end
+end

backend/app/services/gekanator/question_suggestion_promoter.rb

@@ -0,0 +1,52 @@
+module Gekanator
+  class QuestionSuggestionPromoter
+    def self.call(...) = new(...).call
+
+    def initialize suggestion:, user:
+      @suggestion = suggestion
+      @user = user
+    end
+
+    def call
+      suggestion.with_lock do
+        return promoted_question if suggestion.processed?
+        return suggestion if suggestion.answer == 'unknown'
+
+        question = GekanatorQuestion.create!(
+            text: suggestion.question_text,
+            kind: 'post_similarity',
+            source: 'user_suggested',
+            status: 'accepted',
+            priority_weight: 1.2,
+            condition: {
+              type: 'post-similarity',
+              postId: suggestion.gekanator_game.correct_post_id,
+              answer: suggestion.answer,
+              threshold: 0.65
+            },
+            gekanator_question_suggestion: suggestion,
+            created_by: user)
+        example =
+            GekanatorQuestionExample.new(
+                gekanator_question: question,
+                post: suggestion.gekanator_game.correct_post,
+                user: user)
+        example.record_answer!(
+            answer: suggestion.answer,
+            source: 'initial_suggestion',
+            gekanator_game: suggestion.gekanator_game)
+        example.save!
+        suggestion.update!(processed: true)
+        question
+      end
+    end
+
+    private
+
+    attr_reader :suggestion, :user
+
+    def promoted_question
+      suggestion.gekanator_questions.order(id: :desc).first
+    end
+  end
+end

backend/app/services/post_version_recorder.rb

@@ -24,6 +24,7 @@ class PostVersionRecorder < VersionRecorder
       url: @record.url,
       thumbnail_base: @record.thumbnail_base,
       tags: @record.snapshot_tag_names.join(' '),
+      parent_post_ids: @record.snapshot_parent_post_ids.join(' '),
       original_created_from: @record.original_created_from,
       original_created_before: @record.original_created_before }
   end

backend/app/services/theatre_post_advancer.rb

@@ -0,0 +1,29 @@
+class TheatrePostAdvancer
+  def self.call(theatre:)
+    new(theatre:).call
+  end
+
+  def initialize(theatre:)
+    @theatre = theatre
+  end
+
+  def call
+    previous_post = theatre.current_post
+    post = TheatrePostSelector.new(theatre:).select
+
+    TheatreSkipVote.where(theatre:, post: previous_post).delete_all if previous_post
+
+    theatre.update!(current_post: post, current_post_started_at: post ? Time.current : nil)
+
+    if post
+      position = (theatre.programmes.maximum(:position) || 0) + 1
+      theatre.programmes.create!(position:, post:)
+    end
+
+    post
+  end
+
+  private
+
+  attr_reader :theatre
+end

backend/app/services/theatre_post_selector.rb

@@ -0,0 +1,119 @@
+class TheatrePostSelector
+  Candidate = Struct.new(:post, :weight, :penalty, :tags, keyword_init: true)
+  ELIGIBLE_POST_URL_CONDITION =
+      ["url LIKE '%nicovideo.jp%'",
+       "url LIKE '%youtube.com/watch%'",
+       "url LIKE '%youtu.be/%'"]
+      .join(' OR ')
+
+  def initialize theatre:
+    @theatre = theatre
+  end
+
+  def select
+    candidates = weighted_candidates
+    return nil if candidates.empty?
+
+    total = candidates.sum(&:weight)
+    target = rand * total
+
+    candidates.each do |candidate|
+      target -= candidate.weight
+      return candidate.post if target <= 0
+    end
+
+    candidates.last.post
+  end
+
+  def weight_json limit: 20
+    candidates = weighted_candidates
+    sorted = candidates.sort_by { |candidate| [candidate.weight, candidate.post.id] }
+
+    { tag_penalties: tag_penalty_json,
+      lightest_posts: post_weight_json(sorted.first(limit)),
+      heaviest_posts: post_weight_json(sorted.reverse.first(limit)) }
+  end
+
+  private
+
+  attr_reader :theatre
+
+  def weighted_candidates
+    @weighted_candidates ||= begin
+      penalties = tag_penalties
+      posts = eligible_posts.includes(tags: :tag_name).to_a
+
+      posts.map do |post|
+        post_tags = post.tags.to_a
+        penalty = post_tags.sum { |tag| penalties[tag.id].to_i }
+
+        Candidate.new(
+            post:,
+            penalty:,
+            tags: post_tags,
+            weight: 1.0 / (1.0 + penalty))
+      end
+    end
+  end
+
+  def eligible_posts
+    posts = Post.where(ELIGIBLE_POST_URL_CONDITION)
+    posts = posts.where.not(id: theatre.current_post_id) if theatre.current_post_id
+    posts
+  end
+
+  def active_user_ids
+    @active_user_ids ||= theatre.watching_users.ids
+  end
+
+  def tag_penalties
+    @tag_penalties ||=
+      if active_user_ids.empty?
+        {}
+      else
+        TheatreSkipEventVoter
+          .joins(theatre_skip_event: :event_tags)
+          .where(user_id: active_user_ids)
+          .group('theatre_skip_event_tags.tag_id')
+          .count
+      end
+  end
+
+  def tag_penalty_json
+    return [] if tag_penalties.empty?
+
+    tags = Tag.where(id: tag_penalties.keys).includes(:tag_name).index_by(&:id)
+
+    tag_penalties
+      .map { |tag_id, penalty|
+        tag = tags[tag_id]
+        next unless tag
+
+        { tag: light_tag_json(tag),
+          penalty: }
+      }
+      .compact
+      .sort_by { |row| [-row[:penalty], row[:tag][:name].to_s] }
+  end
+
+  def post_weight_json candidates
+    candidates.map { |candidate|
+      { post: light_post_json(candidate.post),
+        weight: candidate.weight,
+        penalty: candidate.penalty,
+        tags: candidate.tags.map { |tag| light_tag_json(tag) } }
+    }
+  end
+
+  def light_post_json post
+    { id: post.id,
+      title: post.title,
+      url: post.url }
+  end
+
+  def light_tag_json tag
+    { id: tag.id,
+      name: tag.name,
+      category: tag.category }
+  end
+end

backend/app/services/theatre_skip_finalizer.rb

@@ -0,0 +1,40 @@
+class TheatreSkipFinalizer
+  def self.call(theatre:, user:)
+    new(theatre:, user:).call
+  end
+
+  def initialize(theatre:, user:)
+    @theatre = theatre
+    @user = user
+  end
+
+  def call
+    return unless theatre.current_post
+
+    post = theatre.current_post
+    voters = TheatreSkipVote.where(theatre:, post:).includes(:user).map(&:user)
+    return if voters.empty?
+
+    event = TheatreSkipEvent.create!(
+        theatre:,
+        post:,
+        skipped_by_user: user,
+        programme_position: theatre.programmes.maximum(:position))
+
+    voters.uniq(&:id).each do |voter|
+      TheatreSkipEventVoter.create!(theatre_skip_event: event, user: voter)
+    end
+
+    post.tags.find_each do |tag|
+      TheatreSkipEventTag.create!(theatre_skip_event: event, tag:)
+    end
+
+    TheatreSkipVote.where(theatre:, post:).delete_all
+
+    event
+  end
+
+  private
+
+  attr_reader :theatre, :user
+end

backend/app/services/version_recorder.rb

@@ -16,19 +16,20 @@ class VersionRecorder
       @record = record_class.unscoped.lock.find(@record.id)
       latest = latest_version
 
-      if !(latest) && @event_type != 'create'
-        raise "#{ version_class.name } first event must be create"
-      end
-
-      if @event_type == 'create' && latest
-        raise "#{ version_class.name } create event already exists"
-      end
+      validate_version_sequence!(latest)
 
       attrs = snapshot_attributes
 
-      return latest if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
+      if @event_type == 'update' && latest && same_snapshot?(latest, attrs)
+        return latest
+      end
 
-      version_class.create!(base_attributes(latest).merge(record_key => @record).merge(attrs))
+      version = version_class.create!(
+          base_attributes(latest).merge(record_key => @record).merge(attrs))
+
+      update_record_version_no!(version.version_no)
+
+      version
     end
   end
 
@@ -45,7 +46,31 @@ class VersionRecorder
       created_by_user: @created_by_user }
   end
 
-  def same_snapshot?(version, attrs) = attrs.all? { |k, v| version.public_send(k) == v }
+  def update_record_version_no! version_no
+    @record.update_columns(version_no:)
+    @record.version_no = version_no
+  end
+
+  def validate_version_sequence! latest
+    if !(latest) && @event_type != 'create'
+      raise "#{ version_class.name } first event must be create"
+    end
+
+    if @event_type == 'create' && latest
+      raise "#{ version_class.name } create event already exists"
+    end
+
+    return unless latest
+
+    if @record.version_no != latest.version_no
+      raise ("#{ record_class.name }##{ @record.id } version_no is #{ @record.version_no }, " +
+             "but latest #{ version_class.name } version_no is #{ latest.version_no }")
+    end
+  end
+
+  def same_snapshot? version, attrs
+    attrs.all? { |k, v| version.public_send(k) == v }
+  end
 
   def validate_event_type!
     return if EVENT_TYPES.include?(@event_type)

backend/config/routes.rb

@@ -24,6 +24,7 @@ Rails.application.routes.draw do
       patch '', action: :update
 
       get :deerjikists
+      put :deerjikists, action: :update_deerjikists
     end
   end
 
@@ -47,8 +48,6 @@ Rails.application.routes.draw do
       get :exists
       get :diff
     end
-
-    resources :assets, controller: :wiki_assets, only: [:index, :create]
   end
 
   resources :posts, only: [:index, :show, :create, :update] do
@@ -64,6 +63,24 @@ Rails.application.routes.draw do
     end
   end
 
+  namespace :gekanator do
+    resources :games, only: [:create], controller: '/gekanator_games' do
+      member do
+        get :extra_questions
+        post :extra_question_answers
+      end
+    end
+    resources :posts, only: [:index], controller: '/gekanator_posts'
+    resources :questions, only: [:index], controller: '/gekanator_questions'
+    resources :question_suggestions,
+              only: [:create],
+              controller: '/gekanator_question_suggestions' do
+      member do
+        post :ai_convert
+      end
+    end
+  end
+
   resources :users, only: [:create, :update] do
     collection do
       post :verify
@@ -86,9 +103,14 @@ Rails.application.routes.draw do
     member do
       put :watching
       patch :next_post
+      put :skip_vote
+      delete :skip_vote, action: :unskip_vote
+      get :post_selection_weights
     end
 
-    resources :comments, controller: :theatre_comments, only: [:index, :create]
+    resources :comments, controller: :theatre_comments, only: [:index, :create, :destroy]
+    resources :programmes, controller: :theatre_programmes, only: [:index]
+    resources :skip_events, controller: :theatre_skip_events, only: [:index]
   end
 
   resources :materials, only: [:index, :show, :create, :update, :destroy]

backend/db/migrate/20260323192300_create_wiki_assets.rb

@@ -1,17 +0,0 @@
-class CreateWikiAssets < ActiveRecord::Migration[8.0]
-  def change
-    create_table :wiki_assets do |t|
-      t.references :wiki_page, null: false, foreign_key: true, index: false
-      t.integer :no, null: false
-      t.string :alt_text
-      t.column :sha256, 'binary(32)', null: false
-      t.references :created_by_user, null: false, foreign_key: { to_table: :users }
-      t.timestamps
-    end
-
-    add_index :wiki_assets, [:wiki_page_id, :sha256], unique: true
-    add_index :wiki_assets, [:wiki_page_id, :no], unique: true
-
-    add_column :wiki_pages, :next_asset_no, :integer, null: false, default: 1
-  end
-end

backend/db/migrate/20260427214800_create_post_implications.rb

@@ -0,0 +1,24 @@
+class CreatePostImplications < ActiveRecord::Migration[8.0]
+  def up
+    create_table :post_implications, primary_key: [:post_id, :parent_post_id] do |t|
+      t.references :post, null: false, foreign_key: true, index: false
+      t.references :parent_post, null: false, foreign_key: { to_table: :posts }
+      t.timestamps
+
+      t.check_constraint 'post_id <> parent_post_id',
+                         name: 'chk_post_implications_no_self'
+    end
+
+    add_column :post_versions, :parent_post_ids, :text, null: false, after: :parent_id
+    remove_column :post_versions, :parent_id, :bigint
+    remove_reference :posts, :parent, foreign_key: { to_table: :posts }
+  end
+
+  def down
+    add_reference :posts, :parent, foreign_key: { to_table: :posts }, after: :thumbnail_base
+    add_column :post_versions, :parent_id, :bigint, after: :post_id
+    remove_column :post_versions, :parent_post_ids, :text
+
+    drop_table :post_implications
+  end
+end

backend/db/migrate/20260501153900_rename_banned_to_banned_at_in_users_and_ip_addresses.rb

@@ -0,0 +1,16 @@
+class RenameBannedToBannedAtInUsersAndIpAddresses < ActiveRecord::Migration[8.0]
+  def up
+    [:users, :ip_addresses].each do
+      add_column _1, :banned_at, :datetime, after: :banned
+      add_index _1, :banned_at
+      remove_column _1, :banned
+    end
+  end
+
+  def down
+    [:ip_addresses, :users].each do
+      add_column _1, :banned, :boolean, null: false, default: false, after: :banned_at
+      remove_column _1, :banned_at
+    end
+  end
+end

backend/db/migrate/20260507124000_add_version_no_to_posts.rb

@@ -0,0 +1,27 @@
+class AddVersionNoToPosts < ActiveRecord::Migration[8.0]
+  def up
+    add_column :posts, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        posts
+      SET
+        version_no = (
+          SELECT
+            MAX(version_no)
+          FROM
+            post_versions
+          WHERE
+            post_id = posts.id)
+    SQL
+
+    change_column_null :posts, :version_no, false
+
+    add_check_constraint :posts, 'version_no > 0', name: 'chk_posts_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :posts, name: 'chk_posts_version_no_positive'
+    remove_column :posts, :version_no
+  end
+end

backend/db/migrate/20260507211600_add_version_no_to_tags.rb

@@ -0,0 +1,37 @@
+class AddVersionNoToTags < ActiveRecord::Migration[8.0]
+  def up
+    add_column :tags, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        tags
+      SET
+        version_no = (
+          CASE category
+          WHEN 'nico' THEN
+            (SELECT
+               MAX(version_no)
+             FROM
+               nico_tag_versions
+             WHERE
+               tag_id = tags.id)
+          ELSE
+            (SELECT
+               MAX(version_no)
+             FROM
+               tag_versions
+             WHERE
+               tag_id = tags.id)
+          END)
+    SQL
+
+    change_column_null :tags, :version_no, false
+
+    add_check_constraint :tags, 'version_no > 0', name: 'chk_tags_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :tags, name: 'chk_tags_version_no_positive'
+    remove_column :tags, :version_no
+  end
+end

backend/db/migrate/20260507213300_add_version_no_to_wiki_pages.rb

@@ -0,0 +1,27 @@
+class AddVersionNoToWikiPages < ActiveRecord::Migration[8.0]
+  def up
+    add_column :wiki_pages, :version_no, :integer
+
+    execute <<~SQL
+      UPDATE
+        wiki_pages
+      SET
+        version_no = (
+          SELECT
+            MAX(version_no)
+          FROM
+            wiki_versions
+          WHERE
+            wiki_page_id = wiki_pages.id)
+    SQL
+
+    change_column_null :wiki_pages, :version_no, false
+
+    add_check_constraint :wiki_pages, 'version_no > 0', name: 'chk_wiki_pages_version_no_positive'
+  end
+
+  def down
+    remove_check_constraint :wiki_pages, name: 'chk_wiki_pages_version_no_positive'
+    remove_column :wiki_pages, :version_no
+  end
+end

backend/db/migrate/20260514221900_create_theatre_programmes.rb

@@ -0,0 +1,10 @@
+class CreateTheatreProgrammes < ActiveRecord::Migration[8.0]
+  def change
+    create_table :theatre_programmes, primary_key: [:theatre_id, :position] do |t|
+      t.references :theatre, null: false, foreign_key: true
+      t.integer :position, null: false
+      t.references :post, null: false, foreign_key: true
+      t.datetime :created_at, null: false
+    end
+  end
+end

backend/db/migrate/20260606000000_create_theatre_skip_votes_and_events.rb

@@ -0,0 +1,36 @@
+class CreateTheatreSkipVotesAndEvents < ActiveRecord::Migration[8.0]
+  def change
+    create_table :theatre_skip_votes, primary_key: [:theatre_id, :post_id, :user_id] do |t|
+      t.references :theatre, null: false, foreign_key: true
+      t.references :post, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: true
+      t.timestamps
+    end
+
+    create_table :theatre_skip_events do |t|
+      t.references :theatre, null: false, foreign_key: true
+      t.references :post, null: false, foreign_key: true
+      t.references :skipped_by_user, null: false, foreign_key: { to_table: :users }
+      t.integer :programme_position
+      t.datetime :created_at, null: false
+    end
+
+    create_table :theatre_skip_event_voters, primary_key: [:theatre_skip_event_id, :user_id] do |t|
+      t.references :theatre_skip_event, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: true
+    end
+
+    create_table :theatre_skip_event_tags, primary_key: [:theatre_skip_event_id, :tag_id] do |t|
+      t.references :theatre_skip_event, null: false, foreign_key: true
+      t.references :tag, null: false, foreign_key: true
+    end
+
+    add_index :theatre_skip_events, [:theatre_id, :created_at]
+    add_index :theatre_skip_votes, [:theatre_id, :post_id, :created_at],
+              name: 'idx_theatre_skip_votes_theatre_post_created'
+    add_index :theatre_skip_event_voters, [:user_id, :theatre_skip_event_id],
+              name: 'idx_theatre_skip_event_voters_user_event'
+    add_index :theatre_skip_event_tags, [:tag_id, :theatre_skip_event_id],
+              name: 'idx_theatre_skip_event_tags_tag_event'
+  end
+end

backend/db/migrate/20260607000000_create_gekanator_games.rb

@@ -0,0 +1,18 @@
+class CreateGekanatorGames < ActiveRecord::Migration[8.0]
+  def change
+    create_table :gekanator_games do |t|
+      t.references :user, null: false, foreign_key: true
+      t.references :guessed_post, null: false, foreign_key: { to_table: :posts }
+      t.references :correct_post, null: false, foreign_key: { to_table: :posts }
+      t.boolean :won, null: false
+      t.integer :question_count, null: false
+      t.json :answers, null: false
+
+      t.timestamps
+    end
+
+    add_check_constraint :gekanator_games,
+                         'question_count >= 0',
+                         name: 'chk_gekanator_games_question_count_nonnegative'
+  end
+end

backend/db/migrate/20260608000000_create_gekanator_question_suggestions.rb

@@ -0,0 +1,14 @@
+class CreateGekanatorQuestionSuggestions < ActiveRecord::Migration[8.0]
+  def change
+    create_table :gekanator_question_suggestions do |t|
+      t.references :gekanator_game,
+                   null: false,
+                   foreign_key: { on_delete: :cascade }
+      t.references :user, null: false, foreign_key: true
+      t.text :question_text, null: false
+      t.boolean :processed, null: false, default: false
+
+      t.timestamps
+    end
+  end
+end

backend/db/migrate/20260608002000_add_answer_to_gekanator_question_suggestions.rb

@@ -0,0 +1,5 @@
+class AddAnswerToGekanatorQuestionSuggestions < ActiveRecord::Migration[8.0]
+  def change
+    add_column :gekanator_question_suggestions, :answer, :string, null: false
+  end
+end

backend/db/migrate/20260609000000_create_gekanator_questions.rb

@@ -0,0 +1,19 @@
+class CreateGekanatorQuestions < ActiveRecord::Migration[8.0]
+  def change
+    create_table :gekanator_questions do |t|
+      t.string :text, null: false
+      t.string :kind, null: false
+      t.json :condition, null: false
+      t.string :source, null: false, default: 'ai_generated'
+      t.string :status, null: false, default: 'pending'
+      t.float :priority_weight, null: false, default: 1.0
+      t.references :gekanator_question_suggestion,
+                   null: true,
+                   foreign_key: true
+      t.references :created_by,
+                   null: true,
+                   foreign_key: { to_table: :users }
+      t.timestamps
+    end
+  end
+end

backend/db/migrate/20260609001000_create_gekanator_ai_runs.rb

@@ -0,0 +1,13 @@
+class CreateGekanatorAiRuns < ActiveRecord::Migration[8.0]
+  def change
+    create_table :gekanator_ai_runs do |t|
+      t.string :model, null: false
+      t.integer :input_tokens, null: false, default: 0
+      t.integer :output_tokens, null: false, default: 0
+      t.decimal :estimated_cost_jpy, precision: 8, scale: 3, null: false, default: 0
+      t.string :status, null: false, default: 'pending'
+      t.references :gekanator_question_suggestion, null: false, foreign_key: true
+      t.timestamps
+    end
+  end
+end

backend/db/migrate/20260610000000_create_gekanator_question_examples.rb

@@ -0,0 +1,19 @@
+class CreateGekanatorQuestionExamples < ActiveRecord::Migration[8.0]
+  def change
+    create_table :gekanator_question_examples do |t|
+      t.references :gekanator_question, null: false, foreign_key: true
+      t.references :post, null: false, foreign_key: true
+      t.references :user, null: false, foreign_key: true
+      t.references :gekanator_game, null: true, foreign_key: true
+      t.string :answer, null: false
+      t.string :source, null: false, default: 'post_game_extra'
+      t.float :weight, null: false, default: 1.0
+      t.timestamps
+    end
+
+    add_index :gekanator_question_examples,
+              [:gekanator_question_id, :post_id, :user_id],
+              unique: true,
+              name: 'idx_gekanator_question_examples_on_question_post_user'
+  end
+end

backend/db/migrate/20260612000000_add_answer_statistics_to_gekanator_question_examples.rb

@@ -0,0 +1,40 @@
+class AddAnswerStatisticsToGekanatorQuestionExamples < ActiveRecord::Migration[8.0]
+  class MigrationGekanatorQuestionExample < ApplicationRecord
+    self.table_name = 'gekanator_question_examples'
+  end
+
+  def up
+    add_column :gekanator_question_examples,
+               :answer_counts,
+               :json,
+               null: true
+    add_column :gekanator_question_examples,
+               :sample_count,
+               :integer,
+               null: false,
+               default: 1
+
+    MigrationGekanatorQuestionExample.reset_column_information
+    MigrationGekanatorQuestionExample.find_each do |example|
+      counts = {
+        'yes' => 0,
+        'no' => 0,
+        'partial' => 0,
+        'probably_no' => 0,
+        'unknown' => 0
+      }
+      counts[example.answer] = 1 if counts.key?(example.answer)
+
+      example.update_columns(
+        answer_counts: counts,
+        sample_count: 1)
+    end
+
+    change_column_null :gekanator_question_examples, :answer_counts, false
+  end
+
+  def down
+    remove_column :gekanator_question_examples, :sample_count
+    remove_column :gekanator_question_examples, :answer_counts
+  end
+end

backend/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
+ActiveRecord::Schema[8.0].define(version: 2026_06_12_000000) do
   create_table "active_storage_attachments", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
@@ -48,6 +48,79 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.index ["tag_id"], name: "index_deerjikists_on_tag_id"
   end
 
+  create_table "gekanator_ai_runs", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "model", null: false
+    t.integer "input_tokens", default: 0, null: false
+    t.integer "output_tokens", default: 0, null: false
+    t.decimal "estimated_cost_jpy", precision: 8, scale: 3, default: "0.0", null: false
+    t.string "status", default: "pending", null: false
+    t.bigint "gekanator_question_suggestion_id", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["gekanator_question_suggestion_id"], name: "index_gekanator_ai_runs_on_gekanator_question_suggestion_id"
+  end
+
+  create_table "gekanator_games", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.bigint "guessed_post_id", null: false
+    t.bigint "correct_post_id", null: false
+    t.boolean "won", null: false
+    t.integer "question_count", null: false
+    t.json "answers", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["correct_post_id"], name: "index_gekanator_games_on_correct_post_id"
+    t.index ["guessed_post_id"], name: "index_gekanator_games_on_guessed_post_id"
+    t.index ["user_id"], name: "index_gekanator_games_on_user_id"
+    t.check_constraint "`question_count` >= 0", name: "chk_gekanator_games_question_count_nonnegative"
+  end
+
+  create_table "gekanator_question_examples", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "gekanator_question_id", null: false
+    t.bigint "post_id", null: false
+    t.bigint "user_id", null: false
+    t.bigint "gekanator_game_id"
+    t.string "answer", null: false
+    t.string "source", default: "post_game_extra", null: false
+    t.float "weight", default: 1.0, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.json "answer_counts", null: false
+    t.integer "sample_count", default: 1, null: false
+    t.index ["gekanator_game_id"], name: "index_gekanator_question_examples_on_gekanator_game_id"
+    t.index ["gekanator_question_id", "post_id", "user_id"], name: "idx_gekanator_question_examples_on_question_post_user", unique: true
+    t.index ["gekanator_question_id"], name: "index_gekanator_question_examples_on_gekanator_question_id"
+    t.index ["post_id"], name: "index_gekanator_question_examples_on_post_id"
+    t.index ["user_id"], name: "index_gekanator_question_examples_on_user_id"
+  end
+
+  create_table "gekanator_question_suggestions", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "gekanator_game_id", null: false
+    t.bigint "user_id", null: false
+    t.text "question_text", null: false
+    t.boolean "processed", default: false, null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.string "answer", null: false
+    t.index ["gekanator_game_id"], name: "index_gekanator_question_suggestions_on_gekanator_game_id"
+    t.index ["user_id"], name: "index_gekanator_question_suggestions_on_user_id"
+  end
+
+  create_table "gekanator_questions", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "text", null: false
+    t.string "kind", null: false
+    t.json "condition", null: false
+    t.string "source", default: "ai_generated", null: false
+    t.string "status", default: "pending", null: false
+    t.float "priority_weight", default: 1.0, null: false
+    t.bigint "gekanator_question_suggestion_id"
+    t.bigint "created_by_id"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["created_by_id"], name: "index_gekanator_questions_on_created_by_id"
+    t.index ["gekanator_question_suggestion_id"], name: "index_gekanator_questions_on_gekanator_question_suggestion_id"
+  end
+
   create_table "ip_addresses", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.binary "ip_address", limit: 16, null: false
     t.datetime "banned_at"
@@ -186,8 +259,10 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "original_created_from"
     t.datetime "original_created_before"
     t.datetime "updated_at", null: false
+    t.integer "version_no", null: false
     t.index ["uploaded_user_id"], name: "index_posts_on_uploaded_user_id"
     t.index ["url"], name: "index_posts_on_url", unique: true
+    t.check_constraint "`version_no` > 0", name: "chk_posts_version_no_positive"
   end
 
   create_table "settings", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -262,8 +337,10 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "updated_at", null: false
     t.integer "post_count", default: 0, null: false
     t.datetime "discarded_at"
+    t.integer "version_no", null: false
     t.index ["discarded_at"], name: "index_tags_on_discarded_at"
     t.index ["tag_name_id"], name: "index_tags_on_tag_name_id", unique: true
+    t.check_constraint "`version_no` > 0", name: "chk_tags_version_no_positive"
   end
 
   create_table "theatre_comments", primary_key: ["theatre_id", "no"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -279,6 +356,55 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.index ["user_id"], name: "index_theatre_comments_on_user_id"
   end
 
+  create_table "theatre_programmes", primary_key: ["theatre_id", "position"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "theatre_id", null: false
+    t.integer "position", null: false
+    t.bigint "post_id", null: false
+    t.datetime "created_at", null: false
+    t.index ["post_id"], name: "index_theatre_programmes_on_post_id"
+    t.index ["theatre_id"], name: "index_theatre_programmes_on_theatre_id"
+  end
+
+  create_table "theatre_skip_event_tags", primary_key: ["theatre_skip_event_id", "tag_id"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "theatre_skip_event_id", null: false
+    t.bigint "tag_id", null: false
+    t.index ["tag_id", "theatre_skip_event_id"], name: "idx_theatre_skip_event_tags_tag_event"
+    t.index ["tag_id"], name: "index_theatre_skip_event_tags_on_tag_id"
+    t.index ["theatre_skip_event_id"], name: "index_theatre_skip_event_tags_on_theatre_skip_event_id"
+  end
+
+  create_table "theatre_skip_event_voters", primary_key: ["theatre_skip_event_id", "user_id"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "theatre_skip_event_id", null: false
+    t.bigint "user_id", null: false
+    t.index ["theatre_skip_event_id"], name: "index_theatre_skip_event_voters_on_theatre_skip_event_id"
+    t.index ["user_id", "theatre_skip_event_id"], name: "idx_theatre_skip_event_voters_user_event"
+    t.index ["user_id"], name: "index_theatre_skip_event_voters_on_user_id"
+  end
+
+  create_table "theatre_skip_events", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "theatre_id", null: false
+    t.bigint "post_id", null: false
+    t.bigint "skipped_by_user_id", null: false
+    t.integer "programme_position"
+    t.datetime "created_at", null: false
+    t.index ["post_id"], name: "index_theatre_skip_events_on_post_id"
+    t.index ["skipped_by_user_id"], name: "index_theatre_skip_events_on_skipped_by_user_id"
+    t.index ["theatre_id", "created_at"], name: "index_theatre_skip_events_on_theatre_id_and_created_at"
+    t.index ["theatre_id"], name: "index_theatre_skip_events_on_theatre_id"
+  end
+
+  create_table "theatre_skip_votes", primary_key: ["theatre_id", "post_id", "user_id"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "theatre_id", null: false
+    t.bigint "post_id", null: false
+    t.bigint "user_id", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["post_id"], name: "index_theatre_skip_votes_on_post_id"
+    t.index ["theatre_id", "post_id", "created_at"], name: "idx_theatre_skip_votes_theatre_post_created"
+    t.index ["theatre_id"], name: "index_theatre_skip_votes_on_theatre_id"
+    t.index ["user_id"], name: "index_theatre_skip_votes_on_user_id"
+  end
+
   create_table "theatre_watching_users", primary_key: ["theatre_id", "user_id"], charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "theatre_id", null: false
     t.bigint "user_id", null: false
@@ -369,10 +495,12 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
     t.datetime "updated_at", null: false
     t.datetime "discarded_at"
     t.integer "next_asset_no", default: 1, null: false
+    t.integer "version_no", null: false
     t.index ["created_user_id"], name: "index_wiki_pages_on_created_user_id"
     t.index ["discarded_at"], name: "index_wiki_pages_on_discarded_at"
     t.index ["tag_name_id"], name: "index_wiki_pages_on_tag_name_id", unique: true
     t.index ["updated_user_id"], name: "index_wiki_pages_on_updated_user_id"
+    t.check_constraint "`version_no` > 0", name: "chk_wiki_pages_version_no_positive"
   end
 
   create_table "wiki_revision_lines", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -423,6 +551,18 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
 
   add_foreign_key "active_storage_attachments", "active_storage_blobs", column: "blob_id"
   add_foreign_key "active_storage_variant_records", "active_storage_blobs", column: "blob_id"
+  add_foreign_key "gekanator_ai_runs", "gekanator_question_suggestions"
+  add_foreign_key "gekanator_games", "posts", column: "correct_post_id"
+  add_foreign_key "gekanator_games", "posts", column: "guessed_post_id"
+  add_foreign_key "gekanator_games", "users"
+  add_foreign_key "gekanator_question_examples", "gekanator_games"
+  add_foreign_key "gekanator_question_examples", "gekanator_questions"
+  add_foreign_key "gekanator_question_examples", "posts"
+  add_foreign_key "gekanator_question_examples", "users"
+  add_foreign_key "gekanator_question_suggestions", "gekanator_games", on_delete: :cascade
+  add_foreign_key "gekanator_question_suggestions", "users"
+  add_foreign_key "gekanator_questions", "gekanator_question_suggestions"
+  add_foreign_key "gekanator_questions", "users", column: "created_by_id"
   add_foreign_key "material_versions", "materials"
   add_foreign_key "material_versions", "materials", column: "parent_id"
   add_foreign_key "material_versions", "tags"
@@ -458,6 +598,18 @@ ActiveRecord::Schema[8.0].define(version: 2026_05_01_153900) do
   add_foreign_key "tags", "tag_names"
   add_foreign_key "theatre_comments", "theatres"
   add_foreign_key "theatre_comments", "users"
+  add_foreign_key "theatre_programmes", "posts"
+  add_foreign_key "theatre_programmes", "theatres"
+  add_foreign_key "theatre_skip_event_tags", "tags"
+  add_foreign_key "theatre_skip_event_tags", "theatre_skip_events"
+  add_foreign_key "theatre_skip_event_voters", "theatre_skip_events"
+  add_foreign_key "theatre_skip_event_voters", "users"
+  add_foreign_key "theatre_skip_events", "posts"
+  add_foreign_key "theatre_skip_events", "theatres"
+  add_foreign_key "theatre_skip_events", "users", column: "skipped_by_user_id"
+  add_foreign_key "theatre_skip_votes", "posts"
+  add_foreign_key "theatre_skip_votes", "theatres"
+  add_foreign_key "theatre_skip_votes", "users"
   add_foreign_key "theatre_watching_users", "theatres"
   add_foreign_key "theatre_watching_users", "users"
   add_foreign_key "theatres", "posts", column: "current_post_id"

backend/spec/factories/ip_addresses.rb

@@ -0,0 +1,10 @@
+FactoryBot.define do
+  factory :ip_address do
+    ip_address { IPAddr.new('203.0.113.10').hton }
+    banned_at { nil }
+
+    trait :banned do
+      banned_at { Time.current }
+    end
+  end
+end

backend/spec/factories/users.rb

@@ -1,15 +1,24 @@
 FactoryBot.define do
   factory :user do
-    name { "test-user" }
+    name { nil }
     inheritance_code { SecureRandom.uuid }
-    role { "guest" }
+    role { 'guest' }
+    banned_at { nil }
+
+    trait :guest do
+      role { 'guest' }
+    end
 
     trait :member do
-      role { "member" }
+      role { 'member' }
     end
 
     trait :admin do
       role { 'admin' }
     end
+
+    trait :banned do
+      banned_at { Time.current }
+    end
   end
 end

backend/spec/models/post_implication_spec.rb

@@ -0,0 +1,51 @@
+require 'rails_helper'
+
+RSpec.describe PostImplication, type: :model do
+  let!(:post_record) do
+    Post.create!(
+      title: 'post',
+      url: 'https://example.com/post-implication-post'
+    )
+  end
+
+  let!(:parent_post) do
+    Post.create!(
+      title: 'parent post',
+      url: 'https://example.com/post-implication-parent'
+    )
+  end
+
+  it 'is valid with post and parent_post' do
+    implication = described_class.new(
+      post: post_record,
+      parent_post:
+    )
+
+    expect(implication).to be_valid
+  end
+
+  it 'does not allow same post as parent_post' do
+    implication = described_class.new(
+      post: post_record,
+      parent_post: post_record
+    )
+
+    expect(implication).not_to be_valid
+    expect(implication.errors[:parent_post_id]).to be_present
+  end
+
+  it 'does not allow duplicate pair' do
+    described_class.create!(
+      post: post_record,
+      parent_post:
+    )
+
+    duplicate = described_class.new(
+      post: post_record,
+      parent_post:
+    )
+
+    expect(duplicate).not_to be_valid
+    expect(duplicate.errors[:post_id]).to be_present
+  end
+end

backend/spec/models/post_version_spec.rb

@@ -19,6 +19,7 @@ RSpec.describe PostVersion, type: :model do
       url: post_record.url,
       thumbnail_base: post_record.thumbnail_base,
       tags: post_record.snapshot_tag_names.join(' '),
+      parent_post_ids: post_record.snapshot_parent_post_ids.join(' '),
       original_created_from: post_record.original_created_from,
       original_created_before: post_record.original_created_before,
       created_at: Time.current,

backend/spec/models/tag_spec.rb

@@ -161,6 +161,7 @@ RSpec.describe Tag, type: :model do
         url: post.url,
         thumbnail_base: post.thumbnail_base,
         tags: snapshot_tags(post),
+        parent_post_ids: post.snapshot_parent_post_ids.join(' '),
         original_created_from: post.original_created_from,
         original_created_before: post.original_created_before,
         created_at: Time.current,

backend/spec/requests/error_responses_spec.rb

@@ -0,0 +1,47 @@
+require 'rails_helper'
+
+RSpec.describe 'error responses', type: :request do
+  describe 'manual input errors' do
+    it 'returns a stable payload for bad requests' do
+      get '/tags/name/%20/deerjikists'
+
+      expect(response).to have_http_status(:bad_request)
+      expect(json).to include(
+          'type' => 'bad_request',
+          'message' => be_present,
+          'errors' => {},
+          'base_errors' => [be_present])
+    end
+
+    it 'returns a stable field-error payload for unprocessable requests' do
+      member = create(:user, :member)
+      tag = create(:tag, :general, name: 'error_response_tag')
+      sign_in_as(member)
+
+      patch "/tags/#{ tag.id }", params: { category: 'nico' }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json).to include(
+          'type' => 'validation_error',
+          'message' => '入力内容を確認してください．',
+          'base_errors' => [])
+      expect(json.fetch('errors')).to include(
+          'category' => ['ニコタグは変更できません．'])
+    end
+  end
+
+  describe 'model validation errors' do
+    it 'returns field messages for model errors' do
+      user = create(:user)
+      sign_in_as(user)
+
+      put "/users/#{ user.id }", params: { name: 'a' * 256 }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json).to include(
+          'type' => 'validation_error',
+          'message' => '入力内容を確認してください．')
+      expect(json.fetch('errors').fetch('name')).to include(be_present)
+    end
+  end
+end

backend/spec/requests/gekanator_games_spec.rb

@@ -0,0 +1,76 @@
+require 'rails_helper'
+
+RSpec.describe 'Gekanator games API', type: :request do
+  let!(:admin) { create_admin_user! }
+  let!(:user) { create_member_user! }
+  let!(:guessed_post) { Post.create!(title: 'guess', url: 'https://example.com/guess') }
+  let!(:correct_post) { Post.create!(title: 'correct', url: 'https://example.com/correct') }
+
+  describe 'POST /gekanator/games' do
+    it 'stores a won game' do
+      sign_in_as admin
+
+      post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          correct_post_id: guessed_post.id,
+          answers: [{ question_id: 'tag:1', answer: 'yes' }] }
+
+      expect(response).to have_http_status(:created)
+      game = GekanatorGame.find(json['id'])
+      expect(game.user).to eq(admin)
+      expect(game.guessed_post).to eq(guessed_post)
+      expect(game.correct_post).to eq(guessed_post)
+      expect(game.won).to eq(true)
+      expect(game.question_count).to eq(1)
+      expect(game.answers).to eq([{ 'question_id' => 'tag:1', 'answer' => 'yes' }])
+    end
+
+    it 'stores a lost game with the correct post' do
+      sign_in_as admin
+
+      post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          correct_post_id: correct_post.id,
+          question_count: 4,
+          answers: [{ question_id: 'tag:1', answer: 'no' }] }
+
+      expect(response).to have_http_status(:created)
+      game = GekanatorGame.find(json['id'])
+      expect(game.correct_post).to eq(correct_post)
+      expect(game.won).to eq(false)
+      expect(game.question_count).to eq(1)
+    end
+
+    it 'rejects a game without the correct post' do
+      sign_in_as admin
+
+      post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          question_count: 4,
+          answers: [{ question_id: 'tag:1', answer: 'no' }] }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'returns unauthorized without a user' do
+      post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          correct_post_id: guessed_post.id,
+          answers: [] }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'stores a game for a non-admin user' do
+      sign_in_as user
+
+      post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          correct_post_id: guessed_post.id,
+          answers: [{ question_id: 'tag:1', answer: 'yes' }] }
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorGame.find(json['id']).user).to eq(user)
+    end
+  end
+end

backend/spec/requests/gekanator_learning_spec.rb

@@ -0,0 +1,786 @@
+require 'rails_helper'
+
+RSpec.describe 'Gekanator learning API', type: :request do
+  let(:admin) { create(:user, :admin) }
+  let(:member) { create(:user, :member) }
+  let(:other_user) { create(:user, :member) }
+
+  let!(:guessed_post) do
+    Post.create!(
+      title: 'guessed',
+      url: 'https://example.com/guessed'
+    )
+  end
+
+  let!(:correct_post) do
+    Post.create!(
+      title: 'correct',
+      url: 'https://example.com/correct'
+    )
+  end
+
+  let!(:other_post) do
+    Post.create!(
+      title: 'other',
+      url: 'https://example.com/other'
+    )
+  end
+
+  let!(:game) do
+    GekanatorGame.create!(
+      user: admin,
+      guessed_post: guessed_post,
+      correct_post: correct_post,
+      won: false,
+      question_count: 1,
+      answers: [
+        {
+          'question_id' => 'tag:character:喜多郁代',
+          'question_text' => '喜多ちゃんが関係してる?',
+          'answer' => 'yes',
+          'original_answer' => 'yes'
+        }
+      ]
+    )
+  end
+
+  def create_post_similarity_question!(
+    text: '喜多ちゃんが泣いてる?',
+    post: correct_post,
+    answer: 'yes',
+    status: 'accepted',
+    source: 'user_suggested',
+    priority_weight: 1.2
+  )
+    GekanatorQuestion.create!(
+      text: text,
+      kind: 'post_similarity',
+      source: source,
+      status: status,
+      priority_weight: priority_weight,
+      condition: {
+        type: 'post-similarity',
+        postId: post.id,
+        answer: answer,
+        threshold: 0.65
+      },
+      created_by: admin
+    )
+  end
+
+  describe 'POST /gekanator/games' do
+    it 'stores a game result for an admin user' do
+      sign_in_as admin
+
+      post '/gekanator/games', params: {
+        guessed_post_id: guessed_post.id,
+        correct_post_id: correct_post.id,
+        answers: [
+          {
+            question_id: 'tag:character:喜多郁代',
+            question_text: '喜多ちゃんが関係してる?',
+            answer: 'yes',
+            original_answer: 'yes'
+          }
+        ]
+      }
+
+      expect(response).to have_http_status(:created)
+
+      created = GekanatorGame.find(json['id'])
+      expect(created.user).to eq(admin)
+      expect(created.guessed_post).to eq(guessed_post)
+      expect(created.correct_post).to eq(correct_post)
+      expect(created.won).to eq(false)
+      expect(created.question_count).to eq(1)
+      expect(created.answers).to eq([
+        {
+          'question_id' => 'tag:character:喜多郁代',
+          'question_text' => '喜多ちゃんが関係してる?',
+          'answer' => 'yes',
+          'original_answer' => 'yes'
+        }
+      ])
+    end
+
+    it 'stores a won game when guessed_post_id equals correct_post_id' do
+      sign_in_as admin
+
+      post '/gekanator/games', params: {
+        guessed_post_id: correct_post.id,
+        correct_post_id: correct_post.id,
+        answers: []
+      }
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorGame.find(json['id']).won).to eq(true)
+    end
+
+    it 'rejects a game without correct_post_id' do
+      sign_in_as admin
+
+      expect {
+        post '/gekanator/games', params: {
+          guessed_post_id: guessed_post.id,
+          answers: []
+        }
+      }.not_to change { GekanatorGame.count }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'stores a game result for a non-admin user' do
+      sign_in_as member
+
+      post '/gekanator/games', params: {
+        guessed_post_id: guessed_post.id,
+        correct_post_id: correct_post.id,
+        answers: []
+      }
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorGame.find(json['id']).user).to eq(member)
+    end
+
+    it 'returns unauthorized without a user' do
+      post '/gekanator/games', params: {
+        guessed_post_id: guessed_post.id,
+        correct_post_id: correct_post.id,
+        answers: []
+      }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
+
+  describe 'POST /gekanator/question_suggestions' do
+    it 'creates a suggestion and promotes yes answer to an accepted post_similarity question' do
+      sign_in_as admin
+
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: game.id,
+          question_text: '喜多ちゃんが泣いてる?',
+          answer: 'yes'
+        }
+      }.to change { GekanatorQuestionSuggestion.count }.by(1)
+        .and change { GekanatorQuestion.count }.by(1)
+        .and change { GekanatorQuestionExample.count }.by(1)
+
+      expect(response).to have_http_status(:created)
+
+      suggestion = GekanatorQuestionSuggestion.last
+      question = GekanatorQuestion.last
+      example = GekanatorQuestionExample.last
+
+      expect(json).to include(
+        'id' => suggestion.id,
+        'count' => 1
+      )
+
+      expect(suggestion).to have_attributes(
+        gekanator_game_id: game.id,
+        user_id: admin.id,
+        question_text: '喜多ちゃんが泣いてる?',
+        answer: 'yes',
+        processed: true
+      )
+
+      expect(question).to have_attributes(
+        text: '喜多ちゃんが泣いてる?',
+        kind: 'post_similarity',
+        source: 'user_suggested',
+        status: 'accepted',
+        priority_weight: 1.2,
+        gekanator_question_suggestion_id: suggestion.id,
+        created_by_id: admin.id
+      )
+      expect(question.condition).to include(
+        'type' => 'post-similarity',
+        'postId' => correct_post.id,
+        'answer' => 'yes',
+        'threshold' => 0.65
+      )
+
+      expect(example).to have_attributes(
+        gekanator_question_id: question.id,
+        post_id: correct_post.id,
+        user_id: admin.id,
+        gekanator_game_id: game.id,
+        answer: 'yes',
+        source: 'initial_suggestion',
+        weight: 1.0
+      )
+    end
+
+    it 'promotes no, partial, and probably_no answers' do
+      sign_in_as admin
+
+      ['no', 'partial', 'probably_no'].each do |answer|
+        expect {
+          post '/gekanator/question_suggestions', params: {
+            gekanator_game_id: game.id,
+            question_text: "answer #{answer} question?",
+            answer: answer
+          }
+        }.to change { GekanatorQuestion.count }.by(1)
+          .and change { GekanatorQuestionExample.count }.by(1)
+
+        expect(response).to have_http_status(:created)
+        expect(GekanatorQuestion.last.condition['answer']).to eq(answer)
+        expect(GekanatorQuestionExample.last.answer).to eq(answer)
+      end
+    end
+
+    it 'does not promote unknown answers' do
+      sign_in_as admin
+
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: game.id,
+          question_text: 'よく分からない質問?',
+          answer: 'unknown'
+        }
+      }.to change { GekanatorQuestionSuggestion.count }.by(1)
+        .and change { GekanatorQuestion.count }.by(0)
+        .and change { GekanatorQuestionExample.count }.by(0)
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorQuestionSuggestion.last.processed).to eq(false)
+    end
+
+    it 'limits suggestions to three per game' do
+      sign_in_as admin
+
+      3.times do |i|
+        GekanatorQuestionSuggestion.create!(
+          gekanator_game: game,
+          user: admin,
+          question_text: "existing question #{i}",
+          answer: 'unknown'
+        )
+      end
+
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: game.id,
+          question_text: 'fourth question?',
+          answer: 'yes'
+        }
+      }.not_to change { GekanatorQuestionSuggestion.count }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'allows a non-admin user to suggest a question for their own game' do
+      member_game = GekanatorGame.create!(
+        user: member,
+        guessed_post: guessed_post,
+        correct_post: correct_post,
+        won: false,
+        question_count: 1,
+        answers: [{ 'question_id' => 'tag:1', 'answer' => 'yes' }]
+      )
+      sign_in_as member
+
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: member_game.id,
+          question_text: 'member question?',
+          answer: 'yes'
+        }
+      }.to change { GekanatorQuestionSuggestion.count }.by(1)
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorQuestionSuggestion.last).to have_attributes(
+        gekanator_game_id: member_game.id,
+        user_id: member.id
+      )
+    end
+
+    it 'returns not found for another user game' do
+      sign_in_as member
+
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: game.id,
+          question_text: 'member question?',
+          answer: 'yes'
+        }
+      }.not_to change { GekanatorQuestionSuggestion.count }
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'returns unauthorized without a user' do
+      expect {
+        post '/gekanator/question_suggestions', params: {
+          gekanator_game_id: game.id,
+          question_text: 'member question?',
+          answer: 'yes'
+        }
+      }.not_to change { GekanatorQuestionSuggestion.count }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
+
+  describe 'GET /gekanator/games/:id/extra_questions' do
+    it 'returns at most two accepted user_suggested post_similarity questions without duplicates' do
+      sign_in_as admin
+
+      low = create_post_similarity_question!(
+        text: 'low?',
+        priority_weight: 1.0
+      )
+      high = create_post_similarity_question!(
+        text: 'high?',
+        priority_weight: 3.0
+      )
+      middle = create_post_similarity_question!(
+        text: 'middle?',
+        priority_weight: 2.0
+      )
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].length).to eq(2)
+      expect(json['questions'].map { _1['id'] }.uniq.length).to eq(2)
+      expect(json['questions'].map { _1['id'] }).to all(be_in([low.id, high.id, middle.id]))
+    end
+
+    it 'can return questions that already have an example for the correct post' do
+      sign_in_as admin
+
+      existing = create_post_similarity_question!(text: 'already learned?')
+
+      GekanatorQuestionExample.create!(
+        gekanator_question: existing,
+        post: correct_post,
+        user: admin,
+        gekanator_game: game,
+        answer: 'yes',
+        source: 'post_game_extra'
+      )
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].map { _1['id'] }).to include(existing.id)
+    end
+
+    it 'can return questions already asked in the game using snake_case question_id' do
+      sign_in_as admin
+
+      asked = create_post_similarity_question!(text: 'already asked?')
+      game.update!(
+        answers: [
+          {
+            'question_id' => "post-similarity:#{asked.id}",
+            'answer' => 'yes'
+          }
+        ]
+      )
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].map { _1['id'] }).to include(asked.id)
+    end
+
+    it 'can return questions already asked in the game using camelCase questionId' do
+      sign_in_as admin
+
+      asked = create_post_similarity_question!(text: 'already asked?')
+      game.update!(
+        answers: [
+          {
+            'questionId' => "post-similarity:#{asked.id}",
+            'answer' => 'yes'
+          }
+        ]
+      )
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].map { _1['id'] }).to include(asked.id)
+    end
+
+    it 'does not return non-accepted, non-user_suggested, or non-post_similarity questions' do
+      sign_in_as admin
+
+      accepted = create_post_similarity_question!(text: 'accepted?')
+      create_post_similarity_question!(text: 'disabled?', status: 'disabled')
+      create_post_similarity_question!(text: 'ai?', source: 'ai_generated')
+      GekanatorQuestion.create!(
+        text: 'tag?',
+        kind: 'tag',
+        source: 'user_suggested',
+        status: 'accepted',
+        priority_weight: 1.0,
+        condition: { type: 'tag', key: 'character:喜多郁代' }
+      )
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].map { _1['id'] }).to contain_exactly(accepted.id)
+    end
+
+    it 'allows a non-admin user to fetch extra questions for their own game' do
+      member_game = GekanatorGame.create!(
+        user: member,
+        guessed_post: guessed_post,
+        correct_post: correct_post,
+        won: false,
+        question_count: 1,
+        answers: [{ 'question_id' => 'tag:1', 'answer' => 'yes' }]
+      )
+      accepted = create_post_similarity_question!(text: 'accepted?')
+      sign_in_as member
+
+      get "/gekanator/games/#{member_game.id}/extra_questions"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].map { _1['id'] }).to include(accepted.id)
+    end
+
+    it 'returns not found for another user game' do
+      sign_in_as member
+
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'returns unauthorized without a user' do
+      get "/gekanator/games/#{game.id}/extra_questions"
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
+
+  describe 'POST /gekanator/games/:id/extra_question_answers' do
+    it 'creates examples for extra question answers' do
+      sign_in_as admin
+
+      question = create_post_similarity_question!(text: 'extra?')
+
+      expect {
+        post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+          answers: [
+            {
+              question_id: question.id.to_s,
+              answer: 'partial'
+            }
+          ]
+        }
+      }.to change { GekanatorQuestionExample.count }.by(1)
+
+      expect(response).to have_http_status(:created)
+      expect(json).to include('count' => 1)
+
+      example = GekanatorQuestionExample.last
+      expect(example).to have_attributes(
+        gekanator_question_id: question.id,
+        post_id: correct_post.id,
+        user_id: admin.id,
+        gekanator_game_id: game.id,
+        answer: 'partial',
+        source: 'post_game_extra',
+        weight: 1.0
+      )
+    end
+
+    it 'updates an existing example for the same question, post, and user' do
+      sign_in_as admin
+
+      question = create_post_similarity_question!(text: 'extra?')
+      existing = GekanatorQuestionExample.create!(
+        gekanator_question: question,
+        post: correct_post,
+        user: admin,
+        answer: 'no',
+        source: 'post_game_extra',
+        weight: 1.0
+      )
+
+      expect {
+        post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+          answers: [
+            {
+              question_id: question.id,
+              answer: 'yes'
+            }
+          ]
+        }
+      }.not_to change { GekanatorQuestionExample.count }
+
+      expect(response).to have_http_status(:created)
+      expect(existing.reload).to have_attributes(
+        answer: 'yes',
+        source: 'post_game_extra',
+        gekanator_game_id: game.id
+      )
+    end
+
+    it 'rejects missing questions' do
+      sign_in_as admin
+
+      expect {
+        post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+          answers: [
+            {
+              question_id: 999_999_999,
+              answer: 'yes'
+            }
+          ]
+        }
+      }.not_to change { GekanatorQuestionExample.count }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'rejects non-accepted questions' do
+      sign_in_as admin
+
+      question = create_post_similarity_question!(
+        text: 'disabled?',
+        status: 'disabled'
+      )
+
+      post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+        answers: [
+          {
+            question_id: question.id,
+            answer: 'yes'
+          }
+        ]
+      }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'rejects non-post_similarity questions' do
+      sign_in_as admin
+
+      question = GekanatorQuestion.create!(
+        text: 'tag?',
+        kind: 'tag',
+        source: 'user_suggested',
+        status: 'accepted',
+        priority_weight: 1.0,
+        condition: { type: 'tag', key: 'character:喜多郁代' }
+      )
+
+      post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+        answers: [
+          {
+            question_id: question.id,
+            answer: 'yes'
+          }
+        ]
+      }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'allows a non-admin user to answer extra questions for their own game' do
+      member_game = GekanatorGame.create!(
+        user: member,
+        guessed_post: guessed_post,
+        correct_post: correct_post,
+        won: false,
+        question_count: 1,
+        answers: [{ 'question_id' => 'tag:1', 'answer' => 'yes' }]
+      )
+      question = create_post_similarity_question!(text: 'extra?')
+      sign_in_as member
+
+      expect {
+        post "/gekanator/games/#{member_game.id}/extra_question_answers", params: {
+          answers: [
+            {
+              question_id: question.id,
+              answer: 'yes'
+            }
+          ]
+        }
+      }.to change { GekanatorQuestionExample.count }.by(1)
+
+      expect(response).to have_http_status(:created)
+      expect(GekanatorQuestionExample.last).to have_attributes(
+        user_id: member.id,
+        gekanator_game_id: member_game.id
+      )
+    end
+
+    it 'returns not found for another user game' do
+      question = create_post_similarity_question!(text: 'extra?')
+      sign_in_as member
+
+      expect {
+        post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+          answers: [
+            {
+              question_id: question.id,
+              answer: 'yes'
+            }
+          ]
+        }
+      }.not_to change { GekanatorQuestionExample.count }
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'returns unauthorized without a user' do
+      question = create_post_similarity_question!(text: 'extra?')
+
+      post "/gekanator/games/#{game.id}/extra_question_answers", params: {
+        answers: [
+          {
+            question_id: question.id,
+            answer: 'yes'
+          }
+        ]
+      }
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+  end
+
+  describe 'GET /gekanator/questions' do
+    it 'returns accepted questions only and includes example_answers for post_similarity questions' do
+      sign_in_as admin
+
+      accepted = create_post_similarity_question!(text: 'accepted?')
+      create_post_similarity_question!(
+        text: 'disabled?',
+        status: 'disabled'
+      )
+
+      GekanatorQuestionExample.create!(
+        gekanator_question: accepted,
+        post: correct_post,
+        user: admin,
+        answer: 'yes',
+        source: 'initial_suggestion',
+        weight: 1.0
+      )
+
+      get '/gekanator/questions'
+
+      expect(response).to have_http_status(:ok)
+      expect(json['questions'].length).to eq(1)
+
+      question_json = json['questions'].first
+      expect(question_json).to include(
+        'id' => "post-similarity:#{accepted.id}",
+        'text' => 'accepted?',
+        'kind' => 'post_similarity',
+        'source' => 'user_suggested',
+        'priority_weight' => 1.2
+      )
+      expect(question_json['condition']).to include(
+        'type' => 'post-similarity',
+        'postId' => correct_post.id,
+        'answer' => 'yes',
+        'threshold' => 0.65
+      )
+      expect(question_json['example_answers']).to include(
+        correct_post.id.to_s => 'yes'
+      )
+    end
+
+    it 'aggregates example_answers by weight' do
+      sign_in_as admin
+
+      question = create_post_similarity_question!(text: 'weighted?')
+
+      GekanatorQuestionExample.create!(
+        gekanator_question: question,
+        post: other_post,
+        user: admin,
+        answer: 'yes',
+        source: 'post_game_extra',
+        weight: 1.0
+      )
+      GekanatorQuestionExample.create!(
+        gekanator_question: question,
+        post: other_post,
+        user: other_user,
+        answer: 'no',
+        source: 'post_game_extra',
+        weight: 2.0
+      )
+
+      get '/gekanator/questions'
+
+      expect(response).to have_http_status(:ok)
+      question_json = json['questions'].find { _1['id'] == "post-similarity:#{question.id}" }
+      expect(question_json['example_answers']).to include(
+        other_post.id.to_s => 'no'
+      )
+    end
+
+    it 'normalizes legacy title length questions' do
+      sign_in_as admin
+
+      GekanatorQuestion.create!(
+        text: '題名が長めの投稿?',
+        kind: 'title',
+        source: 'admin_curated',
+        status: 'accepted',
+        priority_weight: 1.0,
+        condition: {
+          type: 'title-length-greater-than',
+          length: 20
+        },
+        created_by: admin
+      )
+
+      get '/gekanator/questions'
+
+      expect(response).to have_http_status(:ok)
+      question_json = json['questions'].find { _1['id'] == 'title:length-at-least:21' }
+      expect(question_json).to include(
+        'text' => 'タイトルは 21 文字以上?',
+        'kind' => 'title'
+      )
+      expect(question_json['condition']).to include(
+        'type' => 'title-length-at-least',
+        'length' => 21
+      )
+    end
+
+    it 'returns title-contains questions without authentication' do
+      GekanatorQuestion.create!(
+        text: '題名に「結束バンド」が含まれる?',
+        kind: 'title',
+        source: 'ai_generated',
+        status: 'accepted',
+        priority_weight: 0.95,
+        condition: {
+          type: 'title-contains',
+          text: '結束バンド'
+        },
+        created_by: admin
+      )
+
+      get '/gekanator/questions'
+
+      expect(response).to have_http_status(:ok)
+      question_json = json['questions'].find { _1['id'] == 'title:contains:結束バンド' }
+      expect(question_json).to include(
+        'text' => '題名に「結束バンド」が含まれる?',
+        'kind' => 'title'
+      )
+      expect(question_json['condition']).to include(
+        'type' => 'title-contains',
+        'text' => '結束バンド'
+      )
+    end
+  end
+end

backend/spec/requests/materials_spec.rb

@@ -141,16 +141,21 @@ RSpec.describe 'Materials API', type: :request do
     context 'when logged in' do
       before { sign_in_as(guest_user) }
 
-      it 'returns 400 when tag is blank' do
+      it 'returns 422 when tag is blank' do
         post '/materials', params: { tag: '   ', file: dummy_upload }
 
-        expect(response).to have_http_status(:bad_request)
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(json.fetch('errors')).to include(
+            'tag' => ['タグは必須です．'])
       end
 
-      it 'returns 400 when both file and url are blank' do
+      it 'returns 422 when both file and url are blank' do
         post '/materials', params: { tag: 'material_create_blank' }
 
-        expect(response).to have_http_status(:bad_request)
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(json.fetch('errors')).to include(
+            'file' => ['ファイルまたは URL は必須です．'],
+            'url' => ['ファイルまたは URL は必須です．'])
       end
 
       it 'creates a material with an attached file' do
@@ -261,21 +266,26 @@ RSpec.describe 'Materials API', type: :request do
         expect(response).to have_http_status(:not_found)
       end
 
-      it 'returns 400 when tag is blank' do
+      it 'returns 422 when tag is blank' do
         put "/materials/#{ material.id }", params: {
           tag: '   ',
           file: dummy_upload
         }
 
-        expect(response).to have_http_status(:bad_request)
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(json.fetch('errors')).to include(
+            'tag' => ['タグは必須です．'])
       end
 
-      it 'returns 400 when both file and url are blank' do
+      it 'returns 422 when both file and url are blank' do
         put "/materials/#{ material.id }", params: {
           tag: 'material_update_no_payload'
         }
 
-        expect(response).to have_http_status(:bad_request)
+        expect(response).to have_http_status(:unprocessable_entity)
+        expect(json.fetch('errors')).to include(
+            'file' => ['ファイルまたは URL は必須です．'],
+            'url' => ['ファイルまたは URL は必須です．'])
       end
 
       it 'updates tag, url, file, and updated_by_user' do

backend/spec/requests/nico_tags_spec.rb

@@ -3,12 +3,68 @@ require 'rails_helper'
 
 RSpec.describe 'NicoTags', type: :request do
   describe 'GET /tags/nico' do
-    it 'returns tags and next_cursor when overflowing limit' do
-      create_list(:tag, 21, :nico)
-      get '/tags/nico', params: { limit: 20 }
+    it 'returns paginated tags and total count' do
+      create_list(:tag, 3, :nico)
+
+      get '/tags/nico', params: { page: 2, limit: 2 }
+
       expect(response).to have_http_status(:ok)
-      expect(json['tags'].size).to eq(20)
-      expect(json['next_cursor']).to be_present
+      expect(json['tags'].size).to eq(1)
+      expect(json['count']).to eq(3)
+    end
+
+    it 'filters by nico tag name, linked tag name, and link status' do
+      linked = create(:tag, :nico)
+      linked.tag_name.update!(name: 'nico:search_linked')
+      unlinked = create(:tag, :nico)
+      unlinked.tag_name.update!(name: 'nico:search_unlinked')
+      other = create(:tag, :nico)
+      other.tag_name.update!(name: 'nico:other')
+      destination = create(:tag, :general)
+      destination.tag_name.update!(name: 'destination_search')
+      NicoTagRelation.create!(nico_tag: linked, tag: destination)
+      NicoTagRelation.create!(nico_tag: other, tag: create(:tag, :general))
+
+      get '/tags/nico', params: {
+        name: 'search_',
+        linked_tag: 'destination_',
+        link_status: 'linked'
+      }
+
+      expect(response).to have_http_status(:ok)
+      expect(json['count']).to eq(1)
+      expect(json.fetch('tags').map { |tag| tag['id'] }).to eq([linked.id])
+
+      get '/tags/nico', params: { name: 'search_', link_status: 'unlinked' }
+
+      expect(json['count']).to eq(1)
+      expect(json.fetch('tags').map { |tag| tag['id'] }).to eq([unlinked.id])
+    end
+
+    it 'sorts by name and timestamps' do
+      older = create(:tag, :nico)
+      older.tag_name.update!(name: 'nico:a')
+      older.update_columns(created_at: 2.days.ago)
+      newer = create(:tag, :nico)
+      newer.tag_name.update!(name: 'nico:b')
+      newer.update_columns(created_at: 1.day.ago)
+      older_post_tag =
+        PostTag.create!(post: Post.create!(url: 'https://example.com/nico-older'), tag: older)
+      older_post_tag.update_columns(created_at: 1.hour.ago)
+      newer_post_tag =
+        PostTag.create!(post: Post.create!(url: 'https://example.com/nico-newer'), tag: newer)
+      newer_post_tag.update_columns(created_at: 2.hours.ago)
+
+      get '/tags/nico', params: { order: 'name:desc' }
+      expect(json.fetch('tags').map { |tag| tag['id'] }).to eq([newer.id, older.id])
+
+      get '/tags/nico', params: { order: 'created_at:asc' }
+      expect(json.fetch('tags').map { |tag| tag['id'] }).to eq([older.id, newer.id])
+
+      get '/tags/nico', params: { order: 'updated_at:desc' }
+      expect(json.fetch('tags').map { |tag| tag['id'] }).to eq([older.id, newer.id])
+      expect(Time.zone.parse(json.fetch('tags').first.fetch('recent_post_tag_created_at')))
+        .to be_within(1.second).of(older_post_tag.created_at)
     end
   end
 
@@ -75,7 +131,7 @@ RSpec.describe 'NicoTags', type: :request do
       expect(versions.last.created_by_user_id).to eq(admin.id)
     end
 
-    it '400 when linked tag normalises to nico tag' do
+    it 'returns 422 when linked tag normalises to nico tag' do
       sign_in_as(member)
 
       other_nico = create(:tag, :nico, name: 'nico:linked_ng')
@@ -87,7 +143,37 @@ RSpec.describe 'NicoTags', type: :request do
         patch "/tags/nico/#{nico_tag.id}", params: { tags: 'linked_ng_alias' }
       }.not_to change(NicoTagVersion, :count)
 
-      expect(response).to have_http_status(:bad_request)
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors')).to include(
+          'tags' => ['ニコニコ・タグ同士は連携できません．'])
+    end
+
+    it 'returns the tags field error when a nico tag is specified directly' do
+      sign_in_as(member)
+
+      patch "/tags/nico/#{nico_tag.id}", params: { tags: 'nico:linked_ng' }
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors')).to include(
+          'tags' => ['ニコニコ・タグ同士は連携できません．'])
+    end
+
+    it 'returns tag name validation errors on the tags field and rolls back created tags' do
+      sign_in_as(member)
+      TagNameSanitisationRule.create!(
+        priority: 1,
+        source_pattern: 'invalid',
+        replacement: 'valid'
+      )
+      nico_tag
+
+      expect {
+        patch "/tags/nico/#{nico_tag.id}", params: { tags: 'created_first invalid' }
+      }.not_to change(TagName, :count)
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors').fetch('tags')).to include(
+          a_string_including('タグ名 “invalid”:', '名前に使用できない文字が含まれてゐます．'))
     end
   end
 end

backend/spec/requests/tag_versions_spec.rb

@@ -26,6 +26,7 @@ RSpec.describe 'TagVersions API', type: :request do
     created_by_user:,
     created_at:
   )
+    version =
         TagVersion.create!(
             tag: tag,
             version_no: version_no,
@@ -35,8 +36,12 @@ RSpec.describe 'TagVersions API', type: :request do
             aliases: Array(aliases).join(' '),
             parent_tag_ids: Array(parent_tags).map(&:id).join(' '),
             created_by_user: created_by_user,
-      created_at: created_at
-    )
+            created_at: created_at)
+
+    tag.update_columns(version_no: version_no) if tag.has_attribute?(:version_no)
+    tag.version_no = version_no if tag.respond_to?(:version_no=)
+
+    version
   end
 
   let!(:v1) do

backend/spec/requests/tags_deerjikists_spec.rb

@@ -8,23 +8,35 @@ RSpec.describe 'Tags deerjikists API', type: :request do
 
   let!(:tag) { create(:tag, category: :deerjikist) }
 
+  let(:member) { create(:user, :member) }
+  let(:guest) { create(:user, role: :guest) }
+
   before do
-    # show_by_name / deerjikists_by_name 用に名前を固定
     tag.tag_name.update!(name: 'deerjika')
   end
 
   describe 'GET /tags/:id/deerjikists' do
     subject(:do_request) do
-      get "/tags/#{ tag_id }/deerjikists"
+      get "/tags/#{tag_id}/deerjikists"
     end
 
     let(:tag_id) { tag.id }
 
     context 'when tag exists and has no deerjikists' do
-      it 'returns 200 and empty array' do
+      it 'returns 200 with tag and empty deerjikists array' do
         do_request
+
         expect(response).to have_http_status(:ok)
-        expect(json).to eq([])
+
+        expect(json).to be_a(Hash)
+
+        expect(json['tag']).to be_a(Hash)
+        expect(json['tag']['id']).to eq(tag.id)
+        expect(json['tag']['name']).to eq('deerjika')
+        expect(json['tag']['category']).to eq('deerjikist')
+        expect(json['tag']['has_deerjikists']).to eq(false)
+
+        expect(json['deerjikists']).to eq([])
       end
     end
 
@@ -34,14 +46,24 @@ RSpec.describe 'Tags deerjikists API', type: :request do
         Deerjikist.create!(platform: platform2, code: code2, tag: tag)
       end
 
-      it 'returns 200 and deerjikists array' do
+      it 'returns 200 with tag and deerjikists array' do
         do_request
+
         expect(response).to have_http_status(:ok)
 
-        expect(json).to be_a(Array)
-        expect(json.size).to eq(2)
+        expect(json).to be_a(Hash)
 
-        expect(json.map { |h| [h['platform'], h['code']] }).to contain_exactly(
+        expect(json['tag']).to be_a(Hash)
+        expect(json['tag']['id']).to eq(tag.id)
+        expect(json['tag']['name']).to eq('deerjika')
+        expect(json['tag']['category']).to eq('deerjikist')
+        expect(json['tag']['has_deerjikists']).to eq(true)
+
+        expect(json['deerjikists']).to be_a(Array)
+        expect(json['deerjikists'].size).to eq(2)
+
+        expect(json['deerjikists'].map { |h| [h['platform'], h['code']] })
+          .to contain_exactly(
             [platform1, code1],
             [platform2, code2],
           )
@@ -53,6 +75,7 @@ RSpec.describe 'Tags deerjikists API', type: :request do
 
       it 'returns 404' do
         do_request
+
         expect(response).to have_http_status(:not_found)
       end
     end
@@ -60,7 +83,7 @@ RSpec.describe 'Tags deerjikists API', type: :request do
 
   describe 'GET /tags/name/:name/deerjikists' do
     subject(:do_request) do
-      get "/tags/name/#{ name }/deerjikists"
+      get "/tags/name/#{name}/deerjikists"
     end
 
     let(:name) { 'deerjika' }
@@ -70,6 +93,7 @@ RSpec.describe 'Tags deerjikists API', type: :request do
 
       it 'returns 400' do
         do_request
+
         expect(response).to have_http_status(:bad_request)
       end
     end
@@ -79,23 +103,233 @@ RSpec.describe 'Tags deerjikists API', type: :request do
 
       it 'returns 404' do
         do_request
+
         expect(response).to have_http_status(:not_found)
       end
     end
 
+    context 'when tag exists and has no deerjikists' do
+      it 'returns 200 with tag and empty deerjikists array' do
+        do_request
+
+        expect(response).to have_http_status(:ok)
+
+        expect(json).to be_a(Hash)
+
+        expect(json['tag']).to be_a(Hash)
+        expect(json['tag']['id']).to eq(tag.id)
+        expect(json['tag']['name']).to eq('deerjika')
+        expect(json['tag']['category']).to eq('deerjikist')
+        expect(json['tag']['has_deerjikists']).to eq(false)
+
+        expect(json['deerjikists']).to eq([])
+      end
+    end
+
     context 'when tag exists and has deerjikists' do
       before do
         Deerjikist.create!(platform: platform1, code: code1, tag: tag)
       end
 
-      it 'returns 200 and deerjikists array' do
+      it 'returns 200 with tag and deerjikists array' do
         do_request
+
+        expect(response).to have_http_status(:ok)
+
+        expect(json).to be_a(Hash)
+
+        expect(json['tag']).to be_a(Hash)
+        expect(json['tag']['id']).to eq(tag.id)
+        expect(json['tag']['name']).to eq('deerjika')
+        expect(json['tag']['category']).to eq('deerjikist')
+        expect(json['tag']['has_deerjikists']).to eq(true)
+
+        expect(json['deerjikists']).to be_a(Array)
+        expect(json['deerjikists'].size).to eq(1)
+
+        expect(json['deerjikists'][0]['platform']).to eq(platform1)
+        expect(json['deerjikists'][0]['code']).to eq(code1)
+      end
+    end
+  end
+
+  describe 'PUT /tags/:id/deerjikists' do
+    subject(:do_request) do
+      put "/tags/#{tag_id}/deerjikists", params: payload, as: :json
+    end
+
+    let(:tag_id) { tag.id }
+    let(:payload) do
+      [
+        { platform: platform1, code: code1 },
+        { platform: platform2, code: code2 },
+      ]
+    end
+
+    context 'when not logged in' do
+      it 'returns 401' do
+        do_request
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when logged in but not member' do
+      before do
+        sign_in_as guest
+      end
+
+      it 'returns 403' do
+        do_request
+
+        expect(response).to have_http_status(:forbidden)
+      end
+    end
+
+    context 'when tag does not exist' do
+      let(:tag_id) { 9_999_999 }
+
+      before do
+        sign_in_as member
+      end
+
+      it 'returns 404' do
+        do_request
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
+    context 'when logged in as member' do
+      before do
+        sign_in_as member
+      end
+
+      context 'when tag has no deerjikists' do
+        it 'creates deerjikists and returns deerjikists array' do
+          expect {
+            do_request
+          }.to change { Deerjikist.where(tag: tag).count }.from(0).to(2)
+
           expect(response).to have_http_status(:ok)
 
+          expect(json).to be_a(Array)
+          expect(json.map { |h| [h['platform'], h['code']] })
+            .to contain_exactly(
+              [platform1, code1],
+              [platform2, code2],
+            )
+
+          expect(Deerjikist.where(tag: tag).map { |d| [d.platform, d.code] })
+            .to contain_exactly(
+              [platform1, code1],
+              [platform2, code2],
+            )
+        end
+      end
+
+      context 'when tag already has deerjikists' do
+        before do
+          Deerjikist.create!(platform: platform1, code: 'old-code-1', tag: tag)
+          Deerjikist.create!(platform: platform2, code: 'old-code-2', tag: tag)
+        end
+
+        it 'replaces deerjikists and returns deerjikists array' do
+          do_request
+
+          expect(response).to have_http_status(:ok)
+
+          expect(Deerjikist.where(tag: tag).map { |d| [d.platform, d.code] })
+            .to contain_exactly(
+              [platform1, code1],
+              [platform2, code2],
+            )
+
+          expect(Deerjikist.exists?(platform: platform1, code: 'old-code-1')).to eq(false)
+          expect(Deerjikist.exists?(platform: platform2, code: 'old-code-2')).to eq(false)
+
+          expect(json).to be_a(Array)
+          expect(json.map { |h| [h['platform'], h['code']] })
+            .to contain_exactly(
+              [platform1, code1],
+              [platform2, code2],
+            )
+        end
+      end
+
+      context 'when payload is empty array' do
+        let(:payload) { [] }
+
+        before do
+          Deerjikist.create!(platform: platform1, code: code1, tag: tag)
+          Deerjikist.create!(platform: platform2, code: code2, tag: tag)
+        end
+
+        it 'clears deerjikists and returns empty array' do
+          expect {
+            do_request
+          }.to change { Deerjikist.where(tag: tag).count }.from(2).to(0)
+
+          expect(response).to have_http_status(:ok)
+          expect(json).to eq([])
+        end
+      end
+
+      context 'when a row is invalid' do
+        let(:payload) do
+          [
+            { platform: '', code: code1 },
+          ]
+        end
+
+        it 'returns 422 with indexed field errors and does not replace existing deerjikists' do
+          Deerjikist.create!(platform: platform1, code: code1, tag: tag)
+
+          expect {
+            do_request
+          }.not_to change { Deerjikist.where(tag: tag).map { |d| [d.platform, d.code] } }
+
+          expect(response).to have_http_status(:unprocessable_entity)
+          expect(json).to include(
+              'type' => 'validation_error',
+              'message' => '入力内容を確認してください．',
+              'base_errors' => [])
+          expect(json.fetch('errors')).to include(
+              'deerjikists.0.platform' => [be_present])
+        end
+      end
+
+      context 'when youtube code is handle' do
+        let(:channel_id) { 'UCabcdefghijklmnopqrstuv' }
+        let(:payload) do
+          [
+            { platform: 'youtube', code: '@deerjika' },
+          ]
+        end
+
+        before do
+          allow(Net::HTTP).to receive(:get).and_return(
+            %(<link rel="canonical" href="https://www.youtube.com/channel/#{channel_id}">),
+          )
+        end
+
+        it 'normalises youtube handle to channel id' do
+          expect {
+            do_request
+          }.to change { Deerjikist.where(tag: tag).count }.from(0).to(1)
+
+          expect(response).to have_http_status(:ok)
+
+          expect(Net::HTTP).to have_received(:get)
+
+          expect(Deerjikist.exists?(platform: 'youtube', code: channel_id, tag: tag))
+            .to eq(true)
+
           expect(json).to be_a(Array)
           expect(json.size).to eq(1)
-        expect(json[0]['platform']).to eq(platform1)
-        expect(json[0]['code']).to eq(code1)
+          expect(json[0]['platform']).to eq('youtube')
+          expect(json[0]['code']).to eq(channel_id)
+        end
       end
     end
   end

backend/spec/requests/theatre_comments_spec.rb

@@ -80,6 +80,26 @@ RSpec.describe 'TheatreComments', type: :request do
       expect(response).to have_http_status(:ok)
       expect(response.parsed_body.map { |row| row['no'] }).to eq([3, 2, 1])
     end
+
+    it '削除済みコメントは deleted として返し、本文を隠す' do
+      comment_2.discard!
+
+      get "/theatres/#{theatre.id}/comments", params: { no_gt: 1 }
+
+      expect(response).to have_http_status(:ok)
+
+      deleted_comment = response.parsed_body.find { _1['no'] == 2 }
+      expect(deleted_comment).to include(
+        'deleted' => true,
+        'content' => nil
+      )
+
+      visible_comment = response.parsed_body.find { _1['no'] == 3 }
+      expect(visible_comment).to include(
+        'deleted' => false,
+        'content' => 'third comment'
+      )
+    end
   end
 
   describe 'POST /theatres/:theatre_id/comments' do
@@ -147,4 +167,44 @@ RSpec.describe 'TheatreComments', type: :request do
       })
     end
   end
+
+  describe 'DELETE /theatres/:theatre_id/comments/:id' do
+    let(:theatre) { create(:theatre) }
+    let(:alice) { create(:user, name: 'Alice') }
+    let(:bob) { create(:user, name: 'Bob') }
+    let!(:comment) do
+      create(
+        :theatre_comment,
+        theatre: theatre,
+        no: 1,
+        user: alice,
+        content: 'delete target'
+      )
+    end
+
+    it 'returns 401 when not logged in' do
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:unauthorized)
+      expect(comment.reload.discarded?).to eq(false)
+    end
+
+    it 'allows the comment owner to delete it' do
+      sign_in_as(alice)
+
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:no_content)
+      expect(comment.reload.discarded?).to eq(true)
+    end
+
+    it 'returns 403 when another user tries to delete it' do
+      sign_in_as(bob)
+
+      delete "/theatres/#{theatre.id}/comments/#{comment.no}"
+
+      expect(response).to have_http_status(:forbidden)
+      expect(comment.reload.discarded?).to eq(false)
+    end
+  end
 end

backend/spec/requests/theatre_programmes_spec.rb

@@ -0,0 +1,38 @@
+require 'rails_helper'
+
+RSpec.describe 'TheatreProgrammes', type: :request do
+  describe 'GET /theatres/:theatre_id/programmes' do
+    let(:theatre) { create(:theatre) }
+    let(:other_theatre) { create(:theatre) }
+    let(:post_1) { Post.create!(title: 'first', url: 'https://www.nicovideo.jp/watch/sm1') }
+    let(:post_2) { Post.create!(title: 'second', url: 'https://www.nicovideo.jp/watch/sm2') }
+    let(:other_post) { Post.create!(title: 'other', url: 'https://www.nicovideo.jp/watch/sm3') }
+
+    before do
+      TheatreProgramme.create!(theatre:, position: 1, post: post_1, created_at: 2.minutes.ago)
+      TheatreProgramme.create!(theatre:, position: 2, post: post_2, created_at: 1.minute.ago)
+      TheatreProgramme.create!(
+        theatre: other_theatre,
+        position: 1,
+        post: other_post,
+        created_at: 1.minute.ago
+      )
+    end
+
+    it 'returns programmes for the theatre in descending position with post json' do
+      get "/theatres/#{theatre.id}/programmes"
+
+      expect(response).to have_http_status(:ok)
+      expect(json.map { _1['position'] }).to eq([2, 1])
+      expect(json.map { _1.dig('post', 'title') }).to eq(['second', 'first'])
+      expect(json.first['post']).to include('id' => post_2.id, 'url' => post_2.url)
+    end
+
+    it 'filters programmes by position_gt' do
+      get "/theatres/#{theatre.id}/programmes", params: { position_gt: 1 }
+
+      expect(response).to have_http_status(:ok)
+      expect(json.map { _1['position'] }).to eq([2])
+    end
+  end
+end

backend/spec/requests/theatres_spec.rb

@@ -14,10 +14,24 @@ RSpec.describe 'Theatres API', type: :request do
   let(:member) { create(:user, :member, name: 'member user') }
   let(:other_user) { create(:user, :member, name: 'other user') }
 
+  let!(:niconico_post) do
+    Post.create!(
+      title: 'niconico post',
+      url: 'https://www.nicovideo.jp/watch/sm123'
+    )
+  end
+
+  let!(:second_niconico_post) do
+    Post.create!(
+      title: 'second niconico post',
+      url: 'https://www.nicovideo.jp/watch/sm456'
+    )
+  end
+
   let!(:youtube_post) do
     Post.create!(
       title: 'youtube post',
-      url: 'https://www.youtube.com/watch?v=spec123'
+      url: 'https://www.youtube.com/watch?v=yt123'
     )
   end
 
@@ -120,7 +134,8 @@ RSpec.describe 'Theatres API', type: :request do
         expect(json).to include(
           'host_flg' => true,
           'post_id' => nil,
-          'post_started_at' => nil
+          'post_started_at' => nil,
+          'post_elapsed_ms' => nil
         )
 
         expect(json.fetch('watching_users')).to contain_exactly(
@@ -177,7 +192,8 @@ RSpec.describe 'Theatres API', type: :request do
         expect(json).to include(
           'host_flg' => false,
           'post_id' => nil,
-          'post_started_at' => nil
+          'post_started_at' => nil,
+          'post_elapsed_ms' => nil
         )
 
         expect(json.fetch('watching_users')).to contain_exactly(
@@ -204,7 +220,7 @@ RSpec.describe 'Theatres API', type: :request do
         )
         theatre.update!(
           host_user: other_user,
-          current_post: youtube_post,
+          current_post: niconico_post,
           current_post_started_at: started_at
         )
         sign_in_as(member)
@@ -220,9 +236,11 @@ RSpec.describe 'Theatres API', type: :request do
         expect(theatre.host_user_id).to eq(member.id)
 
         expect(json['host_flg']).to eq(true)
-        expect(json['post_id']).to eq(youtube_post.id)
+        expect(json['post_id']).to eq(niconico_post.id)
         expect(Time.zone.parse(json['post_started_at']))
           .to be_within(1.second).of(started_at)
+        expect(json['post_elapsed_ms'])
+          .to be_within(1_000).of(120_000)
       end
     end
   end
@@ -273,16 +291,36 @@ RSpec.describe 'Theatres API', type: :request do
       it 'sets current_post to an eligible post and updates current_post_started_at' do
         expect { do_request }
           .to change { theatre.reload.current_post_id }
-          .from(nil).to(youtube_post.id)
 
         expect(response).to have_http_status(:no_content)
+        expect([niconico_post.id, second_niconico_post.id, youtube_post.id])
+          .to include(theatre.reload.current_post_id)
         expect(theatre.reload.current_post_started_at)
           .to be_within(1.second).of(Time.current)
+        expect(theatre.programmes.count).to eq(1)
+      end
+    end
+
+    context 'when only a YouTube post is eligible' do
+      before do
+        niconico_post.destroy!
+        second_niconico_post.destroy!
+        theatre.update!(host_user: member)
+        sign_in_as(member)
+      end
+
+      it 'sets current_post to the YouTube post' do
+        do_request
+
+        expect(response).to have_http_status(:no_content)
+        expect(theatre.reload.current_post_id).to eq(youtube_post.id)
       end
     end
 
     context 'when current user is host and no eligible post exists' do
       before do
+        niconico_post.destroy!
+        second_niconico_post.destroy!
         youtube_post.destroy!
         theatre.update!(
           host_user: member,
@@ -299,9 +337,189 @@ RSpec.describe 'Theatres API', type: :request do
 
         theatre.reload
         expect(theatre.current_post_id).to be_nil
-        expect(theatre.current_post_started_at)
-          .to be_within(1.second).of(Time.current)
+        expect(theatre.current_post_started_at).to be_nil
       end
     end
   end
+
+  describe 'PUT /theatres/:id/skip_vote' do
+    subject(:do_request) do
+      put "/theatres/#{theatre.id}/skip_vote", params: { post_id: requested_post_id }
+    end
+
+    let(:third_user) { create(:user, :member, name: 'third user') }
+    let(:requested_post_id) { niconico_post.id }
+
+    before do
+      theatre.update!(current_post: niconico_post, current_post_started_at: 10.seconds.ago)
+      [member, other_user, third_user].each do |user|
+        TheatreWatchingUser.create!(
+          theatre:,
+          user:,
+          expires_at: 10.seconds.from_now
+        )
+      end
+    end
+
+    it 'returns 401 when not logged in' do
+      sign_out
+
+      expect { do_request }.not_to change(TheatreSkipVote, :count)
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns 422 when post_id is invalid' do
+      sign_in_as(member)
+
+      expect {
+        put "/theatres/#{theatre.id}/skip_vote", params: { post_id: 'invalid' }
+      }.not_to change(TheatreSkipVote, :count)
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'records a vote and returns the current vote status before majority' do
+      sign_in_as(member)
+
+      expect { do_request }.to change(TheatreSkipVote, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json['skipped']).to eq(false)
+      expect(json['post_id']).to eq(niconico_post.id)
+      expect(json['skip_vote']).to include(
+        'votes_count' => 1,
+        'required_count' => 2,
+        'watching_users_count' => 3,
+        'voted' => true
+      )
+    end
+
+    it 'finalizes skip when votes reach majority and stores voters and tag snapshots' do
+      tag = create(:tag, name: 'skip-target')
+      PostTag.create!(post: niconico_post, tag:)
+
+      TheatreSkipVote.create!(theatre:, post: niconico_post, user: member)
+      sign_in_as(other_user)
+
+      expect { do_request }
+        .to change(TheatreSkipEvent, :count).by(1)
+        .and change(TheatreSkipEventVoter, :count).by(2)
+        .and change(TheatreSkipEventTag, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json['skipped']).to eq(true)
+      expect([second_niconico_post.id, youtube_post.id]).to include(json['post_id'])
+
+      event = TheatreSkipEvent.last
+      expect(event.post).to eq(niconico_post)
+      expect(event.users).to contain_exactly(member, other_user)
+      expect(event.tags).to contain_exactly(tag)
+      expect(TheatreSkipVote.where(theatre:, post: niconico_post)).to be_empty
+    end
+
+    it 'does not record a vote when requested post is no longer current' do
+      theatre.update!(current_post: second_niconico_post)
+      sign_in_as(member)
+
+      expect { do_request }.not_to change(TheatreSkipVote, :count)
+
+      expect(response).to have_http_status(:conflict)
+      expect(json['post_id']).to eq(second_niconico_post.id)
+      expect(json['skip_vote']).to include(
+        'votes_count' => 0,
+        'voted' => false
+      )
+    end
+  end
+
+  describe 'DELETE /theatres/:id/skip_vote' do
+    let(:requested_post_id) { niconico_post.id }
+
+    before do
+      theatre.update!(current_post: niconico_post, current_post_started_at: 10.seconds.ago)
+      TheatreWatchingUser.create!(theatre:, user: member, expires_at: 10.seconds.from_now)
+      TheatreSkipVote.create!(theatre:, post: niconico_post, user: member)
+      sign_in_as(member)
+    end
+
+    it 'removes the current user vote' do
+      expect {
+        delete "/theatres/#{theatre.id}/skip_vote", params: { post_id: requested_post_id }
+      }.to change(TheatreSkipVote, :count).by(-1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json['skip_vote']).to include(
+        'votes_count' => 0,
+        'required_count' => 1,
+        'watching_users_count' => 1,
+        'voted' => false
+      )
+    end
+
+    it 'does not remove a vote when requested post is no longer current' do
+      theatre.update!(current_post: second_niconico_post)
+
+      expect {
+        delete "/theatres/#{theatre.id}/skip_vote", params: { post_id: requested_post_id }
+      }.not_to change(TheatreSkipVote, :count)
+
+      expect(response).to have_http_status(:conflict)
+      expect(json['post_id']).to eq(second_niconico_post.id)
+    end
+  end
+
+  describe 'GET /theatres/:id/skip_events' do
+    before do
+      sign_in_as(member)
+    end
+
+    it 'does not expose skip voters' do
+      event = TheatreSkipEvent.create!(
+        theatre:,
+        post: niconico_post,
+        skipped_by_user: member,
+        created_at: Time.current
+      )
+      TheatreSkipEventVoter.create!(theatre_skip_event: event, user: member)
+
+      get "/theatres/#{theatre.id}/skip_events"
+
+      expect(response).to have_http_status(:ok)
+      expect(json.first).to include(
+        'id' => event.id,
+        'theatre_id' => theatre.id
+      )
+      expect(json.first).not_to have_key('voters')
+      expect(json.first).not_to have_key('skipped_by_user')
+    end
+  end
+
+  describe 'GET /theatres/:id/post_selection_weights' do
+    before do
+      theatre.update!(current_post: niconico_post)
+      TheatreWatchingUser.create!(theatre:, user: member, expires_at: 10.seconds.from_now)
+      sign_in_as(member)
+    end
+
+    it 'returns tag penalties and candidate weights for the current watchers' do
+      tag = create(:tag, name: 'heavy-tag')
+      PostTag.create!(post: second_niconico_post, tag:)
+      event = TheatreSkipEvent.create!(
+        theatre:,
+        post: niconico_post,
+        skipped_by_user: member,
+        created_at: Time.current
+      )
+      TheatreSkipEventVoter.create!(theatre_skip_event: event, user: member)
+      TheatreSkipEventTag.create!(theatre_skip_event: event, tag:)
+
+      get "/theatres/#{theatre.id}/post_selection_weights"
+
+      expect(response).to have_http_status(:ok)
+      expect(json['tag_penalties'].first['penalty']).to eq(1)
+      expect(json['lightest_posts'].first['post']['id']).to eq(second_niconico_post.id)
+      expect(json['lightest_posts'].first['penalty']).to eq(1)
+    end
+  end
 end

backend/spec/requests/users_spec.rb

@@ -1,109 +1,268 @@
-require "rails_helper"
+require 'rails_helper'
+
+RSpec.describe 'Users', type: :request do
+  let(:remote_ip) { '203.0.113.10' }
+
+  before do
+    allow_any_instance_of(ActionDispatch::Request)
+      .to receive(:remote_ip)
+      .and_return(remote_ip)
+  end
+
+  def auth_headers(user)
+    { 'X-Transfer-Code' => user.inheritance_code }
+  end
+
+  describe 'POST /users' do
+    it 'creates guest user, IpAddress and UserIp, and returns code' do
+      expect {
+        post '/users'
+      }.to change(User, :count).by(1)
+        .and change(IpAddress, :count).by(1)
+        .and change(UserIp, :count).by(1)
 
-RSpec.describe "Users", type: :request do
-  describe "POST /users" do
-    it "creates guest user and returns code" do
-      post "/users"
       expect(response).to have_http_status(:created)
-      expect(json["code"]).to be_present
-      expect(json["user"]["role"]).to eq("guest")
+      expect(json['code']).to be_present
+      expect(json['user']['role']).to eq('guest')
+
+      user = User.last
+      ip_address = IpAddress.find_by(ip_address: IPAddr.new(remote_ip).hton)
+
+      expect(user.role).to eq('guest')
+      expect(ip_address).to be_present
+      expect(UserIp.exists?(user:, ip_address:)).to eq(true)
+    end
+
+    it 'returns 403 and does not create user when current IP address is banned' do
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      expect {
+        post '/users'
+      }.not_to change(User, :count)
+
+      expect(response).to have_http_status(:forbidden)
+      expect(UserIp.count).to eq(0)
     end
   end
 
-  describe "POST /users/code/renew" do
-    it "returns 401 when not logged in" do
-      sign_out
-      post "/users/code/renew"
-      expect(response).to have_http_status(:unauthorized)
-    end
-  end
+  describe 'POST /users/code/renew' do
+    it 'returns 401 when not logged in' do
+      post '/users/code/renew'
 
-  describe "PUT /users/:id" do
-    let(:user) { create(:user, name: "old-name", role: "guest") }
-
-    it "returns 401 when current_user id mismatch" do
-      sign_in_as(create(:user))
-      put "/users/#{user.id}", params: { name: "new-name" }
       expect(response).to have_http_status(:unauthorized)
     end
 
-    it "returns 400 when name is blank" do
-      sign_in_as(user)
-      put "/users/#{user.id}", params: { name: "   " }
-      expect(response).to have_http_status(:bad_request)
+    it 'returns 403 when current user is banned' do
+      user = create(:user, :banned)
+
+      post '/users/code/renew', headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
     end
 
-    it "updates name and returns 201 with user slice" do
-      sign_in_as(user)
-      put "/users/#{user.id}", params: { name: "new-name" }
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user)
+
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      post '/users/code/renew', headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  describe 'PUT /users/:id' do
+    let(:user) { create(:user, name: 'old-name', role: 'guest') }
+
+    it 'returns 401 when current_user id mismatch' do
+      other_user = create(:user)
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(other_user)
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns 422 when name is blank' do
+      put "/users/#{user.id}",
+          params: { name: '   ' },
+          headers: auth_headers(user)
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors')).to include(
+          'name' => ['名前は必須です．'])
+    end
+
+    it 'updates name and returns user slice' do
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
 
       expect(response).to have_http_status(:ok)
-      expect(json["id"]).to eq(user.id)
-      expect(json["name"]).to eq("new-name")
+      expect(json['id']).to eq(user.id)
+      expect(json['name']).to eq('new-name')
 
       user.reload
-      expect(user.name).to eq("new-name")
+      expect(user.name).to eq('new-name')
+    end
+
+    it 'returns 403 when current user is banned' do
+      user.update!(banned_at: Time.current)
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+
+      user.reload
+      expect(user.name).to eq('old-name')
+    end
+
+    it 'returns 403 when current IP address is banned' do
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      put "/users/#{user.id}",
+          params: { name: 'new-name' },
+          headers: auth_headers(user)
+
+      expect(response).to have_http_status(:forbidden)
+
+      user.reload
+      expect(user.name).to eq('old-name')
     end
   end
 
-  describe "POST /users/verify" do
-    it "returns valid:false when code not found" do
-      post "/users/verify", params: { code: "nope" }
+  describe 'POST /users/verify' do
+    it 'returns valid:false when code not found' do
+      post '/users/verify', params: { code: 'nope' }
+
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(false)
+      expect(json['valid']).to eq(false)
     end
 
-    it "creates IpAddress and UserIp, and returns valid:true with user slice" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, role: "guest")
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
 
-      # request.remote_ip を固定
-      allow_any_instance_of(ActionDispatch::Request).to receive(:remote_ip).and_return("203.0.113.10")
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
 
       expect {
-        post "/users/verify", params: { code: user.inheritance_code }
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 when verified user is banned' do
+      user = create(
+        :user,
+        :banned,
+        inheritance_code: SecureRandom.uuid,
+        role: 'guest'
+      )
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.not_to change(UserIp, :count)
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'creates IpAddress and UserIp, and returns valid:true with user slice' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
       }.to change(UserIp, :count).by(1)
+        .and change(IpAddress, :count).by(1)
 
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(true)
-      expect(json["user"]["id"]).to eq(user.id)
-      expect(json["user"]["inheritance_code"]).to eq(user.inheritance_code)
-      expect(json["user"]["role"]).to eq("guest")
+      expect(json['valid']).to eq(true)
+      expect(json['user']['id']).to eq(user.id)
+      expect(json['user']['inheritance_code']).to eq(user.inheritance_code)
+      expect(json['user']['role']).to eq('guest')
 
-      # ついでに IpAddress もできてることを確認（ipの保存形式がバイナリでも count で見れる）
-      expect(IpAddress.count).to be >= 1
+      ip_address = IpAddress.find_by(ip_address: IPAddr.new(remote_ip).hton)
+      expect(ip_address).to be_present
+      expect(UserIp.exists?(user:, ip_address:)).to eq(true)
     end
 
-    it "is idempotent for same user+ip (does not create duplicate UserIp)" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, role: "guest")
-      allow_any_instance_of(ActionDispatch::Request).to receive(:remote_ip).and_return("203.0.113.10")
+    it 'is idempotent for same user and same IP address' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
 
-      post "/users/verify", params: { code: user.inheritance_code }
+      post '/users/verify', params: { code: user.inheritance_code }
       expect(response).to have_http_status(:ok)
 
       expect {
-        post "/users/verify", params: { code: user.inheritance_code }
+        post '/users/verify', params: { code: user.inheritance_code }
       }.not_to change(UserIp, :count)
 
       expect(response).to have_http_status(:ok)
-      expect(json["valid"]).to eq(true)
+      expect(json['valid']).to eq(true)
+    end
+
+    it 'creates another UserIp for same user and different IP address' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, role: 'guest')
+
+      post '/users/verify', params: { code: user.inheritance_code }
+      expect(response).to have_http_status(:ok)
+
+      allow_any_instance_of(ActionDispatch::Request)
+        .to receive(:remote_ip)
+        .and_return('203.0.113.11')
+
+      expect {
+        post '/users/verify', params: { code: user.inheritance_code }
+      }.to change(UserIp, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json['valid']).to eq(true)
     end
   end
 
-  describe "GET /users/me" do
-    it "returns 404 when code not found" do
-      get "/users/me", params: { code: "nope" }
+  describe 'GET /users/me' do
+    it 'returns 404 when code not found' do
+      get '/users/me', params: { code: 'nope' }
+
       expect(response).to have_http_status(:not_found)
     end
 
-    it "returns user slice when found" do
-      user = create(:user, inheritance_code: SecureRandom.uuid, name: "me", role: "guest")
-      get "/users/me", params: { code: user.inheritance_code }
+    it 'returns user slice when found' do
+      user = create(:user, inheritance_code: SecureRandom.uuid, name: 'me', role: 'guest')
+
+      get '/users/me', params: { code: user.inheritance_code }
 
       expect(response).to have_http_status(:ok)
-      expect(json["id"]).to eq(user.id)
-      expect(json["name"]).to eq("me")
-      expect(json["inheritance_code"]).to eq(user.inheritance_code)
-      expect(json["role"]).to eq("guest")
+      expect(json['id']).to eq(user.id)
+      expect(json['name']).to eq('me')
+      expect(json['inheritance_code']).to eq(user.inheritance_code)
+      expect(json['role']).to eq('guest')
+    end
+
+    it 'returns 403 when current IP address is banned' do
+      user = create(:user, inheritance_code: SecureRandom.uuid)
+
+      IpAddress.create!(
+        ip_address: IPAddr.new(remote_ip).hton,
+        banned_at: Time.current
+      )
+
+      get '/users/me', params: { code: user.inheritance_code }
+
+      expect(response).to have_http_status(:forbidden)
     end
   end
 end

backend/spec/requests/wiki_assets_spec.rb

@@ -1,191 +0,0 @@
-require 'digest'
-require 'rails_helper'
-require 'stringio'
-
-
-RSpec.describe 'WikiAssets API', type: :request do
-  def dummy_upload(content = 'dummy-image', filename: 'dummy.png', content_type: 'image/png')
-    Rack::Test::UploadedFile.new(StringIO.new(content),
-                                 content_type,
-                                 original_filename: filename)
-  end
-
-  let(:member) { create(:user, :member, name: 'member user') }
-  let(:guest)  { create(:user, name: 'guest user') }
-
-  let!(:tag_name) { TagName.create!(name: 'spec_wiki_asset_page') }
-  let!(:page) do
-    WikiPage.create!(tag_name: tag_name, created_user: member, updated_user: member).tap do |p|
-      Wiki::Commit.content!(page: p, body: 'init', created_user: member, message: 'init')
-    end
-  end
-
-  describe 'GET /wiki/:wiki_page_id/assets' do
-    subject(:do_request) do
-      get "/wiki/#{wiki_page_id}/assets"
-    end
-
-    let(:wiki_page_id) { page.id }
-
-    let!(:asset) do
-      WikiAsset.new(wiki_page: page,
-                    no: 1,
-                    alt_text: 'spec alt',
-                    sha256: Digest::SHA256.digest('asset-1'),
-                    created_by_user: member).tap do |record|
-        record.file.attach(dummy_upload('asset-1'))
-        record.save!
-      end
-    end
-
-    context 'when wiki page exists' do
-      it 'returns assets for the page' do
-        do_request
-
-        expect(response).to have_http_status(:ok)
-        expect(json).to be_an(Array)
-        expect(json.size).to eq(1)
-
-        expect(json.first).to include(
-            'wiki_page_id' => page.id,
-            'no' => 1)
-      end
-
-      it 'does not include assets from other pages' do
-        other_tag_name = TagName.create!(name: 'spec_other_wiki_asset_page')
-        other_page = WikiPage.create!(tag_name: other_tag_name,
-                                      created_user: member,
-                                      updated_user: member)
-        Wiki::Commit.content!(page: other_page, body: 'other', created_user: member, message: 'other')
-
-        WikiAsset.new(wiki_page: other_page,
-                      no: 1,
-                      alt_text: 'other alt',
-                      sha256: Digest::SHA256.digest('asset-2'),
-                      created_by_user: member).tap do |record|
-          record.file.attach(dummy_upload('asset-2', filename: 'other.png'))
-          record.save!
-        end
-
-        do_request
-
-        expect(response).to have_http_status(:ok)
-        expect(json.size).to eq(1)
-        expect(json.first['wiki_page_id']).to eq(page.id)
-      end
-    end
-
-    context 'when wiki page does not exist' do
-      let(:wiki_page_id) { 999_999_999 }
-
-      it 'returns 404' do
-        do_request
-        expect(response).to have_http_status(:not_found)
-      end
-    end
-  end
-
-  describe 'POST /wiki/:wiki_page_id/assets' do
-    subject(:do_request) do
-      post "/wiki/#{wiki_page_id}/assets", params: params
-    end
-
-    let(:wiki_page_id) { page.id }
-    let(:params) do
-      { file: dummy_upload(upload_content),
-        alt_text: 'uploaded alt' }
-    end
-    let(:upload_content) { 'uploaded-image-binary' }
-
-    context 'when not logged in' do
-      it 'returns 401' do
-        sign_out
-        do_request
-        expect(response).to have_http_status(:unauthorized)
-      end
-    end
-
-    context 'when logged in but not member' do
-      it 'returns 403' do
-        sign_in_as(guest)
-        do_request
-        expect(response).to have_http_status(:forbidden)
-      end
-    end
-
-    context 'when wiki page does not exist' do
-      let(:wiki_page_id) { 999_999_999 }
-
-      it 'returns 404' do
-        sign_in_as(member)
-        do_request
-        expect(response).to have_http_status(:not_found)
-      end
-    end
-
-    context 'when file is blank' do
-      let(:params) { { alt_text: 'uploaded alt' } }
-
-      it 'returns 400' do
-        sign_in_as(member)
-        do_request
-        expect(response).to have_http_status(:bad_request)
-      end
-    end
-
-    context 'when success' do
-      before do
-        sign_in_as(member)
-      end
-
-      it 'creates asset, attaches file, increments next_asset_no, and returns json' do
-        expect { do_request }
-          .to change(WikiAsset, :count).by(1)
-
-        expect(response).to have_http_status(:ok)
-
-        asset = WikiAsset.order(:id).last
-        expect(asset.wiki_page_id).to eq(page.id)
-        expect(asset.no).to eq(1)
-        expect(asset.alt_text).to eq('uploaded alt')
-        expect(asset.sha256).to eq(Digest::SHA256.digest(upload_content))
-        expect(asset.created_by_user_id).to eq(member.id)
-        expect(asset.file).to be_attached
-        expect(asset.file.download).to eq(upload_content)
-
-        expect(page.reload.next_asset_no).to eq(2)
-
-        expect(json).to include(
-          'wiki_page_id' => page.id,
-          'no' => 1,
-          'url' => asset.url
-        )
-      end
-
-      it 'uses the next page-local number when assets already exist' do
-        existing = WikiAsset.new(wiki_page: page,
-                                 no: 1,
-                                 alt_text: 'existing alt',
-                                 sha256: Digest::SHA256.digest('existing'),
-                                 created_by_user: member)
-        existing.file.attach(dummy_upload('existing', filename: 'existing.png'))
-        existing.save!
-        page.update!(next_asset_no: 2)
-
-        do_request
-
-        expect(response).to have_http_status(:ok)
-
-        asset = WikiAsset.order(:id).last
-        expect(asset.no).to eq(2)
-        expect(page.reload.next_asset_no).to eq(3)
-
-        expect(json).to include(
-          'wiki_page_id' => page.id,
-          'no' => 2,
-          'url' => asset.url
-        )
-      end
-    end
-  end
-end

backend/spec/requests/wiki_spec.rb

@@ -113,7 +113,6 @@ RSpec.describe 'Wiki API', type: :request do
 
         page_id = json.fetch('id')
         expect(json.fetch('title')).to eq('TestPage')
-        expect(json.fetch('body')).to eq("a\nb\nc")
 
         created_page = WikiPage.find(page_id)
         version = created_page.wiki_versions.order(:version_no).last

backend/spec/services/gekanator/question_suggestion_ai_converter_spec.rb

@@ -0,0 +1,112 @@
+require 'rails_helper'
+
+RSpec.describe Gekanator::QuestionSuggestionAiConverter do
+  let(:user) { create(:user, :member) }
+  let(:guessed_post) { Post.create!(title: 'guess', url: 'https://example.com/guess') }
+  let(:correct_post) { Post.create!(title: 'correct', url: 'https://example.com/correct') }
+  let(:game) do
+    GekanatorGame.create!(
+      user: user,
+      guessed_post: guessed_post,
+      correct_post: correct_post,
+      won: false,
+      question_count: 1,
+      answers: [{ 'question_id' => 'tag:1', 'answer' => 'yes' }]
+    )
+  end
+
+  def create_suggestion!(question_text:, answer: 'yes')
+    GekanatorQuestionSuggestion.create!(
+      gekanator_game: game,
+      user: user,
+      question_text: question_text,
+      answer: answer
+    )
+  end
+
+  it 'converts title-contains suggestions to pending ai-generated questions' do
+    suggestion = create_suggestion!(question_text: '題名に「結束バンド」が含まれる?')
+
+    expect {
+      described_class.call(suggestion: suggestion, user: user)
+    }.to change { GekanatorQuestion.count }.by(1)
+      .and change { GekanatorAiRun.count }.by(1)
+
+    question = GekanatorQuestion.last
+    expect(question).to have_attributes(
+      text: '題名に「結束バンド」が含まれる?',
+      kind: 'title',
+      source: 'ai_generated',
+      status: 'pending',
+      priority_weight: 0.95,
+      gekanator_question_suggestion_id: suggestion.id,
+      created_by_id: user.id
+    )
+    expect(question.condition).to include(
+      'type' => 'title-contains',
+      'text' => '結束バンド'
+    )
+    expect(GekanatorAiRun.last).to have_attributes(
+      gekanator_question_suggestion_id: suggestion.id,
+      model: 'heuristic_converter_v1',
+      status: 'succeeded'
+    )
+  end
+
+  it 'converts concrete non-unknown suggestions to post-similarity questions' do
+    suggestion = create_suggestion!(
+      question_text: '喜多ちゃんが泣いてる?',
+      answer: 'partial'
+    )
+
+    question = described_class.call(suggestion: suggestion, user: user)
+
+    expect(question).to have_attributes(
+      text: '喜多ちゃんが泣いてる?',
+      kind: 'post_similarity',
+      source: 'ai_generated',
+      status: 'pending',
+      priority_weight: 1.0
+    )
+    expect(question.condition).to include(
+      'type' => 'post-similarity',
+      'postId' => correct_post.id,
+      'answer' => 'partial',
+      'threshold' => 0.65
+    )
+  end
+
+  it 'records a failed run when the suggestion cannot be converted' do
+    suggestion = create_suggestion!(
+      question_text: 'よく分からない質問?',
+      answer: 'unknown'
+    )
+
+    expect {
+      expect(described_class.call(suggestion: suggestion, user: user)).to be_nil
+    }.not_to change { GekanatorQuestion.count }
+
+    expect(GekanatorAiRun.last).to have_attributes(
+      gekanator_question_suggestion_id: suggestion.id,
+      status: 'failed'
+    )
+  end
+
+  it 'returns an existing generated question without creating a duplicate run' do
+    suggestion = create_suggestion!(question_text: 'タイトルは 10 文字以上?')
+    existing = GekanatorQuestion.create!(
+      text: 'タイトルは 10 文字以上?',
+      kind: 'title',
+      source: 'ai_generated',
+      status: 'pending',
+      priority_weight: 0.95,
+      condition: { type: 'title-length-at-least', length: 10 },
+      gekanator_question_suggestion: suggestion,
+      created_by: user
+    )
+
+    expect {
+      expect(described_class.call(suggestion: suggestion, user: user)).to eq(existing)
+    }.not_to change { GekanatorAiRun.count }
+  end
+end

backend/spec/services/version_recorder_spec.rb

@@ -0,0 +1,85 @@
+require 'rails_helper'
+
+RSpec.describe VersionRecorder do
+  let(:member) { create(:user, :member) }
+
+  let(:post_record) do
+    Post.create!(
+        title: 'version recorder post',
+        url: 'https://example.com/version-recorder-post')
+  end
+
+  it 'updates record version_no when creating the first version' do
+    version =
+        PostVersionRecorder.record!(
+            post: post_record,
+            event_type: :create,
+            created_by_user: member)
+
+    expect(version.version_no).to eq(1)
+    expect(post_record.reload.version_no).to eq(1)
+  end
+
+  it 'updates record version_no when creating the next version' do
+    PostVersionRecorder.record!(
+        post: post_record,
+        event_type: :create,
+        created_by_user: member)
+
+    post_record.update!(title: 'updated version recorder post')
+
+    version =
+        PostVersionRecorder.record!(
+            post: post_record.reload,
+            event_type: :update,
+            created_by_user: member)
+
+    expect(version.version_no).to eq(2)
+    expect(post_record.reload.version_no).to eq(2)
+  end
+
+  it 'does not create a new version or advance version_no when snapshot is unchanged' do
+    first =
+        PostVersionRecorder.record!(
+            post: post_record,
+            event_type: :create,
+            created_by_user: member)
+
+    expect {
+      version =
+          PostVersionRecorder.record!(
+              post: post_record.reload,
+              event_type: :update,
+              created_by_user: member)
+
+      expect(version).to eq(first)
+    }.not_to change(PostVersion, :count)
+
+    expect(post_record.reload.version_no).to eq(1)
+  end
+
+  it 'raises when record version_no is older than the latest version' do
+    PostVersionRecorder.record!(
+        post: post_record,
+        event_type: :create,
+        created_by_user: member)
+
+    post_record.update!(title: 'updated once')
+
+    PostVersionRecorder.record!(
+        post: post_record.reload,
+        event_type: :update,
+        created_by_user: member)
+
+    post_record.update_columns(version_no: 1)
+
+    post_record.update!(title: 'updated with stale version_no')
+
+    expect {
+      PostVersionRecorder.record!(
+          post: post_record.reload,
+          event_type: :update,
+          created_by_user: member)
+    }.to raise_error(RuntimeError, /version_no/)
+  end
+end

backend/spec/support/test_records.rb

@@ -2,14 +2,12 @@ module TestRecords
   def create_member_user!
     User.create!(name: 'spec user',
                  inheritance_code: SecureRandom.hex(16),
-                 role: 'member',
-                 banned_at: nil)
+                 role: 'member')
   end
 
   def create_admin_user!
     User.create!(name: 'spec admin',
                  inheritance_code: SecureRandom.hex(16),
-                 role: 'admin',
-                 banned_at: nil)
+                 role: 'admin')
   end
 end

backend/spec/tasks/nico_sync_spec.rb

@@ -104,6 +104,7 @@ RSpec.describe "nico:sync" do
       url: post.url,
       thumbnail_base: post.thumbnail_base,
       tags: snapshot_tags(post),
+      parent_post_ids: post.snapshot_parent_post_ids.join(' '),
       original_created_from: post.original_created_from,
       original_created_before: post.original_created_before,
       created_at: Time.current,

docs/codex-handoff.md

@@ -0,0 +1,646 @@
+# Codex handoff for BTRC Hub / タグ広場
+
+This document transfers project-specific context from prior ChatGPT-assisted design and review work to Codex.
+
+Use this file as project background.
+Use `AGENTS.md`, `backend/AGENTS.md`, and `frontend/AGENTS.md` for concrete coding rules and verification commands.
+
+## Project identity
+
+BTRC Hub / タグ広場 is a collaborative knowledge base for collecting, tagging, explaining, and rediscovering Bocchi the Rock creature-related works.
+
+It is not a generic SNS.
+It is not a comment board.
+It is not a service for rehosting external content.
+It is primarily a structured link, tag, wiki, material, and viewing-party system.
+
+Core domains:
+
+1. Posts
+2. Tags
+3. Wiki pages
+4. Materials
+5. Theatre / watch-party features
+
+The project is already publicly accessible and indexed by search engines, but it has not been broadly announced. Treat it as a small public production system, not a private prototype.
+
+## Current stack
+
+Backend:
+
+- Ruby 3.2.2
+- Rails 8.0.2 API
+- MySQL 8
+- Active Storage
+- Cloudflare R2 / S3-compatible storage is expected for uploaded files
+- RSpec
+
+Frontend:
+
+- React 19.1
+- Vite 6.3
+- TypeScript 5.8
+- Axios
+- TanStack Query
+- Tailwind CSS
+- Framer Motion
+- shadcn-like local components
+- react-markdown
+- react-markdown-editor-lite
+- remark-wiki-autolink
+
+Batch / background-like tasks:
+
+- Rake tasks
+- Nico sync
+- YouTube sync
+- Similarity calculation tasks
+
+## Repository working principle
+
+Before editing, inspect the existing implementation.
+
+Do not invent a new architecture when the current repo already has an established convention.
+
+Keep changes scoped to the requested issue.
+
+Prefer small, reviewable changes over broad rewrites.
+
+Do not perform unrelated cleanup in the same patch.
+
+When a task has design ambiguity, first produce a short investigation and recommended plan. Do not silently choose a risky design.
+
+## User coding preferences
+
+General:
+
+- Prefer single quotes for strings unless interpolation, escaping, or framework convention makes double quotes better.
+- Do not add production dependencies without explicit approval.
+- Do not perform broad formatting churn.
+- Do not convert unrelated files to a different style.
+
+Ruby:
+
+- Do not put a space before method-call parentheses.
+- Do not use `%w`.
+- Do not use `%i`.
+- Keep Rails code idiomatic, but preserve the user's style where the repo already uses it.
+
+TypeScript / Python:
+
+- The user prefers GNU-style spacing before parentheses where syntactically valid.
+- Preserve existing project formatting if a formatter or nearby code dictates otherwise.
+
+## Current authentication model
+
+The system does not use normal email/password authentication.
+
+Users are authenticated by inheritance code.
+
+Frontend:
+
+- Stores the code in `localStorage.user_code`.
+- Sends it as the `X-Transfer-Code` header.
+
+Backend:
+
+- Looks up `users.inheritance_code`.
+- Sets `current_user`.
+
+Roles:
+
+- `guest`
+- `member`
+- `admin`
+
+Important helper:
+
+- `User#gte_member?` returns true for `member` and `admin`.
+
+Never introduce a conventional login assumption unless the issue explicitly asks for it.
+
+## BAN / abuse-control model
+
+The backend currently enforces BAN at API level.
+
+The relevant before_action order is conceptually:
+
+1. Reject banned IP address.
+2. Authenticate user if transfer code exists.
+3. Reject banned user.
+
+Entities:
+
+- `users.banned_at`
+- `ip_addresses.banned_at`
+- `user_ips`
+
+IP addresses are stored as binary values using `IPAddr#hton`.
+
+Do not weaken BAN behavior.
+
+Do not move BAN checks behind optional authentication.
+
+Do not make preview, theatre, verify, user creation, or public-looking endpoints bypass BAN without an explicit design decision.
+
+## Public-operation assumptions
+
+Current practical operation:
+
+- A few editor accounts exist.
+- Meaningful editing is mostly done by the owner.
+- Read access is already public.
+- Search engines have indexed the site.
+- Future editor applications are expected through Discord.
+- Prospective editors are likely people known in the Bocchi creature community.
+
+This means security and moderation issues matter even if traffic is still small.
+
+## Core domain summary
+
+### Posts
+
+Posts are external URL-based link records.
+
+Important properties:
+
+- `url` is required and unique.
+- URLs are normalized.
+- Only HTTP / HTTPS are allowed.
+- Posts can have thumbnails through Active Storage.
+- `uploaded_user_id` may be NULL for synced or bot-created posts.
+- `original_created_from` and `original_created_before` represent a time range for original content creation.
+- When both original time bounds exist, `from < before` is required.
+
+Parent/child posts:
+
+- Current implementation uses `post_implications`.
+- It is many-to-many.
+- Do not assume `posts.parent_id`.
+- Frontend/API clients must send `parent_post_ids`, even when empty.
+- `parent_post_ids` is parsed as a space-separated ID string.
+- Self-parenting is invalid.
+- Missing parent IDs are invalid.
+
+Versions:
+
+- `post_versions` stores snapshots.
+- `version_no` is a per-post sequence.
+- Snapshot includes title, URL, thumbnail base, tags, parent post IDs, original time bounds, event type, and actor.
+- Optimistic locking for posts is planned / important, but do not assume it is fully implemented unless the code proves it.
+
+### Tags
+
+Tags are central.
+
+There is separation between tag names and tag entities:
+
+- `tag_names`
+- `tags`
+
+Categories:
+
+- `deerjikist`
+- `meme`
+- `character`
+- `general`
+- `material`
+- `nico`
+- `meta`
+
+Alias model:
+
+- `tag_names.canonical_id` expresses aliases.
+- `canonical_id = NULL` means canonical name.
+- `canonical_id != NULL` means alias.
+- An alias must not point to another alias.
+- A tag name that already has a tag or wiki page generally must not be aliasified.
+
+Tag normalization:
+
+- User-entered tags are normalized through existing backend logic.
+- Known aliases are canonicalized.
+- Parent tags are expanded recursively.
+- `nico:` is normally rejected for manual entry.
+- Special tags such as tag-request / bot / unknown-deerjikist / video / niconico / youtube must be protected.
+
+Do not casually change tag normalization, alias resolution, or parent expansion. These affect search, wiki, sync, and historical data.
+
+### Nico tags
+
+Nico tags use the `nico` category and have separate versioning.
+
+Important relation:
+
+- `nico_tag_relations` maps external Nico tags to internal tags.
+- `nico_tag_id` must be a Nico category tag.
+- `tag_id` must not be Nico category.
+
+Do not allow ordinary manual tag editing to create or corrupt Nico tags.
+
+### Deerjikists
+
+Deerjikists map external platform identities to internal `deerjikist` tags.
+
+Known platforms include:
+
+- `nico`
+- `youtube`
+
+YouTube handles may be normalized to `UC...` channel IDs.
+
+Do not treat user-facing handles and canonical channel IDs as interchangeable without checking existing code.
+
+### Wiki
+
+Wiki pages are a major knowledge layer.
+
+Important points:
+
+- Wiki pages are tied to tag-like titles.
+- Title handling, aliases, and canonical tag names matter.
+- There is line-level storage / revision-oriented behavior in the current implementation.
+- There has been design tension between wiki revisions and wiki versions.
+- Wiki conflict detection using `base_revision_id` exists on the backend side.
+- Frontend support for conflict detection must be verified before assuming it is complete.
+
+Do not redesign Wiki storage casually.
+
+Do not add a second competing history system.
+
+Do not break existing wiki URLs.
+
+### Materials
+
+Materials connect files or reference URLs to `material` or `character` tags.
+
+Important properties:
+
+- A material has a `tag_id`.
+- The tag must be `material` or `character`.
+- A material requires either `url` or attached `file`.
+- Active Storage is involved.
+- Upload/security policy matters more than plain link posting.
+
+Important unresolved/risky area:
+
+- Material creation permissions have historically been risky because upload endpoints can be abused.
+- Prefer `member` or higher for material creation unless the issue explicitly says otherwise.
+
+### Theatre
+
+Theatre is an experimental watch-party style feature.
+
+Known pieces include:
+
+- Display
+- Presence
+- Next post
+- Comments
+- Host-like control
+
+Do not assume theatre has complete CRUD/admin support unless the code proves it.
+
+Theatre may become expensive if next-item selection uses random DB ordering.
+
+## Current high-risk areas
+
+Treat these areas with extra care.
+
+### Security
+
+- Preview API SSRF protection.
+- External iframe / embed CSP.
+- Markdown link safety.
+- BAN / IP BAN bypass.
+- Transfer-code leakage.
+- Guest write access.
+- Upload endpoints.
+- Admin-only tag operations.
+- System tag mutation.
+
+### Data integrity
+
+- Tag alias canonicalization.
+- Tag parent expansion.
+- Post parent many-to-many relationships.
+- Version tables.
+- `version_no` synchronization.
+- Schema drift from branch migration contamination.
+- Wiki revision/version split.
+- Material version recording.
+
+### Frontend correctness
+
+- React Hooks must not be called conditionally.
+- Role guards are currently spread across components/pages.
+- TanStack Query keys must not collide between ID/name or ID/title variants.
+- URL path segments containing tag names or wiki titles must use `encodeURIComponent`.
+- API response types may allow `null` users for bot or migration data.
+- Tag autocomplete has had duplicated logic and stale state hazards.
+
+### Performance
+
+- Avoid unbounded `limit`.
+- Avoid `order('RAND()')` for growing tables.
+- Avoid loading full relations just to count.
+- Avoid Ruby-side sorting/paging for large histories.
+- Tag sidebar client-side aggregation can become expensive.
+- Wiki full-text search needs deliberate indexing/design.
+
+## Current priority order
+
+Use this as the default priority unless an issue says otherwise.
+
+### P0: Safety before broad announcement
+
+1. Preview API SSRF hardening.
+2. Material creation permission tightening.
+3. System tag mutation holes.
+4. `GET /users/me` transfer-code leakage through query params.
+5. Limit caps for index/history/comment APIs.
+6. CSP / iframe sandbox policy.
+7. Confirm BAN enforcement remains global.
+
+### P1: Core correctness
+
+1. Post optimistic locking with `version_no`.
+2. Wiki edit conflict handling.
+3. Wiki history/revision model clarification.
+4. Wiki search truthfulness: implement body search or remove false UI.
+5. Tag alias/canonical/wiki interaction.
+6. Tag URL encoding.
+7. TanStack Query key separation.
+8. Frontend null-user handling.
+9. React Hooks rule fixes.
+10. Material version policy.
+
+### P2: Operational/admin usability
+
+1. Admin screens for users, IPs, bans, aliases, and settings.
+2. Settings table and user settings usage.
+3. Better tag sidebar.
+4. Better role guard helpers.
+5. Better frontend tests.
+6. Better issue triage and closure of already-implemented issues.
+
+### P3: Future features
+
+1. Theatre list/create/edit/admin flow.
+2. Muted/hidden tags.
+3. Tag category custom colors.
+4. Responsive refinements.
+5. Watch-party improvements.
+6. Broader embed support.
+
+## Known issue triage notes
+
+Some existing issues may already be partially or mostly implemented.
+
+Before implementing an issue, check code first.
+
+Examples:
+
+- Tag search and OR/NOT search may already be mostly implemented.
+- BAN enforcement may have been implemented after earlier issue drafts.
+- YouTube sync exists and should not be treated as purely planned.
+- Parent posts are many-to-many in current schema, even if older issues mention one-to-many.
+- Some issues may reflect old schema or old branch state.
+
+When in doubt:
+
+1. Inspect current code.
+2. Inspect schema.
+3. Inspect routes.
+4. Inspect frontend usage.
+5. Report whether the issue is implemented, partially implemented, not implemented, or obsolete.
+6. Only then edit.
+
+## Verification expectations
+
+Backend changes:
+
+- Run RSpec when possible.
+- Add request specs for API behavior changes.
+- Add model specs for validation / normalization changes.
+- Check migrations and schema consistency.
+- Do not silently ignore pending migrations.
+
+Frontend changes:
+
+- Run build.
+- Run lint if configured.
+- Run tests if configured.
+- Add tests for important behavior when the test framework exists.
+- If frontend tests are not yet installed, state that clearly.
+
+Full-stack changes:
+
+- Verify both backend and frontend compile/test paths where possible.
+- Confirm API response shapes match TypeScript types.
+- Confirm authorization behavior on both server and UI.
+
+If commands cannot be run because dependencies are missing, report that explicitly. Do not pretend verification passed.
+
+## Branch / migration caution
+
+The project has previously suffered from schema contamination caused by running migrations from another branch.
+
+Be careful when touching:
+
+- `db/schema.rb`
+- migration files
+- parent post schema
+- banned / banned_at schema
+- version_no migrations
+- wiki asset schema
+
+Before changing migrations:
+
+1. Inspect current schema.
+2. Inspect existing migrations.
+3. Confirm whether the intended branch already includes related migrations.
+4. Prefer additive migrations for shared branches.
+5. Do not edit already-applied production migrations unless explicitly instructed.
+
+## API design principles
+
+Prefer explicit server-side authorization.
+
+Do not rely only on frontend hiding.
+
+Do not return sensitive codes unnecessarily.
+
+Use 403 for authorization failures.
+
+Use 422 for validation failures.
+
+Use 409 for edit conflicts.
+
+Do not expose internal exception messages to users.
+
+Clamp or reject abusive limits consistently.
+
+Keep response shape stable unless the issue explicitly includes a breaking API change.
+
+## Frontend design principles
+
+Use existing route and query-key conventions.
+
+Use TanStack Query `enabled` rather than conditional hook calls.
+
+Do not let role-based early returns change hook order.
+
+Centralize repeated tag autocomplete logic when touching it.
+
+Use `encodeURIComponent` for tag names and wiki titles in URL path segments.
+
+Prefer graceful fallback for nullable actors:
+
+- bot operation
+- deleted user
+- migration-created data
+- external sync
+
+Do not assume all API user fields are non-null.
+
+## Testing priorities to add over time
+
+Frontend tests are especially important because the backend already has more mature RSpec coverage.
+
+Suggested first frontend tests:
+
+1. Tag autocomplete.
+2. Post form tag editing.
+3. Tag URL encoding.
+4. Wiki edit conflict UI.
+5. Role guard behavior.
+6. Null-user history rendering.
+7. Dialog behavior.
+8. Top navigation responsive behavior.
+
+Backend test priorities:
+
+1. BAN enforcement across public-looking endpoints.
+2. Material permissions.
+3. Preview SSRF rejection.
+4. System tag protection.
+5. Post optimistic locking.
+6. Wiki conflict detection.
+7. Tag alias/canonical behavior.
+8. Limit caps.
+9. Parent post parsing.
+10. Version recorder behavior.
+
+## What Codex should not do without explicit approval
+
+Do not:
+
+- Replace Rails.
+- Replace React.
+- Replace TanStack Query.
+- Redesign the database.
+- Rewrite Wiki storage.
+- Remove version tables.
+- Change authentication model.
+- Change role names.
+- Change tag category names.
+- Add background job infrastructure.
+- Add a new UI framework.
+- Add a new test framework if one already exists.
+- Add major dependencies.
+- Change public URL design.
+- Change production storage configuration.
+- Remove historical data behavior.
+- Simplify BAN/security checks.
+- Treat the site as private-only.
+
+## Good first Codex tasks
+
+Start with investigation-only tasks.
+
+Example:
+
+```txt
+Inspect the repository and summarize the Rails, React, TypeScript, and test setup.
+Do not modify files.
+List commands that actually exist in this repository.
+List risks Codex should know before editing.
+```
+
+Then small safe patches:
+
+```txt
+Fix a React Hooks rule violation in one file.
+Keep behavior unchanged.
+Run the relevant frontend verification commands.
+```
+
+```txt
+Add encodeURIComponent around one tag-name URL path segment.
+Add or update a test if the project has a frontend test setup.
+Run build/lint.
+```
+
+```txt
+Add a request spec for a known authorization rule.
+Do not change implementation unless the spec fails for the expected reason.
+```
+
+Avoid starting with:
+
+- Wiki history redesign.
+- Post versioning redesign.
+- Full admin screen suite.
+- Broad frontend refactor.
+- Database cleanup.
+- Authentication rewrite.
+
+## Relationship with ChatGPT
+
+ChatGPT has been used for:
+
+- Design review.
+- Risk analysis.
+- Prioritization.
+- Specification reconstruction.
+- Migration/locking discussions.
+- Codex migration planning.
+
+Codex should be used mainly for:
+
+- Repository inspection.
+- Localized implementation.
+- Test addition.
+- Running verification commands.
+- Producing small reviewable diffs.
+
+For ambiguous architecture, Codex should stop and present options rather than implement a guessed design.
+
+## Current strategic stance
+
+The project should not be rewritten from scratch.
+
+The current Rails + React system is acceptable.
+
+The immediate goal is not elegance.
+The immediate goal is safe public operation, data integrity, and maintainable incremental improvement.
+
+Priority is:
+
+1. Prevent abuse/security incidents.
+2. Preserve data correctness.
+3. Make editing safe for multiple users.
+4. Add tests around fragile frontend behavior.
+5. Improve admin/operation workflows.
+6. Optimize performance after obvious dangerous patterns are removed.
+
+## Final rule
+
+When current code, old specs, issue drafts, and memory disagree, current code wins.
+
+When current code is unsafe, write that explicitly and propose a small safe fix.
+
+When the task is too broad, split it.
+
+When verification cannot be performed, say exactly what was not verified.

docs/commands.md

@@ -0,0 +1,30 @@
+# Commands
+
+## Backend
+
+```sh
+cd backend
+bundle install
+bundle exec rails db:migrate
+bundle exec rspec
+bundle exec rails routes
+```
+
+## Frontend
+
+```sh
+cd frontend
+npm install
+npm run dev
+npm run build
+npm run lint
+npm run test
+npm run test:run
+```
+
+### Full verification
+
+```sh
+cd backend && bundle exec rspec
+cd ../frontend && npm run test:run && npm run build && npm run lint
+```

docs/issue-workflow.md

@@ -0,0 +1,80 @@
+# Issue workflow
+
+## Source of truth
+
+Gitea Issues are the source of truth for tasks, discussions, labels, milestones, and status.
+
+Do not copy the full backlog into git.
+
+Repository documents may define:
+
+- issue templates
+- triage rules
+- Codex task format
+- verification rules
+- release checklist
+
+## Labels
+
+Recommended labels:
+
+- `P0`
+- `P1`
+- `P2`
+- `P3`
+- `security`
+- `data-integrity`
+- `backend`
+- `frontend`
+- `wiki`
+- `tags`
+- `materials`
+- `theatre`
+- `codex-ready`
+- `needs-design`
+- `blocked`
+- `good-first-codex-task`
+
+## Codex-ready criteria
+
+An issue can be labeled `codex-ready` only when it has:
+
+- clear background
+- target area
+- concrete tasks
+- acceptance criteria
+- verification commands
+- explicit non-goals
+- no unresolved architecture decision
+
+## Workflow
+
+1. Create or refine the issue in Gitea.
+2. Add labels and milestone.
+3. If design is unclear, label `needs-design`.
+4. Discuss design before implementation.
+5. When scoped enough, label `codex-ready`.
+6. Give Codex the issue URL or copied issue body.
+7. Codex creates a branch.
+8. Codex implements a small patch.
+9. Codex runs verification commands.
+10. Human reviews the diff.
+11. Merge.
+12. Close the issue from the PR/commit message.
+
+## Commit message
+
+Use issue references when possible:
+
+```txt
+fix: prevent preview SSRF
+
+Refs: #123
+```
+or
+```
+fix: prevent preview SSRF
+
+Closes: #123
+```
+depending on whether the change fully resolves the issue.

docs/release-checklist.md

@@ -0,0 +1,8 @@
+# Release checklist
+
+- [ ] Backend specs pass
+- [ ] Frontend build passes
+- [ ] No pending migrations
+- [ ] Preview API SSRF checked
+- [ ] BAN behavior checked
+- [ ] CSP checked

docs/roadmap.md

@@ -0,0 +1,8 @@
+# Roadmap
+
+## Public announcement readiness
+
+- Harden preview API
+- Tighten material creation permission
+- Add admin MVP
+- Improve frontend tests

frontend/AGENTS.md

@@ -0,0 +1,151 @@
+# frontend/AGENTS.md
+
+## Scope
+
+These rules apply to work under `frontend/`.
+
+This is a Vite + React + TypeScript app using TanStack Query, Tailwind CSS,
+Framer Motion, Radix UI-style components, MDX, and Zustand.
+
+## Commands
+
+Use only scripts that exist in `package.json`:
+
+```sh
+npm run dev
+npm run build
+npm run lint
+npm run preview
+```
+
+`npm run build` runs `tsc -b && vite build`, and `postbuild` runs
+`node scripts/generate-sitemap.js`.
+
+There is currently no `test` script in `package.json`. Do not run or report
+`npm test` unless a test script is added.
+
+After frontend changes, run:
+
+```sh
+npm run build
+npm run lint
+```
+
+If either command cannot be run or fails, report the exact command and failure.
+
+Do not create, modify, or run tests unless the user explicitly asks for test
+work. When the user asks for tests, keep working and rerun them until they
+pass or the remaining failure is clearly blocked.
+
+## TypeScript
+
+- TypeScript is strict. `tsconfig.app.json` enables `strict`,
+  `noUnusedLocals`, `noUnusedParameters`, `erasableSyntaxOnly`,
+  `noFallthroughCasesInSwitch`, and `noUncheckedSideEffectImports`.
+- Keep types explicit at module boundaries, API helpers, and exported utilities.
+- Use `import type` for type-only imports.
+- Prefer existing shared types from `src/types.ts` before adding local duplicate types.
+- Preserve the repository's existing spacing style in TypeScript, including
+  GNU-style spacing before call parentheses where it is already used.
+- Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
+- Never write a TypeScript or TSX line longer than 99 characters.
+- Aim to keep TypeScript and TSX lines within 79 characters where practical.
+- Use 4-space logical indentation in TypeScript and TSX.
+- For arrays, never put whitespace or a line break immediately before `]`.
+- Keep the first element on the same line as `[` by default.
+- If an array would exceed the line limit, break after `[` and indent
+  elements by 4 spaces.
+- In TypeScript and TSX only, replace every leading run of 8 spaces with a tab
+  to reduce bytes.
+- Treat one leading tab as exactly equivalent to 8 leading spaces.
+- Use tabs only for leading indentation. Never replace spaces that occur after
+  a non-space character on the same line.
+
+## React
+
+- Use function components.
+- Existing page components commonly export an anonymous function satisfying
+  `FC`; match nearby file style when editing.
+- React hooks must be called unconditionally and at the top level of components or custom hooks.
+- Gate editing and other privileged controls with shared permission helpers
+  such as `canEditContent`, instead of showing controls and relying only on a
+  later API failure.
+- Keep page-level components under `src/pages`.
+- Keep shared and feature components under `src/components`.
+- Use `react-router-dom` route params and navigation patterns already present in `src/App.tsx`.
+- Encode URL path-segment values with `encodeURIComponent`.
+
+## TanStack Query
+
+- Use `@tanstack/react-query` for server state.
+- Query keys should come from `src/lib/queryKeys.ts`; add key builders there
+  instead of using ad hoc arrays in components.
+- Fetch functions should live in domain helpers under `src/lib`, such as
+  `posts.ts`, `tags.ts`, or `wiki.ts`.
+- Use `useQueryClient().invalidateQueries` with the shared root keys when
+  mutations affect cached lists or detail views.
+- The app-wide `QueryClient` is configured in `src/main.tsx`; do not create
+  additional clients in feature code.
+
+## API calls
+
+- Use `src/lib/api.ts` for HTTP calls.
+- The API wrapper attaches `X-Transfer-Code` from `localStorage` and converts
+  non-blob responses to camelCase.
+- Send Rails snake_case params and request body keys where the backend expects them.
+- Do not bypass the API wrapper unless there is a specific reason, such as a
+  third-party request outside the Rails API.
+- For blob responses, pass `responseType: 'blob'` so the wrapper does not camelCase the body.
+
+## Imports and aliases
+
+- The `@` alias points to `frontend/src`.
+- Prefer `@/...` imports for app code instead of long relative paths.
+- Keep type imports separate with `import type`.
+- Match existing import grouping: external packages, app modules, then type imports.
+
+## Tailwind and UI
+
+- Tailwind scans `src/**/*.{html,js,ts,jsx,tsx,mdx}`.
+- Use `cn` from `src/lib/utils.ts` for conditional class names and class merging.
+- Reuse components from `src/components/common`, `src/components/layout`, and
+  `src/components/ui` before adding new primitives.
+- Keep Tailwind classes consistent with nearby components.
+- Prefer restrained, content-first UI chrome: avoid adding card backgrounds,
+  heavy borders, or nested panel decoration unless the surrounding screen
+  already uses them.
+- Keep operational screens dense and direct; trim explanatory copy and use
+  short Japanese labels that fit the control.
+- Preserve existing Japanese tone and orthography in nearby UI text, including
+  old-kana wording where the file already uses it.
+- When adding dynamic tag color classes, update `tailwind.config.js` safelist
+  if the class cannot be statically detected.
+- Do not introduce new UI libraries or production dependencies without approval.
+
+## TSX formatting
+
+- Preserve compact TSX expression shapes such as inline ternary branches and
+  closing `</div>)` forms when nearby code uses them.
+- For long Tailwind `className` strings, wrap across lines only when needed.
+- Keep continuation indentation aligned with the 4-space logical indentation
+  rule, using tabs only as leading 8-space compression.
+- Do not add braces around `if`, `else`, or `for` bodies when the body is a
+  single physical line.
+- Always add braces around `if`, `else`, or `for` bodies when the body spans
+  two or more physical lines, even if it is one statement.
+- Avoid reformatting unrelated JSX.
+
+## Lint and build constraints
+
+- ESLint uses `@eslint/js`, `typescript-eslint`, `eslint-plugin-react-hooks`,
+  and `eslint-plugin-react-refresh`.
+- The hooks rules are enforced; fix hook ordering instead of disabling the rule.
+- `react-refresh/only-export-components` is enabled as a warning with `allowConstantExport`.
+- Build failures from unused locals or unused parameters are TypeScript
+  errors, not lint-only issues.
+
+## Files to avoid in routine work
+
+- Do not edit `dist/` output directly.
+- Do not inspect or modify `node_modules/` unless explicitly needed.
+- Keep generated build artifacts out of source changes unless the user asks for them.