#399

Reviewed-on: #410
Co-authored-by: miteruzo <miteruzo@naver.com>
Co-committed-by: miteruzo <miteruzo@naver.com>

backend/AGENTS.md

@@ -67,6 +67,192 @@ pass or the remaining failure is clearly blocked.
 Before changing behavior, inspect the matching route, controller, model,
 service, representation, and spec.
 
+## Shared backend systems
+
+Before adding backend behaviour, search the existing backend first. At minimum,
+check these locations:
+
+- `app/controllers`
+- `app/controllers/concerns`
+- `app/models`
+- `app/models/concerns`
+- `app/representations`
+- `app/services`
+- `app/services/*`
+- `app/jobs`
+- `lib`
+- `lib/tasks`
+- `config/initializers`
+
+Do not infer commonality from directory names alone. Read the actual
+responsibility and representative usage sites.
+
+### Controller reuse
+
+Before adding logic to a controller, inspect:
+
+- `ApplicationController` authentication, authorization, BAN, and IP BAN
+- existing render and validation-error helpers
+- existing param parsing
+- controller concerns
+- the controller for the same resource
+- existing services
+- existing representations
+
+Keep controllers focused on:
+
+- authentication and authorization
+- parameter intake
+- service and model invocation
+- HTTP status selection
+- representation selection
+
+Do not reimplement these per controller when an existing path already owns
+them:
+
+- authentication and role checks
+- validation error JSON
+- URL normalisation
+- tag normalisation
+- thumbnail handling
+- version recording
+- complex transactions
+- external HTTP fetching
+- response representation assembly
+
+### Authentication, authorization, and BAN
+
+Treat these as the canonical backend entrypoints:
+
+- `ApplicationController#authenticate_user`
+- `current_user`
+- `X-Transfer-Code`
+- `reject_banned_ip_address!`
+- `reject_banned_user!`
+- `gte_member?`
+- `admin?`
+
+Do not create feature-local permission services, role comparisons, or header
+parsing when the existing authentication boundary already owns the behaviour.
+If the current boundary is insufficient, extend it minimally instead of adding
+another permission path.
+
+### Representations
+
+If an endpoint for the same resource already uses `app/representations`, do not
+assemble a separate JSON shape directly inside the controller without first
+checking the existing representation contract.
+
+Inspect at least:
+
+- `PostRepr`
+- `TagRepr`
+- `MaterialRepr`
+- `TheatreRepr`
+- `UserRepr`
+- `WikiPageRepr`
+- `DeerjikistRepr`
+
+When a lightweight response is genuinely different in purpose, keep it
+deliberate and compatible with the surrounding contracts. Do not force every
+identifier list into a large representation, but do not fork the same resource
+shape casually either.
+
+### Domain services
+
+When work touches multiple models, transactions, external APIs, file handling,
+history creation, or multi-step workflow, search `app/services` first.
+
+At minimum, search for existing services in these responsibility areas:
+
+- version recorder and versioning
+- wiki commit
+- YouTube or Google Drive API client
+- material sync or ZIP export
+- similarity calculation
+- theatre selection or skip finalisation
+- metadata, thumbnail, or file processing
+- URL normaliser or sanitisation
+- import or export
+- preview safety or HTTP fetch
+
+Do not create a same-responsibility service under another namespace or another
+name. If an existing service is close, extend that API minimally instead of
+wrapping it in a feature-local service.
+
+### Versioning
+
+When a feature writes history, snapshots, or restore roots, search the existing
+versioning path first. At minimum, inspect:
+
+- `VersionRecorder`
+- `PostVersionRecorder`
+- `TagVersionRecorder`
+- `TagVersioning`
+- `MaterialVersionRecorder`
+- `NicoTagVersionRecorder`
+- `WikiVersionRecorder`
+
+Do not implement history writes in controllers, callbacks, or ad hoc feature
+services when the recorder layer already owns the transaction boundary and
+meaning.
+
+### Normalisation, sanitisation, and parsing
+
+For URLs, tag names, times, video durations, identifiers, and paths, search the
+existing normaliser, sanitisation rule, parser, and model-callback path first.
+
+Do not let frontend, controller, service, and model each invent different rules
+for the same value. Use one canonical normalisation path and keep input
+validation distinct from pre-persistence normalisation.
+
+### External HTTP and URL safety
+
+When fetching external URLs, reuse the existing preview-safety stack. Search at
+least for:
+
+- URL safety
+- redirect validation
+- response size limits
+- timeouts
+- network failure mapping
+- HTML metadata extraction
+- known-site extraction
+- thumbnail fetching
+
+Do not add direct `Net::HTTP`, `Faraday`, or equivalent feature-local HTTP code
+that reimplements SSRF checks, redirect restrictions, size limits, or timeouts.
+If the current fetcher is insufficient, extend its existing safety contract.
+
+### Storage, files, and Active Storage
+
+When handling files, thumbnails, ZIP output, object storage, or Active Storage
+blobs, inspect existing storage helpers, exporters, thumbnail generators, and
+checksum helpers first. Do not reimplement the same attach, export path,
+download, resize, or checksum flow in a controller or one-off service.
+
+### Concerns
+
+Do not create controller or model concerns merely because some code is shared.
+Use a concern only when multiple classes share the same lifecycle, macro,
+callback, or tightly cohesive behaviour. Utility collections belong in explicit
+objects or services, not in `CommonConcern`, `SharedMethods`, or `Utils`.
+
+### Model boundaries
+
+Model-specific invariants, associations, validations, and normalisation may
+live in the model. Multi-model workflow, external access, complex transaction
+flow, and feature orchestration belong in services. Do not hide feature
+workflow in model callbacks.
+
+### Transactions, locking, and race handling
+
+If transactions, locking, idempotency, or race recovery already exist in a
+service or model method, do not add a second implementation in a controller or
+new service. Inspect the existing transaction boundary first, avoid wrapping
+the same operation in needless nested transactions, and handle unique-constraint
+races according to the target constraint's business meaning.
+
 ## Ruby style
 
 - Prefer precise, minimal changes.

backend/app/controllers/materials_controller.rb

@@ -89,15 +89,13 @@ class MaterialsController < ApplicationController
 
     begin
       Material.transaction do
-        tag_name = TagName.find_undiscard_or_create_by!(name: tag_name_raw)
-        tag = tag_name.tag
-        tag = Tag.create!(tag_name:, category: :material) unless tag
-
+        tag = resolve_material_tag!(tag_name_raw)
         material = Material.new(tag:, url:,
                                 created_by_user: current_user,
                                 updated_by_user: current_user)
         material.file.attach(uploaded_blob) if uploaded_blob
         material.save!
+        TagVersioning.record_tag_snapshot!(tag, created_by_user: current_user)
         upsert_export_paths!(material)
         MaterialVersionRecorder.record!(material:, event_type: :create,
                                         created_by_user: current_user)
@@ -139,10 +137,7 @@ class MaterialsController < ApplicationController
     begin
       Material.transaction do
         MaterialVersionRecorder.ensure_snapshot!(material, created_by_user: current_user)
-        tag_name = TagName.find_undiscard_or_create_by!(name: tag_name_raw)
-        tag = tag_name.tag
-        tag = Tag.create!(tag_name:, category: :material) unless tag
-
+        tag = resolve_material_tag!(tag_name_raw)
         material.assign_attributes(tag:, url:, updated_by_user: current_user)
         if uploaded_blob
           material.file.attach(uploaded_blob)
@@ -150,6 +145,7 @@ class MaterialsController < ApplicationController
           material.file.detach
         end
         material.save!
+        TagVersioning.record_tag_snapshot!(tag, created_by_user: current_user)
         upsert_export_paths!(material)
         MaterialVersionRecorder.record!(material:, event_type: :update,
                                         created_by_user: current_user)
@@ -240,6 +236,12 @@ class MaterialsController < ApplicationController
     nil
   end
 
+  def resolve_material_tag! tag_name_raw
+    tag_name = TagName.find_undiscard_or_create_by!(name: tag_name_raw)
+    tag = tag_name.tag
+    tag || Tag.create!(tag_name:, category: :material)
+  end
+
   def material_index_needs_tag_name? filters
     filters[:q].present? || filters[:sort] == 'tag_name'
   end

backend/app/controllers/post_imports_controller.rb

@@ -0,0 +1,44 @@
+class PostImportsController < ApplicationController
+  before_action :require_member!
+
+  def preview
+    rows = PostImportPreviewer.new.preview_rows(
+        rows: PostImportUrlListParser.parse(params[:source]))
+    render json: { rows: }
+  rescue ArgumentError => e
+    render_bad_request e.message
+  end
+
+  def validate
+    rows = normalised_import_rows allow_warning_fields: true
+    changed_row = Integer(params[:changed_row], exception: false)
+    result =
+        PostImportPreviewer.new.preview_rows(rows:,
+                                             fetch_metadata: changed_row,
+                                             metadata_cache: { })
+    render json: { rows: result }
+  rescue ArgumentError => e
+    render_bad_request e.message
+  end
+
+  def create
+    result = PostImportRunner.new(actor: current_user,
+                                  rows: normalised_import_rows).run
+    render json: result, status: result[:created].positive? ? :created : :ok
+  rescue ArgumentError => e
+    render_bad_request e.message
+  end
+
+  private
+
+  def require_member!
+    return head :unauthorized unless current_user
+    return if current_user.gte_member?
+
+    head :forbidden
+  end
+
+  def normalised_import_rows allow_warning_fields: false
+    PostImportRowNormaliser.normalise!(params[:rows], allow_warning_fields:)
+  end
+end

backend/app/controllers/posts_controller.rb

@@ -142,37 +142,14 @@ class PostsController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
 
-    # TODO: サイトに応じて thumbnail_base 設定
-    title = params[:title].presence
-    url = params[:url]
-    thumbnail = params[:thumbnail]
-    tag_names = params[:tags].to_s.split
-    original_created_from = params[:original_created_from]
-    original_created_before = params[:original_created_before]
-    parent_post_ids = parse_parent_post_ids
-    resized_thumbnail = thumbnail.present? ? Post.resized_thumbnail_attachment(thumbnail) : nil
-
-    post = Post.new(title:, url:, thumbnail_base: nil, uploaded_user: current_user,
-                    original_created_from:, original_created_before:)
-    post.thumbnail.attach(resized_thumbnail) if resized_thumbnail
-
-    ApplicationRecord.transaction do
-      post.save!
-
-      Tag.normalise_tags!(tag_names, deny_deprecated: true, with_sections: true) =>
-          { tags:, sections: }
-      TagVersioning.record_tag_snapshots!(tags, created_by_user: current_user)
-
-      tags = Tag.expand_parent_tags(tags).reject(&:deprecated?)
-      post.video_ms = normalise_video_ms(tags)
-      validate_video_sections!(post.video_ms, sections)
-      post.save!
-      sync_post_tags!(post, tags, sections)
-
-      sync_parent_posts!(post, parent_post_ids)
-
-      PostVersionRecorder.record!(post:, event_type: :create, created_by_user: current_user)
-    end
+    post = PostCreator.new(actor: current_user,
+                           attributes: { title: params[:title], url: params[:url],
+                                         thumbnail: params[:thumbnail], tags: params[:tags],
+                                         original_created_from: params[:original_created_from],
+                                         original_created_before: params[:original_created_before],
+                                         parent_post_ids: parse_parent_post_ids,
+                                         video_ms: params[:video_ms],
+                                         duration: params[:duration] }).create!
 
     post.reload
     render json: PostRepr.base(post), status: :created
@@ -182,7 +159,7 @@ class PostsController < ApplicationController
     render_unprocessable_entity '廃止済みタグは付与できません．', field: :tags
   rescue Tag::SectionLiteralParseError
     render_validation_error fields: { tags: ['タグ区間の記法が不正です．'] }
-  rescue VideoMsParseError
+  rescue PostCreator::VideoMsParseError
     render_validation_error fields: { video_ms: ['動画時間の記法が不正です．'] }
   rescue MiniMagick::Error
     render_validation_error fields: { thumbnail: ['サムネイル画像の変換に失敗しました．'] }

backend/app/controllers/preview_controller.rb

@@ -1,50 +1,57 @@
 class PreviewController < ApplicationController
+  before_action :require_member!
+
   def title
-    # TODO: # 既知サイトなら決まったフォーマットで title 取得するやぅに．
-    return head :unauthorized unless current_user
+    return render_bad_request('URL は必須です．') if params[:url].blank?
 
-    url = params[:url]
-    return render_bad_request('URL は必須です．') unless url.present?
-
-    unless url.start_with?(/http(s)?:\/\//)
-      url = 'http://' + url
-    end
-
-    html = URI.open(url, open_timeout: 5, read_timeout: 5).read
-    doc = Nokogiri::HTML.parse(html)
-    title = doc.at('title')&.text&.strip
-
-    render json: { title: title }
-  rescue => e
+    render json: { title: Preview::ThumbnailFetcher.title(params[:url]) }
+  rescue Preview::UrlSafety::UnsafeUrl => e
     render_bad_request(e.message)
+  rescue Preview::HttpFetcher::FetchTimeout => e
+    render_preview_error(e.message, :gateway_timeout)
+  rescue Preview::HttpFetcher::ResponseTooLarge => e
+    render_preview_error(e.message, :payload_too_large)
+  rescue Preview::HttpFetcher::FetchFailed => e
+    render_preview_error(e.message, :bad_gateway)
   end
 
   def thumbnail
-    # TODO: 既知ドメインであれば指定のアドレスからサムネールを取得するやぅにする．
+    return render_bad_request('URL は必須です．') if params[:url].blank?
 
+    image = MiniMagick::Image.read(Preview::ThumbnailFetcher.fetch(params[:url]))
+    image.auto_orient
+    image.resize '180x180>'
+    image.format 'png'
+    width, height = image.dimensions
+    raise Preview::ThumbnailFetcher::GenerationFailed, 'サムネール画像の変換に失敗しました．' if width > 180 || height > 180
+
+    send_data image.to_blob, type: 'image/png', disposition: 'inline'
+  rescue Preview::UrlSafety::UnsafeUrl => e
+    render_bad_request(e.message)
+  rescue Preview::HttpFetcher::FetchTimeout => e
+    render_preview_error(e.message, :gateway_timeout)
+  rescue Preview::HttpFetcher::ResponseTooLarge => e
+    render_preview_error(e.message, :payload_too_large)
+  rescue Preview::HttpFetcher::FetchFailed => e
+    render_preview_error(e.message, :bad_gateway)
+  rescue Preview::ThumbnailFetcher::GenerationFailed, MiniMagick::Error => e
+    render_unprocessable_entity(e.message)
+  end
+
+  private
+
+  def require_member!
     return head :unauthorized unless current_user
+    return if current_user.gte_member?
 
-    url = params[:url]
-    return render_bad_request('URL は必須です．') if url.blank?
+    head :forbidden
+  end
 
-    unless url.start_with?(/http(s)?:\/\//)
-      url = 'http://' + url
-    end
-
-    path = Rails.root.join('tmp', "thumb_#{ SecureRandom.hex }.png")
-    system("node #{ Rails.root }/lib/screenshot.js #{ Shellwords.escape(url) } #{ path }")
-
-    if File.exist?(path)
-      image = MiniMagick::Image.open(path)
-      image.resize '180x180'
-      File.delete(path) rescue nil
-      send_file image.path, type: 'image/png', disposition: 'inline'
-    else
-      render json: { type: 'internal_server_error',
-                     message: 'サムネールを生成できませんでした．',
-                     errors: { },
-                     base_errors: ['サムネールを生成できませんでした．'] },
-             status: :internal_server_error
-    end
+  def render_preview_error(message, status)
+    render json: { type: status.to_s,
+                   message:,
+                   errors: { },
+                   base_errors: [message] },
+           status:
   end
 end

backend/app/controllers/user_settings_controller.rb

@@ -0,0 +1,61 @@
+class UserSettingsController < ApplicationController
+  wrap_parameters false
+
+  def show
+    return head :unauthorized unless current_user
+
+    render json: current_setting.serializable_hash
+  end
+
+  def update
+    return head :unauthorized unless current_user
+
+    raw_attributes = editable_raw_attributes
+    field_errors = validate_raw_attributes(raw_attributes)
+    return render_validation_error fields: field_errors if field_errors.present?
+
+    setting = current_setting
+    setting.assign_attributes(raw_attributes)
+
+    if setting.save
+      render json: setting.serializable_hash, status: :ok
+    else
+      render_validation_error setting
+    end
+  end
+
+  private
+
+  def current_setting
+    Setting.find_or_create_by!(user: current_user) do |setting|
+      setting.assign_attributes(Setting.defaults)
+    end
+  rescue ActiveRecord::RecordNotUnique
+    Setting.find_by!(user: current_user)
+  end
+
+  def editable_raw_attributes
+    request.request_parameters.slice(*Setting::EDITABLE_ATTRIBUTES)
+  end
+
+  def validate_raw_attributes raw_attributes
+    raw_attributes.each_with_object({ }) do |(key, value), errors|
+      next if value_matches_type?(key, value)
+
+      errors[key.to_sym] = ['値の型が不正です．']
+    end
+  end
+
+  def value_matches_type? key, value
+    case Setting::TYPE_BY_ATTRIBUTE.fetch(key)
+    when :string
+      value.is_a?(String)
+    when :integer
+      value.is_a?(Integer)
+    when :boolean
+      value == true || value == false
+    else
+      false
+    end
+  end
+end

backend/app/controllers/user_theme_slots_controller.rb

@@ -0,0 +1,38 @@
+class UserThemeSlotsController < ApplicationController
+  wrap_parameters false
+
+  def index
+    return head :unauthorized unless current_user
+
+    render json: current_user
+                 .theme_slots
+                 .order(:base_theme, :slot_no)
+                 .map { |slot| slot.serializable_hash }
+  end
+
+  def update
+    return head :unauthorized unless current_user
+
+    base_theme = params[:base_theme].to_s
+    slot_no = params[:slot_no].to_i
+    tokens = params[:tokens]
+
+    unless UserThemeSlot::BASE_THEMES.include?(base_theme)
+      return render_validation_error fields: { base_theme: ['値が不正です．'] }
+    end
+    unless UserThemeSlot::SLOT_NOS.include?(slot_no)
+      return render_validation_error fields: { slot_no: ['値が不正です．'] }
+    end
+    unless tokens.is_a?(ActionController::Parameters) || tokens.is_a?(Hash)
+      return render_validation_error fields: { tokens: ['JSON object で指定してください．'] }
+    end
+
+    slot = UserThemeSlot.find_or_initialize_by(user: current_user,
+                                               base_theme:,
+                                               slot_no:)
+    slot.tokens = tokens.is_a?(ActionController::Parameters) ? tokens.to_unsafe_h : tokens
+    slot.save!
+
+    render json: slot.serializable_hash, status: :ok
+  end
+end

backend/app/models/post.rb

@@ -57,9 +57,9 @@ class Post < ApplicationRecord
 
   attribute :version_no, :integer, default: 1
 
-  before_validation :normalise_url
+  before_validation :normalise_url, if: :will_save_change_to_url?
 
-  validates :url, presence: true, uniqueness: true
+  validates :url, presence: true, uniqueness: true, length: { maximum: 768 }
   validates :video_ms, numericality: { only_integer: true, greater_than: 0 }, allow_nil: true
 
   validate :validate_original_created_range
@@ -173,15 +173,6 @@ class Post < ApplicationRecord
   def normalise_url
     return if url.blank?
 
-    self.url = url.strip
-
-    u = URI.parse(url)
-    return unless u in URI::HTTP
-
-    u.host = u.host.downcase if u.host
-    u.path = u.path.sub(/\/\Z/, '') if u.path.present?
-    self.url = u.to_s
-  rescue URI::InvalidURIError
-    ;
+    self.url = PostUrlNormaliser.normalise(url) || url.strip
   end
 end

backend/app/models/post_url_sanitisation_rule.rb

@@ -0,0 +1,163 @@
+class PostUrlSanitisationRule < ApplicationRecord
+  include Discard::Model
+
+  class InvalidUrlError < StandardError
+    attr_reader :invalid_rows
+
+    def initialize(invalid_rows)
+      @invalid_rows = invalid_rows
+      ids = invalid_rows.map { _1.fetch(:post_id) }.join(', ')
+      super("post URL sanitisation produced invalid URLs for posts #{ ids }")
+    end
+  end
+
+  class UrlConflictError < StandardError
+    attr_reader :conflicts
+
+    def initialize(conflicts)
+      @conflicts = conflicts
+      urls = conflicts.map { _1.fetch(:url) }.uniq.join(', ')
+      super("post URL sanitisation conflicts detected for #{ urls }")
+    end
+  end
+
+  self.primary_key = :priority
+
+  default_scope -> { kept }
+
+  validates :source_pattern, presence: true, uniqueness: true
+
+  validate :source_pattern_must_be_regexp
+
+  class << self
+    def sanitise(url) = sanitise_with_rules(url, rules)
+
+    def apply!
+      rewrites = nil
+
+      Post.transaction do
+        compiled_rules = rules
+
+        rewrites = Post.order(:id)
+                       .lock('FOR UPDATE')
+                       .pluck(:id, :url)
+                       .map do |post_id, original_url|
+          { post_id:,
+            original_url:,
+            sanitised_url: sanitise_with_rules(original_url, compiled_rules) }
+        end
+
+        invalid_rows = rewrites.filter { invalid_sanitised_url?(_1.fetch(:sanitised_url)) }
+                               .map { { post_id: _1.fetch(:post_id),
+                                        original_url: _1.fetch(:original_url),
+                                        sanitised_url: _1.fetch(:sanitised_url) } }
+        raise InvalidUrlError.new(invalid_rows) if invalid_rows.present?
+
+        conflicts = build_conflicts(rewrites)
+        raise UrlConflictError.new(conflicts) if conflicts.present?
+
+        changed = rewrites.filter { _1.fetch(:original_url) != _1.fetch(:sanitised_url) }
+        return if changed.empty?
+
+        token = SecureRandom.hex(6)
+
+        changed.each do |row|
+          Post.where(id: row.fetch(:post_id))
+              .update_all(url: temporary_url_for(row.fetch(:post_id), token))
+        end
+
+        changed.each do |row|
+          Post.where(id: row.fetch(:post_id))
+              .update_all(url: row.fetch(:sanitised_url))
+        end
+      end
+    rescue ActiveRecord::RecordNotUnique => error
+      conflicts = build_persisted_conflicts(rewrites)
+      raise error if conflicts.empty?
+
+      raise UrlConflictError.new(conflicts), cause: error
+    end
+
+    private
+
+    def rules = kept.order(:priority).map { |r| [Regexp.new(r.source_pattern), r.replacement] }
+
+    def sanitise_with_rules(url, compiled_rules)
+      compiled_rules.reduce(url.dup) do |value, (pattern, replacement)|
+        value.sub(pattern, replacement)
+      end
+    end
+
+    def temporary_url_for(post_id, token) =
+        "https://post-url-sanitising.invalid/#{ token }/#{ post_id }"
+
+    def invalid_sanitised_url?(url)
+      return true if url.blank?
+      return true if url.length > 768
+
+      parsed = URI.parse(url)
+      return true if !(parsed in URI::HTTP)
+      return true if parsed.host.blank?
+
+      false
+    rescue URI::InvalidURIError
+      true
+    end
+
+    def build_conflicts(rewrites)
+      rewrites
+          .group_by { _1.fetch(:sanitised_url).downcase }
+          .values
+          .filter { _1.size > 1 }
+          .flatten
+          .map { { url: _1.fetch(:sanitised_url),
+                   post_id: _1.fetch(:post_id),
+                   original_url: _1.fetch(:original_url) } }
+    end
+
+    def build_persisted_conflicts(rewrites)
+      return [] if rewrites.blank?
+
+      target_rows = rewrites.filter { _1.fetch(:original_url) != _1.fetch(:sanitised_url) }
+      target_keys = target_rows.map { _1.fetch(:sanitised_url).downcase }.uniq
+      return [] if target_keys.empty?
+
+      target_pairs = target_rows.to_h do |row|
+        [row.fetch(:post_id), row.fetch(:sanitised_url).downcase]
+      end
+
+      persisted_rows = Post.order(:id)
+                           .where('LOWER(url) IN (?)', target_keys)
+                           .pluck(:id, :url)
+                           .reject { |post_id, original_url| target_pairs[post_id] == original_url.downcase }
+                           .map { |post_id, original_url|
+        { url: original_url,
+          post_id:,
+          original_url:,
+          conflict_key: original_url.downcase }
+      }
+
+      target_conflicts = target_rows.map { { url: _1.fetch(:sanitised_url),
+                                             post_id: _1.fetch(:post_id),
+                                             original_url: _1.fetch(:original_url),
+                                             conflict_key: _1.fetch(:sanitised_url).downcase } }
+
+      (persisted_rows + target_conflicts)
+          .group_by { _1.fetch(:conflict_key) }
+          .values
+          .filter { _1.size > 1 }
+          .flatten
+          .map { _1.except(:conflict_key) }
+    end
+  end
+
+  private
+
+  def source_pattern_must_be_regexp
+    return if source_pattern.blank?
+
+    Regexp.new(source_pattern)
+  rescue RegexpError
+    errors.add :source_pattern, '変な正規表現だね〜（笑）'
+  end
+end

backend/app/models/setting.rb

@@ -1,7 +1,52 @@
 class Setting < ApplicationRecord
+  THEMES = ['system', 'light', 'dark'].freeze
+
+  # These remain in the typed settings schema to preserve existing backend
+  # work. The common `/users/settings` page currently surfaces only `theme`.
+  AUTO_FETCH_MODES = ['auto', 'manual', 'off'].freeze
+  WIKI_EDITOR_MODES = ['split', 'write', 'preview'].freeze
+
+  STRING_ATTRIBUTES = [
+    'theme',
+    'auto_fetch_title',
+    'auto_fetch_thumbnail',
+    'wiki_editor_mode',
+  ].freeze
+  INTEGER_ATTRIBUTES = [].freeze
+  BOOLEAN_ATTRIBUTES = [].freeze
+  EDITABLE_ATTRIBUTES =
+      (STRING_ATTRIBUTES + INTEGER_ATTRIBUTES + BOOLEAN_ATTRIBUTES).freeze
+  TYPE_BY_ATTRIBUTE = {
+    'theme' => :string,
+    'auto_fetch_title' => :string,
+    'auto_fetch_thumbnail' => :string,
+    'wiki_editor_mode' => :string,
+  }.freeze
+
   belongs_to :user
 
   validates :user_id, presence: true
-  validates :key, presence: true, length: { maximum: 255 }
-  validates :value, presence: true
+  validates :user_id, uniqueness: true
+
+  validates :theme, inclusion: { in: THEMES }
+  validates :auto_fetch_title, inclusion: { in: AUTO_FETCH_MODES }
+  validates :auto_fetch_thumbnail, inclusion: { in: AUTO_FETCH_MODES }
+  validates :wiki_editor_mode, inclusion: { in: WIKI_EDITOR_MODES }
+
+  def self.defaults
+    {
+      theme: 'system',
+      auto_fetch_title: 'manual',
+      auto_fetch_thumbnail: 'manual',
+      wiki_editor_mode: 'split',
+    }
+  end
+
+  def self.serializable_attributes
+    EDITABLE_ATTRIBUTES.map(&:to_sym)
+  end
+
+  def serializable_hash(options = nil)
+    super({ only: self.class.serializable_attributes }.merge(options || { }))
+  end
 end

backend/app/models/user.rb

@@ -7,7 +7,8 @@ class User < ApplicationRecord
 
   has_many :created_posts,
            class_name: 'Post', foreign_key: :uploaded_user_id, dependent: :nullify
-  has_many :settings
+  has_one :setting, dependent: :destroy
+  has_many :theme_slots, class_name: 'UserThemeSlot', dependent: :destroy
   has_many :user_ips, dependent: :destroy
   has_many :ip_addresses, through: :user_ips
   has_many :user_post_views, dependent: :destroy

backend/app/models/user_theme_slot.rb

@@ -0,0 +1,27 @@
+class UserThemeSlot < ApplicationRecord
+  BASE_THEMES = ['light', 'dark'].freeze
+  SLOT_NOS = [1, 2, 3].freeze
+
+  belongs_to :user
+
+  validates :user_id, presence: true
+  validates :base_theme, presence: true, inclusion: { in: BASE_THEMES }
+  validates :slot_no, presence: true, inclusion: { in: SLOT_NOS }
+  validates :tokens, presence: true
+  validates :user_id, uniqueness: { scope: [:base_theme, :slot_no] }
+
+  validate :tokens_must_be_object
+
+  def serializable_hash(options = nil)
+    hash = { only: [:base_theme, :slot_no, :tokens, :created_at, :updated_at] }
+    super(hash.merge(options || {}))
+  end
+
+  private
+
+  def tokens_must_be_object
+    return if tokens.is_a?(Hash)
+
+    errors.add(:tokens, 'は JSON object で指定してください．')
+  end
+end

backend/app/services/post_creator.rb

@@ -0,0 +1,122 @@
+class PostCreator
+  class VideoMsParseError < ArgumentError; end
+
+  def initialize actor:, attributes:
+    @actor = actor
+    @attributes = attributes.symbolize_keys
+  end
+
+  def create!
+    post = Post.new(title: @attributes[:title].presence,
+                    url: @attributes[:url],
+                    thumbnail_base: @attributes[:thumbnail_base].presence,
+                    uploaded_user: @actor,
+                    original_created_from: @attributes[:original_created_from].presence,
+                    original_created_before: @attributes[:original_created_before].presence)
+    thumbnail = @attributes[:thumbnail]
+    post.thumbnail.attach(Post.resized_thumbnail_attachment(thumbnail)) if thumbnail.present?
+
+    ApplicationRecord.transaction do
+      post.save!
+      Tag.normalise_tags!(tag_names, deny_deprecated: true, with_sections: true) =>
+          { tags:, sections: }
+      TagVersioning.record_tag_snapshots!(tags, created_by_user: @actor)
+      tags = Tag.expand_parent_tags(tags).reject(&:deprecated?)
+      post.video_ms = normalise_video_ms(tags)
+      validate_video_sections!(post.video_ms, sections)
+      post.save!
+      sync_post_tags!(post, tags, sections)
+      sync_parent_posts!(post, parent_post_ids)
+      PostVersionRecorder.record!(post:, event_type: :create, created_by_user: @actor)
+    end
+    post
+  end
+
+  private
+
+  def tag_names = @attributes[:tags].to_s.split
+
+  def parent_post_ids
+    Array(@attributes[:parent_post_ids]).flat_map { _1.to_s.split }.map { |token|
+      id = Integer(token, exception: false)
+      raise ArgumentError, "親投稿 Id. が不正です: #{ token }" if id.nil? || id <= 0
+
+      id
+    }.uniq
+  end
+
+  def normalise_video_ms tags
+    return nil unless tags.any? { _1.id == Tag.video.id }
+
+    video_ms = @attributes[:video_ms]
+    if video_ms.present?
+      value = Integer(video_ms, exception: false)
+      raise VideoMsParseError unless value&.positive?
+
+      return value
+    end
+    duration = @attributes[:duration]
+    return nil if duration.blank?
+
+    return duration.to_i if duration.is_a?(Numeric) && duration.to_i.positive?
+
+    value = Tag.time_to_ms!(duration.to_s, tag_name: '動画時間')
+    raise VideoMsParseError unless value.positive?
+
+    value
+  rescue Tag::SectionLiteralParseError
+    raise VideoMsParseError
+  end
+
+  def validate_video_sections! video_ms, sections
+    return unless video_ms
+
+    sections.each_value do |ranges|
+      ranges.each do |begin_ms, end_ms|
+        post = Post.new
+        if begin_ms >= video_ms
+          post.errors.add :video_ms, 'タグ区間の開始が動画時間以上です．'
+          raise ActiveRecord::RecordInvalid, post
+        end
+        if end_ms && end_ms > video_ms
+          post.errors.add :video_ms, 'タグ区間の終端が動画時間を超えてゐます．'
+          raise ActiveRecord::RecordInvalid, post
+        end
+      end
+    end
+  end
+
+  def sync_post_tags! post, desired_tags, sections
+    desired_ids = desired_tags.map(&:id).to_set
+    current_ids = post.tags.pluck(:id).to_set
+    Tag.where(id: desired_ids - current_ids).find_each do |tag|
+      PostTag.create_or_find_by!(post:, tag:, created_user: @actor)
+    end
+    PostTagSection.where(post_id: post.id).destroy_all
+    sections.each do |tag_id, ranges|
+      ranges.each do |begin_ms, end_ms|
+        PostTagSection.create!(post_id: post.id,
+                               tag_id:,
+                               begin_ms:,
+                               end_ms:)
+      end
+    end
+    PostTag.where(post_id: post.id,
+                  tag_id: (current_ids - desired_ids).to_a).kept.find_each do |post_tag|
+      post_tag.discard_by!(@actor)
+    end
+  end
+
+  def sync_parent_posts! post, ids
+    if ids.include?(post.id)
+      post.errors.add :parent_post_ids, '自分自身を親投稿にはできません．'
+      raise ActiveRecord::RecordInvalid, post
+    end
+    missing = ids - Post.where(id: ids).pluck(:id)
+    if missing.present?
+      post.errors.add :parent_post_ids, "存在しない親投稿 Id. があります: #{ missing.join(' ') }"
+      raise ActiveRecord::RecordInvalid, post
+    end
+    ids.each { |parent_post_id| PostImplication.create_or_find_by!(post:, parent_post_id:) }
+  end
+end

backend/app/services/post_import_previewer.rb

@@ -0,0 +1,485 @@
+require 'time'
+require 'timeout'
+
+class PostImportPreviewer
+  FIELDS = [
+    'title',
+    'thumbnail_base',
+    'original_created_from',
+    'original_created_before',
+    'duration',
+    'tags',
+    'parent_post_ids'].freeze
+  FETCH_WARNING_FIELDS = ['url', 'title', 'thumbnail_base'].freeze
+  TITLE_FETCH_WARNING = 'タイトルを取得できませんでした．'.freeze
+  THUMBNAIL_FETCH_WARNING = 'サムネールを取得できませんでした．'.freeze
+  METADATA_FETCH_WARNING = 'メタデータを取得できませんでした．'.freeze
+
+  def preview_rows rows:, fetch_metadata: true, metadata_cache: { }
+    prepared_rows = rows.map { prepare_row(_1) }
+    url_counts = prepared_rows.filter_map { _1[:normal_url] }.tally
+    existing_posts =
+        Post.where(url: prepared_rows.map { _1[:normal_url] }.compact.uniq).index_by(&:url)
+    existing_parent_ids = preload_parent_ids(prepared_rows)
+    preload_metadata!(
+        prepared_rows,
+        fetch_metadata,
+        metadata_cache,
+        existing_posts,
+        url_counts)
+    known_tags =
+        preload_known_tags(
+            prepared_rows,
+            fetch_metadata,
+            metadata_cache,
+            existing_posts,
+            url_counts)
+    prepared_rows.map { |row|
+      preview_row(row,
+                  fetch_metadata:,
+                  metadata_cache:,
+                  existing_posts:,
+                  url_counts:,
+                  known_tags:,
+                  existing_parent_ids:)
+    }
+  end
+
+  def normalised_url value
+    PostUrlNormaliser.normalise(value)
+  end
+
+  private
+
+  def prepare_row row
+    source = row.symbolize_keys
+    url = source[:url].to_s.strip
+    normal_url = normalised_url(url)
+    source.merge(url_text: url, normal_url:, url_error: validate_url_safety(normal_url))
+  end
+
+  def preview_row row,
+                  fetch_metadata:,
+                  metadata_cache:,
+                  existing_posts:,
+                  url_counts:,
+                  known_tags:,
+                  existing_parent_ids:
+    attributes = initial_attributes(row)
+    provenance = initial_provenance(row)
+    tag_sources = initial_tag_sources(row, attributes, provenance)
+    field_warnings = initial_field_warnings(row)
+    base_warnings = initial_base_warnings(row)
+    url = row[:url_text]
+    provenance['url'] = 'manual'
+    normal_url = row[:normal_url]
+    url_for_metadata = normal_url || url
+    existing_post = normal_url.present? ? existing_posts[normal_url] : nil
+
+    validation_errors = {}
+    validation_errors[:url] = ['URL が不正です．'] if normal_url.blank?
+    if row[:url_error].present?
+      validation_errors[:url] = [row[:url_error]]
+    end
+    if normal_url.present? && url_counts[normal_url].to_i > 1
+      validation_errors[:url] = ['URL が重複しています．']
+    end
+
+    if row[:metadata_url].present? && row[:metadata_url] != url_for_metadata
+      clear_automatic_values!(attributes, provenance, tag_sources)
+      field_warnings = { }
+      base_warnings = [ ]
+    end
+
+    if validation_errors.blank? && normal_url.present? && existing_post
+      attributes['tags'] = merged_tags(tag_sources, provenance['tags'])
+      warnings_present = field_warnings.values.any?(&:present?) || base_warnings.present?
+      return { source_row: row[:source_row],
+               url: normal_url,
+               attributes:,
+               provenance:,
+               tag_sources:,
+               metadata_url: url_for_metadata,
+               skip_reason: 'existing',
+               existing_post_id: existing_post.id,
+               field_warnings:,
+               base_warnings:,
+               validation_errors:,
+               status: warnings_present ? 'warning' : 'ready' }
+    end
+
+    should_fetch = validation_errors.blank?
+    should_fetch &&= should_fetch_metadata?(fetch_metadata, row[:source_row].to_i)
+    if should_fetch
+      clear_fetch_warnings!(field_warnings)
+      metadata = metadata_for(url_for_metadata, metadata_cache)
+      if metadata[:validation_errors].present?
+        validation_errors.merge!(metadata[:validation_errors])
+      else
+        apply_metadata!(attributes, provenance, tag_sources, metadata[:data])
+        apply_fetch_warnings!(field_warnings, metadata[:warnings])
+      end
+    end
+
+    attributes['url'] = url
+    validate_basic_data(attributes, validation_errors)
+    validate_preview_tags(merged_tags(tag_sources, provenance['tags']),
+                          validation_errors,
+                          field_warnings,
+                          known_tags)
+    validate_parents(attributes['parent_post_ids'], validation_errors, existing_parent_ids)
+    attributes.delete('url')
+    attributes['tags'] = merged_tags(tag_sources, provenance['tags'])
+
+    warnings_present = field_warnings.values.any?(&:present?) || base_warnings.present?
+    { source_row: row[:source_row],
+      url: validation_errors[:url].present? ? url : (normal_url || url),
+      attributes:,
+      provenance:,
+      tag_sources:,
+      metadata_url: url_for_metadata,
+      skip_reason: nil,
+      existing_post_id: nil,
+      field_warnings:,
+      base_warnings:,
+      validation_errors:,
+      status: validation_errors.present? ? 'error' : (warnings_present ? 'warning' : 'ready') }
+  end
+
+  def should_fetch_metadata? fetch_metadata, source_row
+    case fetch_metadata
+    when true then true
+    when Integer then fetch_metadata == source_row
+    when false, nil then false
+    else raise ArgumentError, 'メタデータ取得対象が不正です．'
+    end
+  end
+
+  def initial_attributes row
+    attributes = row[:attributes]&.stringify_keys || { }
+    FIELDS.to_h { |field| [field, attributes[field].to_s] }
+  end
+
+  def initial_provenance row
+    provenance = row[:provenance]&.stringify_keys || { }
+    FIELDS.to_h { |field| [field, provenance[field].presence || 'automatic'] }
+      .merge('url' => 'manual')
+  end
+
+  def initial_tag_sources row, attributes, provenance
+    sources = row[:tag_sources]&.stringify_keys || { 'automatic' => '', 'manual' => '' }
+    sources['automatic'] = sources['automatic'].to_s
+    sources['manual'] =
+      provenance['tags'] == 'manual' ? attributes['tags'].to_s : sources['manual'].to_s
+    sources
+  end
+
+  def initial_field_warnings row
+    (row[:field_warnings] || { })
+      .stringify_keys
+      .transform_values { |value| Array(value).map(&:to_s) }
+  end
+
+  def initial_base_warnings row
+    Array(row[:base_warnings]).map(&:to_s)
+  end
+
+  def clear_automatic_values! attributes, provenance, tag_sources
+    ['title', 'thumbnail_base', 'original_created_from',
+     'original_created_before', 'duration'].each do |field|
+      attributes[field] = '' if provenance[field] == 'automatic'
+    end
+    tag_sources['automatic'] = ''
+    attributes['tags'] = merged_tags(tag_sources, provenance['tags'])
+  end
+
+  def clear_fetch_warnings! field_warnings
+    FETCH_WARNING_FIELDS.each do |field|
+      field_warnings.delete(field)
+    end
+  end
+
+  def metadata_for url, cache
+    cache[url] ||= fetch_metadata(url)
+  end
+
+  def fetch_metadata url
+    return { data: { }, warnings: { 'url' => ['URL が空です．'] },
+             validation_errors: { } } if url.blank?
+
+    data = sanitise_metadata(PostMetadataFetcher.fetch(url).stringify_keys.compact)
+    warnings = { }
+    add_field_warning!(warnings, 'title', TITLE_FETCH_WARNING) if data['title'].blank?
+    if data['thumbnail_base'].blank?
+      add_field_warning!(warnings, 'thumbnail_base', THUMBNAIL_FETCH_WARNING)
+    end
+    { data:, warnings:, validation_errors: { } }
+  rescue Preview::UrlSafety::UnsafeUrl => e
+    Rails.logger.info(
+        "post_import_metadata_fetch_unsafe_url "\
+        "#{ { error: e.class.name, message: e.message }.to_json }")
+    { data: { }, warnings: { }, validation_errors: { url: [e.message] } }
+  rescue Preview::HttpFetcher::FetchFailed,
+         Preview::HttpFetcher::ResponseTooLarge => e
+    Rails.logger.info(
+        "post_import_metadata_fetch_failure "\
+        "#{ { error: e.class.name, message: e.message }.to_json }")
+    { data: { }, warnings: { 'url' => [METADATA_FETCH_WARNING] }, validation_errors: { } }
+  end
+
+  def sanitise_metadata metadata
+    {
+        'title' => sanitise_metadata_title(metadata['title']),
+        'thumbnail_base' => sanitise_metadata_url(metadata['thumbnail_base']),
+        'original_created_from' => sanitise_metadata_time(metadata['original_created_from']),
+        'original_created_before' => sanitise_metadata_time(metadata['original_created_before']),
+        'duration' => sanitise_metadata_duration(metadata['duration']),
+        'tags' => metadata['tags'].to_s.presence }.compact
+  end
+
+  def sanitise_metadata_title value
+    value.is_a?(String) ? value.presence : nil
+  end
+
+  def sanitise_metadata_url value
+    return nil unless value.is_a?(String)
+
+    PostUrlNormaliser.normalise(value)
+  end
+
+  def sanitise_metadata_time value
+    return nil unless value.is_a?(String)
+
+    time = Time.iso8601(value)
+    time.nsec.zero? ? time.iso8601 : time.iso8601(9)
+  rescue ArgumentError, TypeError
+    nil
+  end
+
+  def sanitise_metadata_duration value
+    return nil unless value.is_a?(Numeric)
+
+    value.positive? ? value.to_i : nil
+  end
+
+  def preload_metadata! prepared_rows, fetch_metadata, metadata_cache, existing_posts, url_counts
+    urls = prepared_rows.filter_map { |row|
+      next unless row[:normal_url].present?
+      next if row[:url_error].present?
+      next unless should_fetch_metadata?(fetch_metadata, row[:source_row].to_i)
+      next if url_counts[row[:normal_url]].to_i > 1
+      next if existing_posts.key?(row[:normal_url])
+
+      row[:normal_url]
+    }.uniq
+    urls = urls.reject { metadata_cache.key?(_1) }
+    return if urls.empty?
+
+    url_queue = Queue.new
+    result_queue = Queue.new
+    urls.each { url_queue << _1 }
+    workers = [urls.length, 4].min.times.map {
+      Thread.new {
+        Rails.application.executor.wrap do
+          loop do
+            url = url_queue.pop(true)
+            result_queue << [url, safe_fetch_metadata(url)]
+          rescue ThreadError
+            break
+          end
+        end
+      }
+    }
+    Timeout.timeout(15) { workers.each(&:join) }
+  rescue Timeout::Error
+    workers&.each(&:kill)
+  ensure
+    workers&.each(&:join)
+    while result_queue&.size.to_i.positive?
+      url, result = result_queue.pop
+      metadata_cache[url] = result
+    end
+    urls&.each do |url|
+      metadata_cache[url] ||= { data: { }, warnings: { 'url' => [METADATA_FETCH_WARNING] } }
+    end
+  end
+
+  def safe_fetch_metadata url
+    fetch_metadata(url)
+  rescue Preview::UrlSafety::UnsafeUrl => e
+    Rails.logger.info(
+        "post_import_metadata_fetch_unsafe_url "\
+        "#{ { error: e.class.name, message: e.message }.to_json }")
+    { data: { }, warnings: { }, validation_errors: { url: [e.message] } }
+  rescue StandardError => e
+    Rails.logger.error(
+        "post_import_metadata_fetch_unexpected_failure "\
+        "#{ { error: e.class.name, message: e.message }.to_json }")
+    { data: { }, warnings: { 'url' => [METADATA_FETCH_WARNING] }, validation_errors: { } }
+  end
+
+  def preload_known_tags prepared_rows, fetch_metadata, metadata_cache, existing_posts, url_counts
+    names = prepared_rows.flat_map { |row|
+      attributes = initial_attributes(row)
+      provenance = initial_provenance(row)
+      tag_sources = initial_tag_sources(row, attributes, provenance)
+      if metadata_url_changed?(row)
+        clear_automatic_values!(attributes, provenance, tag_sources)
+      end
+      if should_apply_metadata_to_row?(row, fetch_metadata, existing_posts, url_counts)
+        metadata = metadata_for(row[:normal_url], metadata_cache)
+        apply_metadata!(attributes, provenance, tag_sources, metadata[:data])
+      end
+      preview_tag_names(merged_tags(tag_sources, provenance['tags']))
+    }.compact.uniq
+    return { } if names.empty?
+
+    Tag.joins(:tag_name)
+      .where(tag_names: { name: names })
+      .includes(:tag_name)
+      .to_a
+      .index_by(&:name)
+  end
+
+  def preload_parent_ids prepared_rows
+    ids = prepared_rows.flat_map { |row|
+      attributes = initial_attributes(row)
+      preview_parent_ids(attributes['parent_post_ids'])
+    }.uniq
+    return { } if ids.empty?
+
+    Post.where(id: ids).pluck(:id).to_h { [_1, true] }
+  end
+
+  def metadata_url_changed? row
+    row[:metadata_url].present? && row[:metadata_url] != (row[:normal_url] || row[:url_text])
+  end
+
+  def should_apply_metadata_to_row? row, fetch_metadata, existing_posts, url_counts
+    normal_url = row[:normal_url]
+    return false if normal_url.blank?
+    return false if row[:url_error].present?
+    return false if url_counts[normal_url].to_i > 1
+    return false if existing_posts.key?(normal_url)
+
+    should_fetch_metadata?(fetch_metadata, row[:source_row].to_i)
+  end
+
+  def validate_url_safety normal_url
+    return nil if normal_url.blank?
+
+    Preview::UrlSafety.validate(normal_url)
+    nil
+  rescue Preview::UrlSafety::UnsafeUrl => e
+    e.message
+  end
+
+  def apply_metadata! attributes, provenance, tag_sources, metadata
+    metadata.each do |field, value|
+      if field == 'tags'
+        next if provenance['tags'] == 'manual'
+
+        tag_sources['automatic'] = value.to_s
+        attributes['tags'] = merged_tags(tag_sources)
+        next
+      end
+      next unless provenance[field] == 'automatic'
+
+      attributes[field] = value
+      provenance[field] = 'automatic'
+    end
+  end
+
+  def apply_fetch_warnings! field_warnings, warnings
+    warnings.each do |field, values|
+      values.each do |value|
+        add_field_warning!(field_warnings, field, value)
+      end
+    end
+  end
+
+  def add_field_warning! field_warnings, field, message
+    field_warnings[field] ||= []
+    field_warnings[field] << message unless field_warnings[field].include?(message)
+  end
+
+  def merged_tags sources, origin = nil
+    return sources['manual'].to_s if origin == 'manual'
+
+    sources['automatic'].to_s
+  end
+
+  def preview_tag_names raw
+    names = raw.to_s.split
+    return [] if names.empty?
+    if names.any? { _1.downcase.start_with?('nico:') }
+      return []
+    end
+
+    names.map { |name| TagName.canonicalise(name.sub(/\[.*\]\z/, '')).first }
+  rescue Tag::SectionLiteralParseError
+    []
+  end
+
+  def validate_preview_tags raw, errors, field_warnings, known_tags
+    names = raw.to_s.split
+    return if names.empty?
+    if names.any? { _1.downcase.start_with?('nico:') }
+      errors[:tags] = ['ニコニコ・タグは直接指定できません．']
+      return
+    end
+
+    parsed = names.map { |name| TagName.canonicalise(name.sub(/\[.*\]\z/, '')).first }
+    existing = parsed.filter_map { known_tags[_1] }
+    deprecated = existing.select(&:deprecated?).map(&:name)
+    errors[:tags] = ["廃止済みタグがあります: #{ deprecated.join(' ') }"] if deprecated.present?
+    known = existing.reject(&:deprecated?).map(&:name)
+    new_tags = parsed.uniq - known
+    if new_tags.present?
+      add_field_warning!(field_warnings, 'tags', "新規タグを作成します: #{ new_tags.join(' ') }")
+    end
+  rescue Tag::SectionLiteralParseError
+    errors[:tags] = ['タグ区間の記法が不正です．']
+  end
+
+  def validate_basic_data attributes, errors
+    post = Post.new(title: attributes['title'].presence,
+                    url: attributes['url'],
+                    thumbnail_base: attributes['thumbnail_base'].presence,
+                    original_created_from: attributes['original_created_from'].presence,
+                    original_created_before: attributes['original_created_before'].presence,
+                    video_ms: parse_duration(attributes['duration'], errors))
+    post.valid?
+    post.errors.each do |error|
+      next if error.attribute == :url && error.type == :taken
+
+      (errors[error.attribute] ||= []) << error.message
+    end
+  end
+
+  def parse_duration value, errors
+    return nil if value.blank?
+
+    value.is_a?(Numeric) ? value.to_i : Tag.time_to_ms!(value.to_s, tag_name: '動画時間')
+  rescue Tag::SectionLiteralParseError
+    errors[:video_ms] = ['動画時間の記法が不正です．']
+    nil
+  end
+
+  def preview_parent_ids raw
+    raw.to_s.split.map { Integer(_1, exception: false) }.compact
+  end
+
+  def validate_parents raw, errors, existing_parent_ids
+    ids = raw.to_s.split.map { Integer(_1, exception: false) }
+    return if ids.compact.empty? && raw.to_s.blank?
+
+    if ids.any? { _1.nil? || _1 <= 0 }
+      errors[:parent_post_ids] = ['親投稿 Id. が不正です．']
+      return
+    end
+    if ids.uniq.any? { !existing_parent_ids[_1] }
+      errors[:parent_post_ids] = ['存在しない親投稿 Id. があります．']
+    end
+  end
+end

backend/app/services/post_import_row_normaliser.rb

@@ -0,0 +1,189 @@
+class PostImportRowNormaliser
+  ORIGINS = ['automatic', 'manual'].freeze
+  STRING_FIELDS = [
+    'title',
+    'thumbnail_base',
+    'original_created_from',
+    'original_created_before',
+    'tags',
+    'parent_post_ids'].freeze
+  FLEXIBLE_FIELDS = ['duration', 'video_ms'].freeze
+  ATTRIBUTE_FIELDS = (STRING_FIELDS + FLEXIBLE_FIELDS).freeze
+
+  def self.normalise! rows, allow_warning_fields: false
+    raise ArgumentError, '取込行の形式が不正です．' unless rows.is_a?(Array)
+    raise ArgumentError, '取込件数が多すぎます．' if rows.length > PostImportUrlListParser::MAX_ROWS
+
+    normalised_rows = rows.map { normalise_row!(_1, allow_warning_fields:) }
+    source_rows = normalised_rows.map { _1['source_row'] }
+    raise ArgumentError, '元行番号が重複しています．' if source_rows.uniq.length != source_rows.length
+    if normalised_rows.sum { row_bytesize(_1) } > PostImportUrlListParser::MAX_BYTES
+      raise ArgumentError, '取込データが大きすぎます．'
+    end
+
+    normalised_rows
+  end
+
+  def self.normalise_row! row, allow_warning_fields:
+    unless row.is_a?(Hash) || row.is_a?(ActionController::Parameters)
+      raise ArgumentError, '取込行の形式が不正です．'
+    end
+
+    parameters =
+        row.is_a?(ActionController::Parameters) ? row : ActionController::Parameters.new(row)
+    permitted = parameters.permit(*permitted_keys(allow_warning_fields))
+    normalised = permitted.to_h.deep_transform_keys { _1.to_s.underscore }
+
+    normalised['source_row'] = normalise_source_row!(normalised['source_row'])
+    normalise_url!(normalised['url'])
+    normalise_metadata_url!(normalised['metadata_url'])
+    normalise_attributes!(normalised.fetch('attributes', { }))
+    normalise_provenance!(normalised.fetch('provenance', { }))
+    normalise_tag_sources!(normalised['tag_sources'])
+    normalise_warning_values!(normalised, allow_warning_fields:)
+    if row_bytesize(normalised) > PostImportUrlListParser::MAX_BYTES
+      raise ArgumentError, '取込行が大きすぎます．'
+    end
+
+    normalised
+  end
+
+  def self.permitted_keys allow_warning_fields
+    keys = [
+      :source_row,
+      :sourceRow,
+      :url,
+      :metadata_url,
+      :metadataUrl,
+      { attributes: {} },
+      { provenance: {} },
+      { tag_sources: {} },
+      { tagSources: {} }]
+    return keys unless allow_warning_fields
+
+    keys + [
+      { field_warnings: {} },
+      { fieldWarnings: {} },
+      { base_warnings: [] },
+      { baseWarnings: [] }]
+  end
+  private_class_method :permitted_keys
+
+  def self.normalise_source_row! value
+    source_row = Integer(value, exception: false)
+    raise ArgumentError, '元行番号が不正です．' if source_row.nil? || source_row <= 0
+
+    source_row
+  end
+  private_class_method :normalise_source_row!
+
+  def self.normalise_url! value
+    unless value.is_a?(String)
+      raise ArgumentError, 'URL の形式が不正です．'
+    end
+    if value.bytesize > PostImportUrlListParser::MAX_URL_BYTES
+      raise ArgumentError, 'URL が長すぎます．'
+    end
+  end
+  private_class_method :normalise_url!
+
+  def self.normalise_metadata_url! value
+    raise ArgumentError, 'metadata_url の形式が不正です．' unless value.nil? || value.is_a?(String)
+    if value.to_s.bytesize > PostImportUrlListParser::MAX_URL_BYTES
+      raise ArgumentError, 'metadata_url が長すぎます．'
+    end
+  end
+  private_class_method :normalise_metadata_url!
+
+  def self.normalise_attributes! attributes
+    raise ArgumentError, 'attributes の形式が不正です．' unless attributes.is_a?(Hash)
+    raise ArgumentError, '取込項目が不正です．' unless (attributes.keys - ATTRIBUTE_FIELDS).empty?
+
+    attributes.each do |key, value|
+      case key
+      when *STRING_FIELDS
+        raise ArgumentError, '取込項目の型が不正です．' unless value.nil? || value.is_a?(String)
+      when *FLEXIBLE_FIELDS
+        unless value.nil? || value.is_a?(String) || value.is_a?(Numeric)
+          raise ArgumentError, '取込項目の型が不正です．'
+        end
+      end
+      if value.to_s.bytesize > PostImportUrlListParser::MAX_URL_BYTES
+        raise ArgumentError, '取込項目が大きすぎます．'
+      end
+    end
+  end
+  private_class_method :normalise_attributes!
+
+  def self.normalise_provenance! provenance
+    unless provenance.is_a?(Hash)
+      raise ArgumentError, 'provenance の形式が不正です．'
+    end
+
+    allowed = ATTRIBUTE_FIELDS + ['url']
+    unless (provenance.keys - allowed).empty?
+      raise ArgumentError, '値の由来が不正です．'
+    end
+    unless provenance.values.all? { ORIGINS.include?(_1) }
+      raise ArgumentError, '値の由来が不正です．'
+    end
+  end
+  private_class_method :normalise_provenance!
+
+  def self.normalise_tag_sources! tag_sources
+    return if tag_sources.nil?
+
+    unless tag_sources.is_a?(Hash)
+      raise ArgumentError, 'タグ由来の形式が不正です．'
+    end
+    unless (tag_sources.keys - ORIGINS).empty?
+      raise ArgumentError, 'タグ由来の形式が不正です．'
+    end
+    unless tag_sources.values.all? { _1.is_a?(String) }
+      raise ArgumentError, 'タグ由来の形式が不正です．'
+    end
+    if tag_sources.values.any? { _1.bytesize > PostImportUrlListParser::MAX_URL_BYTES }
+      raise ArgumentError, 'タグ由来が大きすぎます．'
+    end
+    if tag_sources.values.sum(&:bytesize) > PostImportUrlListParser::MAX_URL_BYTES
+      raise ArgumentError, 'タグ由来が大きすぎます．'
+    end
+  end
+  private_class_method :normalise_tag_sources!
+
+  def self.normalise_warning_values! normalised, allow_warning_fields:
+    return unless allow_warning_fields
+
+    field_warnings = normalised['field_warnings']
+    unless field_warnings.nil? || field_warnings.is_a?(Hash)
+      raise ArgumentError, '警告の形式が不正です．'
+    end
+    field_warnings&.each do |key, values|
+      unless ATTRIBUTE_FIELDS.include?(key) || key == 'url'
+        raise ArgumentError, '警告の形式が不正です．'
+      end
+      unless values.is_a?(Array) && values.all? { _1.is_a?(String) }
+        raise ArgumentError, '警告の形式が不正です．'
+      end
+      if values.any? { _1.bytesize > PostImportUrlListParser::MAX_URL_BYTES }
+        raise ArgumentError, '警告が大きすぎます．'
+      end
+    end
+
+    base_warnings = normalised['base_warnings']
+    return if base_warnings.nil?
+
+    unless base_warnings.is_a?(Array) && base_warnings.all? { _1.is_a?(String) }
+      raise ArgumentError, '警告の形式が不正です．'
+    end
+    if base_warnings.any? { _1.bytesize > PostImportUrlListParser::MAX_URL_BYTES }
+      raise ArgumentError, '警告が大きすぎます．'
+    end
+  end
+  private_class_method :normalise_warning_values!
+
+  def self.row_bytesize row
+    row.to_json.bytesize
+  end
+  private_class_method :row_bytesize
+end

backend/app/services/post_import_runner.rb

@@ -0,0 +1,104 @@
+class PostImportRunner
+  def initialize actor:, rows:
+    @actor = actor
+    @rows = rows
+  end
+
+  def run
+    normalised_rows = PostImportRowNormaliser.normalise!(@rows)
+    previews = PostImportPreviewer.new.preview_rows(rows: normalised_rows,
+                                                    fetch_metadata: false)
+    preview_map = previews.index_by { _1[:source_row] }
+
+    results = normalised_rows.map do |row|
+      run_row(row, preview_map.fetch(row['source_row']))
+    end
+
+    { created: results.count { _1[:status] == 'created' },
+      skipped: results.count { _1[:status] == 'skipped' },
+      failed: results.count { _1[:status] == 'failed' },
+      rows: results }
+  end
+
+  private
+
+  def run_row row, preview
+    attributes = row.fetch('attributes', { }).transform_keys { _1.to_s.underscore }
+    return { source_row: row['source_row'],
+             status: 'failed',
+             errors: preview[:validation_errors],
+             recoverable: true } if preview[:validation_errors].present?
+    if preview[:skip_reason] == 'existing'
+      return { source_row: row['source_row'],
+               status: 'skipped',
+               existing_post_id: preview[:existing_post_id] }
+    end
+
+    attributes['tags'] = preview[:attributes]['tags']
+    attributes['url'] = row['url']
+    post = PostCreator.new(actor: @actor, attributes:).create!
+    { source_row: row['source_row'], status: 'created', post: PostRepr.base(post) }
+  rescue ActiveRecord::RecordInvalid => e
+    existing_post = existing_post_for_race(row, e.record)
+    if existing_post
+      return { source_row: row['source_row'],
+               status: 'skipped',
+               existing_post_id: existing_post.id }
+    end
+
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: e.record.errors.to_hash,
+      recoverable: true }
+  rescue ActiveRecord::RecordNotUnique => e
+    raise unless url_record_not_unique?(e)
+
+    existing_post = existing_post_for_race(row)
+    raise unless existing_post
+
+    { source_row: row['source_row'],
+      status: 'skipped',
+      existing_post_id: existing_post.id }
+  rescue Tag::NicoTagNormalisationError
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: { tags: ['ニコニコ・タグは直接指定できません．'] },
+      recoverable: true }
+  rescue Tag::DeprecatedTagNormalisationError
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: { tags: ['廃止済みタグは付与できません．'] },
+      recoverable: true }
+  rescue PostCreator::VideoMsParseError
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: { duration: ['動画時間の記法が不正です．'] },
+      recoverable: true }
+  rescue ArgumentError
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: { base: ['入力値が不正です．'] },
+      recoverable: true }
+  rescue StandardError => e
+    Rails.logger.error("post_import_runner_failure #{ { error: e.class.name,
+                                                        message: e.message }.to_json }")
+    { source_row: row['source_row'],
+      status: 'failed',
+      errors: { base: ['登録中にエラーが発生しました．'] } }
+  end
+
+  def existing_post_for_race row, record = nil
+    if record && !(record.errors.of_kind?(:url, :taken))
+      return nil
+    end
+
+    normal_url = PostUrlNormaliser.normalise(row['url'])
+    return nil if normal_url.blank?
+
+    Post.find_by(url: normal_url)
+  end
+
+  def url_record_not_unique? error
+    error.message.include?('index_posts_on_url')
+  end
+end

backend/app/services/post_import_url_list_parser.rb

@@ -0,0 +1,25 @@
+class PostImportUrlListParser
+  MAX_ROWS = 100
+  MAX_BYTES = 1.megabyte
+  MAX_URL_BYTES = 20.kilobytes
+
+  def self.parse source
+    raw = source.to_s
+    raise ArgumentError, '入力が大きすぎます．' if raw.bytesize > MAX_BYTES
+
+    rows = raw.split(/\r\n|\n|\r/).each_with_index.filter_map { |line, index|
+      url = line.strip
+      next if url.blank?
+
+      if url.bytesize > MAX_URL_BYTES
+        raise ArgumentError, "#{ index + 1 } 行目: URL が長すぎます．"
+      end
+
+      { source_row: index + 1, url: }
+    }
+    raise ArgumentError, 'URL を入力してください．' if rows.empty?
+    raise ArgumentError, "取込件数は #{ MAX_ROWS } 件までです．" if rows.length > MAX_ROWS
+
+    rows
+  end
+end

backend/app/services/post_metadata_fetcher.rb

@@ -0,0 +1,131 @@
+require 'time'
+
+class PostMetadataFetcher
+  TIMESTAMP_PATTERN =
+      Regexp.new(
+          '\A(\d{4})-(\d{2})-(\d{2})T(\d{2})' \
+          '(?::(\d{2})(?::(\d{2})(?:\.(\d+))?)?)?' \
+          '(Z|[+-]\d{2}:?\d{2})?\z')
+
+  def self.fetch raw_url
+    uri, = Preview::UrlSafety.validate(raw_url)
+    response = Preview::HttpFetcher.fetch(
+        uri.to_s,
+        max_bytes: Preview::ThumbnailFetcher::HTML_MAX_BYTES)
+    metadata = Preview::HtmlMetadataExtractor.extract(response)
+    document = Nokogiri::HTML.parse(response.body)
+    content = lambda { |name|
+      document
+        .at_css("meta[property='#{ name }'], meta[name='#{ name }']")
+        &.[]('content')
+        &.strip
+        &.presence
+    }
+    duration = content.call('og:video:duration') || content.call('video:duration')
+    published = content.call('article:published_time') || content.call('date')
+    created_range = original_created_range(published)
+    platform_tags = platform_tags(uri)
+    { title: metadata[:title],
+      thumbnail_base:
+          Preview::KnownSiteExtractor.thumbnail_url(uri) || metadata[:image_url],
+      original_created_from: serialise_time(created_range&.first),
+      original_created_before: serialise_time(created_range&.last),
+      duration: duration&.to_f&.then { _1.positive? ? (_1 * 1_000).round : nil },
+      tags: platform_tags.join(' ') }
+  end
+
+  def self.platform_tags uri
+    return ['動画', 'YouTube'] if Preview::KnownSiteExtractor.youtube_video_id(uri)
+    return ['動画', 'ニコニコ'] if Preview::KnownSiteExtractor.niconico_video_id(uri)
+
+    []
+  end
+
+  def self.original_created_range value
+    return nil if value.blank?
+
+    raw = value.to_s.strip
+    from, before =
+        case raw
+        when /\A(\d{4})\z/
+          year = Regexp.last_match(1).to_i
+          from = Time.zone.local(year, 1, 1)
+          [from, from + 1.year]
+        when /\A(\d{4})-(\d{2})\z/
+          year = Regexp.last_match(1).to_i
+          month = Regexp.last_match(2).to_i
+          from = Time.zone.local(year, month, 1)
+          [from, from + 1.month]
+        when /\A(\d{4})-(\d{2})-(\d{2})\z/
+          year = Regexp.last_match(1).to_i
+          month = Regexp.last_match(2).to_i
+          day = Regexp.last_match(3).to_i
+          from = Time.zone.local(year, month, day)
+          [from, from + 1.day]
+        else
+          parse_timestamp_range(raw)
+        end
+    return nil if from.nil? || before.nil?
+
+    [from, before]
+  rescue ArgumentError, TypeError
+    nil
+  end
+
+  def self.parse_timestamp_range raw
+    match = raw.match(TIMESTAMP_PATTERN)
+    return nil unless match
+
+    year = match[1].to_i
+    month = match[2].to_i
+    day = match[3].to_i
+    hour = match[4].to_i
+    minute = match[5]&.to_i || 0
+    second = match[6]&.to_i || 0
+    fraction = match[7]
+    offset = match[8]
+    whole_second = second + fractional_seconds(fraction)
+    from =
+        if offset.present?
+          Time.new(year, month, day, hour, minute, whole_second, parse_offset(offset)).in_time_zone
+        else
+          Time.zone.local(year, month, day, hour, minute, whole_second)
+        end
+    before =
+        if fraction.present?
+          from + (10**(-fraction.length))
+        elsif match[6].present?
+          from + 1.second
+        elsif match[5].present?
+          from + 1.minute
+        else
+          from + 1.hour
+        end
+    [from, before]
+  end
+
+  def self.parse_offset value
+    return '+00:00' if value == 'Z'
+
+    value.match?(/\A[+-]\d{2}:\d{2}\z/) ? value : "#{ value[0, 3] }:#{ value[3, 2] }"
+  end
+
+  def self.fractional_seconds value
+    return 0 if value.blank?
+
+    Rational(value.to_i, 10**value.length)
+  end
+
+  def self.serialise_time value
+    return nil if value.nil?
+
+    value.nsec.zero? ? value.iso8601 : value.iso8601(9)
+  end
+
+  private_class_method :platform_tags,
+                       :original_created_range,
+                       :parse_timestamp_range,
+                       :parse_offset,
+                       :fractional_seconds,
+                       :serialise_time
+end

backend/app/services/post_url_normaliser.rb

@@ -0,0 +1,13 @@
+class PostUrlNormaliser
+  def self.normalise raw_url
+    value = raw_url.to_s.strip
+    uri = URI.parse(value)
+    return nil unless uri.is_a?(URI::HTTP) && uri.host.present?
+
+    uri.host = uri.host.downcase
+    uri.path = uri.path.sub(/\/\z/, '') if uri.path.present?
+    PostUrlSanitisationRule.sanitise(uri.to_s)
+  rescue URI::InvalidURIError
+    nil
+  end
+end

backend/app/services/preview/html_metadata_extractor.rb

@@ -0,0 +1,21 @@
+module Preview
+  class HtmlMetadataExtractor
+    IMAGE_SELECTORS = [
+      'meta[property="og:image"]',
+      'meta[name="twitter:image"]',
+      'meta[name="thumbnail"]'
+    ].freeze
+
+    def self.extract(response)
+      document = Nokogiri::HTML.parse(response.body)
+      image_url = IMAGE_SELECTORS.filter_map {
+        document.at_css(_1)&.[]('content')&.strip.presence
+      }.first
+
+      { title: document.at_css('title')&.text&.strip,
+        image_url: image_url ? URI.join(response.url, image_url).to_s : nil }
+    rescue URI::InvalidURIError
+      { title: document.at_css('title')&.text&.strip, image_url: nil }
+    end
+  end
+end

backend/app/services/preview/http_fetcher.rb

@@ -0,0 +1,127 @@
+require 'net/http'
+require 'json'
+
+module Preview
+  class HttpFetcher
+    class FetchFailed < StandardError; end
+    class FetchTimeout < FetchFailed; end
+    class ResponseTooLarge < FetchFailed; end
+
+    MAX_REDIRECTS = 5
+    DEFAULT_MAX_BYTES = 5.megabytes
+
+    Response = Data.define(:body, :content_type, :url)
+
+    def self.fetch(raw_url,
+                   max_bytes: DEFAULT_MAX_BYTES,
+                   redirects: MAX_REDIRECTS)
+      uri, addresses = UrlSafety.validate(raw_url)
+      response = request(uri, addresses.first, max_bytes)
+
+      if response.is_a?(Net::HTTPRedirection)
+        location = response['location']
+        if redirects.zero?
+          log_failure(:redirect_limit,
+                      url: uri.to_s,
+                      redirects:,
+                      location:,
+                      content_type: response['content-type'],
+                      content_length: response['content-length'])
+          raise FetchFailed, 'redirect が多すぎます．'
+        end
+
+        if location.blank?
+          log_failure(:blank_redirect_location,
+                      url: uri.to_s,
+                      redirects:,
+                      content_type: response['content-type'],
+                      content_length: response['content-length'])
+          raise FetchFailed, 'redirect 先が不正です．'
+        end
+
+        redirect_url =
+            begin
+              URI.join(uri, location).to_s
+            rescue URI::InvalidURIError => e
+              log_failure(:invalid_redirect_location,
+                          url: uri.to_s,
+                          redirects:,
+                          location:,
+                          error: e.class.name,
+                          message: e.message)
+              raise FetchFailed, 'redirect 先が不正です．'
+            end
+
+        return fetch(redirect_url, max_bytes:, redirects: redirects - 1)
+      end
+
+      unless response.is_a?(Net::HTTPSuccess)
+        log_failure(:http_status,
+                    url: uri.to_s,
+                    code: response.code,
+                    content_type: response['content-type'],
+                    content_length: response['content-length'])
+        raise FetchFailed, "外部サーバーが HTTP #{ response.code } を返しました．"
+      end
+
+      Response.new(response.body, response['content-type'].to_s, uri.to_s)
+    rescue Net::OpenTimeout, Net::ReadTimeout, Timeout::Error => e
+      log_failure(:timeout, url: uri&.to_s || raw_url, error: e.class.name, message: e.message)
+      raise FetchTimeout, e.message
+    rescue SocketError, SystemCallError, OpenSSL::SSL::SSLError, EOFError => e
+      log_failure(:network_error,
+                  url: uri&.to_s || raw_url,
+                  error: e.class.name,
+                  message: e.message)
+      raise FetchFailed, e.message
+    end
+
+    def self.request(uri, ip_address, max_bytes)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.ipaddr = ip_address
+      http.use_ssl = uri.scheme == 'https'
+      http.open_timeout = 5
+      http.read_timeout = 8
+      http.write_timeout = 5
+
+      request = Net::HTTP::Get.new(uri)
+      request['User-Agent'] = 'BTRC-Hub thumbnail preview'
+      request['Accept'] = 'text/html,image/*;q=0.9,*/*;q=0.1'
+
+      http.request(request) do |response|
+        length = response['content-length'].to_i
+        if length > max_bytes
+          log_failure(:response_too_large,
+                      url: uri.to_s,
+                      content_type: response['content-type'],
+                      content_length: response['content-length'],
+                      max_bytes:)
+          raise ResponseTooLarge, '外部データが大きすぎます．'
+        end
+
+        body = +''
+        response.read_body do |chunk|
+          body << chunk
+          next unless body.bytesize > max_bytes
+
+          log_failure(:response_too_large,
+                      url: uri.to_s,
+                      content_type: response['content-type'],
+                      content_length: response['content-length'],
+                      bytes_read: body.bytesize,
+                      max_bytes:)
+          raise ResponseTooLarge, '外部データが大きすぎます．'
+        end
+        response.instance_variable_set(:@body, body)
+        response.instance_variable_set(:@read, true)
+        return response
+      end
+    end
+
+    def self.log_failure(reason, **payload)
+      Rails.logger.warn("preview_http_fetcher_failure #{ { reason:, **payload }.to_json }")
+    end
+
+    private_class_method :request, :log_failure
+  end
+end

backend/app/services/preview/known_site_extractor.rb

@@ -0,0 +1,34 @@
+module Preview
+  class KnownSiteExtractor
+    def self.thumbnail_url(uri)
+      youtube_thumbnail(uri)
+    end
+
+    def self.youtube_video_id(uri)
+      case uri.host&.downcase
+      when 'youtu.be'
+        uri.path.split('/').reject(&:blank?).first
+      when 'www.youtube.com', 'youtube.com', 'm.youtube.com'
+        uri.path == '/watch' ? URI.decode_www_form(uri.query.to_s).to_h['v'] : nil
+      end&.then { _1 if _1.match?(/\A[A-Za-z0-9_-]{6,20}\z/) }
+    end
+
+    def self.niconico_video_id(uri)
+      case uri.host&.downcase
+      when 'www.nicovideo.jp', 'nicovideo.jp'
+        uri.path[%r{\A/watch/(sm\d+)\z}, 1]
+      when 'nico.ms'
+        uri.path[%r{\A/(sm\d+)\z}, 1]
+      end
+    end
+
+    def self.youtube_thumbnail(uri)
+      id = youtube_video_id(uri)
+      return unless id
+
+      "https://i.ytimg.com/vi/#{ id }/hqdefault.jpg"
+    end
+
+    private_class_method :youtube_thumbnail
+  end
+end

backend/app/services/preview/thumbnail_fetcher.rb

@@ -0,0 +1,95 @@
+module Preview
+  class ThumbnailFetcher
+    class GenerationFailed < StandardError; end
+    ALLOWED_IMAGE_CONTENT_TYPES = [
+      'image/jpeg', 'image/png', 'image/gif', 'image/webp'
+    ].freeze
+    HTML_MAX_BYTES = 1.megabyte
+    NICONICO_XML_MAX_BYTES = 256.kilobytes
+
+    def self.fetch(raw_url)
+      uri, = UrlSafety.validate(raw_url)
+
+      known_url = KnownSiteExtractor.thumbnail_url(uri)
+      image = fetch_image_or_nil(known_url) if known_url
+      return image if image
+
+      niconico_url = niconico_thumbnail_url(uri)
+      image = fetch_image_or_nil(niconico_url) if niconico_url
+      return image if image
+
+      page = HttpFetcher.fetch(uri.to_s, max_bytes: HTML_MAX_BYTES)
+      metadata = HtmlMetadataExtractor.extract(page)
+      raise GenerationFailed, 'サムネール画像が見つかりませんでした．' if metadata[:image_url].blank?
+
+      fetch_image!(metadata[:image_url])
+    end
+
+    def self.title(raw_url)
+      uri, = UrlSafety.validate(raw_url)
+      HtmlMetadataExtractor.extract(
+          HttpFetcher.fetch(uri.to_s, max_bytes: HTML_MAX_BYTES))[:title]
+    end
+
+    def self.fetch_image_or_nil(url)
+      return nil if url.blank?
+
+      response = HttpFetcher.fetch(url)
+      return nil unless allowed_image_content_type?(response.content_type)
+
+      response.body
+    rescue HttpFetcher::FetchTimeout
+      raise
+    rescue HttpFetcher::FetchFailed
+      nil
+    end
+
+    def self.fetch_image!(url)
+      response = HttpFetcher.fetch(url)
+      unless allowed_image_content_type?(response.content_type)
+        raise GenerationFailed, 'サムネール画像が見つかりませんでした．'
+      end
+
+      response.body
+    rescue HttpFetcher::FetchTimeout
+      raise
+    rescue HttpFetcher::ResponseTooLarge
+      raise
+    rescue HttpFetcher::FetchFailed
+      raise GenerationFailed, 'サムネール画像を取得できませんでした．'
+    end
+
+    def self.niconico_thumbnail_url(uri)
+      video_id = KnownSiteExtractor.niconico_video_id(uri)
+      return nil if video_id.blank?
+
+      response = HttpFetcher.fetch("https://ext.nicovideo.jp/api/getthumbinfo/#{ video_id }",
+                                   max_bytes: NICONICO_XML_MAX_BYTES)
+      xml = Nokogiri::XML(response.body)
+      return nil unless xml.at_xpath('/nicovideo_thumb_response/@status')&.value == 'ok'
+
+      xml.at_xpath('//thumbnail_url')&.text&.strip.presence
+    rescue HttpFetcher::FetchFailed, HttpFetcher::FetchTimeout => e
+      Rails.logger.info("preview_niconico_getthumbinfo_fallback #{ { url: uri.to_s,
+                                                                     video_id:,
+                                                                     error: e.class.name,
+                                                                     message: e.message }.to_json }")
+      nil
+    rescue Nokogiri::XML::SyntaxError => e
+      Rails.logger.info("preview_niconico_getthumbinfo_fallback #{ { url: uri.to_s,
+                                                                     video_id:,
+                                                                     error: e.class.name,
+                                                                     message: e.message }.to_json }")
+      nil
+    end
+
+    def self.allowed_image_content_type?(content_type)
+      mime_type = content_type.to_s.split(';', 2).first.downcase.strip
+      ALLOWED_IMAGE_CONTENT_TYPES.include?(mime_type)
+    end
+
+    private_class_method :fetch_image_or_nil, :fetch_image!,
+                         :niconico_thumbnail_url,
+                         :allowed_image_content_type?
+  end
+end

backend/app/services/preview/url_safety.rb

@@ -0,0 +1,55 @@
+require 'resolv'
+require 'ipaddr'
+require 'uri'
+
+module Preview
+  class UrlSafety
+    class UnsafeUrl < StandardError; end
+
+    FORBIDDEN_NETWORKS = [
+      '0.0.0.0/8', '10.0.0.0/8', '100.64.0.0/10', '127.0.0.0/8',
+      '169.254.0.0/16', '172.16.0.0/12', '192.0.0.0/24',
+      '192.0.2.0/24', '192.168.0.0/16', '198.18.0.0/15',
+      '198.51.100.0/24', '203.0.113.0/24', '224.0.0.0/4',
+      '240.0.0.0/4', '::/128', '::1/128', 'fc00::/7', 'fe80::/10',
+      'ff00::/8', '2001:db8::/32', '::ffff:0:0/96'
+    ].map { IPAddr.new(_1) }.freeze
+
+    def self.validate(raw_url)
+      value = raw_url.to_s.strip
+      if value.match?(/\A[a-z][a-z0-9+\-.]*:/i)
+        unless value.match?(/\Ahttps?:\/\//i)
+          raise UnsafeUrl, 'http または https の URL を指定してください．'
+        end
+      else
+        value = "http://#{ value }"
+      end
+      uri = URI.parse(value)
+
+      unless ['http', 'https'].include?(uri.scheme&.downcase) && uri.host.present?
+        raise UnsafeUrl, 'http または https の URL を指定してください．'
+      end
+      raise UnsafeUrl, 'userinfo つき URL は使用できません．' if uri.userinfo.present?
+
+      addresses = Resolv.getaddresses(uri.host)
+      raise UnsafeUrl, 'URL のホストを解決できません．' if addresses.empty?
+
+      parsed_addresses = addresses.map { IPAddr.new(_1) }
+      if parsed_addresses.any? { |address| forbidden?(address) }
+        raise UnsafeUrl, '安全でない接続先は使用できません．'
+      end
+
+      [uri, parsed_addresses.map(&:to_s)]
+    rescue Resolv::ResolvError
+      raise UnsafeUrl, 'URL のホストを解決できません．'
+    rescue URI::InvalidURIError, IPAddr::InvalidAddressError
+      raise UnsafeUrl, 'URL が不正です．'
+    end
+
+    def self.forbidden?(address)
+      FORBIDDEN_NETWORKS.any? { _1.include?(address) }
+    end
+
+    private_class_method :forbidden?
+  end
+end

backend/config/routes.rb

@@ -33,6 +33,12 @@ Rails.application.routes.draw do
     get :thumbnail
   end
 
+  scope 'posts/import', controller: :post_imports do
+    post :preview
+    post :validate
+    post '', action: :create
+  end
+
   resources :wiki_pages, path: 'wiki', only: [:index, :show, :create, :update] do
     collection do
       get :search
@@ -81,6 +87,11 @@ Rails.application.routes.draw do
     end
   end
 
+  get 'users/settings', to: 'user_settings#show'
+  patch 'users/settings', to: 'user_settings#update'
+  get 'users/theme_slots', to: 'user_theme_slots#index'
+  put 'users/theme_slots/:base_theme/:slot_no', to: 'user_theme_slots#update'
+
   resources :users, only: [:create, :update] do
     collection do
       post :verify

backend/db/migrate/20260704000000_rebuild_settings_as_typed_user_settings.rb

@@ -0,0 +1,31 @@
+class RebuildSettingsAsTypedUserSettings < ActiveRecord::Migration[8.0]
+  def change
+    remove_foreign_key :settings, :users if foreign_key_exists?(:settings, :users)
+    remove_index :settings, :user_id if index_exists?(:settings, :user_id)
+
+    remove_column :settings, :key, :string if column_exists?(:settings, :key)
+    remove_column :settings, :value, :json if column_exists?(:settings, :value)
+
+    change_column_null :settings, :user_id, false
+
+    add_column :settings, :theme, :string, null: false, default: 'system'
+    add_column :settings,
+               :auto_fetch_title,
+               :string,
+               null: false,
+               default: 'manual'
+    add_column :settings,
+               :auto_fetch_thumbnail,
+               :string,
+               null: false,
+               default: 'manual'
+    add_column :settings,
+               :wiki_editor_mode,
+               :string,
+               null: false,
+               default: 'split'
+
+    add_index :settings, :user_id, unique: true
+    add_foreign_key :settings, :users
+  end
+end

backend/db/migrate/20260705000000_create_user_theme_slots.rb

@@ -0,0 +1,22 @@
+class CreateUserThemeSlots < ActiveRecord::Migration[8.0]
+  def change
+    create_table :user_theme_slots do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :base_theme, null: false
+      t.integer :slot_no, null: false
+      t.json :tokens, null: false
+      t.timestamps
+    end
+
+    add_index :user_theme_slots,
+              [:user_id, :base_theme, :slot_no],
+              unique: true,
+              name: 'index_user_theme_slots_on_user_theme_and_slot'
+    add_check_constraint :user_theme_slots,
+                         "base_theme IN ('light', 'dark')",
+                         name: 'user_theme_slots_base_theme_valid'
+    add_check_constraint :user_theme_slots,
+                         'slot_no BETWEEN 1 AND 3',
+                         name: 'user_theme_slots_slot_no_valid'
+  end
+end

backend/db/migrate/20260713000000_create_post_url_sanitisation_rules.rb

@@ -0,0 +1,61 @@
+class CreatePostUrlSanitisationRules < ActiveRecord::Migration[8.0]
+  class PostUrlSanitisationRule < ActiveRecord::Base
+    self.table_name = 'post_url_sanitisation_rules'
+  end
+
+  def up
+    create_table :post_url_sanitisation_rules, id: :integer, primary_key: :priority do |t|
+      t.string :source_pattern, null: false
+      t.string :replacement, null: false
+      t.timestamps
+      t.datetime :discarded_at
+
+      t.index :source_pattern, unique: true
+      t.index :discarded_at
+    end
+
+    now = Time.current
+
+    PostUrlSanitisationRule.insert_all!([
+        { priority: 10,
+          source_pattern: '\Ahttps?://youtu\.be/([^/?#]+)(?:[?#].*)?\z',
+          replacement: 'https://www.youtube.com/watch?v=\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 20,
+          source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/live/([^/?#]+)(?:[?#].*)?\z',
+          replacement: 'https://www.youtube.com/watch?v=\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 30,
+          source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/shorts/([^/?#]+)(?:[?#].*)?\z',
+          replacement: 'https://www.youtube.com/watch?v=\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 40,
+          source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/embed/([^/?#]+)(?:[?#].*)?\z',
+          replacement: 'https://www.youtube.com/watch?v=\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 50,
+          source_pattern:
+              '\Ahttps?://(?:www\.|m\.)?youtube\.com/watch\?(?:[^#&]+&)*v=([^&#]+)(?:[&#].*)?\z',
+          replacement: 'https://www.youtube.com/watch?v=\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 60,
+          source_pattern: '\Ahttps?://nico\.ms/([^/?#]+)(?:[?#].*)?\z',
+          replacement: 'https://www.nicovideo.jp/watch/\1',
+          created_at: now,
+          updated_at: now },
+        { priority: 70,
+          source_pattern: '\Ahttps?://(?:www\.)?nicovideo\.jp/watch/([^?#/]+)(?:[?#].*)?\z',
+          replacement: 'https://www.nicovideo.jp/watch/\1',
+          created_at: now,
+          updated_at: now }])
+  end
+
+  def down
+    drop_table :post_url_sanitisation_rules
+  end
+end

backend/db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
+ActiveRecord::Schema[8.0].define(version: 2026_07_13_000000) do
   create_table "active_storage_attachments", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
@@ -331,6 +331,16 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
     t.index ["tag_id"], name: "index_post_tags_on_tag_id"
   end
 
+  create_table "post_url_sanitisation_rules", primary_key: "priority", id: :integer, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "source_pattern", null: false
+    t.string "replacement", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.datetime "discarded_at"
+    t.index ["discarded_at"], name: "index_post_url_sanitisation_rules_on_discarded_at"
+    t.index ["source_pattern"], name: "index_post_url_sanitisation_rules_on_source_pattern", unique: true
+  end
+
   create_table "post_versions", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "post_id", null: false
     t.integer "version_no", null: false
@@ -374,11 +384,26 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
 
   create_table "settings", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "user_id", null: false
-    t.string "key", null: false
-    t.json "value", null: false
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
-    t.index ["user_id"], name: "index_settings_on_user_id"
+    t.string "theme", default: "system", null: false
+    t.string "auto_fetch_title", default: "manual", null: false
+    t.string "auto_fetch_thumbnail", default: "manual", null: false
+    t.string "wiki_editor_mode", default: "split", null: false
+    t.index ["user_id"], name: "index_settings_on_user_id", unique: true
+  end
+
+  create_table "wiki_assets", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "wiki_page_id", null: false
+    t.integer "no", null: false
+    t.string "alt_text"
+    t.binary "sha256", limit: 32, null: false
+    t.bigint "created_by_user_id", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["created_by_user_id"], name: "index_wiki_assets_on_created_by_user_id"
+    t.index ["wiki_page_id", "no"], name: "index_wiki_assets_on_wiki_page_id_and_no", unique: true
+    t.index ["wiki_page_id", "sha256"], name: "index_wiki_assets_on_wiki_page_id_and_sha256", unique: true
   end
 
   create_table "tag_implications", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
@@ -426,9 +451,9 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
     t.string "event_type", null: false
     t.string "name", null: false
     t.string "category", null: false
-    t.datetime "deprecated_at"
     t.text "aliases", null: false
     t.text "parent_tag_ids", null: false
+    t.datetime "deprecated_at"
     t.datetime "created_at", null: false
     t.bigint "created_by_user_id"
     t.index ["created_at"], name: "index_tag_versions_on_created_at"
@@ -441,10 +466,10 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
   create_table "tags", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.bigint "tag_name_id", null: false
     t.string "category", default: "general", null: false
+    t.datetime "deprecated_at"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
     t.integer "post_count", default: 0, null: false
-    t.datetime "deprecated_at"
     t.datetime "discarded_at"
     t.integer "version_no", null: false
     t.index ["deprecated_at"], name: "index_tags_on_deprecated_at"
@@ -566,6 +591,19 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
     t.index ["post_id"], name: "index_user_post_views_on_post_id"
   end
 
+  create_table "user_theme_slots", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.string "base_theme", null: false
+    t.integer "slot_no", null: false
+    t.json "tokens", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["user_id", "base_theme", "slot_no"], name: "index_user_theme_slots_on_user_theme_and_slot", unique: true
+    t.index ["user_id"], name: "index_user_theme_slots_on_user_id"
+    t.check_constraint "`base_theme` in (_utf8mb4'light',_utf8mb4'dark')", name: "user_theme_slots_base_theme_valid"
+    t.check_constraint "`slot_no` between 1 and 3", name: "user_theme_slots_slot_no_valid"
+  end
+
   create_table "users", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "name"
     t.string "inheritance_code", limit: 64, null: false
@@ -576,19 +614,6 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
     t.index ["banned_at"], name: "index_users_on_banned_at"
   end
 
-  create_table "wiki_assets", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
-    t.bigint "wiki_page_id", null: false
-    t.integer "no", null: false
-    t.string "alt_text"
-    t.binary "sha256", limit: 32, null: false
-    t.bigint "created_by_user_id", null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-    t.index ["created_by_user_id"], name: "index_wiki_assets_on_created_by_user_id"
-    t.index ["wiki_page_id", "no"], name: "index_wiki_assets_on_wiki_page_id_and_no", unique: true
-    t.index ["wiki_page_id", "sha256"], name: "index_wiki_assets_on_wiki_page_id_and_sha256", unique: true
-  end
-
   create_table "wiki_lines", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
     t.string "sha256", limit: 64, null: false
     t.text "body", null: false
@@ -738,6 +763,7 @@ ActiveRecord::Schema[8.0].define(version: 2026_06_26_010000) do
   add_foreign_key "user_ips", "users"
   add_foreign_key "user_post_views", "posts"
   add_foreign_key "user_post_views", "users"
+  add_foreign_key "user_theme_slots", "users"
   add_foreign_key "wiki_assets", "users", column: "created_by_user_id"
   add_foreign_key "wiki_assets", "wiki_pages"
   add_foreign_key "wiki_pages", "tag_names"

backend/db/seeds.rb

@@ -8,6 +8,43 @@
 #     MovieGenre.find_or_create_by!(name: genre_name)
 #   end
 
+post_url_sanitisation_rules = [
+  { priority: 10,
+    source_pattern: '\Ahttps?://youtu\.be/([^/?#]+)(?:[?#].*)?\z',
+    replacement: 'https://www.youtube.com/watch?v=\1' },
+  { priority: 20,
+    source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/live/([^/?#]+)(?:[?#].*)?\z',
+    replacement: 'https://www.youtube.com/watch?v=\1' },
+  { priority: 30,
+    source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/shorts/([^/?#]+)(?:[?#].*)?\z',
+    replacement: 'https://www.youtube.com/watch?v=\1' },
+  { priority: 40,
+    source_pattern: '\Ahttps?://(?:www\.|m\.)?youtube\.com/embed/([^/?#]+)(?:[?#].*)?\z',
+    replacement: 'https://www.youtube.com/watch?v=\1' },
+  { priority: 50,
+    source_pattern:
+        '\Ahttps?://(?:www\.|m\.)?youtube\.com/watch\?(?:[^#&]+&)*v=([^&#]+)(?:[&#].*)?\z',
+    replacement: 'https://www.youtube.com/watch?v=\1' },
+  { priority: 60,
+    source_pattern: '\Ahttps?://nico\.ms/([^/?#]+)(?:[?#].*)?\z',
+    replacement: 'https://www.nicovideo.jp/watch/\1' },
+  { priority: 70,
+    source_pattern: '\Ahttps?://(?:www\.)?nicovideo\.jp/watch/([^?#/]+)(?:[?#].*)?\z',
+    replacement: 'https://www.nicovideo.jp/watch/\1' }
+]
+
+post_url_sanitisation_rule_scope = PostUrlSanitisationRule.unscoped
+
+post_url_sanitisation_rules.each do |attributes|
+  priority = attributes.fetch(:priority)
+  source_pattern = attributes.fetch(:source_pattern)
+
+  next if post_url_sanitisation_rule_scope.exists?(priority:)
+  next if post_url_sanitisation_rule_scope.exists?(source_pattern:)
+
+  post_url_sanitisation_rule_scope.create!(attributes)
+end
+
 material_sync_source_uri = ENV['MATERIAL_SYNC_SOURCE_URI']
 material_sync_source_file_id = ENV['MATERIAL_SYNC_SOURCE_FILE_ID']
 

backend/lib/package.json

@@ -1,15 +0,0 @@
-{
-  "name": "lib",
-  "version": "1.0.0",
-  "main": "screenshot.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "description": "",
-  "dependencies": {
-    "puppeteer": "^24.10.0"
-  }
-}

backend/lib/screenshot.js

@@ -1,18 +0,0 @@
-const puppeteer = require ('puppeteer')
-const fs = require ('fs')
-
-
-void (async () => {
-  const url = process.argv[2]
-  const output = process.argv[3]
-
-  const browser = await puppeteer.launch ({
-      args: ['--no-sandbox', '--disable-setuid-sandbox'] })
-
-  const page = await browser.newPage ()
-  await page.setViewport ({ width: 960, height: 960 })
-  await page.goto (url, { waitUntil: 'networkidle2', timeout: 15000 })
-
-  await page.screenshot ({ path: output })
-  await browser.close ()
-}) ()

backend/spec/db/seeds_spec.rb

@@ -0,0 +1,65 @@
+require 'rails_helper'
+
+RSpec.describe 'database seeds' do
+  before do
+    PostUrlSanitisationRule.unscoped.delete_all
+  end
+
+  it 'registers the initial post URL sanitisation rules' do
+    load_seeds
+
+    urls = {
+      'https://youtu.be/abc123?si=share' => youtube_url('abc123'),
+      'https://www.youtube.com/live/abc123?t=10' => youtube_url('abc123'),
+      'https://youtube.com/shorts/abc123?feature=share' => youtube_url('abc123'),
+      'https://m.youtube.com/embed/abc123' => youtube_url('abc123'),
+      'https://youtube.com/watch?feature=share&v=abc123&t=10' => youtube_url('abc123'),
+      'https://nico.ms/sm123?from=share#fragment' => nico_url('sm123'),
+      'https://www.nicovideo.jp/watch/sm123?ref=share#fragment' => nico_url('sm123')
+    }
+
+    expect(PostUrlSanitisationRule.count).to eq(7)
+    urls.each do |url, canonical_url|
+      expect(PostUrlSanitisationRule.sanitise(url)).to eq(canonical_url)
+    end
+  end
+
+  it 'does not overwrite or restore an existing rule' do
+    rule = PostUrlSanitisationRule.create!(
+      priority: 10,
+      source_pattern: '\Ahttps://example\.com/custom\z',
+      replacement: 'https://example.com/replacement'
+    )
+    rule.discard!
+    original_attributes = rule.reload.attributes
+
+    2.times { load_seeds }
+
+    persisted_rule = PostUrlSanitisationRule.unscoped.find(10)
+    expect(persisted_rule.attributes).to eq(original_attributes)
+    expect(PostUrlSanitisationRule.unscoped.count).to eq(7)
+  end
+
+  it 'does not duplicate a rule moved to another priority' do
+    source_pattern = '\Ahttps?://youtu\.be/([^/?#]+)(?:[?#].*)?\z'
+    PostUrlSanitisationRule.create!(
+      priority: 80,
+      source_pattern:,
+      replacement: 'https://example.com/custom/\1'
+    )
+
+    load_seeds
+
+    rules = PostUrlSanitisationRule.unscoped
+    expect(rules.where(source_pattern:).count).to eq(1)
+    expect(rules.find(80).replacement).to eq('https://example.com/custom/\1')
+  end
+
+  def load_seeds
+    load Rails.root.join('db/seeds.rb')
+  end
+
+  def youtube_url(video_id) = "https://www.youtube.com/watch?v=#{ video_id }"
+
+  def nico_url(video_id) = "https://www.nicovideo.jp/watch/#{ video_id }"
+end

backend/spec/models/post_spec.rb

@@ -0,0 +1,68 @@
+require 'rails_helper'
+
+RSpec.describe Post, type: :model do
+  before do
+    PostUrlSanitisationRule.unscoped.delete_all
+  end
+
+  describe 'URL normalisation' do
+    it 'normalises the HTTP URL before applying sanitisation rules' do
+      PostUrlSanitisationRule.create!(
+        priority: 10,
+        source_pattern: '\\Ahttps://example\\.com/videos/([^/]+)\\z',
+        replacement: 'https://example.com/watch/\\1'
+      )
+
+      post = described_class.create!(
+        title: 'normalised URL',
+        url: '  https://EXAMPLE.com/videos/123/  '
+      )
+
+      expect(post.url).to eq('https://example.com/watch/123')
+    end
+
+    it 'does not normalise an unchanged URL when another attribute changes' do
+      post = create(:post)
+      post.update_column(:url, 'https://EXAMPLE.com/unchanged/')
+
+      post.update!(title: 'updated title')
+
+      expect(post.reload.url).to eq('https://EXAMPLE.com/unchanged/')
+    end
+
+    it 'validates the sanitised URL length' do
+      path = 'a' * 375
+
+      PostUrlSanitisationRule.create!(
+        priority: 10,
+        source_pattern: '\\Ahttps://example\\.com/(a+)\\z',
+        replacement: 'https://example.com/\\1\\1'
+      )
+
+      post = described_class.new(
+        title: 'long URL',
+        url: "https://example.com/#{ path }"
+      )
+
+      expect(post).to be_invalid
+      expect(post.errors.details.fetch(:url)).to include(
+        error: :too_long,
+        count: 768
+      )
+    end
+
+    it 'validates uniqueness after sanitisation' do
+      PostUrlSanitisationRule.create!(
+        priority: 10,
+        source_pattern: '\\Ahttps://example\\.com/alias\\z',
+        replacement: 'https://example.com/canonical'
+      )
+      create(:post, url: 'https://example.com/canonical')
+
+      post = described_class.new(title: 'duplicate URL', url: 'https://example.com/alias')
+
+      expect(post).to be_invalid
+      expect(post.errors.details.fetch(:url)).to include(error: :taken, value: post.url)
+    end
+  end
+end

backend/spec/models/post_url_sanitisation_rule_spec.rb

@@ -0,0 +1,265 @@
+require 'rails_helper'
+
+RSpec.describe PostUrlSanitisationRule, type: :model do
+  before do
+    described_class.unscoped.delete_all
+  end
+
+  describe 'validations' do
+    it 'requires a source pattern' do
+      rule = described_class.new(priority: 10, source_pattern: nil, replacement: '')
+
+      expect(rule).to be_invalid
+      expect(rule.errors.details.fetch(:source_pattern)).to eq([{ error: :blank }])
+    end
+
+    it 'requires a unique source pattern' do
+      described_class.create!(priority: 10, source_pattern: 'source', replacement: 'first')
+      rule = described_class.new(
+        priority: 20,
+        source_pattern: 'source',
+        replacement: 'second'
+      )
+
+      expect(rule).to be_invalid
+      expect(rule.errors.details.fetch(:source_pattern)).to include(
+        error: :taken,
+        value: 'source'
+      )
+    end
+
+    it 'rejects an invalid regexp' do
+      rule = described_class.new(priority: 10, source_pattern: '[', replacement: '')
+
+      expect(rule).to be_invalid
+      expect(rule.errors[:source_pattern]).to include('変な正規表現だね〜（笑）')
+    end
+  end
+
+  describe '.sanitise' do
+    it 'applies each active rule once in priority order' do
+      described_class.create!(priority: 30, source_pattern: 'c', replacement: 'd')
+      described_class.create!(priority: 10, source_pattern: 'a', replacement: 'aa')
+      described_class.create!(priority: 20, source_pattern: 'aa', replacement: 'c')
+      discarded = described_class.create!(
+        priority: 5,
+        source_pattern: '.',
+        replacement: 'discarded'
+      )
+      discarded.discard!
+
+      expect(described_class.sanitise('a')).to eq('d')
+    end
+
+    it 'canonicalises the initial YouTube and Nico URL forms' do
+      create_initial_rules
+
+      urls = {
+        'https://youtu.be/abc123?si=share' => youtube_url('abc123'),
+        'https://www.youtube.com/live/abc123?t=10' => youtube_url('abc123'),
+        'https://youtube.com/shorts/abc123?feature=share' => youtube_url('abc123'),
+        'https://m.youtube.com/embed/abc123' => youtube_url('abc123'),
+        'https://youtube.com/watch?feature=share&v=abc123&t=10' => youtube_url('abc123'),
+        'https://nico.ms/sm123?from=share#fragment' => nico_url('sm123'),
+        'https://www.nicovideo.jp/watch/sm123?ref=share#fragment' => nico_url('sm123')
+      }
+
+      urls.each do |url, canonical_url|
+        expect(described_class.sanitise(url)).to eq(canonical_url)
+      end
+    end
+  end
+
+  describe '.apply!' do
+    it 'locks posts in ID order and updates through temporary URLs' do
+      first = create(:post, url: 'https://example.com/source/1')
+      second = create(:post, url: 'https://example.com/source/2')
+      create_source_rule
+      sql = capture_sql { described_class.apply! }
+
+      lock_sql = sql.find { _1.match?(/SELECT .*posts.*FOR UPDATE/i) }
+      expect(lock_sql).to match(/ORDER BY .*posts.*id.* ASC/i)
+      expect(sql.grep(/post-url-sanitising\.invalid/).size).to eq(2)
+      expect(first.reload.url).to eq('https://example.com/canonical/1')
+      expect(second.reload.url).to eq('https://example.com/canonical/2')
+    end
+
+    it 'loads and compiles rules only once' do
+      create(:post, url: 'https://example.com/source/1')
+      create(:post, url: 'https://example.com/source/2')
+      create_source_rule
+
+      expect(described_class).to receive(:rules).once.and_call_original
+
+      described_class.apply!
+    end
+
+    it 'does not change post versions, version_no, or updated_at' do
+      post = create(:post, url: 'https://example.com/source/1')
+      post.update_columns(version_no: 7, updated_at: 1.day.ago)
+      original_updated_at = post.reload.updated_at
+      create_source_rule
+
+      expect { described_class.apply! }.not_to change(PostVersion, :count)
+
+      post.reload
+      expect(post.url).to eq('https://example.com/canonical/1')
+      expect(post.version_no).to eq(7)
+      expect(post.updated_at).to eq(original_updated_at)
+    end
+
+    invalid_urls = {
+      'a blank URL' => '',
+      'an unparseable URL' => 'https://[',
+      'a non-HTTP URL' => 'ftp://example.com/file',
+      'an HTTP URL without a host' => 'https:/path'
+    }
+
+    invalid_urls.each do |description, sanitised_url|
+      it "rolls back every update when sanitisation produces #{ description }" do
+        valid_post = create(:post, url: 'https://example.com/source/1')
+        invalid_post = create(:post, url: 'https://example.com/invalid')
+        create_source_rule
+        described_class.create!(
+          priority: 20,
+          source_pattern: '\\Ahttps://example\\.com/invalid\\z',
+          replacement: sanitised_url
+        )
+
+        expect { described_class.apply! }
+            .to raise_error(described_class::InvalidUrlError) { |error|
+          expect(error.invalid_rows).to eq([
+            { post_id: invalid_post.id,
+              original_url: 'https://example.com/invalid',
+              sanitised_url: }
+          ])
+        }
+        expect(valid_post.reload.url).to eq('https://example.com/source/1')
+        expect(invalid_post.reload.url).to eq('https://example.com/invalid')
+      end
+    end
+
+    it 'rolls back every update when sanitisation produces a URL longer than 768 characters' do
+      path = 'a' * 375
+      original_url = "https://example.com/#{ path }"
+      sanitised_url = "https://example.com/#{ path }#{ path }"
+      valid_post = create(:post, url: 'https://example.com/source/1')
+      invalid_post = create(:post, url: original_url)
+      create_source_rule
+      described_class.create!(
+        priority: 20,
+        source_pattern: '\\Ahttps://example\\.com/(a+)\\z',
+        replacement: 'https://example.com/\\1\\1'
+      )
+
+      expect { described_class.apply! }
+          .to raise_error(described_class::InvalidUrlError) { |error|
+        expect(error.invalid_rows).to eq([
+          { post_id: invalid_post.id,
+            original_url:,
+            sanitised_url: }
+        ])
+      }
+      expect(valid_post.reload.url).to eq('https://example.com/source/1')
+      expect(invalid_post.reload.url).to eq(original_url)
+    end
+
+    it 'rejects sanitised URL collisions case-insensitively without changing posts' do
+      source = create(:post, url: 'https://example.com/source/Foo')
+      canonical = create(:post, url: 'https://example.com/canonical/foo')
+      create_source_rule
+
+      expect { described_class.apply! }
+          .to raise_error(described_class::UrlConflictError) { |error|
+        expect(error.conflicts).to contain_exactly(
+          { url: 'https://example.com/canonical/Foo',
+            post_id: source.id,
+            original_url: 'https://example.com/source/Foo' },
+          { url: 'https://example.com/canonical/foo',
+            post_id: canonical.id,
+            original_url: 'https://example.com/canonical/foo' }
+        )
+      }
+      expect(source.reload.url).to eq('https://example.com/source/Foo')
+      expect(canonical.reload.url).to eq('https://example.com/canonical/foo')
+      expect(Post.count).to eq(2)
+    end
+
+    it 'converts a persisted URL constraint race into UrlConflictError' do
+      post = create(:post, url: 'https://example.com/source/1')
+      create_source_rule
+      conflict = { url: 'https://example.com/canonical/1',
+                   post_id: post.id,
+                   original_url: post.url }
+      database_error = ActiveRecord::RecordNotUnique.new('duplicate URL')
+      allow_any_instance_of(ActiveRecord::Relation)
+          .to receive(:update_all).and_raise(database_error)
+      allow(described_class).to receive(:build_persisted_conflicts).and_return([conflict])
+
+      expect { described_class.apply! }
+          .to raise_error(described_class::UrlConflictError) { |error|
+        expect(error.conflicts).to eq([conflict])
+        expect(error.cause).to equal(database_error)
+      }
+      expect(post.reload.url).to eq('https://example.com/source/1')
+    end
+
+    it 're-raises an unidentified RecordNotUnique error' do
+      post = create(:post, url: 'https://example.com/source/1')
+      create_source_rule
+      database_error = ActiveRecord::RecordNotUnique.new('another unique constraint')
+      allow_any_instance_of(ActiveRecord::Relation)
+          .to receive(:update_all).and_raise(database_error)
+      allow(described_class).to receive(:build_persisted_conflicts).and_return([])
+
+      expect { described_class.apply! }.to raise_error(database_error)
+      expect(post.reload.url).to eq('https://example.com/source/1')
+    end
+  end
+
+  def capture_sql
+    statements = []
+    subscriber = lambda do |_name, _start, _finish, _id, payload|
+      binds = payload.fetch(:binds, []).map { _1.value_for_database.to_s }
+      statements << ([payload.fetch(:sql)] + binds).join(' ')
+    end
+    ActiveSupport::Notifications.subscribed(subscriber, 'sql.active_record') { yield }
+    statements
+  end
+
+  def create_source_rule
+    described_class.create!(
+      priority: 10,
+      source_pattern: '\\Ahttps://example\\.com/source/(.+)\\z',
+      replacement: 'https://example.com/canonical/\\1'
+    )
+  end
+
+  def create_initial_rules
+    rules = [
+      ['\\Ahttps?://youtu\\.be/([^/?#]+)(?:[?#].*)?\\z', youtube_url('\\1')],
+      ['\\Ahttps?://(?:www\\.|m\\.)?youtube\\.com/live/([^/?#]+)(?:[?#].*)?\\z',
+       youtube_url('\\1')],
+      ['\\Ahttps?://(?:www\\.|m\\.)?youtube\\.com/shorts/([^/?#]+)(?:[?#].*)?\\z',
+       youtube_url('\\1')],
+      ['\\Ahttps?://(?:www\\.|m\\.)?youtube\\.com/embed/([^/?#]+)(?:[?#].*)?\\z',
+       youtube_url('\\1')],
+      ['\\Ahttps?://(?:www\\.|m\\.)?youtube\\.com/watch\\?(?:[^#&]+&)*' \
+       'v=([^&#]+)(?:[&#].*)?\\z', youtube_url('\\1')],
+      ['\\Ahttps?://nico\\.ms/([^/?#]+)(?:[?#].*)?\\z', nico_url('\\1')],
+      ['\\Ahttps?://(?:www\\.)?nicovideo\\.jp/watch/([^?#/]+)(?:[?#].*)?\\z',
+       nico_url('\\1')]
+    ]
+    rules.each_with_index do |(source_pattern, replacement), index|
+      described_class.create!(
+        priority: (index + 1) * 10,
+        source_pattern:,
+        replacement:
+      )
+    end
+  end
+
+  def youtube_url(video_id) = "https://www.youtube.com/watch?v=#{ video_id }"
+
+  def nico_url(video_id) = "https://www.nicovideo.jp/watch/#{ video_id }"
+end

backend/spec/models/setting_spec.rb

@@ -0,0 +1,34 @@
+require 'rails_helper'
+
+RSpec.describe Setting, type: :model do
+  it 'accepts the default typed user settings' do
+    setting = described_class.new({ user: create(:user) }.merge(described_class.defaults))
+
+    expect(setting).to be_valid
+  end
+
+  it 'requires one settings row per user' do
+    user = create(:user)
+    described_class.create!({ user: }.merge(described_class.defaults))
+
+    duplicate = described_class.new({ user: }.merge(described_class.defaults))
+
+    expect(duplicate).not_to be_valid
+    expect(duplicate.errors[:user_id]).to be_present
+  end
+
+  it 'validates enum-like settings columns' do
+    setting = described_class.new(
+        { user: create(:user),
+          theme: 'neon',
+          auto_fetch_title: 'sometimes',
+          auto_fetch_thumbnail: 'sometimes',
+          wiki_editor_mode: 'sideways' })
+
+    expect(setting).not_to be_valid
+    expect(setting.errors[:theme]).to be_present
+    expect(setting.errors[:auto_fetch_title]).to be_present
+    expect(setting.errors[:auto_fetch_thumbnail]).to be_present
+    expect(setting.errors[:wiki_editor_mode]).to be_present
+  end
+end

backend/spec/models/user_theme_slot_spec.rb

@@ -0,0 +1,40 @@
+require 'rails_helper'
+
+RSpec.describe UserThemeSlot, type: :model do
+  it 'accepts a theme slot for one user, base theme, and slot number' do
+    slot = described_class.new(user: create(:user),
+                               base_theme: 'light',
+                               slot_no: 1,
+                               tokens: { 'background' => '0 0% 100%' })
+
+    expect(slot).to be_valid
+  end
+
+  it 'requires unique slot numbers per user and base theme' do
+    user = create(:user)
+    described_class.create!(user:,
+                            base_theme: 'dark',
+                            slot_no: 2,
+                            tokens: { 'background' => '222.2 84% 4.9%' })
+
+    duplicate = described_class.new(user:,
+                                    base_theme: 'dark',
+                                    slot_no: 2,
+                                    tokens: { 'background' => '0 0% 100%' })
+
+    expect(duplicate).not_to be_valid
+    expect(duplicate.errors[:user_id]).to be_present
+  end
+
+  it 'validates base theme, slot number, and token object shape' do
+    slot = described_class.new(user: create(:user),
+                               base_theme: 'system',
+                               slot_no: 4,
+                               tokens: 'not-object')
+
+    expect(slot).not_to be_valid
+    expect(slot.errors[:base_theme]).to be_present
+    expect(slot.errors[:slot_no]).to be_present
+    expect(slot.errors[:tokens]).to be_present
+  end
+end

backend/spec/requests/materials_spec.rb

@@ -287,6 +287,25 @@ RSpec.describe 'Materials API', type: :request do
         expect(json.dig('export_paths', 'legacy_drive')).to eq('伊地知ニジカ/created.png')
       end
 
+      it 'creates a create tag_version for a newly created material tag' do
+        expect do
+          post '/materials', params: {
+            tag: 'material_create_versioned_tag',
+            file: dummy_upload(filename: 'created.png')
+          }
+        end.to change(TagVersion, :count).by(1)
+
+        expect(response).to have_http_status(:created)
+
+        tag = Tag.joins(:tag_name).find_by!(tag_names: { name: 'material_create_versioned_tag' })
+        version = tag.tag_versions.order(:version_no).last
+
+        expect(version.event_type).to eq('create')
+        expect(version.name).to eq('material_create_versioned_tag')
+        expect(version.category).to eq('material')
+        expect(version.created_by_user).to eq(member_user)
+      end
+
       it 'snapshots attached file metadata and sha256' do
         post '/materials', params: {
           tag: 'material_create_file_version',
@@ -466,6 +485,73 @@ RSpec.describe 'Materials API', type: :request do
         expect(json.dig('tag', 'name')).to eq('material_update_new')
       end
 
+      it 'creates a create tag_version when update creates a new tag' do
+        expect do
+          put "/materials/#{ material.id }", params: {
+            tag: 'material_update_versioned_tag',
+            file: dummy_upload(filename: 'updated.png')
+          }
+        end.to change(Tag, :count).by(1)
+          .and change(TagName, :count).by(1)
+          .and change(TagVersion, :count).by(1)
+
+        expect(response).to have_http_status(:ok)
+
+        tag = Tag.joins(:tag_name).find_by!(tag_names: { name: 'material_update_versioned_tag' })
+        version = tag.tag_versions.order(:version_no).last
+
+        expect(version.event_type).to eq('create')
+        expect(version.name).to eq('material_update_versioned_tag')
+        expect(version.category).to eq('material')
+        expect(version.created_by_user).to eq(member_user)
+      end
+
+      it 'backfills a create tag_version for an existing material tag without history' do
+        existing_tag =
+            Tag.create!(tag_name: TagName.create!(name: 'material_update_existing_no_history'),
+                        category: :material)
+
+        expect(existing_tag.tag_versions).to be_empty
+
+        expect do
+          put "/materials/#{ material.id }", params: {
+            tag: 'material_update_existing_no_history',
+            file: dummy_upload(filename: 'updated.png')
+          }
+        end.to change(TagVersion, :count).by(1)
+
+        expect(response).to have_http_status(:ok)
+
+        version = existing_tag.reload.tag_versions.order(:version_no).last
+        expect(version.event_type).to eq('create')
+        expect(version.name).to eq('material_update_existing_no_history')
+        expect(version.category).to eq('material')
+        expect(version.created_by_user).to eq(member_user)
+      end
+
+      it 'backfills a create tag_version for an existing character tag without history' do
+        existing_tag =
+            Tag.create!(tag_name: TagName.create!(name: 'material_update_character_no_history'),
+                        category: :character)
+
+        expect(existing_tag.tag_versions).to be_empty
+
+        expect do
+          put "/materials/#{ material.id }", params: {
+            tag: 'material_update_character_no_history',
+            file: dummy_upload(filename: 'updated.png')
+          }
+        end.to change(TagVersion, :count).by(1)
+
+        expect(response).to have_http_status(:ok)
+
+        version = existing_tag.reload.tag_versions.order(:version_no).last
+        expect(version.event_type).to eq('create')
+        expect(version.name).to eq('material_update_character_no_history')
+        expect(version.category).to eq('character')
+        expect(version.created_by_user).to eq(member_user)
+      end
+
       it 'detaches the existing file without purging blob when url replaces file' do
         old_blob_id = material.file.blob.id
 
@@ -494,6 +580,7 @@ RSpec.describe 'Materials API', type: :request do
       it 'does not increase version for the same snapshot update' do
         MaterialVersionRecorder.record!(material:, event_type: :create,
                                         created_by_user: member_user)
+        TagVersioning.ensure_snapshot!(tag, created_by_user: member_user)
 
         expect do
           put "/materials/#{ material.id }", params: {
@@ -501,6 +588,8 @@ RSpec.describe 'Materials API', type: :request do
           }
         end.not_to change(MaterialVersion, :count)
 
+        expect(tag.reload.tag_versions.count).to eq(1)
+
         expect(response).to have_http_status(:ok)
         expect(material.reload.version_no).to eq(1)
       end

backend/spec/requests/post_imports_spec.rb

@@ -0,0 +1,112 @@
+require 'rails_helper'
+
+RSpec.describe 'Post imports API', type: :request do
+  let(:member) { create(:user, :member) }
+
+  before do
+    allow(Preview::UrlSafety).to receive(:validate) do |url|
+      [URI.parse(url), ['8.8.8.8']]
+    end
+    allow(PostMetadataFetcher).to receive(:fetch).and_return(
+      title: 'fetched title',
+      thumbnail_base: nil,
+      tags: ''
+    )
+  end
+
+  describe 'POST /posts/import/preview' do
+    it 'requires a member' do
+      sign_out
+      post '/posts/import/preview', params: { source: 'https://example.com/post' }
+      expect(response).to have_http_status(:unauthorized)
+
+      sign_in_as(create(:user, :guest))
+      post '/posts/import/preview', params: { source: 'https://example.com/post' }
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'parses a URL list and returns preview rows' do
+      sign_in_as(member)
+
+      post '/posts/import/preview', params: {
+        source: " https://example.com/one \r\n\r\nhttps://example.com/two"
+      }
+
+      expect(response).to have_http_status(:ok)
+      expect(json.fetch('rows').map { _1.fetch('source_row') }).to eq([1, 3])
+      expect(json.fetch('rows').map { _1.fetch('url') }).to eq([
+        'https://example.com/one',
+        'https://example.com/two'
+      ])
+    end
+
+    it 'returns a safe 400 response for an invalid source' do
+      sign_in_as(member)
+
+      post '/posts/import/preview', params: { source: '' }
+
+      expect(response).to have_http_status(:bad_request)
+      expect(json.fetch('message')).to eq('URL を入力してください．')
+    end
+  end
+
+  describe 'POST /posts/import/validate' do
+    it 'accepts camel-case row properties and returns their warnings' do
+      sign_in_as(member)
+
+      post '/posts/import/validate', params: {
+        rows: [{
+          sourceRow: '1',
+          url: 'https://example.com/post',
+          metadataUrl: 'https://example.com/post',
+          attributes: { title: 'manual title' },
+          provenance: { url: 'manual', title: 'manual' },
+          tagSources: { automatic: '', manual: '' },
+          fieldWarnings: { title: ['old warning'] },
+          baseWarnings: ['base warning']
+        }],
+        changed_row: -1
+      }
+
+      expect(response).to have_http_status(:ok)
+      result = json.fetch('rows').first
+      expect(result.fetch('source_row')).to eq(1)
+      expect(result.fetch('tag_sources')).to eq('automatic' => '', 'manual' => '')
+      expect(result.fetch('field_warnings')).to eq('title' => ['old warning'])
+      expect(result.fetch('base_warnings')).to eq(['base warning'])
+    end
+
+    it 'rejects a non-array rows value with 400' do
+      sign_in_as(member)
+
+      post '/posts/import/validate', params: { rows: { sourceRow: 1 }, changed_row: -1 }
+
+      expect(response).to have_http_status(:bad_request)
+      expect(json.fetch('message')).to eq('取込行の形式が不正です．')
+    end
+  end
+
+  describe 'POST /posts/import' do
+    it 'returns a formal skipped result for an existing post' do
+      existing = create(:post, url: 'https://example.com/existing')
+      sign_in_as(member)
+
+      post '/posts/import', params: {
+        rows: [{
+          sourceRow: 1,
+          url: existing.url,
+          attributes: { title: 'ignored' },
+          provenance: { url: 'manual', title: 'manual' },
+          tagSources: { automatic: '', manual: '' }
+        }]
+      }
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to include('created' => 0, 'skipped' => 1, 'failed' => 0)
+      expect(json.fetch('rows').first).to include(
+        'status' => 'skipped',
+        'existing_post_id' => existing.id
+      )
+    end
+  end
+end

backend/spec/requests/preview_spec.rb

@@ -1,28 +1,46 @@
-require "rails_helper"
+require 'rails_helper'
 
 
-RSpec.describe "Preview", type: :request do
-  describe "GET /preview/title" do
-    it "401 unless logged in" do
+RSpec.describe 'Preview', type: :request do
+  describe 'GET /preview/title' do
+    it '401 unless logged in' do
       sign_out
-      get "/preview/title", params: { url: "example.com" }
+      get '/preview/title', params: { url: 'example.com' }
       expect(response).to have_http_status(:unauthorized)
     end
 
-    it "400 when url blank" do
-      sign_in_as(create(:user))
-      get "/preview/title", params: { url: "" }
+    it '403 when logged in as guest' do
+      sign_in_as(create(:user, :guest))
+      get '/preview/title', params: { url: 'example.com' }
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it '400 when url blank' do
+      sign_in_as(create(:user, :member))
+      get '/preview/title', params: { url: '' }
       expect(response).to have_http_status(:bad_request)
     end
 
-    it "returns parsed title (stubbing URI.open)" do
-      sign_in_as(create(:user))
-      fake_html = "<html><head><title>  Hello  </title></head></html>"
-      allow(URI).to receive(:open).and_return(StringIO.new(fake_html))
+    it 'returns parsed title' do
+      sign_in_as(create(:user, :member))
+      allow(Preview::ThumbnailFetcher)
+          .to receive(:title)
+          .with('example.com')
+          .and_return('Hello')
 
-      get "/preview/title", params: { url: "example.com" }
+      get '/preview/title', params: { url: 'example.com' }
       expect(response).to have_http_status(:ok)
-      expect(json["title"]).to eq("Hello")
+      expect(json['title']).to eq('Hello')
+    end
+
+    it '413 when fetched response is too large' do
+      sign_in_as(create(:user, :member))
+      allow(Preview::ThumbnailFetcher)
+          .to receive(:title)
+          .and_raise(Preview::HttpFetcher::ResponseTooLarge, '外部データが大きすぎます．')
+
+      get '/preview/title', params: { url: 'example.com' }
+      expect(response).to have_http_status(:payload_too_large)
     end
   end
 end

backend/spec/requests/user_settings_spec.rb

@@ -0,0 +1,98 @@
+require 'rails_helper'
+
+RSpec.describe 'user settings', type: :request do
+  describe 'GET /users/settings' do
+    it 'requires a current user' do
+      sign_out
+
+      get '/users/settings'
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns defaults and creates a missing settings row' do
+      user = create(:user)
+      sign_in_as(user)
+
+      expect {
+        get '/users/settings'
+      }.to change(Setting, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to eq(
+          'theme' => 'system',
+          'auto_fetch_title' => 'manual',
+          'auto_fetch_thumbnail' => 'manual',
+          'wiki_editor_mode' => 'split')
+      expect(user.reload.setting).to be_present
+    end
+  end
+
+  describe 'PATCH /users/settings' do
+    it 'requires a current user' do
+      sign_out
+
+      patch '/users/settings', params: { theme: 'dark' }, as: :json
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'updates multiple typed settings at once' do
+      user = create(:user)
+      sign_in_as(user)
+
+      patch '/users/settings',
+            params: {
+              theme: 'dark',
+              auto_fetch_title: 'auto',
+              auto_fetch_thumbnail: 'off',
+              wiki_editor_mode: 'preview' },
+            as: :json
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to include(
+          'theme' => 'dark',
+          'auto_fetch_title' => 'auto',
+          'auto_fetch_thumbnail' => 'off',
+          'wiki_editor_mode' => 'preview')
+      expect(user.reload.setting).to have_attributes(
+          theme: 'dark',
+          auto_fetch_title: 'auto',
+          auto_fetch_thumbnail: 'off',
+          wiki_editor_mode: 'preview')
+    end
+
+    it 'does not treat Rails parameter wrapping as an editable setting' do
+      user = create(:user)
+      sign_in_as(user)
+
+      patch '/users/settings',
+            params: { theme: 'light', user_setting: { theme: 'dark' } },
+            as: :json
+
+      expect(response).to have_http_status(:ok)
+      expect(user.reload.setting.theme).to eq('light')
+    end
+
+    it 'returns validation_error for type mismatches' do
+      sign_in_as(create(:user))
+
+      patch '/users/settings', params: { theme: 1 }, as: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json).to include('type' => 'validation_error')
+      expect(json.fetch('errors')).to include(
+          'theme' => ['値の型が不正です．'])
+    end
+
+    it 'returns validation_error for invalid enum values' do
+      sign_in_as(create(:user))
+
+      patch '/users/settings', params: { theme: 'neon' }, as: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json).to include('type' => 'validation_error')
+      expect(json.fetch('errors').fetch('theme')).to be_present
+    end
+  end
+end

backend/spec/requests/user_theme_slots_spec.rb

@@ -0,0 +1,104 @@
+require 'rails_helper'
+
+RSpec.describe 'user theme slots', type: :request do
+  describe 'GET /users/theme_slots' do
+    it 'requires a current user' do
+      sign_out
+
+      get '/users/theme_slots'
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'returns only the current user slots in stable order' do
+      user = create(:user)
+      other_user = create(:user)
+      sign_in_as(user)
+      UserThemeSlot.create!(user:, base_theme: 'light', slot_no: 2, tokens: { 'a' => 1 })
+      UserThemeSlot.create!(user:, base_theme: 'dark', slot_no: 1, tokens: { 'b' => 2 })
+      UserThemeSlot.create!(user: other_user,
+                            base_theme: 'dark',
+                            slot_no: 3,
+                            tokens: { 'c' => 3 })
+
+      get '/users/theme_slots'
+
+      expect(response).to have_http_status(:ok)
+      expect(json.map { |slot| [slot.fetch('base_theme'), slot.fetch('slot_no')] }).to eq(
+          [['dark', 1], ['light', 2]])
+      expect(json.map { |slot| slot.fetch('tokens') }).to eq(
+          [{ 'b' => 2 }, { 'a' => 1 }])
+    end
+  end
+
+  describe 'PUT /users/theme_slots/:base_theme/:slot_no' do
+    it 'requires a current user' do
+      sign_out
+
+      put '/users/theme_slots/light/1',
+          params: { tokens: { background: '0 0% 100%' } },
+          as: :json
+
+      expect(response).to have_http_status(:unauthorized)
+    end
+
+    it 'creates a theme slot' do
+      user = create(:user)
+      sign_in_as(user)
+
+      expect {
+        put '/users/theme_slots/light/1',
+            params: { tokens: { background: '0 0% 100%', tagColours: { nico: '#ffffff' } } },
+            as: :json
+      }.to change(UserThemeSlot, :count).by(1)
+
+      expect(response).to have_http_status(:ok)
+      expect(json).to include('base_theme' => 'light', 'slot_no' => 1)
+      expect(json.fetch('tokens')).to include(
+          'background' => '0 0% 100%',
+          'tagColours' => { 'nico' => '#ffffff' })
+      expect(user.theme_slots.find_by!(base_theme: 'light', slot_no: 1).tokens).to include(
+          'background' => '0 0% 100%')
+    end
+
+    it 'updates an existing theme slot instead of creating a duplicate' do
+      user = create(:user)
+      sign_in_as(user)
+      UserThemeSlot.create!(user:, base_theme: 'dark', slot_no: 2, tokens: { 'old' => true })
+
+      expect {
+        put '/users/theme_slots/dark/2',
+            params: { tokens: { background: '222.2 84% 4.9%' } },
+            as: :json
+      }.not_to change(UserThemeSlot, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(user.theme_slots.find_by!(base_theme: 'dark', slot_no: 2).tokens).to eq(
+          'background' => '222.2 84% 4.9%')
+    end
+
+    it 'rejects invalid path parameters and token shapes' do
+      sign_in_as(create(:user))
+
+      put '/users/theme_slots/system/4',
+          params: { tokens: 'not-object' },
+          as: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors')).to include(
+          'base_theme' => ['値が不正です．'])
+    end
+
+    it 'rejects non-object tokens for valid slots' do
+      sign_in_as(create(:user))
+
+      put '/users/theme_slots/light/1',
+          params: { tokens: 'not-object' },
+          as: :json
+
+      expect(response).to have_http_status(:unprocessable_entity)
+      expect(json.fetch('errors')).to include(
+          'tokens' => ['JSON object で指定してください．'])
+    end
+  end
+end

backend/spec/services/post_import_previewer_spec.rb

@@ -0,0 +1,187 @@
+require 'rails_helper'
+
+RSpec.describe PostImportPreviewer do
+  before do
+    allow(Preview::UrlSafety).to receive(:validate) do |url|
+      [URI.parse(url), ['8.8.8.8']]
+    end
+  end
+
+  def row(source_row:, url:, attributes: { }, provenance: { }, **values)
+    {
+      source_row:,
+      url:,
+      attributes:,
+      provenance:
+    }.merge(values)
+  end
+
+  describe '#preview_rows' do
+    it 'marks an existing post for skipping without fetching metadata' do
+      existing = create(:post, url: 'https://example.com/existing')
+      expect(PostMetadataFetcher).not_to receive(:fetch)
+
+      result = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://EXAMPLE.com/existing/')
+      ]).first
+
+      expect(result).to include(
+        url: 'https://example.com/existing',
+        skip_reason: 'existing',
+        existing_post_id: existing.id,
+        validation_errors: {}
+      )
+      expect(result.fetch(:field_warnings)).to eq({})
+    end
+
+    it 'reports list duplicates as URL errors instead of existing skips' do
+      create(:post, url: 'https://example.com/duplicate')
+      expect(PostMetadataFetcher).not_to receive(:fetch)
+
+      results = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://example.com/duplicate'),
+        row(source_row: 2, url: 'https://EXAMPLE.com/duplicate/')
+      ])
+
+      expect(results.map { _1[:validation_errors] }).to all(
+        include(url: ['URL が重複しています．'])
+      )
+      expect(results).to all(include(skip_reason: nil, existing_post_id: nil))
+    end
+
+    it 'does not fetch metadata for an unsafe URL' do
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_raise(Preview::UrlSafety::UnsafeUrl, '安全でない接続先は使用できません．')
+      expect(PostMetadataFetcher).not_to receive(:fetch)
+
+      result = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://unsafe.example/post')
+      ]).first
+
+      expect(result.fetch(:validation_errors)).to include(
+        url: ['安全でない接続先は使用できません．']
+      )
+    end
+
+    it 'applies metadata to automatic fields and recognises metadata tags' do
+      Tag.create!(name: 'known-tag', category: :general)
+      allow(PostMetadataFetcher).to receive(:fetch).and_return(
+        title: 'metadata title',
+        thumbnail_base: 'https://example.com/thumb.jpg',
+        duration: 2_000,
+        tags: 'known-tag'
+      )
+
+      result = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://example.com/new')
+      ]).first
+
+      expect(result.fetch(:attributes)).to include(
+        'title' => 'metadata title',
+        'thumbnail_base' => 'https://example.com/thumb.jpg',
+        'duration' => 2_000,
+        'tags' => 'known-tag'
+      )
+      expect(result.fetch(:field_warnings)).not_to have_key('tags')
+      expect(PostMetadataFetcher).to have_received(:fetch).once
+    end
+
+    it 'preserves manual empty values when metadata is available' do
+      allow(PostMetadataFetcher).to receive(:fetch).and_return(
+        title: 'metadata title',
+        tags: 'metadata-tag'
+      )
+
+      result = described_class.new.preview_rows(rows: [
+        row(
+          source_row: 1,
+          url: 'https://example.com/manual',
+          attributes: { title: '', tags: '' },
+          provenance: { title: 'manual', tags: 'manual' },
+          tag_sources: { automatic: 'old-tag', manual: '' }
+        )
+      ]).first
+
+      expect(result.fetch(:attributes)).to include('title' => '', 'tags' => '')
+      expect(result.fetch(:tag_sources)).to include('manual' => '')
+    end
+
+    it 'clears warnings derived from an old metadata URL' do
+      allow(PostMetadataFetcher).to receive(:fetch).and_return(
+        title: 'new title',
+        thumbnail_base: 'https://example.com/new-thumb.jpg',
+        tags: ''
+      )
+
+      result = described_class.new.preview_rows(rows: [
+        row(
+          source_row: 1,
+          url: 'https://example.com/new-url',
+          attributes: { title: 'old title', tags: 'old-tag' },
+          provenance: { title: 'automatic', tags: 'automatic' },
+          tag_sources: { automatic: 'old-tag', manual: '' },
+          metadata_url: 'https://example.com/old-url',
+          field_warnings: { tags: ['old tag warning'], url: ['old fetch warning'] },
+          base_warnings: ['old base warning']
+        )
+      ]).first
+
+      expect(result.fetch(:attributes)).to include('title' => 'new title', 'tags' => '')
+      expect(result.fetch(:base_warnings)).to eq([])
+      expect(result.fetch(:field_warnings).values.flatten)
+          .not_to include('old tag warning', 'old fetch warning')
+    end
+
+    it 'isolates an unexpected metadata failure to the affected URL' do
+      allow(PostMetadataFetcher).to receive(:fetch) do |url|
+        raise 'fetch failure' if url.include?('failure')
+
+        { title: 'successful title', tags: '' }
+      end
+      allow(Rails.logger).to receive(:error)
+
+      results = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://example.com/failure'),
+        row(source_row: 2, url: 'https://example.com/success')
+      ])
+
+      expect(results[0].fetch(:field_warnings)).to include(
+        'url' => [described_class::METADATA_FETCH_WARNING]
+      )
+      expect(results[1].fetch(:attributes)).to include('title' => 'successful title')
+    end
+
+    it 'turns an unsafe URL detected during metadata fetching into a URL error' do
+      allow(PostMetadataFetcher).to receive(:fetch)
+          .and_raise(Preview::UrlSafety::UnsafeUrl, '安全でない接続先です．')
+      allow(Rails.logger).to receive(:info)
+
+      result = described_class.new.preview_rows(rows: [
+        row(source_row: 1, url: 'https://example.com/redirects-to-private')
+      ]).first
+
+      expect(result.fetch(:validation_errors)).to include(
+        url: ['安全でない接続先です．']
+      )
+    end
+
+    it 'validates parent IDs from the preloaded set' do
+      parent = create(:post)
+
+      results = described_class.new.preview_rows(
+        rows: [
+          row(source_row: 1, url: 'https://example.com/valid-parent',
+              attributes: { parent_post_ids: parent.id.to_s }),
+          row(source_row: 2, url: 'https://example.com/missing-parent',
+              attributes: { parent_post_ids: '999999' })
+        ],
+        fetch_metadata: false
+      )
+
+      expect(results[0].fetch(:validation_errors)).not_to have_key(:parent_post_ids)
+      expect(results[1].fetch(:validation_errors)).to include(
+        parent_post_ids: ['存在しない親投稿 Id. があります．']
+      )
+    end
+  end
+end

backend/spec/services/post_import_row_normaliser_spec.rb

@@ -0,0 +1,77 @@
+require 'rails_helper'
+
+RSpec.describe PostImportRowNormaliser do
+  def valid_row(overrides = { })
+    {
+      sourceRow: '1',
+      url: 'https://example.com/post',
+      metadataUrl: 'https://example.com/post',
+      attributes: { title: 'title', duration: 1_000 },
+      provenance: { url: 'manual', title: 'automatic' },
+      tagSources: { automatic: 'tag', manual: '' }
+    }.deep_merge(overrides)
+  end
+
+  describe '.normalise!' do
+    it 'normalises aliases and source rows into a permitted plain hash' do
+      row = ActionController::Parameters.new(valid_row)
+
+      expect(described_class.normalise!([row])).to eq([
+        {
+          'source_row' => 1,
+          'url' => 'https://example.com/post',
+          'metadata_url' => 'https://example.com/post',
+          'attributes' => { 'title' => 'title', 'duration' => 1_000 },
+          'provenance' => { 'url' => 'manual', 'title' => 'automatic' },
+          'tag_sources' => { 'automatic' => 'tag', 'manual' => '' }
+        }
+      ])
+    end
+
+    it 'normalises source rows before checking duplicates' do
+      rows = [valid_row, valid_row(sourceRow: 1, url: 'https://example.com/other')]
+
+      expect { described_class.normalise!(rows) }
+          .to raise_error(ArgumentError, '元行番号が重複しています．')
+    end
+
+    it 'rejects non-array batches and non-hash rows' do
+      expect { described_class.normalise!({}) }
+          .to raise_error(ArgumentError, '取込行の形式が不正です．')
+      expect { described_class.normalise!(['row']) }
+          .to raise_error(ArgumentError, '取込行の形式が不正です．')
+    end
+
+    it 'rejects unknown attributes and invalid field types' do
+      expect { described_class.normalise!([valid_row(attributes: { unknown: 'x' })]) }
+          .to raise_error(ArgumentError, '取込項目が不正です．')
+      expect { described_class.normalise!([valid_row(attributes: { title: [] })]) }
+          .to raise_error(ArgumentError, '取込項目の型が不正です．')
+      expect { described_class.normalise!([valid_row(attributes: { duration: false })]) }
+          .to raise_error(ArgumentError, '取込項目の型が不正です．')
+    end
+
+    it 'rejects unknown provenance and tag-source values' do
+      expect { described_class.normalise!([valid_row(provenance: { title: 'mapped' })]) }
+          .to raise_error(ArgumentError, '値の由来が不正です．')
+      expect { described_class.normalise!([valid_row(tagSources: { mapped: 'tag' })]) }
+          .to raise_error(ArgumentError, 'タグ由来の形式が不正です．')
+    end
+
+    it 'accepts warning fields only at the validation boundary' do
+      row = valid_row.merge(
+        fieldWarnings: { title: ['取得できませんでした．'] },
+        baseWarnings: ['確認してください．']
+      )
+
+      without_warnings = described_class.normalise!([row]).first
+      with_warnings = described_class.normalise!([row], allow_warning_fields: true).first
+
+      expect(without_warnings).not_to include('field_warnings', 'base_warnings')
+      expect(with_warnings).to include(
+        'field_warnings' => { 'title' => ['取得できませんでした．'] },
+        'base_warnings' => ['確認してください．']
+      )
+    end
+  end
+end

backend/spec/services/post_import_runner_spec.rb

@@ -0,0 +1,133 @@
+require 'rails_helper'
+
+RSpec.describe PostImportRunner do
+  let(:actor) { create(:user, :member) }
+
+  def row(source_row: 1, url: 'https://example.com/post')
+    {
+      sourceRow: source_row,
+      url:,
+      attributes: { title: 'title', tags: '' },
+      provenance: { url: 'manual', title: 'manual', tags: 'manual' },
+      tagSources: { automatic: '', manual: '' }
+    }
+  end
+
+  def preview(source_row: 1, errors: { }, skip_reason: nil, existing_post_id: nil)
+    {
+      source_row:,
+      attributes: { 'title' => 'title', 'tags' => '' },
+      validation_errors: errors,
+      skip_reason:,
+      existing_post_id:
+    }
+  end
+
+  it 'previews the whole batch once before processing individual rows' do
+    rows = [row, row(source_row: 2, url: 'https://example.com/two')]
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    expect(previewer).to receive(:preview_rows)
+        .with(
+          rows: satisfy { _1.map { |row_value| row_value['source_row'] } == [1, 2] },
+          fetch_metadata: false
+        )
+        .and_return([preview, preview(source_row: 2)])
+    allow(PostCreator).to receive(:new).and_return(
+      instance_double(PostCreator, create!: create(:post))
+    )
+
+    result = described_class.new(actor:, rows:).run
+
+    expect(result).to include(created: 2, skipped: 0, failed: 0)
+  end
+
+  it 'treats validation errors as failures before an existing skip' do
+    existing = create(:post)
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([
+      preview(errors: { url: ['URL が重複しています．'] },
+              skip_reason: 'existing', existing_post_id: existing.id)
+    ])
+    expect(PostCreator).not_to receive(:new)
+
+    result = described_class.new(actor:, rows: [row]).run.fetch(:rows).first
+
+    expect(result).to include(
+      status: 'failed',
+      errors: { url: ['URL が重複しています．'] },
+      recoverable: true
+    )
+  end
+
+  it 'returns the existing post ID for skipped rows' do
+    existing = create(:post)
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([
+      preview(skip_reason: 'existing', existing_post_id: existing.id)
+    ])
+
+    result = described_class.new(actor:, rows: [row]).run.fetch(:rows).first
+
+    expect(result).to eq(
+      source_row: 1,
+      status: 'skipped',
+      existing_post_id: existing.id
+    )
+  end
+
+  it 'converts a URL uniqueness validation race into a skip' do
+    existing = create(:post, url: 'https://example.com/race')
+    invalid = Post.new(url: existing.url)
+    invalid.errors.add(:url, :taken)
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([preview])
+    creator = instance_double(PostCreator)
+    allow(PostCreator).to receive(:new).and_return(creator)
+    allow(creator).to receive(:create!).and_raise(ActiveRecord::RecordInvalid.new(invalid))
+
+    result = described_class.new(
+      actor:,
+      rows: [row(url: 'https://EXAMPLE.com/race/')]
+    ).run.fetch(:rows).first
+
+    expect(result).to include(status: 'skipped', existing_post_id: existing.id)
+  end
+
+  it 're-raises RecordNotUnique errors unrelated to the posts URL index' do
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([preview])
+    creator = instance_double(PostCreator)
+    allow(PostCreator).to receive(:new).and_return(creator)
+    allow(creator).to receive(:create!)
+        .and_raise(ActiveRecord::RecordNotUnique, 'other_unique_index')
+
+    expect {
+      described_class.new(actor:, rows: [row]).run
+    }.to raise_error(ActiveRecord::RecordNotUnique)
+  end
+
+  it 'converts a posts URL index race into a skip' do
+    existing = create(:post, url: 'https://example.com/index-race')
+    previewer = instance_double(PostImportPreviewer)
+    allow(PostImportPreviewer).to receive(:new).and_return(previewer)
+    allow(previewer).to receive(:preview_rows).and_return([preview])
+    creator = instance_double(PostCreator)
+    allow(PostCreator).to receive(:new).and_return(creator)
+    allow(creator).to receive(:create!).and_raise(
+      ActiveRecord::RecordNotUnique,
+      'duplicate key index_posts_on_url'
+    )
+
+    result = described_class.new(
+      actor:,
+      rows: [row(url: 'https://EXAMPLE.com/index-race/')]
+    ).run.fetch(:rows).first
+
+    expect(result).to include(status: 'skipped', existing_post_id: existing.id)
+  end
+end

backend/spec/services/post_import_url_list_parser_spec.rb

@@ -0,0 +1,40 @@
+require 'rails_helper'
+
+RSpec.describe PostImportUrlListParser do
+  describe '.parse' do
+    it 'trims URLs, ignores blank lines, and preserves source line numbers' do
+      source = "  https://example.com/one  \r\n\r\nhttps://example.com/two\n"
+
+      expect(described_class.parse(source)).to eq([
+        { source_row: 1, url: 'https://example.com/one' },
+        { source_row: 3, url: 'https://example.com/two' }
+      ])
+    end
+
+    it 'rejects an empty URL list' do
+      expect { described_class.parse(" \n\r\n") }
+          .to raise_error(ArgumentError, 'URL を入力してください．')
+    end
+
+    it 'rejects more than 100 non-empty rows' do
+      source = 101.times.map { |index| "https://example.com/#{ index }" }.join("\n")
+
+      expect { described_class.parse(source) }
+          .to raise_error(ArgumentError, '取込件数は 100 件までです．')
+    end
+
+    it 'includes the original line number in an oversized URL error' do
+      source = "\n#{ 'a' * (described_class::MAX_URL_BYTES + 1) }"
+
+      expect { described_class.parse(source) }
+          .to raise_error(ArgumentError, '2 行目: URL が長すぎます．')
+    end
+
+    it 'rejects an oversized request before parsing rows' do
+      source = 'a' * (described_class::MAX_BYTES + 1)
+
+      expect { described_class.parse(source) }
+          .to raise_error(ArgumentError, '入力が大きすぎます．')
+    end
+  end
+end

backend/spec/services/post_metadata_fetcher_spec.rb

@@ -0,0 +1,64 @@
+require 'rails_helper'
+
+RSpec.describe PostMetadataFetcher do
+  Response = Struct.new(:body)
+
+  def fetch_with_published_time(value, url: 'https://example.com/video')
+    html = <<~HTML
+      <html><head>
+        <meta property="article:published_time" content="#{ value }">
+      </head></html>
+    HTML
+    uri = URI.parse(url)
+    allow(Preview::UrlSafety).to receive(:validate).with(url).and_return([uri, ['8.8.8.8']])
+    allow(Preview::HttpFetcher).to receive(:fetch).and_return(Response.new(html))
+    allow(Preview::HtmlMetadataExtractor).to receive(:extract)
+        .and_return(title: 'title', image_url: nil)
+
+    described_class.fetch(url)
+  end
+
+  it 'builds ranges explicitly for year, month, and day precision' do
+    year = fetch_with_published_time('2024')
+    month = fetch_with_published_time('2024-02')
+    day = fetch_with_published_time('2024-02-03')
+
+    expect(year).to include(
+      original_created_from: Time.zone.local(2024, 1, 1).iso8601,
+      original_created_before: Time.zone.local(2025, 1, 1).iso8601
+    )
+    expect(month).to include(
+      original_created_from: Time.zone.local(2024, 2, 1).iso8601,
+      original_created_before: Time.zone.local(2024, 3, 1).iso8601
+    )
+    expect(day).to include(
+      original_created_from: Time.zone.local(2024, 2, 3).iso8601,
+      original_created_before: Time.zone.local(2024, 2, 4).iso8601
+    )
+  end
+
+  it 'preserves an input offset and fractional-second precision' do
+    result = fetch_with_published_time('2024-02-03T12:34:56.123+02:30')
+
+    expect(Time.iso8601(result.fetch(:original_created_from)))
+        .to eq(Time.iso8601('2024-02-03T12:34:56.123+02:30'))
+    expect(
+      Time.iso8601(result.fetch(:original_created_before)) -
+      Time.iso8601(result.fetch(:original_created_from))
+    ).to eq(0.001)
+    expect(result.fetch(:original_created_from)).to include('.123000000')
+  end
+
+  it 'adds platform tags for known video URLs' do
+    result = fetch_with_published_time('2024', url: 'https://youtu.be/abc123')
+
+    expect(result.fetch(:tags)).to eq('動画 YouTube')
+  end
+
+  it 'returns nil dates for an invalid timestamp' do
+    result = fetch_with_published_time('not-a-time')
+
+    expect(result.fetch(:original_created_from)).to be_nil
+    expect(result.fetch(:original_created_before)).to be_nil
+  end
+end

backend/spec/services/post_url_normaliser_spec.rb

@@ -0,0 +1,27 @@
+require 'rails_helper'
+
+RSpec.describe PostUrlNormaliser do
+  before do
+    PostUrlSanitisationRule.unscoped.delete_all
+  end
+
+  describe '.normalise' do
+    it 'normalises the host and trailing slash before applying sanitisation rules' do
+      PostUrlSanitisationRule.create!(
+        priority: 10,
+        source_pattern: '\\Ahttps://example\\.com/source\\z',
+        replacement: 'https://example.com/canonical'
+      )
+
+      result = described_class.normalise('  https://EXAMPLE.com/source/  ')
+
+      expect(result).to eq('https://example.com/canonical')
+    end
+
+    it 'returns nil for unsupported or malformed URLs' do
+      expect(described_class.normalise('ftp://example.com/file')).to be_nil
+      expect(described_class.normalise('https://[')).to be_nil
+      expect(described_class.normalise('https:/path')).to be_nil
+    end
+  end
+end

backend/spec/services/preview/http_fetcher_spec.rb

@@ -0,0 +1,23 @@
+require 'rails_helper'
+
+RSpec.describe Preview::HttpFetcher do
+  describe '.fetch' do
+    it 'raises FetchFailed when redirect location is invalid' do
+      redirect = Net::HTTPFound.new('1.1', '302', 'Found')
+      redirect['location'] = 'http://[invalid'
+
+      allow(Preview::UrlSafety).to receive(:validate)
+          .with('https://example.com/page')
+          .and_return([URI.parse('https://example.com/page'), ['203.0.113.10']])
+      allow(described_class).to receive(:request)
+          .and_return(redirect)
+      allow(Rails.logger).to receive(:warn)
+
+      expect {
+        described_class.fetch('https://example.com/page')
+      }.to raise_error(Preview::HttpFetcher::FetchFailed)
+      expect(Rails.logger).to have_received(:warn)
+          .with(/invalid_redirect_location/)
+    end
+  end
+end

backend/spec/services/preview/thumbnail_fetcher_spec.rb

@@ -0,0 +1,51 @@
+require 'rails_helper'
+
+RSpec.describe Preview::ThumbnailFetcher do
+  describe '.fetch' do
+    it 'rejects svg thumbnails' do
+      page = Preview::HttpFetcher::Response.new(
+          '<meta property="og:image" content="https://example.com/thumb.svg">',
+          'text/html',
+          'https://example.com/page')
+      svg = Preview::HttpFetcher::Response.new(
+          '<svg></svg>',
+          'image/svg+xml',
+          'https://example.com/thumb.svg')
+
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_return([URI.parse('https://example.com/page'), ['203.0.113.10']])
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/page', max_bytes: described_class::HTML_MAX_BYTES)
+          .and_return(page)
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/thumb.svg')
+          .and_return(svg)
+
+      expect {
+        described_class.fetch('https://example.com/page')
+      }.to raise_error(Preview::ThumbnailFetcher::GenerationFailed)
+    end
+
+    it 'accepts allowed image content type with parameters' do
+      page = Preview::HttpFetcher::Response.new(
+          '<meta property="og:image" content="https://example.com/thumb.jpg">',
+          'text/html',
+          'https://example.com/page')
+      image = Preview::HttpFetcher::Response.new(
+          'jpeg-bytes',
+          'image/jpeg; charset=binary',
+          'https://example.com/thumb.jpg')
+
+      allow(Preview::UrlSafety).to receive(:validate)
+          .and_return([URI.parse('https://example.com/page'), ['203.0.113.10']])
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/page', max_bytes: described_class::HTML_MAX_BYTES)
+          .and_return(page)
+      allow(Preview::HttpFetcher).to receive(:fetch)
+          .with('https://example.com/thumb.jpg')
+          .and_return(image)
+
+      expect(described_class.fetch('https://example.com/page')).to eq('jpeg-bytes')
+    end
+  end
+end

backend/spec/services/preview/url_safety_spec.rb

@@ -0,0 +1,15 @@
+require 'rails_helper'
+
+RSpec.describe Preview::UrlSafety do
+  describe '.validate' do
+    it 'raises UnsafeUrl when DNS resolution fails' do
+      allow(Resolv).to receive(:getaddresses)
+          .with('missing.example')
+          .and_raise(Resolv::ResolvError)
+
+      expect {
+        described_class.validate('https://missing.example')
+      }.to raise_error(Preview::UrlSafety::UnsafeUrl)
+    end
+  end
+end

backend/spec/tasks/nico_export_spec.rb

@@ -62,7 +62,7 @@ RSpec.describe 'nico:export' do
 
     it 'deduplicates video ids' do
       create_post('https://www.nicovideo.jp/watch/sm12345')
-      create_post('https://www.nicovideo.jp/watch/sm12345?from=1')
+      create_post('https://sp.nicovideo.jp/watch/sm12345')
 
       expect(Open3).to receive(:capture3) do |_env, *args, **_kwargs|
         expect(args.drop(3)).to eq(['sm12345'])

frontend/AGENTS.md

@@ -50,16 +50,27 @@ pass or the remaining failure is clearly blocked.
 - Prefer single quotes for strings unless interpolation or escaping makes double quotes better.
 - Never write a TypeScript or TSX line longer than 99 characters.
 - Aim to keep TypeScript and TSX lines within 79 characters where practical.
-- Use 4-space logical indentation in TypeScript and TSX.
+- Use 2-space block indentation in TypeScript and TSX.
+- Use 4-space continuation indentation for wrapped expressions, arguments,
+  ternary branches, method chains, object pairs, arrays, and JSX attributes.
+- Treat the user's `PostImportSourcePage.tsx` and
+  `PostImportReviewPage.tsx` formatting as the local reference shape.
 - For arrays, never put whitespace or a line break immediately before `]`.
 - Keep the first element on the same line as `[` by default.
 - If an array would exceed the line limit, break after `[` and indent
   elements by 4 spaces.
-- In TypeScript and TSX only, replace every leading run of 8 spaces with a tab
-  to reduce bytes.
+- In TypeScript and TSX only, use tabs for leading 8-column compression only.
+- A tab does not represent one indentation level.
+- Determine visible indentation with 2-space block indentation and 4-space
+  continuation indentation first, then compress only complete leading runs of
+  8 spaces into tabs.
 - Treat one leading tab as exactly equivalent to 8 leading spaces.
 - Use tabs only for leading indentation. Never replace spaces that occur after
   a non-space character on the same line.
+- Keep residual leading 2, 4, or 6 spaces after any tab compression.
+- Examples: 2 columns = 2 spaces, 4 columns = 4 spaces, 6 columns = 6
+  spaces, 8 columns = 1 tab, 10 columns = 1 tab + 2 spaces, 12 columns = 1
+  tab + 4 spaces.
 
 ## React
 
@@ -97,12 +108,23 @@ pass or the remaining failure is clearly blocked.
   third-party request outside the Rails API.
 - For blob responses, pass `responseType: 'blob'` so the wrapper does not camelCase the body.
 
+## Dialogues
+
+- Dialogue work follows the shared-frontend reuse rules below.
+
 ## Imports and aliases
 
 - The `@` alias points to `frontend/src`.
 - Prefer `@/...` imports for app code instead of long relative paths.
 - Keep type imports separate with `import type`.
-- Match existing import grouping: external packages, app modules, then type imports.
+- Do not mix runtime values and `type` specifiers in one named import
+  declaration.
+- Do not write `import { value, type TypeName } from ...`.
+- Keep short value imports from one module on one line when they fit within
+  99 characters.
+- Order imports as four groups with a blank line between groups: external
+  value imports, `@/...` value imports, external type imports, `@/...`
+  type imports.
 
 ## Tailwind and UI
 
@@ -118,23 +140,773 @@ pass or the remaining failure is clearly blocked.
   short Japanese labels that fit the control.
 - Preserve existing Japanese tone and orthography in nearby UI text, including
   old-kana wording where the file already uses it.
-- When adding dynamic tag color classes, update `tailwind.config.js` safelist
+- When adding dynamic tag colour classes, update `tailwind.config.js` safelist
   if the class cannot be statically detected.
 - Do not introduce new UI libraries or production dependencies without approval.
 
-## TSX formatting
+## TypeScript and TSX formatting
 
+- The delimiter-placement and line-breaking rules in this section apply to
+  both plain TypeScript `.ts` and TSX `.tsx`, unless a bullet explicitly says
+  it is JSX- or React-specific.
 - Preserve compact TSX expression shapes such as inline ternary branches and
   closing `</div>)` forms when nearby code uses them.
+- Block bodies for components, functions, callbacks, `if`, `try`, `catch`,
+  `finally`, loops, and JSX nesting use 2 spaces per level.
+- Wrapped expressions, arguments, ternary branches, method chains, and object
+  pairs use 4-space continuation indentation relative to the owning
+  expression. Do not confuse this with 2-space block indentation.
+- Tabs are leading 8-column compression only. They do not represent one
+  nesting level. Decide visible indentation first, then compress only
+  complete leading runs of 8 spaces into tabs.
+- Do not add braces around a single-line `if` body merely for formatting.
+- Use braces for multi-line `if`, `else`, and loop bodies.
+- Multi-stage ternary expressions must use explicit parentheses for each
+  condition group and nested branch. Do not rely on indentation alone to show
+  `?` / `:` pairing.
+- Keep short inline props types local when they remain readable and within the
+  line limit; do not mechanically extract a named type with no reuse benefit.
+- In multi-line object literals, keep the opening `{` with the first pair when
+  the line length allows it; do not mechanically explode short objects into
+  Prettier-style vertical blocks.
+- Method chains should align as a continuation under the receiver expression;
+  do not indent chains more deeply than the normal continuation depth.
+- `PostImportSourcePage.tsx` and `PostImportReviewPage.tsx` are the current
+  canonical examples for block indentation, continuation indentation, import
+  grouping, ternary grouping, method-chain placement, and local inline props
+  types.
+- Treat TypeScript and TSX formatting rules as hard constraints, not
+  preferences. Before finishing a TypeScript or TSX edit, inspect the edited
+  hunks for closing `)`, `]`, and `}` placement and fix violations instead of
+  relying on formatter defaults.
+- After every TypeScript or TSX edit, perform a style-only self-review of the
+  edited hunks before running verification or reporting completion. The task is
+  not complete while any edited TypeScript or TSX hunk violates these local
+  formatting rules.
+- The TypeScript/TSX self-review must classify every edited leading or trailing
+  `)`, `]`, and `}` by syntax role before deciding whether it is valid. Do not
+  apply a rule by glyph alone. A closing `)` for a function parameter list is
+  different from a closing `)` for a function call. A closing `}` for a block
+  is different from a closing `}` for an object, type literal, import list, or
+  destructuring pattern.
+- The TSX-specific self-review must confirm there are no common Prettier-style
+  React component declarations with a multi-line destructured parameter.
+- The TypeScript/TSX self-review must confirm multi-line function declaration
+  parameter `)` placement follows the detailed parameter-list rules below.
+- The TypeScript/TSX self-review must confirm call-expression `)` is never at
+  the beginning of a line.
+- The TypeScript/TSX self-review must confirm
+  object/type/import/destructuring `}` is not at the beginning of a line.
+- The TypeScript/TSX self-review must confirm multi-line
+  function/lambda/callback/block `}` is on its own line and never at the end
+  of the previous line.
+- The TypeScript/TSX self-review must confirm array `]` is not at the
+  beginning of a line.
+- The TSX-specific self-review must confirm JSX closing markers and closing
+  parentheses keep the surrounding compact style.
+- The TypeScript/TSX self-review must confirm leading block indentation uses
+  2 spaces per level, wrapped continuations use the repository's 4-space
+  continuation alignment, and complete leading runs of 8 spaces may be
+  compressed to tabs.
 - For long Tailwind `className` strings, wrap across lines only when needed.
-- Keep continuation indentation aligned with the 4-space logical indentation
-  rule, using tabs only as leading 8-space compression.
+- Keep continuation indentation aligned with the repository's 4-space
+  continuation rule while keeping block indentation at 2 spaces.
+- Keep short value imports from one module on one line when they fit within
+  99 characters.
+- In TypeScript and TSX function declarations, including `const` arrow
+  function declarations, classify the parameter list before placing the closing
+  `)`.
+- Block indentation example:
+
+```ts
+const Component = () => {
+  const value = loadValue ()
+
+  useEffect (() => {
+    if (value != null)
+      useValue (value)
+  }, [value])
+}
+```
+
+- Continuation indentation example:
+
+```ts
+const editingRow =
+    Number.isFinite (editingSourceRow)
+    ? rows.find (_1 => _1.sourceRow === editingSourceRow) ?? null
+    : null
+```
+
+- Import grouping example:
+
+```ts
+import { useNavigate, useParams, useSearchParams } from 'react-router-dom'
+
+import { loadPostImportSession } from '@/lib/postImportSession'
+
+import type { FC } from 'react'
+
+import type { PostImportRow } from '@/lib/postImportSession'
+```
+
+- Inline props type example:
+
+```ts
+const Footer = (
+    { loading,
+      onSubmit }: { loading:  boolean
+		    onSubmit: () => void },
+) => null
+```
+
+- Ternary grouping example:
+
+```ts
+const rows =
+    repairMode === 'failed'
+    ? (
+	[...source].sort ((a, b) => {
+	  const aFailed = a.failed ? 0 : 1
+	  const bFailed = b.failed ? 0 : 1
+	  return aFailed - bFailed
+	}))
+    : source
+```
+
+- If the parameter list itself is given its own multi-line block after the
+  function's opening `(`, put the closing parameter `)` at the beginning of its
+  own line before the return type or `=>`.
+- If the only line break is inside a parameter's inline type, object type, or
+  destructuring shape, and the parameter list itself is not split as a separate
+  block, keep the closing parameter `)` on the same line as that parameter's
+  final `}`. In this case, moving `)` to a new line is wrong.
+- Do not write React component declarations in the common Prettier form
+  `const Component = ({ ... }) => (` when the destructured parameter spans
+  multiple lines. Use the project form with the opening `(` after `=`, the
+  destructured object as the argument, and the closing parameter `)` on its own
+  line before `=>`.
+- In TypeScript and TSX, never place a closing parenthesis at the beginning of
+  a line except for a multi-line function declaration parameter list.
+- Never place a closing square bracket at the beginning of a line.
+- For object literals, type literals, import/export named bindings, destructuring
+  patterns, and other associative-array-style braces, do not place the closing
+  brace at the beginning of a line. Keep `}` on the same line as the final
+  property, binding, or specifier unless that would violate the line limit.
+  Function, lambda, callback, and block closing braces are exempt and should
+  stay on their own line when that fits the local style. When a function,
+  lambda, callback, or block body spans multiple lines, do not put its closing
+  `}` at the end of the previous line.
+- For arrays and tuple-like lists, do not place the closing `]` at the
+  beginning of a line. Keep `]` on the same line as the final element unless
+  that would violate the line limit.
+- For function and method calls, do not place the closing `)` at the beginning
+  of a line. The only TypeScript/TSX exception is the closing parameter `)` of a
+  multi-line function declaration.
 - Do not add braces around `if`, `else`, or `for` bodies when the body is a
   single physical line.
 - Always add braces around `if`, `else`, or `for` bodies when the body spans
   two or more physical lines, even if it is one statement.
+- Use correct British English spelling for new identifiers, filenames,
+  component names, helper names, comments, and developer-facing prose unless
+  editing an already established American-English API that must keep its
+  existing spelling for compatibility.
+- Prefer British English spellings such as `behaviour`, `colour`, `realise`,
+  `theatre`, `centre`, `favourite`, `optimise`, and `catalogue`.
+- Avoid American or Canadian spellings such as `behavior`, `color`, `realize`,
+  `theater`, `center`, `favorite`, `optimize`, and `catalog`.
+- Even when an external library or API uses the wrong spelling, prefer to
+  correct it at the local boundary and use proper British English names in this
+  frontend codebase. For example, prefer
+  `import { color: colour } from '@external-lib'` over spreading `color`
+  through local code.
+- Apply the same boundary correction to object destructuring, wrapper helpers,
+  adapter layers, and local variable names when doing so does not break the
+  external contract.
+- In this frontend, prefer names such as `BehaviourSettingsSection.tsx`, not
+  `BehaviorSettingsSection.tsx`.
 - Avoid reformatting unrelated JSX.
 
+## Shared frontend systems
+
+Before creating a new component, hook, helper, store, context, or other
+frontend abstraction, search at least:
+
+- `src/components/common`
+- `src/components/layout`
+- `src/components/ui`
+- `src/components/dialogues`
+- `src/lib`
+- `src/lib/dialogues`
+- `src/stores`
+- `src/types.ts`
+
+Also inspect the existing pages and components in the same feature.
+
+Search by responsibility, not by filename alone. Check display, interaction,
+state, communication, validation, and permission behaviour before deciding that
+an existing implementation is unsuitable.
+
+### Component placement and reuse order
+
+When adding UI, use this order:
+
+1. reuse an existing feature component
+2. reuse an existing component from `components/common`
+3. reuse an existing layout component from `components/layout`
+4. use an existing primitive from `components/ui` through the established
+   common API
+5. extend an existing component minimally
+6. add a feature-local component in the feature area
+7. add a new common component only when multiple features clearly share a
+   stable visual contract
+
+Do not place a one-screen component in a common directory merely because its
+name starts with `Common`.
+
+### Low-level primitives
+
+Treat `components/ui` as low-level primitives. If a higher-level common API
+already exists for dialogues, toast, form validation, navigation, or similar
+behaviour, feature code must use that API instead of assembling primitives
+directly.
+
+Examples of existing preferred entrypoints include:
+
+- dialogue: `@/lib/dialogues/useDialogue`
+- toast: the existing toast API
+- internal navigation: `PrefetchLink`
+- form errors: `FieldError`, `FieldWarning`, `FormField`
+- buttons: `Button`
+- conditional class merge: `cn`
+
+Do not evade the rule with aliases or thin wrappers around the low-level
+primitive.
+
+### Dialogues
+
+Feature-facing dialogue work must use `@/lib/dialogues/useDialogue`.
+
+Reuse the existing common dialogue API and common dialogue component. Do not
+import `@/components/ui/dialog` directly in feature code to assemble bespoke
+dialogue shells, and do not evade this rule with aliases such as
+`Dialog as Dialogue`.
+
+Do not reimplement overlay, portal, close button, header, footer, focus
+handling, Escape handling, outside-click handling, or confirmation flow in
+feature code.
+
+Keep business-specific form content in feature code, and keep the visual and
+behavioural dialogue shell in common code.
+
+Use British spelling `Dialogue` for project-defined dialogue identifiers. Keep
+exact third-party spellings only at the external boundary where compatibility
+requires them.
+
+### API calls
+
+Rails API calls must use `src/lib/api.ts`.
+
+Do not create feature-local Axios instances, fetch wrappers, header injectors,
+camelCase converters, or generic error converters. If blob or other special
+transport behaviour is already supported by the common API, use the existing
+options instead of bypassing the wrapper.
+
+### Query keys, server state, and prefetch
+
+Before adding query state, inspect:
+
+- `src/lib/queryKeys.ts`
+- existing domain helpers
+- existing prefetchers
+- the root query-key hierarchy
+- current mutation invalidation patterns
+- the app-wide `QueryClient`
+
+Do not write ad hoc query-key arrays in feature code. Do not duplicate fetcher,
+prefetcher, or invalidation helpers for the same resource.
+
+### Domain helpers
+
+For posts, tags, wiki, materials, and other domain work, inspect the existing
+helpers in `src/lib/*.ts` before adding logic to a page component.
+
+Do not accumulate these in page components when an existing helper layer should
+own them:
+
+- API request construction
+- response-shape conversion
+- query-key construction
+- canonical URL generation
+- permission calculation
+- storage serialisation
+- domain-specific parsing
+
+Keep purely local one-screen display shaping local when that is the clearest
+place for it.
+
+### Permission helpers
+
+Use the existing permission helpers such as `src/lib/users.ts` when deciding
+editability, role checks, admin/member visibility, and similar UI behaviour.
+
+Do not scatter `user?.role`, numeric role comparisons, or string comparisons
+through components. Frontend visibility control should be consistent even though
+backend authorization remains the final gate.
+
+### Validation errors
+
+Before adding feature-local validation-error handling, inspect:
+
+- `useValidationErrors`
+- `apiErrors`
+- `FieldError`
+- `FieldWarning`
+- `FormField`
+- `inputClass`
+
+Do not create a new generic hook, field-error state shape, or error-rendering
+component for a pattern the shared error stack already covers. Keep only
+genuinely feature-specific business errors local.
+
+### Forms and fields
+
+Before creating a new input, textarea, date/time field, tag input, label, or
+error layout, inspect at least:
+
+- `Form`
+- `FormField`
+- `FieldError`
+- `FieldWarning`
+- `DateTimeField`
+- `TagInput`
+- `TextArea`
+- `Label`
+- `Button`
+
+Do not create a same-function field component merely because the spacing or
+surface styling is slightly different. Prefer feature-level composition over
+bloated common-field option lists.
+
+### Navigation and prefetch
+
+Use `PrefetchLink` and existing router helpers for internal navigation. Do not
+introduce feature-local `<a>`, `window.location`, or custom prefetch logic for
+internal routes. Keep path-segment encoding aligned with the existing rules.
+
+### State management
+
+Before adding state, decide whether the source of truth should be:
+
+- component-local state
+- URL search params
+- TanStack Query server state
+- an existing Zustand store
+- an existing event bus
+- an existing storage helper
+
+Do not create a new global store, context, or event bus for one screen when
+local state or an existing mechanism is enough. Do not create a second store
+for the same responsibility.
+
+### Storage and settings
+
+When touching localStorage, sessionStorage, or user settings, inspect existing
+settings helpers, storage helpers, expiry handling, versioning, and sanitisers.
+
+Do not reimplement per-component key naming, JSON parsing and serialisation,
+expiry, or schema checks when a shared helper already owns the pattern.
+
+### Hooks
+
+Before creating a custom hook, search existing `src/lib/use*.ts` and
+`src/lib/use*.tsx`.
+
+Hooks are for shared stateful behaviour or React lifecycle integration. Do not
+turn a pure function, one-off helper, or mere re-export shim into `useFoo`.
+
+### Stores, contexts, and event buses
+
+Add a new store, context, or event bus only when the current mechanisms cannot
+express the requirement and there are multiple genuinely separate consumers.
+
+Do not hold the same information redundantly across URL state, query cache,
+local component state, Zustand, and an event bus. Keep one source of truth.
+
+### Types
+
+If a domain type already exists in `src/types.ts` or a domain helper, reuse it
+instead of redefining the same shape in a feature file.
+
+Small local props and draft types may stay local. Do not create giant
+catch-all type files such as `CommonTypes.ts`.
+
+### Styling utilities
+
+Use existing styling utilities such as `cn` and `inputClass`.
+
+Do not add feature-local class-merge helpers, generic status-colour mappers, or
+responsive wrapper helpers when a shared utility already exists. Keep common
+tone names visual only; feature-specific state names stay in feature code.
+
+### Layout
+
+Before adding page shells, padding rules, viewport-height handling, sidebar
+offsets, or footer offsets, inspect existing layout components such as
+`MainArea`, top navigation, sidebar, page title, and section-title patterns.
+
+Do not create a second layout shell before checking whether the current layout
+can be reused or minimally extended.
+
+### Delimiter decision table
+
+Use this table before accepting any edited TypeScript or TSX hunk. The table is
+more authoritative than formatter habit. Unless a subsection explicitly
+mentions JSX, it applies equally to `.ts` and `.tsx`.
+
+#### Import and export named bindings
+
+Bad:
+
+```ts
+import {
+    Button,
+    Card,
+} from '@/components/ui'
+```
+
+Good:
+
+```ts
+import { Button,
+	 Card } from '@/components/ui'
+```
+
+Also acceptable when short:
+
+```ts
+import { Button, Card } from '@/components/ui'
+```
+
+Rule: named-binding `}` is associative-array-style syntax. It must not be alone
+at the beginning of a line. Prefer keeping `{` with the first binding and `}`
+with the final binding when this fits the line limit.
+
+#### Type literals
+
+Bad:
+
+```ts
+type Props = {
+    open: boolean
+    onOpenChange: (open: boolean) => void
+}
+```
+
+Good:
+
+```ts
+type Props = {
+    open: boolean
+    onOpenChange: (open: boolean) => void }
+```
+
+Rule: type-literal `}` is not a block close. It must stay on the same line as
+the final property unless that would break the hard line limit.
+
+#### Object literals
+
+Bad:
+
+```ts
+const value = {
+    open,
+    activeScope,
+}
+```
+
+Good:
+
+```ts
+const value = {
+    open,
+    activeScope }
+```
+
+Bad:
+
+```ts
+const value = useMemo (() => ({
+    open,
+    activeScope,
+}), [open, activeScope])
+```
+
+Good:
+
+```ts
+const value = useMemo (() => ({
+    open,
+    activeScope }), [open, activeScope])
+```
+
+Rule: object-literal `}` is associative-array-style syntax. It must not be on a
+line by itself. Keep it with the final property, and keep call `)` off the
+beginning of a line.
+
+#### Destructuring parameters
+
+Bad:
+
+```tsx
+const Component: FC<Props> = ({
+    open,
+    onOpenChange,
+}) => {
+  return null
+}
+```
+
+Good:
+
+```tsx
+const Component: FC<Props> = (
+    { open,
+      onOpenChange },
+) => {
+  return null
+}
+```
+
+Rule: when a React component or helper takes a destructured object parameter
+that spans multiple lines, do not use the Prettier-style `= ({ ... }) =>`
+shape. Put the function parameter list on its own lines. The destructuring `}`
+stays with the final binding. The parameter-list `)` is then allowed and
+required at the beginning of its own line.
+
+#### Inline typed destructuring parameter
+
+Good:
+
+```ts
+const RouteTransitionWrapper = ({ user, setUser }: {
+    user:     User | null
+    setUser:  Dispatch<SetStateAction<User | null>> }) => {
+  return null
+}
+```
+
+Bad:
+
+```ts
+const RouteTransitionWrapper = ({ user, setUser }: {
+    user:     User | null
+    setUser:  Dispatch<SetStateAction<User | null>>
+}) => {
+  return null
+}
+```
+
+Rule: this is not a separately split parameter-list block. The line break is
+inside the inline type. Keep the type-literal `}` and parameter-list `)` on the
+same line as the final type property.
+
+#### Multi-line normal parameter list
+
+Bad:
+
+```ts
+const updateDraft = <Key extends keyof Settings,> (
+    key: Key,
+    value: Settings[Key]) => {
+  return null
+}
+```
+
+Good:
+
+```ts
+const updateDraft = <Key extends keyof Settings,> (
+    key:    Key,
+    value:  Settings[Key],
+) => {
+  return null
+}
+```
+
+Rule: when the parameter list itself is split across multiple parameter lines,
+the closing parameter `)` goes at the beginning of its own line before `=>` or
+the return type.
+
+#### Function and callback blocks
+
+Bad:
+
+```ts
+const handleSave = () => { save ()
+}
+```
+
+Bad:
+
+```ts
+const handleSave = () => {
+  save () }
+```
+
+Good:
+
+```ts
+const handleSave = () => {
+  save ()
+}
+```
+
+Rule: block `}` closes executable code, not associative data. Multi-line
+function, lambda, callback, `if`, `for`, `switch`, and similar block braces
+belong on their own line.
+
+#### Function and method calls
+
+Bad:
+
+```ts
+const value = compute (
+    first,
+    second
+)
+```
+
+Good:
+
+```ts
+const value = compute (
+    first,
+    second)
+```
+
+Rule: call-expression `)` must not be at the beginning of a line. The exception
+for leading `)` applies only to function declaration parameter lists, never to
+calls.
+
+#### JSX closing markers
+
+Bad:
+
+```tsx
+<Button
+    type="button"
+    onClick={handleSave}
+>
+  保存
+</Button>
+)
+```
+
+Good:
+
+```tsx
+<Button
+    type="button"
+    onClick={handleSave}>
+  保存
+</Button>)
+```
+
+Bad:
+
+```tsx
+<Input
+    value={value}
+    onChange={handleChange}
+/>
+```
+
+Good:
+
+```tsx
+<Input
+    value={value}
+    onChange={handleChange}/>
+```
+
+Rule: keep `>` or `/>` with the final prop, and keep JSX closing parentheses in
+the local compact form such as `</div>)`.
+
+#### Arrays and tuples
+
+Bad:
+
+```ts
+const items = [
+    first,
+    second,
+]
+```
+
+Good:
+
+```ts
+const items = [
+    first,
+    second]
+```
+
+Good when short:
+
+```ts
+const items = [first, second]
+```
+
+Rule: array and tuple `]` must not be at the beginning of a line. Keep it with
+the final element unless that would break the hard line limit.
+
+#### Single-line braces
+
+Good:
+
+```ts
+const next = { ...current, enabled: true }
+const tag = { id, name }
+```
+
+Bad:
+
+```tsx
+<Component prop={ value }/>
+```
+
+Good:
+
+```tsx
+<Component prop={value}/>
+```
+
+Rule: JavaScript object braces on one line get one inner space. JSX expression
+braces do not get inner spaces.
+
+#### Final TSX self-review checklist
+
+Before reporting completion after a TypeScript or TSX edit, check the edited
+hunks line by line:
+
+1. No import/export/type/object/destructuring `}` appears alone at the beginning
+   of a line.
+2. No call-expression `)` appears at the beginning of a line.
+3. Any leading `)` is definitely closing a function declaration parameter list,
+   not a call.
+4. Any parameter-list `)` at the end of a line is valid because the parameter
+   list itself was not split, only an inline type or destructuring shape was.
+5. No array or tuple `]` appears at the beginning of a line.
+6. Multi-line executable block `}` is on its own line.
+7. JSX `>` and `/>` stay with the final prop unless nearby code proves
+   otherwise.
+8. JSX closing parentheses keep the compact local style.
+9. Leading block indentation uses 2 spaces per level, wrapped continuations
+   use the repository's 4-space continuation alignment, and complete leading
+   runs of 8 spaces may be compressed to tabs.
+10. No line has trailing whitespace.
+
 ## Lint and build constraints
 
 - ESLint uses `@eslint/js`, `typescript-eslint`, `eslint-plugin-react-hooks`,

frontend/src/App.tsx

@@ -1,5 +1,5 @@
-import { AnimatePresence, LayoutGroup, motion } from 'framer-motion'
-import { useEffect, useState } from 'react'
+import { AnimatePresence, LayoutGroup, MotionConfig, motion } from 'framer-motion'
+import { Fragment, useEffect, useMemo, useState } from 'react'
 import { BrowserRouter,
 	 Navigate,
 	 Route,
@@ -12,6 +12,20 @@ import TopNav from '@/components/TopNav'
 import DialogueProvider from '@/components/dialogues/DialogueProvider'
 import { Toaster } from '@/components/ui/toaster'
 import { apiPost, isApiError } from '@/lib/api'
+import { applyClientAnimationMode,
+	 applyClientAppearance,
+	 type ClientAnimationMode,
+	 fetchUserThemeSlots,
+	 fetchUserSettings,
+	 getClientThemeMode,
+	 hasStoredClientThemeSelection,
+	 normaliseUserThemeSlots,
+	 setCachedUserThemeSlots,
+	 seedClientThemeMode } from '@/lib/settings'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
+import { UnsavedChangesGuardProvider } from '@/lib/useUnsavedChangesGuard'
+
+import { KeyboardShortcutsProvider } from '@/lib/useKeyboardShortcuts'
 import DeerjikistDetailPage from '@/pages/deerjikists/DeerjikistDetailPage'
 import MaterialBasePage from '@/pages/materials/MaterialBasePage'
 import MaterialDetailPage from '@/pages/materials/MaterialDetailPage'
@@ -27,6 +41,9 @@ import NotFound from '@/pages/NotFound'
 import TOSPage from '@/pages/TOSPage.mdx'
 import PostDetailPage from '@/pages/posts/PostDetailPage'
 import PostHistoryPage from '@/pages/posts/PostHistoryPage'
+import PostImportResultPage from '@/pages/posts/PostImportResultPage'
+import PostImportReviewPage from '@/pages/posts/PostImportReviewPage'
+import PostImportSourcePage from '@/pages/posts/PostImportSourcePage'
 import PostListPage from '@/pages/posts/PostListPage'
 import PostNewPage from '@/pages/posts/PostNewPage'
 import PostSearchPage from '@/pages/posts/PostSearchPage'
@@ -48,17 +65,63 @@ import type { Dispatch, FC, SetStateAction } from 'react'
 import type { User } from '@/types'
 
 
-const RouteTransitionWrapper = ({ user, setUser }: {
+const RouteTransitionWrapper = ({ animationMode, user, setUser }: {
+    animationMode: ClientAnimationMode
     user:     User | null
     setUser:  Dispatch<SetStateAction<User | null>> }) => {
   const location = useLocation ()
 
+  if (animationMode === 'off')
+    {
+      return (
+	  <Routes location={location}>
+	    <Route path="/" element={<Navigate to="/posts" replace/>}/>
+	    <Route path="/posts" element={<PostListPage/>}/>
+	    <Route path="/posts/new" element={<PostNewPage user={user}/>}/>
+	    <Route path="/posts/import" element={<PostImportSourcePage user={user}/>}/>
+	    <Route path="/posts/import/:sessionId/review" element={<PostImportReviewPage user={user}/>}/>
+	    <Route path="/posts/import/:sessionId/result" element={<PostImportResultPage user={user}/>}/>
+	    <Route path="/posts/search" element={<PostSearchPage/>}/>
+	    <Route path="/posts/:id" element={<PostDetailRoute user={user}/>}/>
+	    <Route path="/posts/changes" element={<PostHistoryPage/>}/>
+	    <Route path="/tags" element={<TagListPage/>}/>
+	    <Route path="/tags/:id" element={<TagDetailPage/>}/>
+	    <Route path="/tags/:id/deerjikists" element={<DeerjikistDetailPage/>}/>
+	    <Route path="/tags/nico" element={<NicoTagListPage user={user}/>}/>
+	    <Route path="/nico/tags" element={<NicoTagListPage user={user}/>}/>
+	    <Route path="/tags/changes" element={<TagHistoryPage/>}/>
+	    <Route path="/theatres/:id" element={<TheatreDetailPage user={user}/>}/>
+	    <Route path="/materials" element={<MaterialBasePage/>}>
+	      <Route index element={<MaterialListPage/>}/>
+	      <Route path="changes" element={<MaterialHistoryPage/>}/>
+	      <Route path="new" element={<MaterialNewPage/>}/>
+	      <Route path="suppressions" element={<MaterialSyncSuppressionsPage/>}/>
+	      <Route path=":id" element ={<MaterialDetailPage/>}/>
+	    </Route>
+	    <Route path="/wiki" element={<WikiSearchPage/>}/>
+	    <Route path="/wiki/:title" element={<WikiDetailPage/>}/>
+	    <Route path="/wiki/new" element={<WikiNewPage user={user}/>}/>
+	    <Route path="/wiki/:id/edit" element={<WikiEditPage user={user}/>}/>
+	    <Route path="/wiki/:id/diff" element={<WikiDiffPage/>}/>
+	    <Route path="/wiki/changes" element={<WikiHistoryPage/>}/>
+	    <Route path="/users/settings" element={<SettingPage user={user} setUser={setUser}/>}/>
+	    <Route path="/settings" element={<Navigate to="/users/settings" replace/>}/>
+	    <Route path="/tos" element={<TOSPage/>}/>
+	    <Route path="/gekanator" element={<GekanatorPage user={user}/>}/>
+	    <Route path="/more" element={<MorePage/>}/>
+	    <Route path="*" element={<NotFound/>}/>
+	  </Routes>)
+    }
+
   return (
       <AnimatePresence mode="wait">
 	<Routes location={location}>
 	  <Route path="/" element={<Navigate to="/posts" replace/>}/>
 	  <Route path="/posts" element={<PostListPage/>}/>
 	  <Route path="/posts/new" element={<PostNewPage user={user}/>}/>
+	  <Route path="/posts/import" element={<PostImportSourcePage user={user}/>}/>
+	  <Route path="/posts/import/:sessionId/review" element={<PostImportReviewPage user={user}/>}/>
+	  <Route path="/posts/import/:sessionId/result" element={<PostImportResultPage user={user}/>}/>
 	  <Route path="/posts/search" element={<PostSearchPage/>}/>
 	  <Route path="/posts/:id" element={<PostDetailRoute user={user}/>}/>
 	  <Route path="/posts/changes" element={<PostHistoryPage/>}/>
@@ -103,6 +166,37 @@ const PostDetailRoute = ({ user }: { user: User | null }) => {
 const App: FC = () => {
   const [user, setUser] = useState<User | null> (null)
   const [status, setStatus] = useState (200)
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const LayoutWrapper = animationMode === 'off' ? Fragment : LayoutGroup
+
+  const appLayoutTransition = useMemo (
+      () => (
+	  animationMode === 'off'
+	  ? { duration: 0 }
+	  : animationMode === 'reduced'
+	    ? { duration: .08, ease: 'linear' as const }
+	    : { duration: .2, ease: 'easeOut' as const }
+      ),
+      [animationMode],
+  )
+
+  useEffect (() => {
+    applyClientAppearance ()
+
+    const mediaQuery = window.matchMedia ('(prefers-color-scheme: dark)')
+    const handleThemeChange = () => {
+      if (getClientThemeMode () === 'system')
+	applyClientAppearance ()
+    }
+
+    mediaQuery.addEventListener ('change', handleThemeChange)
+    return () => mediaQuery.removeEventListener ('change', handleThemeChange)
+  }, [])
+
+  useEffect (() => {
+    applyClientAnimationMode (animationMode)
+  }, [animationMode])
 
   useEffect (() => {
     const createUser = async () => {
@@ -137,6 +231,30 @@ const App: FC = () => {
       createUser ()
   }, [])
 
+  useEffect (() => {
+    if (!(user))
+      return
+
+    void (async () => {
+	try
+	{
+	  const [settings, themeSlots] = await Promise.all ([
+	      fetchUserSettings (),
+	      fetchUserThemeSlots (),
+	  ])
+	  const storedThemeSlots = normaliseUserThemeSlots (themeSlots)
+	  setCachedUserThemeSlots (storedThemeSlots)
+	  if (!(hasStoredClientThemeSelection ()))
+	    seedClientThemeMode (settings.theme)
+	  applyClientAppearance ()
+	}
+      catch
+      {
+	return
+      }
+    }) ()
+  }, [user])
+
   switch (status)
   {
   case 503:
@@ -150,17 +268,33 @@ const App: FC = () => {
 
 	<BrowserRouter>
 	  <DialogueProvider>
-	    <LayoutGroup>
-	      <motion.div
-		  layout="position"
-		  transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-		  className="relative flex flex-col h-dvh w-full overflow-y-hidden">
-		<TopNav user={user}/>
-		<RouteTransitionWrapper user={user} setUser={setUser}/>
-	      </motion.div>
-	    </LayoutGroup>
+	    <UnsavedChangesGuardProvider>
+	      <KeyboardShortcutsProvider>
+	      <MotionConfig
+		  reducedMotion={
+		      animationMode === 'normal'
+		      ? 'never'
+		      : animationMode === 'reduced'
+			? 'user'
+			: 'always'
+		  }>
+		<LayoutWrapper>
+		  <motion.div
+		      layout={animationMode === 'off' ? false : 'position'}
+		      transition={{ layout: appLayoutTransition }}
+		      className="relative flex flex-col h-dvh w-full overflow-y-hidden">
+		    <TopNav user={user}/>
+		    <RouteTransitionWrapper
+			animationMode={animationMode}
+			user={user}
+			setUser={setUser}/>
+		  </motion.div>
+		</LayoutWrapper>
+	      </MotionConfig>
 
-	    <Toaster/>
+	      <Toaster/>
+	      </KeyboardShortcutsProvider>
+	    </UnsavedChangesGuardProvider>
 	  </DialogueProvider>
 	</BrowserRouter>
       </>)

frontend/src/components/DraggableDroppableTagRow.test.tsx

@@ -0,0 +1,75 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+import DraggableDroppableTagRow from '@/components/DraggableDroppableTagRow'
+import { buildTag } from '@/test/factories'
+import { renderWithProviders } from '@/test/render'
+
+const dndKit = vi.hoisted (() => ({
+  useDraggable: vi.fn (),
+  useDroppable: vi.fn (),
+}))
+
+vi.mock ('@dnd-kit/core', () => dndKit)
+
+const tag = buildTag ({ id: 7, name: 'ドラッグ元', postCount: 3 })
+
+const renderRow = (activeDndId?: string) => {
+  renderWithProviders (
+      <DraggableDroppableTagRow
+          activeDndId={activeDndId}
+          tag={tag}
+          nestLevel={2}
+          pathKey="cat-general-7"
+          suppressClickRef={{ current: false }}/>,
+  )
+}
+
+const tagBody = (): HTMLElement => {
+  const link = document.querySelector<HTMLElement> ('a[title="ドラッグ元"]')
+
+  if (link == null)
+    throw new Error ('tag link not found')
+
+  const body = link.closest ('div')
+
+  if (body == null)
+    throw new Error ('tag body not found')
+
+  return body
+}
+
+describe ('DraggableDroppableTagRow', () => {
+  beforeEach (() => {
+    vi.clearAllMocks ()
+    dndKit.useDraggable.mockReturnValue ({
+        attributes: { 'aria-describedby': 'drag-source' },
+        listeners:  { onPointerDown: vi.fn () },
+        setNodeRef: vi.fn (),
+        transform:  null })
+    dndKit.useDroppable.mockReturnValue ({
+        isOver:     false,
+        setNodeRef: vi.fn () })
+  })
+
+  it ('passes dndId through draggable data for active-row tracking', () => {
+    renderRow ()
+
+    expect (dndKit.useDraggable).toHaveBeenCalledWith (
+        expect.objectContaining ({
+            id:   'tag-node:cat-general-7',
+            data: expect.objectContaining ({
+                dndId:     'tag-node:cat-general-7',
+                nestLevel: 2,
+                tagId:     7 }) }))
+  })
+
+  it ('hides only the active drag source from the explicit active dnd id', () => {
+    renderRow ('tag-node:cat-general-7')
+    expect (tagBody ()).toHaveStyle ({ visibility: 'hidden' })
+  })
+
+  it ('keeps inactive tag rows visible while another tag is dragged', () => {
+    renderRow ('tag-node:other')
+    expect (tagBody ()).toHaveStyle ({ visibility: 'visible' })
+  })
+})

frontend/src/components/DraggableDroppableTagRow.tsx

@@ -4,6 +4,8 @@ import { motion } from 'framer-motion'
 import { useRef } from 'react'
 
 import TagLink from '@/components/TagLink'
+import { clientAnimationTransition } from '@/lib/clientAnimation'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
 
 import type { CSSProperties, FC, MutableRefObject } from 'react'
@@ -11,6 +13,7 @@ import type { CSSProperties, FC, MutableRefObject } from 'react'
 import type { Tag } from '@/types'
 
 type Props = {
+    activeDndId?:      string
     tag:              Tag
     nestLevel:        number
     pathKey:          string
@@ -19,7 +22,21 @@ type Props = {
     sp?:              boolean }
 
 
-const DraggableDroppableTagRow: FC<Props> = ({ tag, nestLevel, pathKey, parentTagId, suppressClickRef, sp }) => {
+const DraggableDroppableTagRow: FC<Props> = ({
+    activeDndId,
+    tag,
+    nestLevel,
+    pathKey,
+    parentTagId,
+    suppressClickRef,
+    sp,
+}) => {
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const layoutTransition = clientAnimationTransition (
+      animationMode,
+      { normal: { duration: .2, ease: 'easeOut' as const } },
+  )
   const dndId = `tag-node:${ pathKey }`
 
   const downPosRef = useRef<{ x: number; y: number } | null> (null)
@@ -45,18 +62,23 @@ const DraggableDroppableTagRow: FC<Props> = ({ tag, nestLevel, pathKey, parentTa
   const { attributes,
 	  listeners,
 	  setNodeRef: setDragRef,
-	  transform,
-	  isDragging: dragging } = useDraggable ({ id:    dndId,
-						   data:  { kind:   'tag',
-							    tagId:  tag.id,
-							    parentTagId } })
+	  transform } = useDraggable ({ id:    dndId,
+					data:  { kind:   'tag',
+						 dndId,
+						 tagId:  tag.id,
+						 parentTagId,
+						 nestLevel } })
 
   const { setNodeRef: setDropRef, isOver: over } = useDroppable ({
       id:   dndId,
       data: { kind: 'tag', tagId: tag.id } })
 
+  const activeDragging = activeDndId === dndId
   const style: CSSProperties = { transform:   CSS.Translate.toString (transform),
-				 visibility:  dragging ? 'hidden' : 'visible' }
+				 visibility:  activeDragging ? 'hidden' : 'visible' }
+  const innerClassName = cn (
+      'inline-flex min-w-0 max-w-full items-baseline overflow-hidden',
+      sp && 'touch-pan-y')
 
   return (
       <div
@@ -69,12 +91,16 @@ const DraggableDroppableTagRow: FC<Props> = ({ tag, nestLevel, pathKey, parentTa
 	      return
 	    const dx = e.clientX - p.x
 	    const dy = e.clientY - p.y
+
 	    if (dx * dx + dy * dy >= 9)
 	      armEatNextClick ()
 	  }}
 	  onPointerUpCapture={() => {
 	    downPosRef.current = null
 	  }}
+	  onPointerCancelCapture={() => {
+	    downPosRef.current = null
+	  }}
 	  onClickCapture={e => {
 	    if (suppressClickRef.current)
 	      {
@@ -82,22 +108,35 @@ const DraggableDroppableTagRow: FC<Props> = ({ tag, nestLevel, pathKey, parentTa
 		e.stopPropagation ()
 	      }
 	  }}
-	  ref={node => {
-	    setDragRef (node)
-	    setDropRef (node)
-	  }}
-	  style={style}
+	  ref={setDropRef}
 	  className={cn (
 	      'min-w-0 max-w-full overflow-hidden rounded select-none',
+	      sp && 'touch-pan-y',
 	      over && 'ring-2 ring-offset-2')}
-	  {...attributes}
-	  {...listeners}>
-	<motion.div
-	    className="flex min-w-0 max-w-full items-baseline overflow-hidden"
-	    transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-	    layoutId={`tag-${ sp ? 'sp-' : '' }${ tag.id }`}>
-	  <TagLink tag={tag} nestLevel={nestLevel}/>
-	</motion.div>
+	  >
+	{activeDragging
+	 ? (
+	    <div
+		ref={setDragRef}
+		style={style}
+		className={innerClassName}
+		{...attributes}
+		{...listeners}>
+	      <TagLink tag={tag} nestLevel={nestLevel}/>
+	    </div>)
+	 : (
+	    <motion.div
+		ref={setDragRef}
+		style={style}
+		className={innerClassName}
+		{...attributes}
+		{...listeners}
+		transition={{ layout: layoutTransition }}
+		layoutId={animationMode === 'off'
+		    ? undefined
+		    : `tag-${ sp ? 'sp-' : '' }${ tag.id }`}>
+	      <TagLink tag={tag} nestLevel={nestLevel}/>
+	    </motion.div>)}
       </div>)
 }
 

frontend/src/components/PostEmbed.tsx

@@ -4,6 +4,8 @@ import YoutubeEmbed from 'react-youtube'
 import NicoViewer from '@/components/NicoViewer'
 import TwitterEmbed from '@/components/TwitterEmbed'
 import { useDialogue } from '@/components/dialogues/DialogueProvider'
+import { Button } from '@/components/ui/button'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 
 import type { FC, RefObject } from 'react'
 
@@ -24,16 +26,19 @@ type Props = {
     onError?:           (data: unknown) => void }
 
 
-const PostEmbed: FC<Props> = ({
-    ref,
-    post,
-    onLoadComplete,
-    onMetadataChange,
-    onVideoReady,
-    onPlaybackChange,
-    onError,
-}) => {
+const PostEmbed: FC<Props> = (
+    { ref,
+      post,
+      onLoadComplete,
+      onMetadataChange,
+      onVideoReady,
+      onPlaybackChange,
+      onError },
+) => {
   const dialogue = useDialogue ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const embedAutoLoadMode = behaviourSettings.embedAutoLoad ?? 'auto'
+  const [manualLoadRequested, setManualLoadRequested] = useState (false)
   const [framed, setFramed] = useState (false)
   const [youtubePlayer, setYoutubePlayer] = useState<YouTubePlayer | null> (null)
   const niconicoVideoReadyRef = useRef (false)
@@ -105,6 +110,10 @@ const PostEmbed: FC<Props> = ({
     niconicoVideoReadyRef.current = false
   }, [post.url])
 
+  useEffect (() => {
+    setManualLoadRequested (false)
+  }, [embedAutoLoadMode, post.url])
+
   useEffect (() => {
     if (!(youtubePlayer) || !(onPlaybackChange))
       return
@@ -117,6 +126,28 @@ const PostEmbed: FC<Props> = ({
   }, [onPlaybackChange, reportYoutubePlayback, youtubePlayer])
 
   const url = new URL (post.url)
+  const shouldLoadEmbed =
+      embedAutoLoadMode === 'auto'
+      || (
+	  embedAutoLoadMode === 'manual'
+	  && manualLoadRequested
+      )
+
+  const externalLink = (
+      <a href={post.url} target="_blank" rel="noreferrer">
+	外部ページを開く
+      </a>)
+
+  const manualLoadControl = (
+      <div className="flex flex-wrap items-center gap-3">
+	<Button
+	    type="button"
+	    variant="outline"
+	    onClick={() => setManualLoadRequested (true)}>
+	  埋め込みを読込
+	</Button>
+	{externalLink}
+      </div>)
 
   switch (url.hostname.split ('.').slice (-2).join ('.'))
   {
@@ -128,6 +159,11 @@ const PostEmbed: FC<Props> = ({
 
       const [videoId] = mVideoId
 
+      if (embedAutoLoadMode === 'off')
+	return externalLink
+      if (shouldLoadEmbed === false)
+	return manualLoadControl
+
       return (
 	  <NicoViewer
 	      ref={ref}
@@ -150,6 +186,11 @@ const PostEmbed: FC<Props> = ({
       const [userId] = mUserId
       const [statusId] = mStatusId
 
+      if (embedAutoLoadMode === 'off')
+	return externalLink
+      if (shouldLoadEmbed === false)
+	return manualLoadControl
+
       return <TwitterEmbed userId={userId} statusId={statusId}/>
     }
 
@@ -159,6 +200,11 @@ const PostEmbed: FC<Props> = ({
       if (!(videoId))
 	break
 
+      if (embedAutoLoadMode === 'off')
+	return externalLink
+      if (shouldLoadEmbed === false)
+	return manualLoadControl
+
       return (
 	  <YoutubeEmbed videoId={videoId} opts={{ playerVars: {
 	      playsinline:  1,
@@ -184,6 +230,11 @@ const PostEmbed: FC<Props> = ({
 		height={360}/>)
 	 : (
 	    <div>
+	      {embedAutoLoadMode === 'off'
+	       ? externalLink
+	       : embedAutoLoadMode === 'manual' && shouldLoadEmbed === false
+		 ? manualLoadControl
+		 : (
 	      <a href="#" onClick={async e => {
 		e.preventDefault ()
 
@@ -197,7 +248,7 @@ const PostEmbed: FC<Props> = ({
 		    confirmText: '表示' }))
 	      }}>
 		外部ページを表示
-	      </a>
+	      </a>)}
 	    </div>)}
       </>)
 }

frontend/src/components/PostFormTagsArea.tsx

@@ -68,9 +68,12 @@ const PostFormTagsArea: FC<Props> = ({ tags, setTags, errors, ...rest }) => {
 
     setBounds ({ start, end })
 
-    const data = await apiGet<Tag[]> ('/tags/autocomplete', { params: { q: token, nico: '0' } })
-    setSuggestions (data.filter (t => t.postCount > 0))
-    setSuggestionsVsbl (suggestions.length > 0)
+    const data = await apiGet<Tag[]> ('/tags/autocomplete', { params: {
+	q: token,
+	nico: '0' } })
+    const nextSuggestions = data.filter (t => t.postCount > 0)
+    setSuggestions (nextSuggestions)
+    setSuggestionsVsbl (nextSuggestions.length > 0)
   }
 
   return (

frontend/src/components/PostList.tsx

@@ -3,6 +3,7 @@ import { useRef } from 'react'
 import { useLocation } from 'react-router-dom'
 
 import PrefetchLink from '@/components/PrefetchLink'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
 import { useSharedTransitionStore } from '@/stores/sharedTransitionStore'
 
@@ -16,6 +17,15 @@ type Props = { posts:     Post[]
 
 const PostList: FC<Props> = ({ posts, onClick }) => {
   const location = useLocation ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const thumbnailMode = behaviourSettings.thumbnailMode ?? 'normal'
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const cardLayoutTransition =
+      animationMode === 'off'
+      ? { duration: 0 }
+      : animationMode === 'reduced'
+	? { duration: .08, ease: 'linear' as const }
+	: { duration: .2, ease: 'easeOut' as const }
 
   const setForLocationKey = useSharedTransitionStore (s => s.setForLocationKey)
 
@@ -39,7 +49,8 @@ const PostList: FC<Props> = ({ posts, onClick }) => {
 		  }}>
 		<motion.div
 		    ref={cardRef}
-		    layoutId={layoutId}
+		    layout={animationMode === 'off' ? false : true}
+		    layoutId={animationMode === 'off' ? undefined : layoutId}
 		    className={cn ('w-full h-full overflow-hidden rounded-xl shadow',
 				   'transform-gpu will-change-transform',
 				   (post.childPosts ?? []).length > 0 && 'ring-4 ring-green-500',
@@ -54,22 +65,36 @@ const PostList: FC<Props> = ({ posts, onClick }) => {
 		    }}
 		    onLayoutAnimationComplete={() => {
 		      if (!(cardRef.current))
-			return 
+			return
 
 		      cardRef.current.style.zIndex = ''
 		      cardRef.current.style.position = ''
 		    }}
-		    transition={{ layout: { duration: .2, ease: 'easeOut' } }}>
-		  <img src={post.thumbnail || post.thumbnailBase || undefined}
-		       alt={post.title || post.url}
-		       title={post.title || post.url || undefined}
-		       loading={i < 12 ? 'eager' : 'lazy'}
-		       decoding="async"
-		       className="object-cover w-full h-full"/>
+		    transition={{ layout: cardLayoutTransition }}>
+		  {thumbnailMode === 'off'
+		   ? (
+		      <div className="flex h-full w-full items-center justify-center
+				      bg-muted text-center text-xs text-muted-foreground">
+			サムネイルなし
+		      </div>)
+		   : (
+		      <img
+			  src={post.thumbnail || post.thumbnailBase || undefined}
+			  alt={post.title || post.url}
+			  title={post.title || post.url || undefined}
+			  loading={
+			      thumbnailMode === 'light'
+			      ? 'lazy'
+			      : i < 12
+				? 'eager'
+				: 'lazy'
+			  }
+			  decoding="async"
+			  className="object-cover w-full h-full"/>)}
 		</motion.div>
 	      </PrefetchLink>)
 	})}
       </div>)
 }
 
-export default PostList
+export default PostList

frontend/src/components/PostOriginalCreatedTimeField.tsx

@@ -23,10 +23,10 @@ const PostOriginalCreatedTimeField: FC<Props> = (
     <FormField label="オリジナルの作成日時" messages={errors}>
       {({ describedBy, invalid }) => (
 	  <>
-	    <div className="my-1 flex">
-	      <div className="w-80">
+	    <div className="my-1 flex flex-col gap-2 sm:flex-row sm:items-start">
+	      <div className="min-w-0 flex-1">
 		<DateTimeField
-		    className="mr-2"
+		    className="w-full"
 		    disabled={disabled ?? false}
 		    aria-describedby={describedBy}
 		    aria-invalid={invalid}
@@ -49,6 +49,7 @@ const PostOriginalCreatedTimeField: FC<Props> = (
 	      </div>
 	      <div>
 		<Button
+		    type="button"
 		    className="bg-gray-600 text-white rounded"
 		    disabled={disabled}
 		    onClick={() => {
@@ -59,10 +60,10 @@ const PostOriginalCreatedTimeField: FC<Props> = (
 	      </div>
 	    </div>
 
-	    <div className="my-1 flex">
-	      <div className="w-80">
+	    <div className="my-1 flex flex-col gap-2 sm:flex-row sm:items-start">
+	      <div className="min-w-0 flex-1">
 		<DateTimeField
-		    className="mr-2"
+		    className="w-full"
 		    disabled={disabled}
 		    aria-describedby={describedBy}
 		    aria-invalid={invalid}
@@ -73,6 +74,7 @@ const PostOriginalCreatedTimeField: FC<Props> = (
 	      </div>
 	      <div>
 		<Button
+		    type="button"
 		    className="bg-gray-600 text-white rounded"
 		    disabled={disabled}
 		    onClick={() => {

frontend/src/components/PrefetchLink.tsx

@@ -5,6 +5,8 @@ import { createPath, useNavigate } from 'react-router-dom'
 
 import { useOverlayStore } from '@/components/RouteBlockerOverlay'
 import { prefetchForURL } from '@/lib/prefetchers'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
+import { useUnsavedChangesGuard } from '@/lib/useUnsavedChangesGuard'
 import { cn } from '@/lib/utils'
 
 import type { AnchorHTMLAttributes, MouseEvent, TouchEvent } from 'react'
@@ -33,10 +35,20 @@ export default forwardRef<HTMLAnchorElement, Props> (({
 
   const navigate = useNavigate ()
   const qc = useQueryClient ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const { confirmDiscardNavigation } = useUnsavedChangesGuard ()
+  const linkPreloadMode = behaviourSettings.linkPreload ?? 'intent'
+  const path = useMemo (
+      () => typeof to === 'string' ? to : createPath (to),
+      [to],
+  )
   const url = useMemo (() => {
-    const path = (typeof to === 'string') ? to : createPath (to)
-    return (new URL (path, location.origin)).toString ()
-  }, [to])
+    return (new URL (path, window.location.origin)).toString ()
+  }, [path])
+  const nextPathname = useMemo (
+      () => (new URL (path, window.location.origin)).pathname,
+      [path],
+  )
   const setOverlay = useOverlayStore (s => s.setActive)
 
   const doPrefetch = async () => {
@@ -54,11 +66,15 @@ export default forwardRef<HTMLAnchorElement, Props> (({
 
   const handleMouseEnter = async (ev: MouseEvent<HTMLAnchorElement>) => {
     onMouseEnter?.(ev)
+    if (ev.defaultPrevented || linkPreloadMode !== 'intent')
+      return
     await doPrefetch ()
   }
 
   const handleTouchStart = async (ev: TouchEvent<HTMLAnchorElement>) => {
     onTouchStart?.(ev)
+    if (ev.defaultPrevented || linkPreloadMode !== 'intent')
+      return
     await doPrefetch ()
   }
 
@@ -77,6 +93,13 @@ export default forwardRef<HTMLAnchorElement, Props> (({
 
       ev.preventDefault ()
 
+      if (nextPathname !== window.location.pathname)
+	{
+	  const confirmed = await confirmDiscardNavigation ()
+	  if (!(confirmed))
+	    return
+	}
+
       flushSync (() => {
 	setOverlay (true)
       })
@@ -99,7 +122,7 @@ export default forwardRef<HTMLAnchorElement, Props> (({
 
   return (
       <a ref={ref}
-	 href={typeof to === 'string' ? to : createPath (to)}
+	 href={path}
 	 onMouseEnter={handleMouseEnter}
 	 onTouchStart={handleTouchStart}
 	 onClick={handleClick}

frontend/src/components/ResponsiveMarqueeText.tsx

@@ -1,3 +1,4 @@
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
 import { useEffect, useRef, useState } from 'react'
 
@@ -20,6 +21,8 @@ const MIN_MARQUEE_OVERFLOW_PX = 1
 const ResponsiveMarqueeText: FC<Props> = (
     { text, className, truncateOnMobile = false, title },
 ) => {
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
   const outerRef = useRef<HTMLSpanElement | null> (null)
   const staticRef = useRef<HTMLSpanElement | null> (null)
   const animatedRef = useRef<HTMLSpanElement | null> (null)
@@ -98,6 +101,7 @@ const ResponsiveMarqueeText: FC<Props> = (
     const animated = animatedRef.current
     const canMarquee = (
         active
+        && animationMode !== 'off'
         && desktopMarqueeEnabled
         && overflowPx >= MIN_MARQUEE_OVERFLOW_PX
         && animated != null)
@@ -207,7 +211,7 @@ const ResponsiveMarqueeText: FC<Props> = (
       resetAnimated ()
       setMarqueeVisible (false)
     }
-  }, [active, desktopMarqueeEnabled, overflowPx, text])
+  }, [active, animationMode, desktopMarqueeEnabled, overflowPx, text])
 
   return (
       <span

frontend/src/components/TagDetailSidebar.tsx

@@ -1,11 +1,13 @@
 import { DndContext,
 	 DragOverlay,
+	 MeasuringStrategy,
 	 MouseSensor,
 	 TouchSensor,
+	 pointerWithin,
 	 useDroppable,
 	 useSensor,
 	 useSensors } from '@dnd-kit/core'
-import { restrictToWindowEdges } from '@dnd-kit/modifiers'
+import { restrictToWindowEdges, snapCenterToCursor } from '@dnd-kit/modifiers'
 import { useQueryClient } from '@tanstack/react-query'
 import { motion } from 'framer-motion'
 import { useEffect, useMemo, useRef, useState } from 'react'
@@ -20,18 +22,28 @@ import SidebarComponent from '@/components/layout/SidebarComponent'
 import { toast } from '@/components/ui/use-toast'
 import { CATEGORIES, CATEGORY_NAMES } from '@/consts'
 import { apiDelete, apiGet, apiPatch, apiPost } from '@/lib/api'
+import { clientAnimationTransition } from '@/lib/clientAnimation'
 import { postsKeys, tagsKeys } from '@/lib/queryKeys'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { dateString, originalCreatedAtString } from '@/lib/utils'
 
-import type { DragEndEvent } from '@dnd-kit/core'
+import type { CollisionDetection, DragEndEvent } from '@dnd-kit/core'
 import type { FC, MutableRefObject, ReactNode } from 'react'
 
 import type { Category, Post, TagWithSections } from '@/types'
 
 type TagByCategory = { [key in Category]: TagWithSections[] }
 
+const tagCollisionDetection: CollisionDetection = args => {
+  return pointerWithin (args)
+}
+
+const alwaysMeasureDroppables = {
+    droppable: { strategy: MeasuringStrategy.Always } } as const
+
 
 const renderTagTree = (
+    activeDndId:       string | undefined,
     tag:              TagWithSections,
     nestLevel:        number,
     path:             string,
@@ -43,6 +55,7 @@ const renderTagTree = (
   const self = (
       <li key={key} className="mb-1">
 	<DraggableDroppableTagRow
+	    activeDndId={activeDndId}
 	    tag={tag}
 	    nestLevel={nestLevel}
 	    pathKey={key}
@@ -56,11 +69,17 @@ const renderTagTree = (
       ...((tag.children
 	   ?.sort ((a, b) => a.name < b.name ? -1 : 1)
 	   .flatMap (child =>
-	      renderTagTree (child, nestLevel + 1, key, suppressClickRef, tag.id, sp)))
+	      renderTagTree (
+		  activeDndId,
+		  child,
+		  nestLevel + 1,
+		  key,
+		  suppressClickRef,
+		  tag.id,
+		  sp)))
 	  ?? [])]
 }
 
-
 const isDescendant = (
     root:     TagWithSections,
     targetId: number,
@@ -127,6 +146,37 @@ const buildTagByCategory = (post: Post): TagByCategory => {
 }
 
 
+const buildFlatTagByCategory = (
+    byCategory: TagByCategory,
+): TagByCategory => {
+  const tagsTmp = { } as TagByCategory
+  const seen = new Set<number> ()
+
+  for (const category of CATEGORIES)
+    tagsTmp[category] = []
+
+  const visit = (tag: TagWithSections) => {
+    if (seen.has (tag.id))
+      return
+
+    seen.add (tag.id)
+    tagsTmp[tag.category].push ({ ...tag, children: [] })
+
+    for (const child of tag.children ?? [])
+      visit (child)
+  }
+
+  for (const category of CATEGORIES)
+    for (const tag of byCategory[category] ?? [])
+      visit (tag)
+
+  for (const category of CATEGORIES)
+    tagsTmp[category].sort ((tagA, tagB) => tagA.name < tagB.name ? -1 : 1)
+
+  return tagsTmp
+}
+
+
 const changeCategory = async (
     tagId:    number,
     category: Category): Promise<void> => {
@@ -145,17 +195,47 @@ const DropSlot = ({ cat }: { cat: Category }) => {
       </li>)
 }
 
+const EmptyCategoryDropSection = (
+    { cat, children }: { cat: Category
+			 children: ReactNode }) => {
+  const { setNodeRef, isOver: over } = useDroppable ({
+      id:   `slot:${ cat }`,
+      data: { kind: 'slot', cat } })
+
+  return (
+      <div ref={setNodeRef} className="my-3">
+	{children}
+	<ul>
+	  <li className="h-1">
+	    {over && <div className="h-0.5 w-full rounded bg-sky-400"/>}
+	  </li>
+	</ul>
+      </div>)
+}
+
 
 type Props = {
     className?: string
     post:       Post
     sp?:        boolean }
 
+type ActiveTagDrag = {
+    dndId:       string
+    tagId:      number
+    nestLevel:  number }
+
 
 const TagDetailSidebar: FC<Props> = ({ className, post, sp }) => {
   sp = Boolean (sp)
 
   const qc = useQueryClient ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const tagRelationDisplay = behaviourSettings.tagRelationDisplay ?? 'grouped'
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const layoutTransition = clientAnimationTransition (
+      animationMode,
+      { normal: { duration: .2, ease: 'easeOut' as const } },
+  )
 
   const baseTags = useMemo<TagByCategory> (() => {
     const tagsTmp = { } as TagByCategory
@@ -173,10 +253,15 @@ const TagDetailSidebar: FC<Props> = ({ className, post, sp }) => {
     return tagsTmp
   }, [post])
 
-  const [activeTagId, setActiveTagId] = useState<number | null> (null)
+  const [activeTagDrag, setActiveTagDrag] = useState<ActiveTagDrag | null> (null)
   const [dragging, setDragging] = useState (false)
   const [saving, setSaving] = useState (false)
   const [tags, setTags] = useState (baseTags)
+  const flatTagsByCategory = useMemo<TagByCategory> (
+      () => buildFlatTagByCategory (tags),
+      [tags],
+  )
+  const activeDndId = activeTagDrag?.dndId
 
   const suppressClickRef = useRef (false)
 
@@ -285,9 +370,19 @@ const TagDetailSidebar: FC<Props> = ({ className, post, sp }) => {
 	<TagSearch/>
 	<DndContext
 	    sensors={sensors}
+	    collisionDetection={tagCollisionDetection}
+	    measuring={alwaysMeasureDroppables}
 	    onDragStart={e => {
 	      if (e.active.data.current?.kind === 'tag')
-		setActiveTagId (e.active.data.current?.tagId ?? null)
+		{
+		  const tagId = e.active.data.current?.tagId
+		  const nestLevel = e.active.data.current?.nestLevel
+		  const dndId = e.active.data.current?.dndId
+		  setActiveTagDrag (
+		      tagId == null || nestLevel == null || dndId == null
+		      ? null
+		      : { dndId, tagId, nestLevel })
+		}
 	      setDragging (true)
 	      suppressClickRef.current = true
 	      document.body.style.userSelect = 'none'
@@ -298,38 +393,80 @@ const TagDetailSidebar: FC<Props> = ({ className, post, sp }) => {
 		suppressClickRef.current = false}, { capture: true, once: true })
 	    }}
 	    onDragCancel={() => {
-	      setActiveTagId (null)
+	      setActiveTagDrag (null)
 	      setDragging (false)
 	      document.body.style.userSelect = ''
 	      suppressClickRef.current = false
 	    }}
 	    onDragEnd={async e => {
-	      setActiveTagId (null)
+	      setActiveTagDrag (null)
 	      setDragging (false)
 	      await onDragEnd (e)
 	      document.body.style.userSelect = ''
 	    }}
 	    modifiers={[restrictToWindowEdges]}>
-	  {CATEGORIES.map ((cat: Category) => ((tags[cat] ?? []).length > 0 || dragging) && (
-	      <div className="my-3" key={cat}>
+	  {CATEGORIES.map ((cat: Category) => {
+	    const categoryTags =
+		tagRelationDisplay === 'grouped'
+		? (tags[cat] ?? [])
+		: (flatTagsByCategory[cat] ?? [])
+
+	    if (!(categoryTags.length > 0 || dragging))
+	      return null
+
+	    const sectionTitle = (
 		<SubsectionTitle>
 		  <motion.div
-		      layoutId={`tag-${ sp ? 'sp-' : '' }${ cat }`}
-		      transition={{ layout: { duration: .2, ease: 'easeOut' } }}>
+		      layoutId={animationMode === 'off'
+			  ? undefined
+			  : `tag-${ sp ? 'sp-' : '' }${ cat }`}
+		      transition={{ layout: layoutTransition }}>
 		    {CATEGORY_NAMES[cat]}
 		  </motion.div>
-		</SubsectionTitle>
+		</SubsectionTitle>)
 
-		<ul>
-		  {(tags[cat] ?? []).flatMap (tag => (
-		      renderTagTree (tag, 0, `cat-${ cat }`, suppressClickRef, undefined, sp)))}
-		  <DropSlot cat={cat}/>
-		</ul>
-	      </div>))}
+	    if (!(categoryTags.length > 0))
+	      return (
+		  <EmptyCategoryDropSection cat={cat} key={cat}>
+		    {sectionTitle}
+		  </EmptyCategoryDropSection>)
+
+	    return (
+		<div className="my-3" key={cat}>
+		  {sectionTitle}
+		  <ul>
+		    {(tagRelationDisplay === 'grouped'
+		      ? (tags[cat] ?? []).flatMap (tag =>
+			    renderTagTree (
+				activeDndId,
+				tag,
+				0,
+				`cat-${ cat }`,
+				suppressClickRef,
+				undefined,
+				sp,
+			    ),
+			)
+		      : (flatTagsByCategory[cat] ?? []).map (tag => (
+			  <li key={`flat-${ cat }-${ tag.id }`} className="mb-1">
+			    <DraggableDroppableTagRow
+				activeDndId={activeDndId}
+				tag={tag}
+				nestLevel={0}
+				pathKey={`flat-${ cat }-${ tag.id }`}
+				suppressClickRef={suppressClickRef}
+				sp={sp}/>
+			  </li>)))}
+		    <DropSlot cat={cat}/>
+		  </ul>
+		</div>)
+	  })}
 	  {post && (
 	      <motion.div
-		  layoutId={`post-info-${ sp }`}
-		  transition={{ layout: { duration: .2, ease: 'easeOut' } }}>
+		  layoutId={animationMode === 'off'
+		      ? undefined
+		      : `post-info-${ sp }`}
+		  transition={{ layout: layoutTransition }}>
 		<SectionTitle>情報</SectionTitle>
 		<ul>
 		  <li>Id.: {post.id}</li>
@@ -366,11 +503,14 @@ const TagDetailSidebar: FC<Props> = ({ className, post, sp }) => {
 		</ul>
 	      </motion.div>)}
 
-	  <DragOverlay adjustScale={false}>
+	  <DragOverlay
+	      adjustScale={false}
+	      modifiers={[snapCenterToCursor]}
+	      dropAnimation={animationMode === 'off' ? null : undefined}>
 	    <div className="pointer-events-none">
-	      {activeTagId != null && (() => {
-		const tag = findTag (tags, activeTagId)
-		return tag && <TagLink tag={tag}/>
+	      {activeTagDrag != null && (() => {
+		const tag = findTag (tags, activeTagDrag.tagId)
+		return tag && <TagLink tag={tag} nestLevel={activeTagDrag.nestLevel}/>
 	      }) ()}
 	    </div>
 	  </DragOverlay>

frontend/src/components/TagLink.tsx

@@ -1,9 +1,8 @@
 import PrefetchLink from '@/components/PrefetchLink'
 import ResponsiveMarqueeText from '@/components/ResponsiveMarqueeText'
-import { LIGHT_COLOUR_SHADE, DARK_COLOUR_SHADE, TAG_COLOUR } from '@/consts'
 import { cn } from '@/lib/utils'
 
-import type { ComponentProps, FC, HTMLAttributes } from 'react'
+import type { ComponentProps, CSSProperties, FC, HTMLAttributes } from 'react'
 
 import type { Tag } from '@/types'
 
@@ -36,15 +35,16 @@ const TagLink: FC<Props> = ({ tag,
 			      withWiki  = true,
 			      withCount = true,
 			      className,
+			      style,
 			      title,
 			      ...props }) => {
-  const spanClass = cn (
-      `text-${ TAG_COLOUR[tag.category] }-${ LIGHT_COLOUR_SHADE }`,
-      `dark:text-${ TAG_COLOUR[tag.category] }-${ DARK_COLOUR_SHADE }`)
-  const linkClass = cn (
-      spanClass,
-      `hover:text-${ TAG_COLOUR[tag.category] }-${ LIGHT_COLOUR_SHADE - 200 }`,
-      `dark:hover:text-${ TAG_COLOUR[tag.category] }-${ DARK_COLOUR_SHADE - 200 }`)
+  const colourStyle = {
+      '--tag-link-colour': `var(--tag-colour-${ tag.category })`,
+      '--tag-link-hover-colour': `var(--tag-colour-${ tag.category }-hover)`,
+      ...style,
+  } as CSSProperties
+  const spanClass = 'tag-link-colour'
+  const linkClass = 'tag-link-colour tag-link-hover-colour'
   const textClass = 'group min-w-0 max-w-full overflow-hidden align-bottom'
   const rootClass =
       'inline-flex min-w-0 max-w-full flex-nowrap items-stretch align-baseline gap-x-1 md:items-baseline'
@@ -63,7 +63,8 @@ const TagLink: FC<Props> = ({ tag,
 		  ? (
 		      <PrefetchLink
 			  to={`/wiki/${ encodeURIComponent (tag.name) }`}
-			  className={linkClass}>
+			  className={linkClass}
+			  style={colourStyle}>
 			?
 		      </PrefetchLink>)
 		  : (
@@ -71,13 +72,15 @@ const TagLink: FC<Props> = ({ tag,
 		      ? (
 			  <PrefetchLink
 			      to={`/materials/${ tag.materialId }`}
-			      className={linkClass}>
+			      className={linkClass}
+			      style={colourStyle}>
 			    ?
 			  </PrefetchLink>)
 		      : (
 			  <PrefetchLink
 			      to={`/tags/${ tag.id }/deerjikists`}
-			      className={linkClass}>
+			      className={linkClass}
+			      style={colourStyle}>
 			    ?
 			  </PrefetchLink>)))
 	       : (
@@ -120,6 +123,7 @@ const TagLink: FC<Props> = ({ tag,
 	      <span
 		  title={textTitle}
 		  className={cn (spanClass, textClass, className)}
+		  style={colourStyle}
 		  {...props}>
 		<ResponsiveMarqueeText
 		    text={tag.matchedAlias}
@@ -134,6 +138,7 @@ const TagLink: FC<Props> = ({ tag,
 		to={`/posts?${ (new URLSearchParams ({ tags: tag.name })).toString () }`}
 		title={textTitle}
 		className={cn (linkClass, textClass, className)}
+		style={colourStyle}
 		{...props}>
 	      <ResponsiveMarqueeText
 		  text={tag.name}
@@ -144,6 +149,7 @@ const TagLink: FC<Props> = ({ tag,
 	    <span
 		  title={textTitle}
 		  className={cn (spanClass, textClass, className)}
+		  style={colourStyle}
 		  {...props}>
 	      <ResponsiveMarqueeText
 		  text={tag.name}

frontend/src/components/TagSearch.tsx

@@ -105,6 +105,7 @@ const TagSearch: FC = () => {
   return (
       <div className="relative w-full">
 	<input type="text"
+	       data-shortcut-focus-search="true"
 	       placeholder="タグ検索..."
 	       value={search}
 	       onChange={whenChanged}

frontend/src/components/TagSidebar.tsx

@@ -8,6 +8,8 @@ import SectionTitle from '@/components/common/SectionTitle'
 import SidebarComponent from '@/components/layout/SidebarComponent'
 import { CATEGORIES } from '@/consts'
 import { apiGet } from '@/lib/api'
+import { clientAnimationTransition } from '@/lib/clientAnimation'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 
 import type { FC, MouseEvent } from 'react'
 
@@ -21,6 +23,13 @@ type Props = { posts:     Post[]
 
 const TagSidebar: FC<Props> = ({ posts, onClick }) => {
   const navigate = useNavigate ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const animationsOff = animationMode === 'off'
+  const layoutTransition = clientAnimationTransition (
+      animationMode,
+      { normal: { duration: .2, ease: 'easeOut' as const } },
+  )
 
   const [tagsVsbl, setTagsVsbl] = useState (false)
   const [tags, setTags] = useState<TagByCategory> ({ })
@@ -65,12 +74,18 @@ const TagSidebar: FC<Props> = ({ posts, onClick }) => {
 	  {CATEGORIES.flatMap (cat => cat in tags ? (
 	      tags[cat].map (tag => (
 		  <li key={tag.id} className="mb-1 min-w-0 max-w-full overflow-hidden">
-		    <motion.div
-			className="flex min-w-0 max-w-full items-baseline overflow-hidden"
-			transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-			layoutId={`tag-${ tag.id }`}>
-		      <TagLink tag={tag} onClick={onClick}/>
-		    </motion.div>
+		    {animationsOff
+		     ? (
+			 <div className="flex min-w-0 max-w-full items-baseline overflow-hidden">
+			   <TagLink tag={tag} onClick={onClick}/>
+			 </div>)
+		     : (
+			 <motion.div
+			     className="flex min-w-0 max-w-full items-baseline overflow-hidden"
+			     transition={{ layout: layoutTransition }}
+			     layoutId={`tag-${ tag.id }`}>
+			   <TagLink tag={tag} onClick={onClick}/>
+			 </motion.div>)}
 		  </li>))) : [])}
 	</ul>
 	<SectionTitle>関聯</SectionTitle>
@@ -103,18 +118,25 @@ const TagSidebar: FC<Props> = ({ posts, onClick }) => {
 	  {posts.length > 0 && TagBlock}
 	</div>
 
-	<AnimatePresence initial={false}>
-	  {tagsVsbl && (
-	      <motion.div
-		  key="sptags"
-		  className="md:hidden overflow-hidden"
-		  initial={{ height: 0 }}
-		  animate={{ height: 'auto' }}
-		  exit={{ height: 0 }}
-		  transition={{ duration: .2, ease: 'easeOut' }}>
-		{posts.length > 0 && TagBlock}
-	      </motion.div>)}
-	</AnimatePresence>
+	{animationsOff
+	 ? (
+	     tagsVsbl && (
+		 <div className="md:hidden overflow-hidden">
+		   {posts.length > 0 && TagBlock}
+		 </div>))
+	 : (
+	     <AnimatePresence initial={false}>
+	       {tagsVsbl && (
+		   <motion.div
+		       key="sptags"
+		       className="md:hidden overflow-hidden"
+		       initial={{ height: 0 }}
+		       animate={{ height: 'auto' }}
+		       exit={{ height: 0 }}
+		       transition={layoutTransition}>
+		     {posts.length > 0 && TagBlock}
+		   </motion.div>)}
+	     </AnimatePresence>)}
 
 	<a href="#"
 	   className="md:hidden block my-2 text-center text-sm

frontend/src/components/TopNav.test.tsx

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+
+import { menuOutline } from '@/components/TopNav'
+import { buildUser } from '@/test/factories'
+
+const submenuItem = (role: 'guest' | 'member' | 'admin', section: string, item: string) => {
+  const menu = menuOutline ({
+    user: buildUser ({ role }),
+    wikiId: section === 'Wiki' ? 10 : null,
+    pathName: section === 'Wiki' ? '/wiki/page' : '/posts' })
+  return menu.find (_1 => _1.name === section)?.subMenu.find (_1 => _1.name === item)
+}
+
+describe ('menuOutline', () => {
+  it ('uses content-edit permission for post, material, and Wiki actions', () => {
+    for (const role of ['member', 'admin'] as const)
+      {
+	expect (submenuItem (role, '広場', '追加')?.visible).toBe (true)
+	expect (submenuItem (role, '広場', '取込')?.visible).toBe (true)
+	expect (submenuItem (role, '素材', '追加')?.visible).toBe (true)
+	expect (submenuItem (role, 'Wiki', '新規')?.visible).toBe (true)
+	expect (submenuItem (role, 'Wiki', '編輯')?.visible).toBe (true)
+      }
+
+    expect (submenuItem ('guest', '広場', '追加')?.visible).toBe (false)
+    expect (submenuItem ('guest', '広場', '取込')?.visible).toBe (false)
+    expect (submenuItem ('guest', '素材', '追加')?.visible).toBe (false)
+    expect (submenuItem ('guest', 'Wiki', '新規')?.visible).toBe (false)
+    expect (submenuItem ('guest', 'Wiki', '編輯')?.visible).toBe (false)
+  })
+
+  it ('keeps material suppression admin-only', () => {
+    expect (submenuItem ('member', '素材', '抑止')?.visible).toBe (false)
+    expect (submenuItem ('admin', '素材', '抑止')?.visible).toBe (true)
+  })
+})

frontend/src/components/TopNav.tsx

@@ -8,6 +8,8 @@ import PrefetchLink from '@/components/PrefetchLink'
 import TopNavUser from '@/components/TopNavUser'
 import { WikiIdBus } from '@/lib/eventBus/WikiIdBus'
 import { materialsKeys, tagsKeys, wikiKeys } from '@/lib/queryKeys'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
+import { canEditContent } from '@/lib/users'
 import { fetchTag, fetchTagByName } from '@/lib/tags'
 import { fetchMaterial } from '@/lib/materials'
 import { cn } from '@/lib/utils'
@@ -17,7 +19,7 @@ import type { FC, MouseEvent } from 'react'
 
 import type { Material, Menu, MenuVisibleItem, Tag, User } from '@/types'
 
-type Props = { user: User | null }
+type Props = { user: User | null, }
 
 
 export const menuOutline = (
@@ -25,10 +27,11 @@ export const menuOutline = (
 	tag?: Tag | null
 	material?: Material | null
 	wikiId: number | null
-	user: User | null,
+	user: User | null
 	pathName: string },
 ): Menu => {
   const postCount = tag?.postCount ?? material?.tag?.postCount ?? 0
+  const editable = canEditContent (user)
 
   const wikiPageFlg = Boolean (/^\/wiki\/(?!new|changes)[^/]+/.test (pathName) && wikiId)
   const wikiTitle = pathName.split ('/')[2] ?? ''
@@ -41,7 +44,8 @@ export const menuOutline = (
       { name: '広場', to: '/posts', subMenu: [
 	  { name: '一覧', to: '/posts' },
 	  { name: '検索', to: '/posts/search' },
-	  { name: '追加', to: '/posts/new' },
+	  { name: '追加', to: '/posts/new', visible: editable },
+	  { name: '取込', to: '/posts/import', visible: editable },
 	  { name: '全体履歴', to: '/posts/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:広場' }] },
       { name: 'タグ', to: '/tags', subMenu: [
@@ -57,8 +61,9 @@ export const menuOutline = (
 	    visible: tagFlg && tag?.category !== 'nico' }] },
       { name: '素材', to: '/materials', visible: true, subMenu: [
 	  { name: '一覧', to: '/materials' },
-	  { name: '追加', to: '/materials/new' },
-	  { name: '抑止', to: '/materials/suppressions' },
+	  { name: '追加', to: '/materials/new', visible: editable },
+	  { name: '抑止', to: '/materials/suppressions',
+	    visible: user?.role === 'admin' },
 	  { name: '全体履歴', to: '/materials/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:素材管理' },
 	  { component: <Separator/>, visible: materialFlg },
@@ -69,14 +74,15 @@ export const menuOutline = (
 	    visible: materialFlg }] },
       { name: 'Wiki', to: '/wiki/ヘルプ:ホーム', base: '/wiki', subMenu: [
 	  { name: '検索', to: '/wiki' },
-	  { name: '新規', to: '/wiki/new' },
+	  { name: '新規', to: '/wiki/new', visible: editable },
 	  { name: '全体履歴', to: '/wiki/changes' },
 	  { name: 'ヘルプ', to: '/wiki/ヘルプ:Wiki' },
 	  { component: <Separator/>, visible: wikiPageFlg },
 	  { name: `広場 (${ postCount || 0 })`, to: `/posts?tags=${ wikiTitle }`,
 	    visible: wikiPageFlg },
 	  { name: '履歴', to: `/wiki/changes?id=${ wikiId }`, visible: wikiPageFlg },
-	  { name: '編輯', to: `/wiki/${ wikiId || wikiTitle }/edit`, visible: wikiPageFlg }] },
+	  { name: '編輯', to: `/wiki/${ wikiId || wikiTitle }/edit`,
+	    visible: wikiPageFlg && editable }] },
       { name: 'おたのしみ', visible: false, subMenu: [
 	  { name: '上映会 (β)', to: '/theatres/1' },
 	  { name: 'グカネータ (β)', to: '/gekanator' }] },
@@ -91,6 +97,10 @@ export const menuOutline = (
 
 const TopNav: FC<Props> = ({ user }) => {
   const location = useLocation ()
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const animationsOff = animationMode === 'off'
+  const reducedAnimations = animationMode === 'reduced'
 
   const dirRef = useRef<(-1) | 1> (1)
   const itemsRef = useRef<(HTMLAnchorElement | null)[]> ([])
@@ -155,6 +165,24 @@ const TopNav: FC<Props> = ({ user }) => {
   const activeIdx =
       visibleMenu.findIndex (item => location.pathname.startsWith (item.base || item.to))
   const submenuHeight = moreVsbl ? 40 * moreMenu.length : (activeIdx < 0 ? 0 : 40)
+  const topNavTransition =
+      animationsOff
+      ? { duration: 0 }
+      : reducedAnimations
+	? { duration: .08, ease: 'linear' as const }
+	: { duration: .2, ease: 'easeOut' as const }
+  const opacityTransition =
+      animationsOff
+      ? { duration: 0 }
+      : reducedAnimations
+	? { duration: .08 }
+	: { duration: .12 }
+  const highlightTransitionClass =
+      animationsOff
+      ? undefined
+      : reducedAnimations
+	? 'transition-[transform,width] duration-75 ease-linear'
+	: 'transition-[transform,width] duration-200 ease-out'
 
   const prevActiveIdxRef = useRef<number> (activeIdx)
 
@@ -189,13 +217,11 @@ const TopNav: FC<Props> = ({ user }) => {
 
   return (
       <>
-	<nav className="px-3 flex justify-between items-center w-full
-			bg-yellow-200 dark:bg-red-975 md:bg-yellow-50">
+	<nav className="top-nav-root px-3 flex justify-between items-center w-full">
 	  <div className="flex items-center gap-2 h-12">
 	    <PrefetchLink
 		to="/posts"
-		className="mx-4 text-xl font-bold text-pink-600 hover:text-pink-400
-			   dark:text-pink-300 dark:hover:text-pink-100"
+		className="top-nav-brand-link mx-4 text-xl font-bold"
 		onClick={() => {
 		  scroll (0, 0)
 		}}>
@@ -205,8 +231,8 @@ const TopNav: FC<Props> = ({ user }) => {
 	    <div ref={navRef} className="relative hidden md:flex h-12 items-center">
 	      <div aria-hidden
 		   className={cn ('absolute inset-y-0 h-12',
-				  'bg-yellow-200 dark:bg-red-950',
-				  'transition-[transform,width] duration-200 ease-out')}
+				  'top-nav-highlight',
+				  highlightTransitionClass)}
 		   style={{ width:      hl.width,
 			    transform:  `translateX(${ hl.left }px)`,
 			    opacity:    hl.visible ? 1 : 0 }}/>
@@ -214,10 +240,12 @@ const TopNav: FC<Props> = ({ user }) => {
 	      {visibleMenu.map ((item, i) => (
 		  <motion.div
 		      key={item.to}
-		      layoutId={`menu-${ item.name }`}
+		      {...(animationsOff
+			   ? { }
+			   : { layoutId: `menu-${ item.name }` })}
 		      animate={{ opacity: moreVsbl ? 0 : 1 }}
-		      transition={{ opacity: { duration: .12 },
-				    layout: { duration: .2, ease: 'easeOut' } }}
+		      transition={{ opacity: opacityTransition,
+				    layout: topNavTransition }}
 		      style={{ pointerEvents: moreVsbl ? 'none' : 'auto' }}
 		      onMouseEnter={() => setMoreVsbl (false)}>
 		    <PrefetchLink
@@ -225,7 +253,7 @@ const TopNav: FC<Props> = ({ user }) => {
 			ref={(el: (HTMLAnchorElement | null)) => {
 			  itemsRef.current[i] = el
 			}}
-			className={cn ('relative z-10 flex h-full items-center px-5',
+			className={cn ('top-nav-menu-link relative z-10 flex h-full items-center px-5',
 				       (i === openItemIdx) && 'font-bold')}>
 		      {item.name}
 		    </PrefetchLink>
@@ -240,7 +268,7 @@ const TopNav: FC<Props> = ({ user }) => {
 		    setMoreVsbl (true)
 		    measure (-1)
 		  }}
-		  className={cn ('relative z-10 flex h-full items-center px-5',
+		  className={cn ('top-nav-menu-link relative z-10 flex h-full items-center px-5',
 				 (openItemIdx < 0 || moreVsbl) && 'font-bold')}>
 		その他 &raquo;
 	      </PrefetchLink>
@@ -249,30 +277,28 @@ const TopNav: FC<Props> = ({ user }) => {
 
 	  <TopNavUser user={user}/>
 
-	  <a href="#"
-	     className="md:hidden ml-auto pr-4
-			text-pink-600 hover:text-pink-400
-			dark:text-pink-300 dark:hover:text-pink-100"
-	     onClick={ev => {
-	       ev.preventDefault ()
+	  <button
+	     type="button"
+	     className="top-nav-mobile-toggle md:hidden ml-auto border-0 bg-transparent pr-4"
+	     onClick={() => {
 	       setMenuOpen (!(menuOpen))
 	     }}>
 	    {menuOpen ? '×' : 'Menu'}
-	  </a>
+	  </button>
 	</nav>
 
 	<AnimatePresence initial={false}>
 	  <motion.div
 	      key="submenu-shell"
-	      layout
-	      className="relative z-20 hidden md:block overflow-hidden
-			 bg-yellow-200 dark:bg-red-950"
+	      {...(animationsOff ? { }
+		   : { layout: true })}
+	      className="relative z-20 hidden md:block overflow-hidden top-nav-submenu"
 	      animate={{ height: submenuHeight }}
 	      onMouseLeave={() => {
 		if (moreVsbl)
 		  setMoreVsbl (false)
 	      }}
-	      transition={{ layout: { duration: .2, ease: 'easeOut' } }}
+	      transition={{ layout: topNavTransition }}
 	      onAnimationComplete={() => {
 		measure (moreVsbl ? -1 : activeIdx)
 	      }}>
@@ -282,12 +308,14 @@ const TopNav: FC<Props> = ({ user }) => {
 		  <div key={i} className="relative h-[40px]">
 		    <div className="absolute inset-0 flex items-center px-3">
 		      <motion.div
-			  transition={{ duration: .2, ease: 'easeOut' }}
-			  {...((item.visible ?? true)
+			  transition={topNavTransition}
+			  {...(animationsOff
+			       ? { }
+			       : ((item.visible ?? true)
 			       ? { layoutId: `menu-${ item.name }` }
 			       : { initial: { x: 40, y: -40, opacity: 0 },
 				   animate: { x: 0, y: 0, opacity: 1 },
-				   exit: { x: 40, y: -40, opacity: 0 } })}
+				   exit: { x: 40, y: -40, opacity: 0 } }))}
 			  className="z-10 h-full flex items-center px-3 font-bold w-28">
 			<h2>{item.name}</h2>
 		      </motion.div>
@@ -298,30 +326,34 @@ const TopNav: FC<Props> = ({ user }) => {
 			  ? (
 			      <motion.div
 				  key={`c-${ i }-${ j }`}
-				  transition={{ duration: .2, ease: 'easeOut' }}
-				  {...((visibleMenu[activeIdx]?.name
+				  transition={topNavTransition}
+				  {...(animationsOff
+				       ? { }
+				       : ((visibleMenu[activeIdx]?.name
 					=== item.name)
 				       ? { layoutId: `submenu-${ item.name }-${ j }` }
 				       : { initial: { y: -40, opacity: 0 },
 					   animate: { y: 0, opacity: 1 },
-					   exit: { y: -40, opacity: 0 } })}>
+					   exit: { y: -40, opacity: 0 } }))}>
 				{subItem.component}
 			      </motion.div>)
 			  : (
 			      <motion.div
 				  key={`l-${ i }-${ j }`}
-				  transition={{ duration: .2, ease: 'easeOut' }}
-				  {...((visibleMenu[activeIdx]?.name
+				  transition={topNavTransition}
+				  {...(animationsOff
+				       ? { }
+				       : ((visibleMenu[activeIdx]?.name
 					=== item.name)
 				       ? { layoutId: `submenu-${ item.name }-${ j }` }
 				       : { initial: { y: -40, opacity: 0 },
 					   animate: { y: 0, opacity: 1 },
-					   exit: { y: -40, opacity: 0 } })}>
+					   exit: { y: -40, opacity: 0 } }))}>
 				<PrefetchLink
 				    to={subItem.to}
 				    target={subItem.to.slice (0, 2) === '//' ? '_blank' : undefined}
 				    onClick={() => setMoreVsbl (false)}
-				    className="h-full flex items-center px-3">
+				    className="top-nav-menu-link h-full flex items-center px-3">
 				  {subItem.name}
 				</PrefetchLink>
 			      </motion.div>)))}
@@ -330,129 +362,215 @@ const TopNav: FC<Props> = ({ user }) => {
 	   : ((visibleMenu[activeIdx]?.subMenu ?? []).length > 0
 	      && (
 		  <div className="relative h-[40px]">
-		    <AnimatePresence initial={false} custom={dir}>
-		      <motion.div
-			  key={activeIdx}
-			  custom={dir}
-			  variants={{ enter: (d: -1 | 1) => ({ y: d * 24, opacity: 0 }),
-				      centre: { y: 0, opacity: 1 },
-				      exit: (d: -1 | 1) => ({ y: (-d) * 24, opacity: 0 }) }}
-			  className="absolute inset-0 flex items-center px-3"
-			  initial="enter"
-			  animate="centre"
-			  exit="exit"
-			  transition={{ duration: .2, ease: 'easeOut' }}>
-			{(visibleMenu[activeIdx]?.subMenu ?? [])
-			 .filter (item => item.visible ?? true)
-			 .map ((item, i) => (
-			    'component' in item
-			    ? (
-				<motion.div
-				    key={`c-${ i }`}
-				    transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-				    layoutId={`submenu-${ visibleMenu[activeIdx].name }-${ i }`}>
-				  {item.component}
-				</motion.div>)
-			    : (
-				<motion.div
-				    key={`l-${ i }`}
-				    transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-				    layoutId={`submenu-${ visibleMenu[activeIdx].name }-${ i }`}>
-				  <PrefetchLink
-				      to={item.to}
-				      target={item.to.slice (0, 2) === '//' ? '_blank' : undefined}
-				      className="h-full flex items-center px-3">
-				    {item.name}
-				  </PrefetchLink>
-				</motion.div>)))}
-		      </motion.div>
-		    </AnimatePresence>
+		    {animationsOff
+		     ? (
+			 <div className="absolute inset-0 flex items-center px-3">
+			   {(visibleMenu[activeIdx]?.subMenu ?? [])
+			    .filter (item => item.visible ?? true)
+			    .map ((item, i) => (
+			       'component' in item
+			       ? (
+				   <div key={`c-${ i }`}>
+				     {item.component}
+				   </div>)
+			       : (
+				   <div key={`l-${ i }`}>
+				     <PrefetchLink
+					 to={item.to}
+					 target={item.to.slice (0, 2) === '//'
+						 ? '_blank'
+						 : undefined}
+					 className="top-nav-menu-link h-full flex items-center px-3">
+				       {item.name}
+				     </PrefetchLink>
+				   </div>)))}
+			 </div>)
+		     : (
+			 <AnimatePresence initial={false} custom={dir}>
+			   <motion.div
+			       key={activeIdx}
+			       custom={dir}
+			       variants={{ enter: (d: -1 | 1) => ({ y: d * 24, opacity: 0 }),
+					   centre: { y: 0, opacity: 1 },
+					   exit: (d: -1 | 1) => ({ y: (-d) * 24, opacity: 0 }) }}
+			       className="absolute inset-0 flex items-center px-3"
+			       initial="enter"
+			       animate="centre"
+			       exit="exit"
+			       transition={topNavTransition}>
+			     {(visibleMenu[activeIdx]?.subMenu ?? [])
+			      .filter (item => item.visible ?? true)
+			      .map ((item, i) => (
+				 'component' in item
+				 ? (
+				     <motion.div
+					 key={`c-${ i }`}
+					 transition={{ layout: topNavTransition }}
+					 layoutId={`submenu-${ visibleMenu[activeIdx].name }-${ i }`}>
+				       {item.component}
+				     </motion.div>)
+				 : (
+				     <motion.div
+					 key={`l-${ i }`}
+					 transition={{ layout: topNavTransition }}
+					 layoutId={`submenu-${ visibleMenu[activeIdx].name }-${ i }`}>
+				       <PrefetchLink
+					   to={item.to}
+					   target={item.to.slice (0, 2) === '//'
+						   ? '_blank'
+						   : undefined}
+					   className="top-nav-menu-link h-full flex items-center px-3">
+					 {item.name}
+				       </PrefetchLink>
+				     </motion.div>)))}
+			   </motion.div>
+			 </AnimatePresence>)}
 		  </div>))}
 	  </motion.div>
 	</AnimatePresence>
 
-	<AnimatePresence initial={false}>
-	  {menuOpen && (
-	      <motion.div
-		  key="spmenu"
-		  className={cn ('flex flex-col md:hidden',
-				 'bg-yellow-200 dark:bg-red-975 items-start')}
-		  variants={{ closed: { clipPath: 'inset(0 0 100% 0)',
-					height:   0 },
-			      open:   { clipPath: 'inset(0 0 0% 0)',
-					height:   'auto' } }}
-		  initial="closed"
-		  animate="open"
-		  exit="closed"
-		  transition={{ duration: .2, ease: 'easeOut' }}>
-		<Separator/>
-		{visibleMenu.map ((item, i) => (
-		    <Fragment key={i}>
-		      <PrefetchLink
-			  to={i === openItemIdx ? item.to : '#'}
-			  className={cn ('w-full min-h-[40px] flex items-center pl-8',
-				     ((i === openItemIdx)
-				      && 'font-bold bg-yellow-50 dark:bg-red-950'))}
-			  onClick={(ev: MouseEvent<HTMLAnchorElement>) => {
-			    if (i !== openItemIdx)
-			      {
-				ev.preventDefault ()
-				setOpenItemIdx (i)
-			      }
-			  }}>
-			{item.name}
-		      </PrefetchLink>
+	{animationsOff
+	 ? (
+	     menuOpen && (
+		 <div
+		     className={cn ('top-nav-root top-nav-mobile-menu flex flex-col md:hidden',
+				    'items-start')}>
+		   <Separator/>
+		   {visibleMenu.map ((item, i) => (
+		       <Fragment key={i}>
+			 <PrefetchLink
+			     to={i === openItemIdx ? item.to : '#'}
+			     className={cn ('top-nav-mobile-row w-full min-h-[40px] flex items-center pl-8',
+					((i === openItemIdx)
+					 && 'top-nav-mobile-active font-bold'))}
+			     onClick={(ev: MouseEvent<HTMLAnchorElement>) => {
+			       if (i !== openItemIdx)
+				 {
+				   ev.preventDefault ()
+				   setOpenItemIdx (i)
+				 }
+			     }}>
+			   {item.name}
+			 </PrefetchLink>
 
-		      <AnimatePresence initial={false}>
-			{i === openItemIdx && (
-			    <motion.div
-				key={`sp-sub-${ i }`}
-				className="w-full bg-yellow-50 dark:bg-red-950"
-				variants={{ closed: { clipPath: 'inset(0 0 100% 0)',
-						      height:   0,
-						      opacity:  0 },
-					    open:   { clipPath: 'inset(0 0 0% 0)',
-						      height:   'auto',
-						      opacity:  1 } }}
-				initial="closed"
-				animate="open"
-				exit="closed"
-				transition={{ duration: .2, ease: 'easeOut' }}>
-			      {item.subMenu
-			       .filter (subItem => subItem.visible ?? true)
-			       .map ((subItem, j) => (
-				  'component' in subItem
-				  ? (
-				      <Fragment key={`sp-c-${ i }-${ j }`}>
-					{subItem.component}
-				      </Fragment>)
-				  : (
-				      <PrefetchLink
-					  key={`sp-l-${ i }-${ j }`}
-					  to={subItem.to}
-					  target={subItem.to.slice (0, 2) === '//'
-						  ? '_blank'
-						  : undefined}
-					  className="w-full min-h-[36px] flex items-center pl-12">
-					{subItem.name}
-				      </PrefetchLink>)))}
-			    </motion.div>)}
-		      </AnimatePresence>
-		    </Fragment>))}
-		<PrefetchLink
-		    to="/more"
-		    ref={(el: (HTMLAnchorElement | null)) => {
-		      itemsRef.current[visibleMenu.length] = el
-		    }}
-		    className={cn ('w-full min-h-[40px] flex items-center pl-8',
-				   ((openItemIdx < 0)
-				    && 'font-bold bg-yellow-50 dark:bg-red-950'))}>
-		  その他 &raquo;
-		</PrefetchLink>
-		<TopNavUser user={user} sp/>
-		<Separator/>
-	      </motion.div>)}
-	</AnimatePresence>
+			 {i === openItemIdx && (
+			     <div className="top-nav-submenu w-full">
+			       {item.subMenu
+				.filter (subItem => subItem.visible ?? true)
+				.map ((subItem, j) => (
+				   'component' in subItem
+				   ? (
+				       <Fragment key={`sp-c-${ i }-${ j }`}>
+					 {subItem.component}
+				       </Fragment>)
+				   : (
+				       <PrefetchLink
+					   key={`sp-l-${ i }-${ j }`}
+					   to={subItem.to}
+					   target={subItem.to.slice (0, 2) === '//'
+						   ? '_blank'
+						   : undefined}
+					   className="top-nav-mobile-row w-full min-h-[36px] flex items-center pl-12">
+					 {subItem.name}
+				       </PrefetchLink>)))}
+			     </div>)}
+		       </Fragment>))}
+		   <PrefetchLink
+		       to="/more"
+		       ref={(el: (HTMLAnchorElement | null)) => {
+			 itemsRef.current[visibleMenu.length] = el
+		       }}
+		       className={cn ('top-nav-mobile-row w-full min-h-[40px] flex items-center pl-8',
+				      ((openItemIdx < 0)
+				       && 'top-nav-mobile-active font-bold'))}>
+		     その他 &raquo;
+		   </PrefetchLink>
+		   <TopNavUser user={user} sp/>
+		   <Separator/>
+		 </div>))
+	 : (
+	     <AnimatePresence initial={false}>
+	       {menuOpen && (
+		   <motion.div
+		       key="spmenu"
+		       className={cn ('top-nav-root top-nav-mobile-menu flex flex-col md:hidden',
+				      'items-start')}
+		       variants={{ closed: { clipPath: 'inset(0 0 100% 0)',
+					     height:   0 },
+				   open:   { clipPath: 'inset(0 0 0% 0)',
+					     height:   'auto' } }}
+		       initial="closed"
+		       animate="open"
+		       exit="closed"
+		       transition={topNavTransition}>
+		     <Separator/>
+		     {visibleMenu.map ((item, i) => (
+			 <Fragment key={i}>
+			   <PrefetchLink
+			       to={i === openItemIdx ? item.to : '#'}
+			       className={cn ('top-nav-mobile-row w-full min-h-[40px] flex items-center pl-8',
+					  ((i === openItemIdx)
+					   && 'top-nav-mobile-active font-bold'))}
+			       onClick={(ev: MouseEvent<HTMLAnchorElement>) => {
+				 if (i !== openItemIdx)
+				   {
+				     ev.preventDefault ()
+				     setOpenItemIdx (i)
+				   }
+			       }}>
+			     {item.name}
+			   </PrefetchLink>
+
+			   <AnimatePresence initial={false}>
+			     {i === openItemIdx && (
+				 <motion.div
+				     key={`sp-sub-${ i }`}
+				     className="top-nav-submenu w-full"
+				     variants={{ closed: { clipPath: 'inset(0 0 100% 0)',
+							   height:   0,
+							   opacity:  0 },
+						 open:   { clipPath: 'inset(0 0 0% 0)',
+							   height:   'auto',
+							   opacity:  1 } }}
+				     initial="closed"
+				     animate="open"
+				     exit="closed"
+				     transition={topNavTransition}>
+				   {item.subMenu
+				    .filter (subItem => subItem.visible ?? true)
+				    .map ((subItem, j) => (
+				       'component' in subItem
+				       ? (
+					   <Fragment key={`sp-c-${ i }-${ j }`}>
+					     {subItem.component}
+					   </Fragment>)
+				       : (
+					   <PrefetchLink
+					       key={`sp-l-${ i }-${ j }`}
+					       to={subItem.to}
+					       target={subItem.to.slice (0, 2) === '//'
+						       ? '_blank'
+						       : undefined}
+					       className="top-nav-mobile-row w-full min-h-[36px] flex items-center pl-12">
+					     {subItem.name}
+					   </PrefetchLink>)))}
+				 </motion.div>)}
+			   </AnimatePresence>
+			 </Fragment>))}
+		     <PrefetchLink
+			 to="/more"
+			 ref={(el: (HTMLAnchorElement | null)) => {
+			   itemsRef.current[visibleMenu.length] = el
+			 }}
+			 className={cn ('top-nav-mobile-row w-full min-h-[40px] flex items-center pl-8',
+					((openItemIdx < 0)
+					 && 'top-nav-mobile-active font-bold'))}>
+		       その他 &raquo;
+		     </PrefetchLink>
+		     <TopNavUser user={user} sp/>
+		     <Separator/>
+		   </motion.div>)}
+	     </AnimatePresence>)}
       </>)
 }
 

frontend/src/components/common/FieldWarning.tsx

@@ -0,0 +1,18 @@
+import type { FC } from 'react'
+
+type Props = { id?:        string
+	       messages?:  string[] }
+
+
+export const FieldWarning: FC<Props> = ({ id, messages }: Props) => {
+  if (messages == null || messages.length === 0)
+    return null
+
+  return (
+      <ul id={id} className="mt-1 space-y-1 text-amber-700 dark:text-amber-200">
+	{messages.map ((message, i) => <li key={i}>{message}</li>)}
+      </ul>)
+}
+
+
+export default FieldWarning

frontend/src/components/common/Form.tsx

@@ -1,11 +1,15 @@
+import { cn } from '@/lib/utils'
+
 import type { FC, ReactNode } from 'react'
 
-type Props = { children: ReactNode }
+type Props = {
+    children:   ReactNode
+    className?: string }
 
 
-const Form: FC<Props> = ({ children }) => (
-    <div className="max-w-xl mx-auto p-4 space-y-4">
+const Form: FC<Props> = ({ children, className }) => (
+    <div className={cn ('mx-auto max-w-xl space-y-4 p-4', className)}>
       {children}
     </div>)
 
-export default Form
+export default Form

frontend/src/components/common/StatusBadge.tsx

@@ -0,0 +1,34 @@
+import { cn } from '@/lib/utils'
+
+import type { FC, ReactNode } from 'react'
+
+export type StatusBadgeTone =
+    'success'
+    | 'neutral'
+    | 'warning'
+
+type Props = {
+    children: ReactNode
+    tone:     StatusBadgeTone }
+
+const TONES: Record<StatusBadgeTone, string[]> = {
+    success: [
+	'border-emerald-300 bg-emerald-50 text-emerald-700',
+	'dark:border-emerald-900 dark:bg-emerald-950 dark:text-emerald-200'],
+    warning: [
+	'border-amber-300 bg-amber-50 text-amber-700',
+	'dark:border-amber-900 dark:bg-amber-950 dark:text-amber-200'],
+    neutral: [
+	'border-stone-300 bg-stone-50 text-stone-700',
+	'dark:border-stone-700 dark:bg-stone-900 dark:text-stone-200'] }
+
+
+const StatusBadge: FC<Props> = ({ children, tone }) => (
+    <span
+	className={cn (
+	    'inline-flex items-center rounded-full border px-2.5 py-1 text-xs font-medium',
+	    TONES[tone])}>
+      {children}
+    </span>)
+
+export default StatusBadge

frontend/src/components/common/TabGroup.test.tsx

@@ -20,4 +20,16 @@ describe ('TabGroup', () => {
     expect (screen.getByText ('Alpha')).toBeInTheDocument ()
     expect (screen.queryByText ('Beta')).not.toBeInTheDocument ()
   })
+
+  it ('renders tabs as buttons and shows the right addon', () => {
+    render (
+        <TabGroup rightAddon={<span>件数 20</span>}>
+          <Tab name="広場">Plaza</Tab>
+        </TabGroup>,
+    )
+
+    expect (screen.getByRole ('button', { name: '広場' })).toBeInTheDocument ()
+    expect (screen.queryByRole ('link', { name: '広場' })).not.toBeInTheDocument ()
+    expect (screen.getByText ('件数 20')).toBeInTheDocument ()
+  })
 })

frontend/src/components/common/TabGroup.tsx

@@ -7,12 +7,15 @@ type TabProps = { name:     string
 		  init?:    boolean
 		  children: React.ReactNode }
 
-type Props = { children: React.ReactNode }
+type Props = {
+    children:    React.ReactNode
+    rightAddon?: React.ReactNode
+}
 
 export const Tab = ({ children }: TabProps) => <>{children}</>
 
 
-const TabGroup: FC<Props> = ({ children }) => {
+const TabGroup: FC<Props> = ({ children, rightAddon }) => {
   const tabs = React.Children.toArray (children) as React.ReactElement<TabProps>[]
 
   const [current, setCurrent] = useState<number> (() => {
@@ -22,17 +25,27 @@ const TabGroup: FC<Props> = ({ children }) => {
 
   return (
       <div className="mt-4">
-	<div className="flex gap-4">
-	  {tabs.map ((tab, i) => (
-	      <a key={i}
-		 href="#"
-		 className={cn (i === current && 'font-bold')}
-		 onClick={ev => {
-		   ev.preventDefault ()
-		   setCurrent (i)
-		 }}>
-		{tab.props.name}
-	      </a>))}
+	<div className="flex items-center justify-between gap-4">
+	  <div className="flex min-w-0 gap-4">
+	    {tabs.map ((tab, i) => (
+		<button
+		   key={i}
+		   type="button"
+		   className={cn (
+		       'bg-transparent p-0 text-left text-[hsl(var(--theme-link))] hover:opacity-85',
+		       'focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring',
+		       i === current && 'font-bold',
+		   )}
+		   onClick={() => {
+		     setCurrent (i)
+		   }}>
+		  {tab.props.name}
+		</button>))}
+	  </div>
+	  {rightAddon && (
+	      <div className="shrink-0">
+		{rightAddon}
+	      </div>)}
 	</div>
 	<div className="mt-2">
 	  {tabs[current]}

frontend/src/components/common/TagInput.test.tsx

@@ -26,7 +26,7 @@ describe ('TagInput', () => {
     await waitFor (() => {
       expect (api.apiGet).toHaveBeenCalledWith (
           '/tags/autocomplete',
-          { params: { q: '虹夏' } },
+          { params: { q: '虹夏', nico: '0' } },
       )
     })
     expect (setValue).toHaveBeenCalledWith ('ぼっち 虹夏')
@@ -41,4 +41,20 @@ describe ('TagInput', () => {
     expect (api.apiGet).not.toHaveBeenCalled ()
     expect (setValue).toHaveBeenCalledWith (' ')
   })
+
+  it ('sends nico=1 only when includeNico is true', async () => {
+    const setValue = vi.fn ()
+    api.apiGet.mockResolvedValueOnce ([buildTag ({ name: '虹夏', postCount: 2 })])
+
+    render (<TagInput value="" setValue={setValue} includeNico={true}/>)
+
+    fireEvent.change (screen.getByRole ('textbox'), { target: { value: '虹夏' } })
+
+    await waitFor (() => {
+      expect (api.apiGet).toHaveBeenCalledWith (
+          '/tags/autocomplete',
+          { params: { q: '虹夏', nico: '1' } },
+      )
+    })
+  })
 })

frontend/src/components/common/TagInput.tsx

@@ -10,13 +10,20 @@ import type { Tag } from '@/types'
 
 
 type Props = {
+    includeNico?:   boolean
     describedBy?:  string
     invalid?:      boolean
     value:         string
     setValue:      (value: string) => void }
 
 
-const TagInput: FC<Props> = ({ describedBy, invalid, value, setValue }) => {
+const TagInput: FC<Props> = ({
+    includeNico = false,
+    describedBy,
+    invalid,
+    value,
+    setValue,
+}) => {
   const [activeIndex, setActiveIndex] = useState (-1)
   const [suggestions, setSuggestions] = useState<Tag[]> ([])
   const [suggestionsVsbl, setSuggestionsVsbl] = useState (false)
@@ -32,10 +39,12 @@ const TagInput: FC<Props> = ({ describedBy, invalid, value, setValue }) => {
 	return
       }
 
-    const data = await apiGet<Tag[]> ('/tags/autocomplete', { params: { q } })
-    setSuggestions (data.filter (t => t.postCount > 0))
-    if (suggestions.length > 0)
-      setSuggestionsVsbl (true)
+    const data = await apiGet<Tag[]> ('/tags/autocomplete', { params: {
+	q,
+	nico: includeNico ? '1' : '0' } })
+    const nextSuggestions = data.filter (t => t.postCount > 0)
+    setSuggestions (nextSuggestions)
+    setSuggestionsVsbl (nextSuggestions.length > 0)
   }
 
   // TODO: TagSearch からのコピペのため，共通化を考へる．

frontend/src/components/dialogues/DialogueProvider.test.tsx

@@ -0,0 +1,114 @@
+import { useCallback, useEffect } from 'react'
+import { fireEvent, render, screen, waitFor } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import DialogueProvider from '@/components/dialogues/DialogueProvider'
+import useDialogue from '@/lib/dialogues/useDialogue'
+
+import type { DialogueFormControls } from '@/lib/dialogues/useDialogue'
+
+const FormBody = (
+    { controls,
+      onSelect }: { controls: DialogueFormControls
+		    onSelect: () => Promise<boolean> | boolean },
+) => {
+  useEffect (() => {
+    controls.setActions ([{
+      label: '左操作',
+      placement: 'start',
+      onSelect }, {
+      label: '保存',
+      onSelect: () => true }])
+  }, [controls, onSelect])
+
+  return <div>長いフォーム本文</div>
+}
+
+const NestedConfirmFormBody = ({ controls }: { controls: DialogueFormControls }) => {
+  const reset = useCallback (async () => {
+    await controls.confirm ({
+      title: '変更をリセットしますか?',
+      confirmText: 'リセット' })
+    return false
+  }, [controls])
+
+  return <FormBody controls={controls} onSelect={reset}/>
+}
+
+describe ('DialogueProvider', () => {
+  it ('keeps ordinary dialogues in FIFO order', async () => {
+    const Launcher = () => {
+      const dialogue = useDialogue ()
+      return (
+	  <button
+	      onClick={() => {
+		void dialogue.confirm ({ title: '一件目' })
+		void dialogue.confirm ({ title: '二件目' })
+	      }}>
+	    開く
+	  </button>)
+    }
+
+    render (<DialogueProvider><Launcher/></DialogueProvider>)
+    fireEvent.click (screen.getByRole ('button', { name: '開く' }))
+
+    expect (screen.getByText ('一件目')).toBeInTheDocument ()
+    expect (screen.queryByText ('二件目')).not.toBeInTheDocument ()
+    fireEvent.click (screen.getByRole ('button', { name: '確定' }))
+    expect (await screen.findByText ('二件目')).toBeInTheDocument ()
+  })
+
+  it ('keeps a large form open when an action returns false', async () => {
+    const action = vi.fn ().mockResolvedValue (false)
+    const Launcher = () => {
+      const dialogue = useDialogue ()
+      return (
+	  <button
+	      onClick={() => void dialogue.form ({
+		title: '投稿を編輯',
+		description: '説明',
+		size: 'large',
+		body: controls => <FormBody controls={controls} onSelect={action}/> })}>
+	    開く
+	  </button>)
+    }
+
+    render (<DialogueProvider><Launcher/></DialogueProvider>)
+    fireEvent.click (screen.getByRole ('button', { name: '開く' }))
+
+    const dialogue = screen.getByRole ('dialog')
+    expect (dialogue).toHaveClass ('max-h-[calc(100dvh-1rem)]', 'flex-col', 'max-w-3xl')
+    await waitFor (() => expect (screen.getByRole ('button', { name: '左操作' }))
+	.toBeInTheDocument ())
+    expect (screen.getByRole ('button', { name: '左操作' })).toHaveClass ('w-full', 'sm:w-auto')
+    fireEvent.click (screen.getByRole ('button', { name: '左操作' }))
+
+    await waitFor (() => expect (action).toHaveBeenCalledTimes (1))
+    expect (screen.getByText ('投稿を編輯')).toBeInTheDocument ()
+  })
+
+  it ('opens a nested confirmation over a form and returns to the same form', async () => {
+    const Launcher = () => {
+      const dialogue = useDialogue ()
+      return (
+	  <button
+	      onClick={() => void dialogue.form ({
+		title: '投稿を編輯',
+		body: controls => <NestedConfirmFormBody controls={controls}/> })}>
+	    開く
+	  </button>)
+    }
+
+    render (<DialogueProvider><Launcher/></DialogueProvider>)
+    fireEvent.click (screen.getByRole ('button', { name: '開く' }))
+    const action = await screen.findByRole ('button', { name: '左操作' })
+    fireEvent.click (action)
+
+    expect (await screen.findByText ('変更をリセットしますか?')).toBeInTheDocument ()
+    fireEvent.click (screen.getByRole ('button', { name: 'リセット' }))
+    await waitFor (() => {
+      expect (screen.queryByText ('変更をリセットしますか?')).not.toBeInTheDocument ()
+    })
+    expect (screen.getByText ('投稿を編輯')).toBeInTheDocument ()
+  })
+})

frontend/src/components/dialogues/DialogueProvider.tsx

@@ -1,4 +1,4 @@
-import { createContext, useCallback, useContext, useMemo, useState } from 'react'
+import { useCallback, useMemo, useRef, useState } from 'react'
 
 import { Button } from '@/components/ui/button'
 import { Dialog,
@@ -7,29 +7,16 @@ import { Dialog,
 	 DialogFooter,
 	 DialogHeader,
 	 DialogTitle } from '@/components/ui/dialog'
+import { DialogueContext } from '@/lib/dialogues/useDialogue'
 
 import type { FC, ReactNode } from 'react'
-
-type DialogueVariant = 'default' | 'danger'
-
-type ConfirmOptions = { title:        string
-			description?: ReactNode
-			confirmText?: string
-			cancelText?:  string
-			variant?:     DialogueVariant }
-
-type AlertOptions = { title:        string
-		      description?: ReactNode
-		      okText?:      string }
-
-type Choice<T extends string> = { value:    T
-				  label:    string
-				  variant?: DialogueVariant }
-
-type ChoiceOptions<T extends string> = { title:         string
-					 description?:  ReactNode
-					 choices:       Choice<T>[]
-					 cancelText?:   string }
+import type { AlertOptions,
+	      ChoiceOptions,
+	      ConfirmOptions,
+	      DialogueAPI,
+	      DialogueFormAction,
+	      DialogueFormControls,
+	      DialogueFormOptions } from '@/lib/dialogues/useDialogue'
 
 type DialogueRequest =
     | { id:       number
@@ -44,13 +31,10 @@ type DialogueRequest =
 	kind:     'choice'
 	options:  ChoiceOptions<string>
 	resolve:  (value: string | null) => void }
-
-type DialogueAPI =
-    { confirm:  (options: ConfirmOptions) => Promise<boolean>
-      alert:    (options: AlertOptions) => Promise<void>
-      choice:   <T extends string> (options: ChoiceOptions<T>) => Promise<T | null> }
-
-const DialogueContext = createContext<DialogueAPI | null> (null)
+    | { id:       number
+	kind:     'form'
+	options:  DialogueFormOptions
+	resolve:  () => void }
 
 let nextDialogueId = 1
 
@@ -59,20 +43,27 @@ type Props = { children: ReactNode }
 
 const DialogueProvider: FC<Props> = ({ children }) => {
   const [queue, setQueue] = useState<DialogueRequest[]> ([])
+  const [pendingIds, setPendingIds] = useState<number[]> ([])
+  const [formActions, setFormActions] = useState<Record<number, DialogueFormAction[]>> ({ })
+  const formControls = useRef<Record<number, DialogueFormControls>> ({ })
+  const [nestedConfirm, setNestedConfirm] = useState<{
+      parentId: number
+      options:  ConfirmOptions
+      resolve:  (value: boolean) => void } | null> (null)
 
   const push = useCallback ((request: Omit<DialogueRequest, 'id'>) => {
     const id = nextDialogueId
     ++nextDialogueId
 
-    setQueue (q => [...q, { ...request, id } as DialogueRequest])
+    setQueue (current => [...current, { ...request, id } as DialogueRequest])
   }, [])
 
-  const closeActive = useCallback ((result?: unknown) => {
-    setQueue (q => {
-      const [active, ...rest] = q
+  const closeRequest = useCallback ((id: number, result?: unknown) => {
+    setQueue (current => {
+      const active = current.find (request => request.id === id)
 
-      if (!(active))
-	return rest
+      if (active == null)
+	return current
 
       switch (active.kind)
       {
@@ -87,9 +78,42 @@ const DialogueProvider: FC<Props> = ({ children }) => {
       case 'choice':
 	active.resolve ((result ?? null) as string | null)
 	break
+
+      case 'form':
+	active.resolve ()
+	break
       }
 
-      return rest
+      return current.filter (request => request.id !== id)
+    })
+    setPendingIds (current => current.filter (_1 => _1 !== id))
+    setFormActions (current => {
+	const { [id]: _, ...rest } = current
+	return rest
+    })
+    delete formControls.current[id]
+  }, [])
+
+  const setRequestActions = useCallback (
+      (id: number, actions: DialogueFormAction[]) => {
+	setFormActions (current => ({ ...current, [id]: actions }))
+      },
+      [])
+
+  const openNestedConfirm = useCallback (
+      (parentId: number, options: ConfirmOptions) =>
+	  new Promise<boolean> (resolve => {
+	    setNestedConfirm ({ parentId, options, resolve })
+	  }),
+      [])
+
+  const closeNestedConfirm = useCallback ((result: boolean) => {
+    setNestedConfirm (current => {
+      if (current == null)
+	return current
+
+      current.resolve (result)
+      return null
     })
   }, [])
 
@@ -103,86 +127,229 @@ const DialogueProvider: FC<Props> = ({ children }) => {
       choice: options => new Promise (resolve => {
 	push ({ kind: 'choice',
 		options: options as ChoiceOptions<string>,
-		resolve: resolve as (value: string | null) => void })}) }), [push])
+		resolve: resolve as (value: string | null) => void })
+      }),
+      form: options => new Promise<void> (resolve => {
+	push ({ kind: 'form', options, resolve })
+      }) }), [push])
+
+  const handleFormAction = useCallback (
+      async (id: number, action: DialogueFormAction) => {
+	if (pendingIds.includes (id))
+	  return
+
+	setPendingIds (current => [...current, id])
+	try
+	  {
+	    const shouldClose = await action.onSelect ()
+	    if (shouldClose !== false)
+	      closeRequest (id)
+	  }
+	finally
+	  {
+	    setPendingIds (current => current.filter (_1 => _1 !== id))
+	  }
+      },
+      [closeRequest, pendingIds])
 
   const active = queue[0]
+  const startActions =
+      active?.kind === 'form'
+      ? (formActions[active.id] ?? []).filter (action => action.placement === 'start')
+      : []
+  const endActions =
+      active?.kind === 'form'
+      ? (formActions[active.id] ?? []).filter (action =>
+	  action.placement == null || action.placement === 'end')
+      : []
 
   return (
       <DialogueContext.Provider value={api}>
 	{children}
 
-	<Dialog
-	    open={Boolean (active)}
-	    onOpenChange={open => {
-	      if (!(open))
-		closeActive (active?.kind !== 'confirm' && null)
-	    }}>
-	  {active && (
+	{active && (
+	    <Dialog
+		open
+		onOpenChange={open => {
+		  const blocked =
+		      nestedConfirm?.parentId === active.id
+		      || pendingIds.includes (active.id)
+		  if (!(open) && !(blocked))
+		    closeRequest (active.id, active.kind !== 'confirm' && null)
+		}}>
+	      <DialogContent
+		  className={
+		      active.kind === 'form'
+		      ? `flex max-h-[calc(100dvh-1rem)] ${ active.options.size === 'large'
+			  ? 'max-w-3xl'
+			  : 'max-w-lg' } flex-col overflow-hidden gap-0`
+		      : 'px-6 pb-6 pt-7'
+		  }
+		  onEscapeKeyDown={event => {
+		    if (nestedConfirm?.parentId === active.id || pendingIds.includes (active.id))
+		      event.preventDefault ()
+		  }}
+		  onPointerDownOutside={event => {
+		    if (nestedConfirm?.parentId === active.id || pendingIds.includes (active.id))
+		      event.preventDefault ()
+		  }}>
+		{active.kind === 'form'
+		 ? (
+		     <>
+		       <DialogHeader className="shrink-0 pb-4 pl-8 pr-0 pt-1 text-left">
+			 <DialogTitle>{active.options.title}</DialogTitle>
+
+			 {active.options.description && (
+			     <DialogDescription asChild>
+			       <div>{active.options.description}</div>
+			     </DialogDescription>)}
+		       </DialogHeader>
+
+		       <div className="min-h-0 flex-1 overflow-y-auto overscroll-contain">
+			 {active.options.body (
+			     formControls.current[active.id] ??= {
+				 close: () => closeRequest (active.id),
+				 setActions: actions => setRequestActions (active.id, actions),
+				 confirm: options => openNestedConfirm (active.id, options) })}
+		       </div>
+
+		       <DialogFooter
+			   className="shrink-0 flex-col gap-2 pt-4
+				      sm:flex-row sm:justify-between sm:gap-0 sm:space-x-0">
+			 <div className="flex w-full flex-col gap-2 sm:w-auto sm:flex-row">
+			   {startActions.map (action => (
+			       <Button
+				   key={action.label}
+				   className="w-full sm:w-auto"
+				   variant={action.variant === 'danger'
+				       ? 'destructive'
+				       : 'default'}
+				   onClick={() => void handleFormAction (active.id, action)}
+				   disabled={pendingIds.includes (active.id)
+				       || nestedConfirm?.parentId === active.id
+				       || action.disabled}>
+				 {action.label}
+			       </Button>))}
+			 </div>
+
+			 <div className="flex w-full flex-col gap-2 sm:w-auto sm:flex-row">
+			   <Button
+			       className="w-full sm:w-auto"
+			       variant="outline"
+			       onClick={() => closeRequest (active.id)}
+			       disabled={pendingIds.includes (active.id)
+				   || nestedConfirm?.parentId === active.id}>
+			     {active.options.cancelText ?? '取消'}
+			   </Button>
+
+			   {endActions.map (action => (
+			       <Button
+				   key={action.label}
+				   className="w-full sm:w-auto"
+				   variant={action.variant === 'danger'
+				       ? 'destructive'
+				       : 'default'}
+				   onClick={() => void handleFormAction (active.id, action)}
+				   disabled={pendingIds.includes (active.id)
+				       || nestedConfirm?.parentId === active.id
+				       || action.disabled}>
+				 {action.label}
+			       </Button>))}
+			 </div>
+		       </DialogFooter>
+		     </>)
+		 : (
+		     <>
+		       <DialogHeader className="pl-8">
+			 <DialogTitle>{active.options.title}</DialogTitle>
+
+			 {active.options.description && (
+			     <DialogDescription asChild>
+			       <div>{active.options.description}</div>
+			     </DialogDescription>)}
+		       </DialogHeader>
+
+		       <DialogFooter>
+			 {active.kind === 'confirm' && (
+			     <>
+			       <Button
+				   variant="outline"
+				   onClick={() => closeRequest (active.id, false)}>
+				 {active.options.cancelText ?? '取消'}
+			       </Button>
+
+			       <Button
+				   variant={(active.options.variant === 'danger')
+					    ? 'destructive'
+					    : 'default'}
+				   onClick={() => closeRequest (active.id, true)}>
+				 {active.options.confirmText ?? '確定'}
+			       </Button>
+			     </>)}
+
+			 {active.kind === 'alert' && (
+			     <Button onClick={() => closeRequest (active.id)}>
+			       {active.options.okText ?? '確定'}
+			     </Button>)}
+
+			 {active.kind === 'choice' && (
+			     <>
+			       <Button
+				   variant="outline"
+				   onClick={() => closeRequest (active.id, null)}>
+				 {active.options.cancelText ?? '取消'}
+			       </Button>
+
+			       {active.options.choices.map (choice => (
+				   <Button
+				       key={choice.value}
+				       variant={(choice.variant === 'danger')
+						? 'destructive'
+						: 'default'}
+				       onClick={() => closeRequest (active.id, choice.value)}>
+				     {choice.label}
+				   </Button>))}
+			     </>)}
+		       </DialogFooter>
+		     </>)}
+	      </DialogContent>
+	    </Dialog>)}
+
+	{nestedConfirm && (
+	    <Dialog
+		open
+		onOpenChange={open => {
+		  if (!(open))
+		    closeNestedConfirm (false)
+		}}>
 	      <DialogContent className="px-6 pb-6 pt-7">
 		<DialogHeader className="pl-8">
-		  <DialogTitle>{active.options.title}</DialogTitle>
+		  <DialogTitle>{nestedConfirm.options.title}</DialogTitle>
 
-		  {active.options.description && (
+		  {nestedConfirm.options.description && (
 		      <DialogDescription asChild>
-			<div>{active.options.description}</div>
+			<div>{nestedConfirm.options.description}</div>
 		      </DialogDescription>)}
 		</DialogHeader>
 
 		<DialogFooter>
-		  {active.kind === 'confirm' && (
-		      <>
-			<Button
-			    variant="outline"
-			    onClick={() => closeActive (false)}>
-			  {active.options.cancelText ?? '取消'}
-			</Button>
+		  <Button
+		      variant="outline"
+		      onClick={() => closeNestedConfirm (false)}>
+		    {nestedConfirm.options.cancelText ?? '取消'}
+		  </Button>
 
-			<Button
-			    variant={(active.options.variant === 'danger')
-				     ? 'destructive'
-				     : 'default'}
-			    onClick={() => closeActive (true)}>
-			  {active.options.confirmText ?? '確定'}
-			</Button>
-		      </>)}
-
-		  {active.kind === 'alert' && (
-		      <Button onClick={() => closeActive ()}>
-			{active.options.okText ?? '確定'}
-		      </Button>)}
-
-		  {active.kind === 'choice' && (
-		      <>
-			<Button
-			    variant="outline"
-			    onClick={() => closeActive (null)}>
-			  {active.options.cancelText ?? '取消'}
-			</Button>
-
-			{active.options.choices.map (choice => (
-			    <Button
-				key={choice.value}
-				variant={(choice.variant === 'danger')
-					 ? 'destructive'
-					 : 'default'}
-				onClick={() => closeActive (choice.value)}>
-			      {choice.label}
-			    </Button>))}
-		      </>)}
+		  <Button
+		      variant={nestedConfirm.options.variant === 'danger'
+			  ? 'destructive'
+			  : 'default'}
+		      onClick={() => closeNestedConfirm (true)}>
+		    {nestedConfirm.options.confirmText ?? '確定'}
+		  </Button>
 		</DialogFooter>
-	      </DialogContent>)}
-	</Dialog>
+	      </DialogContent>
+	    </Dialog>)}
       </DialogueContext.Provider>)
 }
-
-
-export const useDialogue = () => {
-  const dialogue = useContext (DialogueContext)
-
-  if (!(dialogue))
-    throw new Error ('useDialogue must be used inside DialogueProvider')
-
-  return dialogue
-}
-
+export { useDialogue } from '@/lib/dialogues/useDialogue'
 export default DialogueProvider

frontend/src/components/layout/MainArea.tsx

@@ -1,5 +1,7 @@
 import { motion } from 'framer-motion'
 
+import { clientAnimationTransition } from '@/lib/clientAnimation'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
 
 import type { FC, ReactNode } from 'react'
@@ -9,12 +11,21 @@ type Props = {
     className?: string }
 
 
-const MainArea: FC<Props> = ({ children, className }) => (
-    <motion.main
-	transition={{ layout: { duration: .2, ease: 'easeOut' } }}
-	className={cn ('flex-1 overflow-y-auto p-4', className)}
-	layout="position">
-      {children}
-    </motion.main>)
+const MainArea: FC<Props> = ({ children, className }) => {
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const layoutTransition = clientAnimationTransition (
+      animationMode,
+      { normal: { duration: .2, ease: 'easeOut' as const } },
+  )
 
-export default MainArea
+  return (
+      <motion.main
+	  transition={{ layout: layoutTransition }}
+	  className={cn ('flex-1 overflow-y-auto p-4', className)}
+	  layout={animationMode === 'off' ? false : 'position'}>
+	{children}
+      </motion.main>)
+}
+
+export default MainArea

frontend/src/components/layout/SidebarComponent.tsx

@@ -1,6 +1,8 @@
 import { motion } from 'framer-motion'
 import { Helmet } from 'react-helmet-async'
 
+import { clientAnimationTransition } from '@/lib/clientAnimation'
+import { useClientBehaviourSettings } from '@/lib/useClientBehaviourSettings'
 import { cn } from '@/lib/utils'
 
 import type { CSSProperties, FC, MouseEvent, PointerEvent, ReactNode } from 'react'
@@ -68,6 +70,12 @@ const SidebarComponent: FC<Props> = ({
     sidebarKey,
     side = 'left',
 }) => {
+  const behaviourSettings = useClientBehaviourSettings ()
+  const animationMode = behaviourSettings.animation ?? 'normal'
+  const layoutTransition = clientAnimationTransition (
+      animationMode,
+      { normal: { duration: .2, ease: 'easeOut' as const } },
+  )
   const rootRef = useRef<HTMLDivElement | null> (null)
   const maxWidthRef = useRef (maxWidth)
   const getContainerWidth = useCallback (() => {
@@ -305,8 +313,8 @@ const SidebarComponent: FC<Props> = ({
   return (
       <motion.div
 	  ref={rootRef}
-	  layout="position"
-	  transition={{ layout: { duration: .2, ease: 'easeOut' } }}
+	  layout={animationMode === 'off' ? false : 'position'}
+	  transition={{ layout: layoutTransition }}
 	  style={style}
 	  className={cn (
 	      'relative w-full md:w-[var(--sidebar-width)] md:shrink-0 md:h-full',

frontend/src/components/posts/import/PostImportRowForm.test.tsx

@@ -0,0 +1,91 @@
+import { act, render, screen, waitFor } from '@testing-library/react'
+import { describe, expect, it, vi } from 'vitest'
+
+import PostImportRowForm from '@/components/posts/import/PostImportRowForm'
+import { buildPostImportRow } from '@/test/postImportFactories'
+
+import type { DialogueFormAction, DialogueFormControls } from '@/lib/dialogues/useDialogue'
+
+describe ('PostImportRowForm', () => {
+  it ('resets only the draft, then saves with resetRequested', async () => {
+    const row = buildPostImportRow ()
+    row.attributes.title = 'manual title'
+    row.provenance.title = 'manual'
+    const actions: DialogueFormAction[][] = []
+    const controls: DialogueFormControls = {
+      close: vi.fn (),
+      confirm: vi.fn ().mockResolvedValue (true),
+      setActions: next => actions.push (next) }
+    const invalidRow = buildPostImportRow ({
+      validationErrors: { title: ['タイトルを確認してください．'] } })
+    const onSave = vi.fn ().mockResolvedValue ({ saved: false, row: invalidRow })
+
+    render (<PostImportRowForm row={row} controls={controls} onSave={onSave}/>)
+    const titleInput = screen.getByDisplayValue ('manual title')
+
+    await waitFor (() => expect (actions.at (-1)?.length).toBe (2))
+    const reset = actions.at (-1)?.find (_1 => _1.label === '変更をリセット')
+    expect (reset).toMatchObject ({ placement: 'start', variant: 'danger', disabled: false })
+    await act (async () => {
+      await reset?.onSelect ()
+    })
+
+    expect (controls.confirm).toHaveBeenCalled ()
+    expect (titleInput).toHaveValue ('')
+    expect (onSave).not.toHaveBeenCalled ()
+
+    const save = actions.at (-1)?.find (_1 => _1.label === '編輯内容を保存')
+    await act (async () => {
+      await save?.onSelect ()
+    })
+
+    expect (onSave).toHaveBeenCalledWith ({
+      draft: expect.objectContaining ({ title: '' }),
+      resetRequested: true })
+    expect (screen.getByText ('タイトルを確認してください．')).toBeInTheDocument ()
+  })
+
+  it ('does not reset the draft when confirmation is cancelled', async () => {
+    const row = buildPostImportRow ({ attributes: { title: 'manual title' } })
+    let actions: DialogueFormAction[] = []
+    const controls: DialogueFormControls = {
+      close: vi.fn (),
+      confirm: vi.fn ().mockResolvedValue (false),
+      setActions: next => {
+	actions = next
+      } }
+
+    render (
+	<PostImportRowForm
+	    row={row}
+	    controls={controls}
+	    onSave={vi.fn ()}/>)
+    await waitFor (() => expect (actions.length).toBe (2))
+
+    await act (async () => {
+      await actions.find (_1 => _1.label === '変更をリセット')?.onSelect ()
+    })
+
+    expect (screen.getByDisplayValue ('manual title')).toBeInTheDocument ()
+  })
+
+  it ('marks edited fields and areas invalid from field errors', () => {
+    const row = buildPostImportRow ({
+      validationErrors: { url: ['URL error'], tags: ['tag error'] },
+      importErrors: { duration: ['duration error'] },
+      fieldWarnings: { title: ['title warning'] } })
+
+    render (
+	<PostImportRowForm
+	    row={row}
+	    controls={{ close: vi.fn (), confirm: vi.fn (), setActions: vi.fn () }}
+	    onSave={vi.fn ()}/>)
+
+    expect (screen.getByText ('URL error')).toBeInTheDocument ()
+    expect (screen.getByText ('tag error')).toBeInTheDocument ()
+    expect (screen.getByText ('duration error')).toBeInTheDocument ()
+    expect (screen.getByText ('title warning')).toBeInTheDocument ()
+    expect (screen.getAllByRole ('textbox').filter (
+	_1 => _1.getAttribute ('aria-invalid') === 'true')).toHaveLength (3)
+  })
+})

frontend/src/components/posts/import/PostImportRowForm.tsx

@@ -0,0 +1,277 @@
+import { useCallback, useEffect, useMemo, useState } from 'react'
+
+import PostOriginalCreatedTimeField from '@/components/PostOriginalCreatedTimeField'
+import FieldError from '@/components/common/FieldError'
+import FieldWarning from '@/components/common/FieldWarning'
+import FormField from '@/components/common/FormField'
+import TextArea from '@/components/common/TextArea'
+import ThumbnailPreview from '@/components/posts/import/ThumbnailPreview'
+import { inputClass } from '@/lib/utils'
+
+import type { FC } from 'react'
+
+import type { PostImportRow } from '@/lib/postImportSession'
+import type { DialogueFormControls } from '@/lib/dialogues/useDialogue'
+
+type Draft = {
+  url:                   string
+  title:                 string
+  thumbnailBase:         string
+  originalCreatedFrom:   string
+  originalCreatedBefore: string
+  duration:              string
+  tags:                  string
+  parentPostIds:         string }
+
+type Props = {
+  row:          PostImportRow
+  controls:     DialogueFormControls
+  onSave:       (args: { draft:          Draft
+			 resetRequested: boolean }) => Promise<{
+			     saved: boolean
+			     row:   PostImportRow | null }> }
+
+const buildDraft = (row: PostImportRow): Draft => ({
+    url: row.url,
+    title: String (row.attributes.title ?? ''),
+    thumbnailBase: String (row.attributes.thumbnailBase ?? ''),
+    originalCreatedFrom: String (row.attributes.originalCreatedFrom ?? ''),
+    originalCreatedBefore: String (row.attributes.originalCreatedBefore ?? ''),
+    duration: String (row.attributes.duration ?? ''),
+    tags: String (row.attributes.tags ?? ''),
+    parentPostIds: String (row.attributes.parentPostIds ?? '') })
+
+const buildResetDraft = (row: PostImportRow): Draft => ({
+    url: row.resetSnapshot.url,
+    title: String (row.resetSnapshot.attributes.title ?? ''),
+    thumbnailBase: String (row.resetSnapshot.attributes.thumbnailBase ?? ''),
+    originalCreatedFrom: String (row.resetSnapshot.attributes.originalCreatedFrom ?? ''),
+    originalCreatedBefore: String (row.resetSnapshot.attributes.originalCreatedBefore ?? ''),
+    duration: String (row.resetSnapshot.attributes.duration ?? ''),
+    tags: String (row.resetSnapshot.attributes.tags ?? ''),
+    parentPostIds: String (row.resetSnapshot.attributes.parentPostIds ?? '') })
+
+const groupedMessages = (...values: (string[] | undefined)[]): string[] =>
+    values.flatMap (value => value ?? [])
+
+const sameDraft = (left:  Draft, right: Draft): boolean =>
+    left.url === right.url
+    && left.title === right.title
+    && left.thumbnailBase === right.thumbnailBase
+    && left.originalCreatedFrom === right.originalCreatedFrom
+    && left.originalCreatedBefore === right.originalCreatedBefore
+    && left.duration === right.duration
+    && left.tags === right.tags
+    && left.parentPostIds === right.parentPostIds
+
+
+const PostImportRowForm: FC<Props> = (
+    { row,
+      controls,
+      onSave },
+) => {
+  const [draft, setDraft] = useState<Draft> (() => buildDraft (row))
+  const [messageRow, setMessageRow] = useState<PostImportRow | null> (null)
+  const [saving, setSaving] = useState (false)
+  const [resetRequested, setResetRequested] = useState (false)
+
+  useEffect (() => {
+    const nextDraft = buildDraft (row)
+    setDraft (nextDraft)
+    setMessageRow (null)
+    setResetRequested (false)
+  }, [row])
+
+  const displayRow = messageRow ?? row
+  const resetDraft = useMemo (
+      () => buildResetDraft (row),
+      [row])
+  const resetDisabled = saving || sameDraft (draft, resetDraft)
+
+  const update = <Key extends keyof Draft,> (
+      key:   Key,
+      value: Draft[Key],
+  ) => {
+    if (messageRow != null)
+      setMessageRow (null)
+    setDraft (current => ({ ...current, [key]: value }))
+  }
+
+  const reset = useCallback (async (): Promise<boolean> => {
+    if (resetDisabled)
+      return false
+
+    const confirmed = await controls.confirm ({
+	title: '変更をリセットしますか?',
+	description: '現在の URL に対する自動取得直後の内容へ戻します．',
+	confirmText: 'リセット',
+	cancelText: '取消',
+	variant: 'danger' })
+    if (!(confirmed))
+      return false
+
+    setDraft (resetDraft)
+    setResetRequested (true)
+    setMessageRow (null)
+    return false
+  }, [controls, resetDisabled, resetDraft])
+
+  const save = useCallback (async (): Promise<boolean> => {
+    setSaving (true)
+    try
+      {
+	const result = await onSave ({ draft, resetRequested })
+	if (result.saved)
+	  return true
+
+	if (result.row != null)
+	  setMessageRow (result.row)
+	return false
+      }
+    finally
+      {
+	setSaving (false)
+      }
+  }, [draft, onSave, resetRequested])
+
+  useEffect (() => {
+    controls.setActions ([{
+	label: '変更をリセット',
+	placement: 'start',
+	variant: 'danger',
+	disabled: resetDisabled,
+	onSelect: reset },
+	{
+	  label: '編輯内容を保存',
+	  disabled: saving,
+	  onSelect: save }])
+  }, [controls, resetDisabled, reset, save, saving])
+
+  return (
+      <>
+	<div className="px-6 pb-6">
+	  <div className="space-y-4">
+	    <div className="grid gap-6 md:grid-cols-[7rem_minmax(0,1fr)]">
+	      <div className="space-y-3 md:sticky md:top-0 md:self-start">
+		<ThumbnailPreview
+		    url={draft.thumbnailBase}
+		    className="h-28 w-28"/>
+	      </div>
+
+	      <div className="space-y-4">
+		<PostImportTextField
+		    label="URL"
+		    value={draft.url}
+		    warnings={displayRow.fieldWarnings.url}
+		    errors={groupedMessages (
+			displayRow.validationErrors.url,
+			displayRow.importErrors?.url)}
+		    onChange={value => update ('url', value)}/>
+		<PostImportTextField
+		    label="タイトル"
+		    value={draft.title}
+		    warnings={displayRow.fieldWarnings.title}
+		    errors={groupedMessages (
+			displayRow.validationErrors.title,
+			displayRow.importErrors?.title)}
+		    onChange={value => update ('title', value)}/>
+		<PostImportTextField
+		    label="サムネール基底 URL"
+		    value={draft.thumbnailBase}
+		    warnings={displayRow.fieldWarnings.thumbnailBase}
+		    errors={groupedMessages (
+			displayRow.validationErrors.thumbnailBase,
+			displayRow.importErrors?.thumbnailBase)}
+		    onChange={value => update ('thumbnailBase', value)}/>
+		<PostOriginalCreatedTimeField
+		    originalCreatedFrom={draft.originalCreatedFrom || null}
+		    setOriginalCreatedFrom={value => update ('originalCreatedFrom', value ?? '')}
+		    originalCreatedBefore={draft.originalCreatedBefore || null}
+		    setOriginalCreatedBefore={value => update ('originalCreatedBefore', value ?? '')}
+		    errors={groupedMessages (
+			displayRow.validationErrors.originalCreatedAt,
+			displayRow.validationErrors.originalCreatedFrom,
+			displayRow.validationErrors.originalCreatedBefore,
+			displayRow.importErrors?.originalCreatedAt,
+			displayRow.importErrors?.originalCreatedFrom,
+			displayRow.importErrors?.originalCreatedBefore)}/>
+		<PostImportTextField
+		    label="動画時間"
+		    value={draft.duration}
+		    errors={groupedMessages (
+			displayRow.validationErrors.duration,
+			displayRow.validationErrors.videoMs,
+			displayRow.importErrors?.duration,
+			displayRow.importErrors?.videoMs)}
+		    onChange={value => update ('duration', value)}/>
+		<PostImportAreaField
+		    label="タグ"
+		    value={draft.tags}
+		    warnings={displayRow.fieldWarnings.tags}
+		    errors={groupedMessages (
+			displayRow.validationErrors.tags,
+			displayRow.importErrors?.tags)}
+		    onChange={value => update ('tags', value)}/>
+		<PostImportTextField
+		    label="親投稿"
+		    value={draft.parentPostIds}
+		    errors={groupedMessages (
+			displayRow.validationErrors.parentPostIds,
+			displayRow.importErrors?.parentPostIds)}
+		    onChange={value => update ('parentPostIds', value)}/>
+		<FieldWarning messages={displayRow.baseWarnings}/>
+		<FieldError messages={displayRow.validationErrors.base}/>
+		<FieldError messages={displayRow.importErrors?.base}/>
+	      </div>
+	    </div>
+	  </div>
+	</div>
+      </>)
+}
+
+const PostImportTextField = (
+    { label, value, warnings, errors, onChange }: {
+	label:    string
+	value:    string
+	warnings?: string[]
+	errors?:  string[]
+	onChange: (value: string) => void },
+) => (
+    <FormField label={label} messages={errors}>
+      {({ describedBy, invalid }) => (
+	  <>
+	    <input
+		value={value}
+		onChange={ev => onChange (ev.target.value)}
+		aria-describedby={describedBy}
+		aria-invalid={invalid}
+		className={inputClass (invalid)}/>
+	    <FieldWarning messages={warnings}/>
+	  </>)}
+    </FormField>)
+
+const PostImportAreaField = (
+    { label, value, warnings, errors, onChange }: {
+	label:    string
+	value:    string
+	warnings?: string[]
+	errors?:  string[]
+	onChange: (value: string) => void },
+) => (
+    <FormField label={label} messages={errors}>
+      {({ describedBy, invalid }) => (
+	  <>
+	    <TextArea
+		value={value}
+		rows={4}
+		onChange={ev => onChange (ev.target.value)}
+		aria-describedby={describedBy}
+		invalid={invalid}
+		className="h-auto"/>
+	    <FieldWarning messages={warnings}/>
+	  </>)}
+    </FormField>)
+
+export default PostImportRowForm
+export { buildDraft }
+export type { Draft as PostImportRowDraft }

frontend/src/components/posts/import/PostImportRowSummary.tsx

@@ -0,0 +1,112 @@
+import { Button } from '@/components/ui/button'
+import { cn } from '@/lib/utils'
+
+import PostImportStatusBadge from '@/components/posts/import/PostImportStatusBadge'
+import ThumbnailPreview from '@/components/posts/import/ThumbnailPreview'
+import { displayPostImportStatus } from '@/components/posts/import/postImportRowStatus'
+
+import type { FC } from 'react'
+
+import type { PostImportRow } from '@/lib/postImportSession'
+
+type Props = {
+    row:     PostImportRow
+    onEdit:  () => void }
+
+const summaryWarning = (row: PostImportRow): string | null =>
+    Object.values (row.fieldWarnings ?? { }).flat ()[0]
+    ?? row.baseWarnings?.[0]
+    ?? null
+
+const summaryDate = (row: PostImportRow): string =>
+    [row.attributes.originalCreatedFrom, row.attributes.originalCreatedBefore]
+	.filter (_1 => typeof _1 === 'string' && _1 !== '')
+	.join (' ～ ')
+
+
+const PostImportRowSummary: FC<Props> = ({ row, onEdit }) => {
+    const warning = summaryWarning (row)
+    const displayStatus = displayPostImportStatus (row)
+
+    return (
+	<>
+	  <div
+	      className={cn (
+		  'hidden items-center gap-4 rounded-lg border p-4 md:grid',
+		  'md:grid-cols-[4rem_5rem_minmax(0,1fr)_auto_auto]',
+		  'transition-shadow hover:shadow-sm')}>
+	    <div className="space-y-1">
+	      <div className="text-sm font-medium">#{row.sourceRow}</div>
+	    </div>
+	    <ThumbnailPreview
+		url={String (row.attributes.thumbnailBase ?? '')}
+		className="h-16 w-16"/>
+	    <div className="min-w-0 space-y-1">
+	      <div className="line-clamp-2 text-sm font-medium">
+		{String (row.attributes.title ?? '') || '（タイトル未取得）'}
+	      </div>
+	      <div className="truncate text-xs text-neutral-600 dark:text-neutral-300">
+		{row.url}
+	      </div>
+	      <div className="truncate text-xs text-neutral-500 dark:text-neutral-400">
+		{String (row.attributes.tags ?? '') || 'タグなし'}
+	      </div>
+	      <div className="text-xs text-neutral-500 dark:text-neutral-400">
+		{summaryDate (row) || '日時未取得'}
+		{row.attributes.duration ? ` / ${ row.attributes.duration }` : ''}
+	      </div>
+	      {warning && (
+		  <div className="text-xs text-amber-700 dark:text-amber-200">
+		    {warning}
+		  </div>)}
+	    </div>
+	    <div className="space-y-1">
+	      {displayStatus != null && <PostImportStatusBadge value={displayStatus}/>}
+	    </div>
+	    <div className="flex justify-end">
+	      <Button
+		  type="button"
+		  variant="outline"
+		  onClick={onEdit}
+		  disabled={row.importStatus === 'created'}>
+		編輯
+	      </Button>
+	    </div>
+	  </div>
+
+	  <div
+	      className={cn (
+		  'space-y-3 rounded-lg border p-4 md:hidden',
+		  'transition-shadow hover:shadow-sm')}>
+	    <div className="flex items-start gap-3">
+	      <ThumbnailPreview
+		  url={String (row.attributes.thumbnailBase ?? '')}
+		  className="h-20 w-20 shrink-0"/>
+	      <div className="min-w-0 flex-1 space-y-2">
+		<div className="line-clamp-2 text-sm font-medium">
+		  {String (row.attributes.title ?? '') || '（タイトル未取得）'}
+		</div>
+		<div className="truncate text-xs text-neutral-600 dark:text-neutral-300">
+		  {row.url}
+		</div>
+		<div className="flex flex-wrap gap-2">
+		  {displayStatus != null && <PostImportStatusBadge value={displayStatus}/>}
+		</div>
+		{warning && (
+		    <div className="text-xs text-amber-700 dark:text-amber-200">
+		      {warning}
+		    </div>)}
+	      </div>
+	    </div>
+	    <Button
+		type="button"
+		variant="outline"
+		onClick={onEdit}
+		disabled={row.importStatus === 'created'}>
+	      編輯
+	    </Button>
+	  </div>
+	</>)
+}
+
+export default PostImportRowSummary

frontend/src/components/posts/import/PostImportStatusBadge.tsx

@@ -0,0 +1,27 @@
+import StatusBadge from '@/components/common/StatusBadge'
+
+import type { FC } from 'react'
+
+import type { StatusBadgeTone } from '@/components/common/StatusBadge'
+import type { PostImportBadgeValue } from '@/components/posts/import/postImportRowStatus'
+
+type Props = {
+    value: PostImportBadgeValue }
+
+const LABELS: Record<PostImportBadgeValue, string> = {
+    ready: '登録可能',
+    warning: '警告',
+    skipped: 'スキップ' }
+
+const TONES: Record<PostImportBadgeValue, StatusBadgeTone> = {
+    ready: 'success',
+    warning: 'warning',
+    skipped: 'neutral' }
+
+
+const PostImportStatusBadge: FC<Props> = ({ value }) => (
+    <StatusBadge tone={TONES[value]}>
+      {LABELS[value]}
+    </StatusBadge>)
+
+export default PostImportStatusBadge

frontend/src/components/posts/import/ThumbnailPreview.tsx

@@ -0,0 +1,49 @@
+import { useEffect, useState } from 'react'
+
+import type { FC } from 'react'
+
+
+type Props = {
+    url:       string
+    alt?:      string
+    className?: string }
+
+
+const ThumbnailPreview: FC<Props> = ({ url, alt = 'サムネール', className = 'h-16 w-16' }) => {
+    const [failed, setFailed] = useState (false)
+
+    useEffect (() => {
+	setFailed (false)
+    }, [url])
+
+    if (!(url))
+      {
+	return (
+	    <div
+		className={`${ className } flex items-center justify-center rounded border
+			    border-border bg-muted text-xs text-muted-foreground`}>
+	      なし
+	    </div>)
+      }
+
+    if (failed)
+      {
+	return (
+	    <div
+		className={`${ className } flex items-center justify-center rounded border
+			    border-amber-300 bg-amber-50 p-2 text-center text-xs
+			    text-amber-700 dark:border-amber-900 dark:bg-amber-950
+			    dark:text-amber-200`}>
+	      サムネールを表示できません
+	    </div>)
+      }
+
+    return (
+	<img
+	    src={url}
+	    alt={alt}
+	    className={`${ className } rounded border border-border object-cover`}
+	    onError={() => setFailed (true)}/>)
+}
+
+export default ThumbnailPreview

frontend/src/components/posts/import/postImportRowStatus.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest'
+
+import { displayPostImportStatus } from '@/components/posts/import/postImportRowStatus'
+import { buildPostImportRow } from '@/test/postImportFactories'
+
+describe ('displayPostImportStatus', () => {
+  it ('shows only ready, warning, and skipped states', () => {
+    expect (displayPostImportStatus (buildPostImportRow ())).toBe ('ready')
+    expect (displayPostImportStatus (buildPostImportRow ({
+      status: 'warning',
+      fieldWarnings: { title: ['warning'] } }))).toBe ('warning')
+    expect (displayPostImportStatus (buildPostImportRow ({
+      skipReason: 'existing',
+      existingPostId: 2 }))).toBe ('skipped')
+  })
+
+  it ('does not expose validation, failure, or created states as badges', () => {
+    expect (displayPostImportStatus (buildPostImportRow ({
+      status: 'error',
+      validationErrors: { title: ['invalid'] } }))).toBeNull ()
+    expect (displayPostImportStatus (buildPostImportRow ({
+      importStatus: 'failed' }))).toBeNull ()
+    expect (displayPostImportStatus (buildPostImportRow ({
+      importStatus: 'created',
+      createdPostId: 3 }))).toBeNull ()
+  })
+})

frontend/src/components/posts/import/postImportRowStatus.ts

@@ -0,0 +1,22 @@
+import type { PostImportRow } from '@/lib/postImportSession'
+
+export type PostImportDisplayStatus = 'ready' | 'skipped' | 'warning'
+
+export type PostImportBadgeValue = PostImportDisplayStatus
+
+const hasWarnings = (row: PostImportRow): boolean =>
+    Object.values (row.fieldWarnings ?? { }).some (_1 => _1.length > 0)
+    || row.baseWarnings.length > 0
+
+export const displayPostImportStatus = (
+    row: PostImportRow,
+): PostImportDisplayStatus | null =>
+    (row.skipReason === 'existing' || row.importStatus === 'skipped')
+    ? 'skipped'
+    : ((Object.keys (row.validationErrors ?? { }).length > 0
+	|| row.importStatus === 'failed'
+	|| row.importStatus === 'created')
+       ? null
+       : ((hasWarnings (row) || row.status === 'warning')
+	  ? 'warning'
+	  : 'ready'))

frontend/src/components/users/BehaviourSettingsSection.tsx

@@ -0,0 +1,198 @@
+import { useEffect, useMemo, useState } from 'react'
+
+import { Button } from '@/components/ui/button'
+import { toast } from '@/components/ui/use-toast'
+import { getClientBehaviorSettings, setClientBehaviorSettings } from '@/lib/settings'
+import { cn } from '@/lib/utils'
+
+import type { FC, ReactNode } from 'react'
+
+import type { ClientAnimationMode,
+	      ClientBehaviorSettings,
+	      ClientEmbedAutoLoadMode,
+	      ClientLinkPreloadMode,
+	      ClientTagRelationDisplayMode } from '@/lib/settings'
+
+type Props = {
+    sectionClassName: string
+    onDirtyStateChange?: (
+	dirty: boolean,
+	discard: () => void,
+    ) => void }
+
+type SegmentedOption<T extends string> = {
+    value: T
+    label: string }
+
+type SegmentedControlProps<T extends string> = {
+    value:     T
+    options:   SegmentedOption<T>[]
+    onChange:  (value: T) => void }
+
+type SettingBlockProps = {
+    title:        string
+    description?: string
+    children:     ReactNode }
+
+const animationOptions: SegmentedOption<ClientAnimationMode>[] = [
+    { value: 'off', label: 'なし' },
+    { value: 'reduced', label: '控えめ' },
+    { value: 'normal', label: '通常' }]
+
+const embedAutoLoadOptions: SegmentedOption<ClientEmbedAutoLoadMode>[] = [
+    { value: 'off', label: '読み込まない' },
+    { value: 'manual', label: 'クリック時' },
+    { value: 'auto', label: '自動' }]
+
+const linkPreloadOptions: SegmentedOption<ClientLinkPreloadMode>[] = [
+    { value: 'off', label: 'しない' },
+    { value: 'intent', label: 'する' }]
+
+const tagRelationDisplayOptions: SegmentedOption<ClientTagRelationDisplayMode>[] = [
+    { value: 'flat', label: 'まとめない' },
+    { value: 'grouped', label: 'まとめる' }]
+
+const SegmentedControl = <T extends string,> (
+    { value, options, onChange }: SegmentedControlProps<T>,
+) => {
+  return (
+      <div
+	  role="radiogroup"
+	  className="flex flex-wrap gap-2 rounded-xl border border-border bg-muted/40 p-1">
+	{options.map (option => (
+	    <button
+		key={option.value}
+		type="button"
+		role="radio"
+		aria-checked={value === option.value}
+		className={cn (
+		    'min-w-0 flex-1 rounded-lg px-3 py-2 text-sm font-medium',
+		    'transition-colors focus-visible:outline-none focus-visible:ring-2',
+		    'focus-visible:ring-ring focus-visible:ring-offset-2',
+		    value === option.value
+		    ? 'bg-primary text-primary-foreground shadow-sm ring-1 ring-primary/40'
+		    : 'bg-transparent text-muted-foreground hover:bg-background/70 hover:text-foreground',
+		)}
+		onClick={() => onChange (option.value)}>
+	      {option.label}
+	    </button>))}
+      </div>)
+}
+
+
+const SettingBlock: FC<SettingBlockProps> = (
+    { title, description, children },
+) => (
+    <div className="space-y-3 rounded-xl px-4">
+      <div className="space-y-1">
+	<h3 className="text-sm font-semibold">{title}</h3>
+	<p className="text-sm text-muted-foreground">{description}</p>
+      </div>
+      {children}
+    </div>)
+
+
+const BehaviourSettingsSection: FC<Props> = (
+    { sectionClassName,
+      onDirtyStateChange },
+) => {
+  const [savedSettings, setSavedSettings] =
+      useState<ClientBehaviorSettings> (() => getClientBehaviorSettings ())
+  const [draftSettings, setDraftSettings] =
+      useState<ClientBehaviorSettings> (() => getClientBehaviorSettings ())
+
+  useEffect (() => {
+    const current = getClientBehaviorSettings ()
+    setSavedSettings (current)
+    setDraftSettings (current)
+  }, [])
+
+  const hasUnsavedChanges = useMemo (
+      () => JSON.stringify (draftSettings) !== JSON.stringify (savedSettings),
+      [draftSettings, savedSettings])
+
+  const updateDraft = <Key extends keyof ClientBehaviorSettings,> (
+      key:    Key,
+      value:  ClientBehaviorSettings[Key],
+  ) => {
+    setDraftSettings (current => ({ ...current, [key]: value }))
+  }
+
+  const handleSave = () => {
+    const next = setClientBehaviorSettings (draftSettings)
+    setSavedSettings (next)
+    setDraftSettings (next)
+    toast ({ title: '動作設定を保存しました' })
+  }
+
+  const handleDiscard = () => {
+    setDraftSettings (savedSettings)
+  }
+
+  useEffect (() => {
+    onDirtyStateChange?.(hasUnsavedChanges, handleDiscard)
+
+    return () => {
+      onDirtyStateChange?.(false, () => { })
+    }
+  }, [handleDiscard, hasUnsavedChanges, onDirtyStateChange])
+
+  return (
+      <section className={sectionClassName}>
+	<div className="flex flex-wrap items-start justify-between gap-3">
+	  <div className="space-y-1">
+	    <h2 className="text-xl font-bold">動作</h2>
+	  </div>
+
+	  <div className="flex flex-wrap gap-2">
+	    <Button
+		type="button"
+		variant="destructive"
+		disabled={hasUnsavedChanges === false}
+		onClick={handleDiscard}>
+	      変更を破棄
+	    </Button>
+	    <Button
+		type="button"
+		disabled={hasUnsavedChanges === false}
+		onClick={handleSave}>
+	      保存
+	    </Button>
+	  </div>
+	</div>
+
+	<div className="space-y-4">
+	  <SettingBlock title="アニメーション">
+	    <SegmentedControl
+		value={draftSettings.animation ?? 'normal'}
+		options={animationOptions}
+		onChange={value => updateDraft ('animation', value)}/>
+	  </SettingBlock>
+
+	  <SettingBlock
+	      title="リンク先の先読み"
+	      description="マウスを置いた時点でリンク先のデータを取得します。">
+	    <SegmentedControl
+		value={draftSettings.linkPreload ?? 'intent'}
+		options={linkPreloadOptions}
+		onChange={value => updateDraft ('linkPreload', value)}/>
+	  </SettingBlock>
+
+	  <SettingBlock title="タグの親子関係表示">
+	    <SegmentedControl
+		value={draftSettings.tagRelationDisplay ?? 'grouped'}
+		options={tagRelationDisplayOptions}
+		onChange={value => updateDraft ('tagRelationDisplay', value)}/>
+	  </SettingBlock>
+
+	  <SettingBlock title="埋め込み自動読込">
+	    <SegmentedControl
+		value={draftSettings.embedAutoLoad ?? 'auto'}
+		options={embedAutoLoadOptions}
+		onChange={value => updateDraft ('embedAutoLoad', value)}/>
+	  </SettingBlock>
+	</div>
+      </section>)
+}
+
+export default BehaviourSettingsSection

frontend/src/components/users/KeyboardSettingsSection.tsx

@@ -0,0 +1,262 @@
+import { useEffect, useMemo, useState } from 'react'
+
+import { Button } from '@/components/ui/button'
+import { toast } from '@/components/ui/use-toast'
+import {
+    getConflictingShortcutActionIds,
+    formatKeyBinding,
+    isSpaceBinding,
+    keyBindingFromKeyboardEvent,
+    SHORTCUT_DEFINITIONS,
+    SHORTCUT_SCOPE_LABELS,
+} from '@/lib/keyboardShortcuts'
+import { getEffectiveKeyBindings } from '@/lib/settings'
+import { useKeyboardShortcutSettings } from '@/lib/useKeyboardShortcuts'
+
+import type { ShortcutActionId } from '@/lib/keyboardShortcuts'
+import type { ClientKeyboardSettings } from '@/lib/settings'
+import type { FC } from 'react'
+
+type Props = {
+    sectionClassName: string
+    onDirtyStateChange?: (
+	dirty: boolean,
+	discard: () => void,
+    ) => void
+}
+
+
+const KeyboardSettingsSection: FC<Props> = (
+    { sectionClassName,
+      onDirtyStateChange },
+) => {
+  const {
+      keyboardSettings,
+      saveKeyboardSettings,
+  } = useKeyboardShortcutSettings ()
+  const [capturingActionId, setCapturingActionId] =
+      useState<ShortcutActionId | null> (null)
+  const [draftKeyboardSettings, setDraftKeyboardSettings] =
+      useState<ClientKeyboardSettings> (keyboardSettings)
+
+  useEffect (() => {
+    setDraftKeyboardSettings (keyboardSettings)
+  }, [keyboardSettings])
+
+  const draftEffectiveBindings = useMemo (
+      () => getEffectiveKeyBindings (draftKeyboardSettings.bindings),
+      [draftKeyboardSettings.bindings],
+  )
+  const draftConflictActionIds = useMemo (
+      () => getConflictingShortcutActionIds (draftEffectiveBindings),
+      [draftEffectiveBindings],
+  )
+  const hasUnsavedChanges = useMemo (
+      () => JSON.stringify (draftKeyboardSettings) !== JSON.stringify (keyboardSettings),
+      [draftKeyboardSettings, keyboardSettings],
+  )
+
+  useEffect (() => {
+    if (capturingActionId == null)
+      return
+
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.isComposing || event.key === 'Process')
+	return
+
+      event.preventDefault ()
+      event.stopPropagation ()
+
+      if (event.key === 'Escape')
+	{
+	  setCapturingActionId (null)
+	  return
+	}
+
+      if (event.key === 'Backspace' || event.key === 'Delete')
+	{
+	  setDraftKeyboardSettings (current => ({
+	      ...current,
+	      bindings: {
+		  ...(current.bindings ?? { }),
+		  [capturingActionId]: null,
+	      },
+	  }))
+	  setCapturingActionId (null)
+	  return
+	}
+
+      const binding = keyBindingFromKeyboardEvent (event)
+      if (binding == null)
+	return
+
+      if (isSpaceBinding (binding))
+	{
+	  toast ({ title: 'Space は今は割り当てられません．' })
+	  return
+	}
+
+      setDraftKeyboardSettings (current => ({
+	  ...current,
+	  bindings: {
+	      ...(current.bindings ?? { }),
+	      [capturingActionId]: binding,
+	  },
+      }))
+      setCapturingActionId (null)
+    }
+
+    document.addEventListener ('keydown', onKeyDown, true)
+    return () => document.removeEventListener ('keydown', onKeyDown, true)
+  }, [capturingActionId])
+
+  const rows = useMemo (() => SHORTCUT_DEFINITIONS.map (definition => ({
+      ...definition,
+      currentBinding:    draftEffectiveBindings[definition.id],
+      hasConflict:       draftConflictActionIds.has (definition.id),
+      hasCustomBinding:  Object.prototype.hasOwnProperty.call (
+	  draftKeyboardSettings.bindings ?? { },
+	  definition.id,
+      ),
+  })), [
+      draftConflictActionIds,
+      draftEffectiveBindings,
+      draftKeyboardSettings.bindings,
+  ])
+
+  const handleSave = () => {
+    saveKeyboardSettings (draftKeyboardSettings)
+    toast ({ title: 'キーボード設定を保存しました' })
+  }
+
+  const handleDiscard = () => {
+    setDraftKeyboardSettings (keyboardSettings)
+    setCapturingActionId (null)
+  }
+
+  useEffect (() => {
+    onDirtyStateChange?.(hasUnsavedChanges, handleDiscard)
+
+    return () => {
+      onDirtyStateChange?.(false, () => { })
+    }
+  }, [handleDiscard, hasUnsavedChanges, onDirtyStateChange])
+
+  return (
+      <section className={sectionClassName}>
+	<div className="flex flex-wrap items-start justify-between gap-3">
+	  <div className="space-y-1">
+	    <h2 className="text-xl font-bold">キーボード</h2>
+	  </div>
+
+	  <div className="flex flex-wrap gap-2">
+	    <Button
+		type="button"
+		variant="outline"
+		onClick={() => {
+		  setDraftKeyboardSettings (current => ({
+		      ...current,
+		      bindings: { },
+		  }))
+		}}>
+	      すべて既定に戻す
+	    </Button>
+	    <Button
+		type="button"
+		variant="destructive"
+		disabled={!(hasUnsavedChanges)}
+		onClick={handleDiscard}>
+	      変更を破棄
+	    </Button>
+	    <Button
+		type="button"
+		disabled={!(hasUnsavedChanges) || draftConflictActionIds.size > 0}
+		onClick={handleSave}>
+	      保存
+	    </Button>
+	  </div>
+	</div>
+
+	<label className="flex items-center gap-2 text-sm">
+	  <input
+	      type="checkbox"
+	      checked={draftKeyboardSettings.enabled !== false}
+	      onChange={event => {
+		setDraftKeyboardSettings (current => ({
+		    ...current,
+		    enabled: event.target.checked,
+		}))
+	      }}/>
+	  <span>キーボード・ショートカットを有効にする</span>
+	</label>
+
+	{capturingActionId != null && (
+	    <p className="text-sm text-muted-foreground">
+	      キー入力待ちです．Escape で取消し，Backspace / Delete で未割当にできます．
+	    </p>)}
+
+	<div className="overflow-x-auto">
+	  <table className="w-full min-w-[52rem] table-fixed border-collapse text-sm">
+	    <thead className="border-b border-border">
+	      <tr>
+		<th className="p-2 text-left">操作</th>
+		<th className="p-2 text-left">適用範囲</th>
+		<th className="p-2 text-left">現在のキー</th>
+		<th className="p-2 text-left"></th>
+		<th className="p-2 text-left"></th>
+		<th className="p-2 text-left">競合状態</th>
+	      </tr>
+	    </thead>
+	    <tbody>
+	      {rows.map (row => (
+		  <tr key={row.id} className="border-b border-border/60 last:border-b-0">
+		    <td className="p-2">{row.label}</td>
+		    <td className="p-2">{SHORTCUT_SCOPE_LABELS[row.scope]}</td>
+		    <td className="p-2 font-mono">
+		      {formatKeyBinding (row.currentBinding)}
+		    </td>
+		    <td className="p-2">
+		      <Button
+			  type="button"
+			  variant={capturingActionId === row.id ? 'default' : 'outline'}
+			  className="h-8"
+			  onClick={() => {
+			    setCapturingActionId (
+				capturingActionId === row.id ? null : row.id,
+			    )
+			  }}>
+			{capturingActionId === row.id ? '入力待ち…' : '変更'}
+		      </Button>
+		    </td>
+		    <td className="p-2">
+		      <Button
+			  type="button"
+			  variant="ghost"
+			  className="h-8"
+			  disabled={!(row.hasCustomBinding)}
+			  onClick={() => {
+			    setDraftKeyboardSettings (current => {
+				const nextBindings = { ...(current.bindings ?? { }) }
+				delete nextBindings[row.id]
+				return {
+				    ...current,
+				    bindings: nextBindings,
+				}
+			    })
+			  }}>
+			既定に戻す
+		      </Button>
+		    </td>
+		    <td className="p-2">
+		      {row.hasConflict
+		       ? <span className="text-red-600 dark:text-red-400">競合あり</span>
+		       : 'なし'}
+		    </td>
+		  </tr>))}
+	    </tbody>
+	  </table>
+	</div>
+      </section>)
+}
+
+export default KeyboardSettingsSection

frontend/src/components/users/ShortcutHelpDialog.tsx

@@ -0,0 +1,87 @@
+import {
+    Dialog,
+    DialogContent,
+    DialogDescription,
+    DialogHeader,
+    DialogTitle,
+} from '@/components/ui/dialog'
+import {
+    formatKeyBinding,
+    SHORTCUT_DEFINITIONS,
+    SHORTCUT_SCOPE_LABELS,
+} from '@/lib/keyboardShortcuts'
+
+import type {
+    KeyBinding,
+    ShortcutActionId,
+    ShortcutScope,
+} from '@/lib/keyboardShortcuts'
+import type { FC } from 'react'
+
+type Props = {
+    open:               boolean
+    onOpenChange:       (open: boolean) => void
+    activeScope:        ShortcutScope
+    effectiveBindings:  Record<ShortcutActionId, KeyBinding | null>
+    conflictActionIds:  Set<ShortcutActionId>
+    availableActionIds: Set<ShortcutActionId>
+}
+
+
+const ShortcutHelpDialog: FC<Props> = (
+    {
+	open,
+	onOpenChange,
+	activeScope,
+	effectiveBindings,
+	conflictActionIds,
+	availableActionIds,
+    },
+) => {
+  const rows = SHORTCUT_DEFINITIONS
+      .filter (definition =>
+	  definition.scope === 'global' || definition.scope === activeScope)
+      .filter (definition => availableActionIds.has (definition.id))
+
+  return (
+      <Dialog open={open} onOpenChange={onOpenChange}>
+	<DialogContent className="max-w-3xl px-6 pb-6 pt-7">
+	  <DialogHeader className="pl-8">
+	    <DialogTitle>キーボード・ショートカット</DialogTitle>
+	    <DialogDescription>
+	      この画面で利用できるショートカットを表示します。
+	    </DialogDescription>
+	  </DialogHeader>
+
+	  <div className="overflow-x-auto">
+	    <table className="w-full min-w-[40rem] table-fixed border-collapse text-sm">
+	      <thead className="border-b border-border">
+		<tr>
+		  <th className="p-2 text-left">操作</th>
+		  <th className="p-2 text-left">適用範囲</th>
+		  <th className="p-2 text-left">キー</th>
+		  <th className="p-2 text-left">競合</th>
+		</tr>
+	      </thead>
+	      <tbody>
+		{rows.map (row => (
+		    <tr key={row.id} className="border-b border-border/60 last:border-b-0">
+		      <td className="p-2">{row.label}</td>
+		      <td className="p-2">{SHORTCUT_SCOPE_LABELS[row.scope]}</td>
+		      <td className="p-2 font-mono">
+			{formatKeyBinding (effectiveBindings[row.id])}
+		      </td>
+		      <td className="p-2">
+			{conflictActionIds.has (row.id)
+			 ? <span className="text-red-600 dark:text-red-400">競合あり</span>
+			 : 'なし'}
+		      </td>
+		    </tr>))}
+	      </tbody>
+	    </table>
+	  </div>
+	</DialogContent>
+      </Dialog>)
+}
+
+export default ShortcutHelpDialog

frontend/src/index.css

@@ -10,6 +10,10 @@
   {
     --background: 0 0% 100%;
     --foreground: 222.2 84% 4.9%;
+    --card: 0 0% 100%;
+    --card-foreground: 222.2 84% 4.9%;
+    --popover: 0 0% 100%;
+    --popover-foreground: 222.2 84% 4.9%;
 
     --primary: 222.2 47.4% 11.2%;
     --primary-foreground: 210 40% 98%;
@@ -29,12 +33,40 @@
     --border: 214.3 31.8% 91.4%;
     --input: 214.3 31.8% 91.4%;
     --ring: 222.2 84% 4.9%;
+    --theme-link: 221.2 83.2% 53.3%;
+    --top-nav-root-bg-mobile: #fef08a;
+    --top-nav-root-bg-desktop: #fefce8;
+    --top-nav-active-bg: #fef08a;
+    --top-nav-submenu-bg: #fef08a;
+    --top-nav-mobile-menu-bg: #fef08a;
+    --top-nav-mobile-active-bg: #fefce8;
+    --top-nav-brand-link: #db2777;
+    --top-nav-menu-link: #1d4ed8;
+
+    --tag-colour-deerjikist: #9f1239;
+    --tag-colour-deerjikist-hover: #b62a51;
+    --tag-colour-meme: #6b21a8;
+    --tag-colour-meme-hover: #8238bf;
+    --tag-colour-character: #4d7c0f;
+    --tag-colour-character-hover: #649326;
+    --tag-colour-general: #155e75;
+    --tag-colour-general-hover: #2c758c;
+    --tag-colour-material: #c2410c;
+    --tag-colour-material-hover: #d95823;
+    --tag-colour-meta: #a16207;
+    --tag-colour-meta-hover: #b8791e;
+    --tag-colour-nico: #4b5563;
+    --tag-colour-nico-hover: #626c7a;
   }
 
   .dark
   {
     --background: 222.2 84% 4.9%;
     --foreground: 210 40% 98%;
+    --card: 222.2 84% 4.9%;
+    --card-foreground: 210 40% 98%;
+    --popover: 222.2 84% 4.9%;
+    --popover-foreground: 210 40% 98%;
 
     --primary: 210 40% 98%;
     --primary-foreground: 222.2 47.4% 11.2%;
@@ -54,20 +86,28 @@
     --border: 217.2 32.6% 17.5%;
     --input: 217.2 32.6% 17.5%;
     --ring: 212.7 26.8% 83.9%;
+    --top-nav-root-bg-mobile: #230505;
+    --top-nav-root-bg-desktop: #230505;
+    --top-nav-active-bg: #450a0a;
+    --top-nav-submenu-bg: #450a0a;
+    --top-nav-mobile-menu-bg: #230505;
+    --top-nav-mobile-active-bg: #450a0a;
+    --top-nav-brand-link: #f9a8d4;
+    --top-nav-menu-link: #93c5fd;
   }
 
   body
   {
-    @apply overflow-x-clip;
+    @apply overflow-x-clip bg-background text-foreground;
   }
 
   a
   {
-    @apply text-blue-700 dark:text-blue-300;
+    color: hsl(var(--theme-link));
   }
   a:hover
   {
-    @apply text-blue-500 dark:text-blue-100;
+    color: color-mix(in oklab, hsl(var(--theme-link)), white 18%);
   }
 }
 
@@ -78,8 +118,8 @@
   font-weight: 400;
 
   color-scheme: light dark;
-  color: rgba(255, 255, 255, 0.87);
-  background-color: #242424;
+  color: hsl(var(--foreground));
+  background-color: hsl(var(--background));
 
   font-synthesis: none;
   text-rendering: optimizeLegibility;
@@ -87,6 +127,23 @@
   -moz-osx-font-smoothing: grayscale;
 }
 
+:root[data-animation='reduced'] *,
+:root[data-animation='off'] *
+{
+  scroll-behavior: auto !important;
+}
+
+:root[data-animation='off'] *,
+:root[data-animation='off'] *::before,
+:root[data-animation='off'] *::after
+{
+  animation-duration: 0ms !important;
+  animation-delay: 0ms !important;
+  animation-iteration-count: 1 !important;
+  transition-duration: 0ms !important;
+  transition-delay: 0ms !important;
+}
+
 a
 {
   font-weight: 500;
@@ -97,28 +154,15 @@ body
 {
   margin: 0;
   min-width: 320px;
+  background: hsl(var(--background));
+  color: hsl(var(--foreground));
 }
 
 #root
 {
   min-height: 100dvh;
-}
-
-@media (prefers-color-scheme: light)
-{
-  :root
-  {
-    color: #213547;
-    background-color: #ffffff;
-  }
-  a:hover
-  {
-    color: #747bff;
-  }
-  button
-  {
-    background-color: #f9f9f9;
-  }
+  background: hsl(var(--background));
+  color: hsl(var(--foreground));
 }
 
 @keyframes wiki-blink
@@ -138,6 +182,78 @@ body
   position: relative;
 }
 
+.tag-link-colour
+{
+  color: var(--tag-link-colour);
+}
+
+.tag-link-hover-colour:hover
+{
+  color: var(--tag-link-hover-colour) !important;
+}
+
+.top-nav-root
+{
+  background: var(--top-nav-root-bg-mobile);
+}
+
+@media (min-width: 768px)
+{
+  .top-nav-root
+  {
+    background: var(--top-nav-root-bg-desktop);
+  }
+}
+
+.top-nav-brand-link,
+.top-nav-mobile-toggle
+{
+  color: var(--top-nav-brand-link);
+}
+
+.top-nav-brand-link:hover,
+.top-nav-mobile-toggle:hover
+{
+  color: color-mix(in oklab, var(--top-nav-brand-link), white 18%);
+}
+
+.top-nav-menu-link,
+.top-nav-mobile-row
+{
+  color: var(--top-nav-menu-link);
+}
+
+.top-nav-menu-link:hover,
+.top-nav-mobile-row:hover
+{
+  color: color-mix(in oklab, var(--top-nav-menu-link), white 18%);
+}
+
+.top-nav-highlight
+{
+  background: var(--top-nav-active-bg);
+}
+
+.top-nav-submenu
+{
+  background: var(--top-nav-submenu-bg);
+}
+
+.top-nav-mobile-menu .top-nav-submenu
+{
+  background: var(--top-nav-mobile-active-bg);
+}
+
+.top-nav-mobile-menu
+{
+  background: var(--top-nav-mobile-menu-bg);
+}
+
+.top-nav-mobile-active
+{
+  background: var(--top-nav-mobile-active-bg);
+}
+
 .tag-marquee__animated
 {
   position: absolute;

frontend/src/index.test.ts

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+import { describe, expect, it } from 'vitest'
+
+
+const indexCss = readFileSync (
+    resolve (process.cwd (), 'src/index.css'),
+    'utf8')
+const compactIndexCss = indexCss.replace (/\s+/g, ' ')
+const mobileActiveRule = '.top-nav-mobile-active {'
+    + ' background: var(--top-nav-mobile-active-bg); }'
+const mobileSubmenuRule = '.top-nav-mobile-menu .top-nav-submenu {'
+    + ' background: var(--top-nav-mobile-active-bg); }'
+
+
+describe ('TopNav mobile menu colours', () => {
+  it ('uses one background variable for active rows and expanded submenus', () => {
+    expect (compactIndexCss).toContain (mobileActiveRule)
+    expect (compactIndexCss).toContain (mobileSubmenuRule)
+  })
+})

frontend/src/lib/clientAnimation.ts

@@ -0,0 +1,34 @@
+import type { Transition } from 'framer-motion'
+
+import type { ClientAnimationMode } from '@/lib/settings'
+
+type ClientAnimationTransitionOptions = {
+    normal:   Transition
+    reduced?: Transition
+    off?:     Transition }
+
+
+export const clientAnimationsOff = (
+    animationMode: ClientAnimationMode,
+): boolean =>
+    animationMode === 'off'
+
+
+export const clientAnimationTransition = (
+    animationMode: ClientAnimationMode,
+    { normal, reduced, off }: ClientAnimationTransitionOptions,
+): Transition => {
+  if (animationMode === 'off')
+    return off ?? { duration: 0 }
+
+  if (animationMode === 'reduced')
+    return reduced ?? { duration: .08, ease: 'linear' as const }
+
+  return normal
+}
+
+
+export const clientScrollBehaviour = (
+    animationMode: ClientAnimationMode,
+): ScrollBehavior =>
+    animationMode === 'off' ? 'auto' : 'smooth'

frontend/src/lib/dialogues/useDialogue.ts

@@ -0,0 +1,72 @@
+import { createContext, useContext } from 'react'
+
+import type { ReactNode } from 'react'
+
+type DialogueVariant = 'default' | 'danger'
+
+type ConfirmOptions = { title:        string
+			description?: ReactNode
+			confirmText?: string
+			cancelText?:  string
+			variant?:     DialogueVariant }
+
+type AlertOptions = { title:        string
+		      description?: ReactNode
+		      okText?:      string }
+
+type Choice<T extends string> = { value:    T
+				  label:    string
+				  variant?: DialogueVariant }
+
+type ChoiceOptions<T extends string> = { title:         string
+					 description?:  ReactNode
+					 choices:       Choice<T>[]
+					 cancelText?:   string }
+
+type DialogueFormAction = {
+  label:      string
+  placement?: 'start' | 'end'
+  variant?:   DialogueVariant
+  disabled?:  boolean
+  onSelect:   () => Promise<boolean | void> | boolean | void }
+
+type DialogueFormControls = {
+  close:      () => void
+  setActions: (actions: DialogueFormAction[]) => void
+  confirm:    (options: ConfirmOptions) => Promise<boolean> }
+
+type DialogueFormOptions = { title:         string
+			     description?:  ReactNode
+			     body:          (controls: DialogueFormControls) => ReactNode
+			     cancelText?:   string
+			     size?:         'default' | 'large' }
+
+type DialogueAPI =
+    { confirm:  (options: ConfirmOptions) => Promise<boolean>
+      alert:    (options: AlertOptions) => Promise<void>
+      choice:   <T extends string> (options: ChoiceOptions<T>) => Promise<T | null>
+      form:     (options: DialogueFormOptions) => Promise<void> }
+
+const DialogueContext = createContext<DialogueAPI | null> (null)
+
+const useDialogue = () => {
+  const dialogue = useContext (DialogueContext)
+
+  if (dialogue == null)
+    throw new Error ('useDialogue must be used inside DialogueProvider')
+
+  return dialogue
+}
+
+export { DialogueContext, useDialogue }
+export default useDialogue
+export type {
+    AlertOptions,
+    Choice,
+    ChoiceOptions,
+    ConfirmOptions,
+    DialogueAPI,
+    DialogueFormAction,
+    DialogueFormControls,
+    DialogueFormOptions,
+    DialogueVariant }

frontend/src/lib/keyboardShortcuts.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest'
+
+import { DEFAULT_KEY_BINDINGS,
+	 formatKeyBinding,
+	 getConflictingShortcutActionIds,
+	 isEditableEventTarget,
+	 keyBindingFromKeyboardEvent,
+	 resolveShortcutScope,
+	 SHORTCUT_DEFINITIONS_BY_ID } from '@/lib/keyboardShortcuts'
+
+describe ('keyboardShortcuts', () => {
+  it ('defines the default key bindings used by the settings screen', () => {
+    expect (SHORTCUT_DEFINITIONS_BY_ID['global.openShortcutHelp']).toMatchObject ({
+	label: 'ショートカット一覧を開く',
+	scope: 'global',
+	defaultBinding: { key: '?', shift: true } })
+    expect (DEFAULT_KEY_BINDINGS['global.focusSearch']).toEqual ({ key: '/' })
+    expect (DEFAULT_KEY_BINDINGS['navigation.posts']).toEqual ({ key: 'p' })
+    expect (DEFAULT_KEY_BINDINGS['pagination.next']).toEqual ({ key: 'ArrowRight' })
+    expect (DEFAULT_KEY_BINDINGS['settings.theme']).toEqual ({ key: '3' })
+  })
+
+  it ('formats key bindings for display', () => {
+    expect (formatKeyBinding ({ key: '?', shift: true })).toBe ('Shift + ?')
+    expect (formatKeyBinding ({ key: '/' })).toBe ('/')
+    expect (formatKeyBinding ({ key: 'p' })).toBe ('P')
+    expect (formatKeyBinding ({ key: 'ArrowRight' })).toBe ('ArrowRight')
+    expect (formatKeyBinding (null)).toBe ('未割当')
+  })
+
+  it ('normalises keyboard events without assigning space by default', () => {
+    const event = { key: 'P',
+		    ctrlKey: false,
+		    shiftKey: false,
+		    altKey: false,
+		    metaKey: false } as KeyboardEvent
+
+    expect (keyBindingFromKeyboardEvent (event)).toEqual ({ key: 'p' })
+    expect (DEFAULT_KEY_BINDINGS['pagination.next']).not.toEqual ({ key: ' ' })
+  })
+
+  it ('detects conflicting action bindings', () => {
+    const conflicts = getConflictingShortcutActionIds ({
+	...DEFAULT_KEY_BINDINGS,
+	'navigation.posts': { key: 'p' },
+	'navigation.tags': { key: 'p' } })
+
+    expect (conflicts.has ('navigation.posts')).toBe (true)
+    expect (conflicts.has ('navigation.tags')).toBe (true)
+    expect (conflicts.has ('navigation.wiki')).toBe (false)
+  })
+
+  it ('resolves route scopes and editable event targets', () => {
+    const input = document.createElement ('input')
+    const div = document.createElement ('div')
+    div.setAttribute ('role', 'textbox')
+
+    expect (resolveShortcutScope ('/posts/search')).toBe ('postSearch')
+    expect (resolveShortcutScope ('/users/settings')).toBe ('settings')
+    expect (resolveShortcutScope ('/materials/1')).toBe ('materials')
+    expect (isEditableEventTarget (input)).toBe (true)
+    expect (isEditableEventTarget (div)).toBe (true)
+    expect (isEditableEventTarget (document.createElement ('button'))).toBe (false)
+  })
+})

frontend/src/lib/keyboardShortcuts.ts

@@ -0,0 +1,328 @@
+export type ShortcutScope =
+    | 'global'
+    | 'posts'
+    | 'postSearch'
+    | 'tags'
+    | 'settings'
+    | 'wiki'
+    | 'materials'
+
+export type ShortcutActionId =
+    | 'global.openShortcutHelp'
+    | 'global.focusSearch'
+    | 'navigation.posts'
+    | 'navigation.tags'
+    | 'navigation.materials'
+    | 'navigation.wiki'
+    | 'pagination.next'
+    | 'pagination.previous'
+    | 'settings.account'
+    | 'settings.behavior'
+    | 'settings.theme'
+    | 'settings.keyboard'
+
+export type KeyBinding = {
+    key:    string
+    ctrl?:  boolean
+    shift?: boolean
+    alt?:   boolean
+    meta?:  boolean
+}
+
+export type ShortcutDefinition = {
+    id:              ShortcutActionId
+    label:           string
+    scope:           ShortcutScope
+    defaultBinding:  KeyBinding | null
+}
+
+export const SHORTCUT_SCOPE_LABELS: Record<ShortcutScope, string> = {
+    global:     '全画面',
+    posts:      '広場',
+    postSearch: '広場検索',
+    tags:       'タグ',
+    settings:   '設定',
+    wiki:       'Wiki',
+    materials:  '素材',
+}
+
+export const SHORTCUT_DEFINITIONS: ShortcutDefinition[] = [
+    {
+	id:              'global.openShortcutHelp',
+	label:           'ショートカット一覧を開く',
+	scope:           'global',
+	defaultBinding:  { key: '?', shift: true },
+    },
+    {
+	id:              'global.focusSearch',
+	label:           '検索欄へ移動',
+	scope:           'global',
+	defaultBinding:  { key: '/' },
+    },
+    {
+	id:              'navigation.posts',
+	label:           '広場へ移動',
+	scope:           'global',
+	defaultBinding:  { key: 'p' },
+    },
+    {
+	id:              'navigation.tags',
+	label:           'タグへ移動',
+	scope:           'global',
+	defaultBinding:  { key: 't' },
+    },
+    {
+	id:              'navigation.materials',
+	label:           '素材へ移動',
+	scope:           'global',
+	defaultBinding:  { key: 'm' },
+    },
+    {
+	id:              'navigation.wiki',
+	label:           'Wiki へ移動',
+	scope:           'global',
+	defaultBinding:  { key: 'w' },
+    },
+    {
+	id:              'pagination.next',
+	label:           '次のページへ移動',
+	scope:           'global',
+	defaultBinding:  { key: 'ArrowRight' },
+    },
+    {
+	id:              'pagination.previous',
+	label:           '前のページへ移動',
+	scope:           'global',
+	defaultBinding:  { key: 'ArrowLeft' },
+    },
+    {
+	id:              'settings.account',
+	label:           '設定: アカウント',
+	scope:           'settings',
+	defaultBinding:  { key: '1' },
+    },
+    {
+	id:              'settings.behavior',
+	label:           '設定: 動作',
+	scope:           'settings',
+	defaultBinding:  { key: '2' },
+    },
+    {
+	id:              'settings.theme',
+	label:           '設定: テーマ',
+	scope:           'settings',
+	defaultBinding:  { key: '3' },
+    },
+    {
+	id:              'settings.keyboard',
+	label:           '設定: キーボード',
+	scope:           'settings',
+	defaultBinding:  { key: '4' },
+    },
+]
+
+export const SHORTCUT_DEFINITIONS_BY_ID =
+    SHORTCUT_DEFINITIONS.reduce<Record<ShortcutActionId, ShortcutDefinition>> (
+	(definitions, definition) => {
+	    definitions[definition.id] = definition
+	    return definitions
+	},
+	{
+	    'global.openShortcutHelp': SHORTCUT_DEFINITIONS[0],
+	    'global.focusSearch': SHORTCUT_DEFINITIONS[1],
+	    'navigation.posts': SHORTCUT_DEFINITIONS[2],
+	    'navigation.tags': SHORTCUT_DEFINITIONS[3],
+	    'navigation.materials': SHORTCUT_DEFINITIONS[4],
+	    'navigation.wiki': SHORTCUT_DEFINITIONS[5],
+	    'pagination.next': SHORTCUT_DEFINITIONS[6],
+	    'pagination.previous': SHORTCUT_DEFINITIONS[7],
+	    'settings.account': SHORTCUT_DEFINITIONS[8],
+	    'settings.behavior': SHORTCUT_DEFINITIONS[9],
+	    'settings.theme': SHORTCUT_DEFINITIONS[10],
+	    'settings.keyboard': SHORTCUT_DEFINITIONS[11],
+	},
+    )
+
+export const DEFAULT_KEY_BINDINGS =
+    SHORTCUT_DEFINITIONS.reduce<Record<ShortcutActionId, KeyBinding | null>> (
+	(bindings, definition) => {
+	    bindings[definition.id] = definition.defaultBinding
+	    return bindings
+	},
+	{
+	    'global.openShortcutHelp': null,
+	    'global.focusSearch': null,
+	    'navigation.posts': null,
+	    'navigation.tags': null,
+	    'navigation.materials': null,
+	    'navigation.wiki': null,
+	    'pagination.next': null,
+	    'pagination.previous': null,
+	    'settings.account': null,
+	    'settings.behavior': null,
+	    'settings.theme': null,
+	    'settings.keyboard': null,
+	},
+    )
+
+const normaliseKey = (key: string): string => {
+  if (key === 'Spacebar')
+    return ' '
+  if (key.length === 1 && key !== ' ')
+    return key.toLowerCase ()
+  return key
+}
+
+const isModifierKey = (key: string): boolean =>
+    key === 'Shift'
+    || key === 'Control'
+    || key === 'Alt'
+    || key === 'Meta'
+
+export const normaliseKeyBinding = (value: unknown): KeyBinding | null => {
+  if (!(value) || typeof value !== 'object')
+    return null
+
+  const binding = value as Partial<KeyBinding>
+  if (typeof binding.key !== 'string')
+    return null
+
+  const key = normaliseKey (binding.key)
+  if (key.length === 0 || isModifierKey (key))
+    return null
+
+  return {
+      key,
+      ...(binding.ctrl ? { ctrl: true } : { }),
+      ...(binding.shift ? { shift: true } : { }),
+      ...(binding.alt ? { alt: true } : { }),
+      ...(binding.meta ? { meta: true } : { }),
+  }
+}
+
+export const serialiseKeyBinding = (binding: KeyBinding | null): string | null => {
+  if (binding == null)
+    return null
+
+  const parts = [
+      binding.ctrl ? 'Ctrl' : null,
+      binding.shift ? 'Shift' : null,
+      binding.alt ? 'Alt' : null,
+      binding.meta ? 'Meta' : null,
+      binding.key,
+  ].filter ((part): part is string => part != null)
+
+  return parts.join ('+')
+}
+
+const keyLabel = (key: string): string => {
+  switch (key)
+  {
+  case ' ':
+    return 'Space'
+
+  case 'ArrowLeft':
+    return 'ArrowLeft'
+
+  case 'ArrowRight':
+    return 'ArrowRight'
+
+  case 'ArrowUp':
+    return 'ArrowUp'
+
+  case 'ArrowDown':
+    return 'ArrowDown'
+
+  case 'Escape':
+    return 'Escape'
+
+  case 'Backspace':
+    return 'Backspace'
+
+  case 'Delete':
+    return 'Delete'
+
+  default:
+    return key.length === 1 ? key.toUpperCase () : key
+  }
+}
+
+export const formatKeyBinding = (binding: KeyBinding | null): string => {
+  if (binding == null)
+    return '未割当'
+
+  return [
+      binding.ctrl ? 'Ctrl' : null,
+      binding.shift ? 'Shift' : null,
+      binding.alt ? 'Alt' : null,
+      binding.meta ? 'Meta' : null,
+      keyLabel (binding.key),
+  ].filter ((part): part is string => part != null)
+      .join (' + ')
+}
+
+export const keyBindingFromKeyboardEvent = (
+    event: Pick<KeyboardEvent, 'key' | 'ctrlKey' | 'shiftKey' | 'altKey' | 'metaKey'>,
+): KeyBinding | null => {
+  const key = normaliseKey (event.key)
+  if (key.length === 0 || isModifierKey (key))
+    return null
+
+  return {
+      key,
+      ...(event.ctrlKey ? { ctrl: true } : { }),
+      ...(event.shiftKey ? { shift: true } : { }),
+      ...(event.altKey ? { alt: true } : { }),
+      ...(event.metaKey ? { meta: true } : { }),
+  }
+}
+
+export const isEditableEventTarget = (target: EventTarget | null): boolean => {
+  if (!(target instanceof Element))
+    return false
+
+  return target.closest (
+      'input, textarea, select, [contenteditable="true"], [role="textbox"]',
+  ) != null
+}
+
+export const getConflictingShortcutActionIds = (
+    bindings: Record<ShortcutActionId, KeyBinding | null>,
+): Set<ShortcutActionId> => {
+  const grouped = new Map<string, ShortcutActionId[]> ()
+
+  Object.entries (bindings).forEach (([actionId, binding]) => {
+      const serialised = serialiseKeyBinding (binding)
+      if (serialised == null)
+	return
+
+      const ids = grouped.get (serialised) ?? []
+      ids.push (actionId as ShortcutActionId)
+      grouped.set (serialised, ids)
+  })
+
+  return new Set (
+      [...grouped.values ()]
+	  .filter (actionIds => actionIds.length > 1)
+	  .flat (),
+  )
+}
+
+export const resolveShortcutScope = (pathname: string): ShortcutScope => {
+  if (pathname.startsWith ('/posts/search'))
+    return 'postSearch'
+  if (pathname.startsWith ('/posts'))
+    return 'posts'
+  if (pathname.startsWith ('/tags'))
+    return 'tags'
+  if (pathname.startsWith ('/users/settings'))
+    return 'settings'
+  if (pathname.startsWith ('/wiki'))
+    return 'wiki'
+  if (pathname.startsWith ('/materials'))
+    return 'materials'
+  return 'global'
+}
+
+export const isSpaceBinding = (binding: KeyBinding | null): boolean =>
+    binding?.key === ' '

frontend/src/lib/postImportRows.test.ts

@@ -0,0 +1,147 @@
+import { describe, expect, it } from 'vitest'
+
+import { creatableImportRows,
+	 initialisePreviewRows,
+	 mergeImportResults,
+	 mergeValidatedImportRows,
+	 processableImportRows,
+	 resultSummaryCounts,
+	 retryImportRow,
+	 reviewSummaryCounts } from '@/lib/postImportSession'
+import { buildPostImportRow } from '@/test/postImportFactories'
+
+describe ('post import row state', () => {
+  it ('separates processable existing rows from creatable rows', () => {
+    const ready = buildPostImportRow ({ sourceRow: 1 })
+    const existing = buildPostImportRow ({
+      sourceRow: 2,
+      skipReason: 'existing',
+      existingPostId: 20 })
+    const invalid = buildPostImportRow ({
+      sourceRow: 3,
+      status: 'error',
+      validationErrors: { url: ['invalid'] } })
+    const created = buildPostImportRow ({
+      sourceRow: 4,
+      importStatus: 'created',
+      createdPostId: 40 })
+    const rows = [ready, existing, invalid, created]
+
+    expect (processableImportRows (rows)).toEqual ([ready, existing])
+    expect (creatableImportRows (rows)).toEqual ([ready])
+    expect (reviewSummaryCounts (rows)).toEqual ({
+      total: 4,
+      submittable: 1,
+      skipPlanned: 1 })
+  })
+
+  it ('preserves terminal rows while merging validation results', () => {
+    const created = buildPostImportRow ({
+      sourceRow: 1,
+      importStatus: 'created',
+      createdPostId: 10,
+      attributes: { title: 'created title' } })
+    const pending = buildPostImportRow ({
+      sourceRow: 2,
+      fieldWarnings: { title: ['old warning'] },
+      provenance: { title: 'manual' },
+      attributes: { title: 'manual title' } })
+    const validated = [
+      buildPostImportRow ({ sourceRow: 1, attributes: { title: 'changed' } }),
+      buildPostImportRow ({
+	sourceRow: 2,
+	fieldWarnings: { title: ['fetch warning'], tags: ['tag warning'] },
+	provenance: { title: 'manual' },
+	attributes: { title: 'manual title' } })]
+
+    const result = mergeValidatedImportRows ([created, pending], validated)
+
+    expect (result[0]).toBe (created)
+    expect (result[1]?.fieldWarnings).toEqual ({ tags: ['tag warning'] })
+  })
+
+  it ('updates the reset snapshot only after metadata URL changes', () => {
+    const current = buildPostImportRow ({
+      attributes: { title: 'manual title' },
+      metadataUrl: 'https://example.com/old' })
+    const validated = buildPostImportRow ({
+      attributes: { title: 'new metadata title' },
+      metadataUrl: 'https://example.com/new',
+      fieldWarnings: { title: ['warning'] },
+      baseWarnings: ['base warning'] })
+
+    const result = mergeValidatedImportRows ([current], [validated])[0]
+
+    expect (result?.resetSnapshot).toMatchObject ({
+      attributes: { title: 'new metadata title' },
+      fieldWarnings: { title: ['warning'] },
+      baseWarnings: ['base warning'],
+      metadataUrl: 'https://example.com/new' })
+  })
+
+  it ('merges result states and clears incompatible post identifiers', () => {
+    const created = mergeImportResults ([buildPostImportRow ({
+      skipReason: 'existing',
+      existingPostId: 2 })], [{
+      sourceRow: 1,
+      status: 'created',
+      post: { id: 3 } }])[0]
+    const skipped = mergeImportResults ([buildPostImportRow ({
+      createdPostId: 3,
+      importStatus: 'created' })], [{
+      sourceRow: 1,
+      status: 'skipped',
+      existingPostId: 4 }])[0]
+    const failed = mergeImportResults ([buildPostImportRow ({
+      skipReason: 'existing',
+      existingPostId: 4 })], [{
+      sourceRow: 1,
+      status: 'failed',
+      errors: { base: ['failure'] } }])[0]
+
+    expect (created).toMatchObject ({
+      importStatus: 'created',
+      createdPostId: 3,
+      existingPostId: undefined,
+      skipReason: undefined })
+    expect (skipped).toMatchObject ({
+      importStatus: 'skipped',
+      existingPostId: 4,
+      createdPostId: undefined,
+      skipReason: 'existing' })
+    expect (failed).toMatchObject ({
+      importStatus: 'failed',
+      createdPostId: undefined,
+      existingPostId: undefined,
+      skipReason: undefined,
+      importErrors: { base: ['failure'] } })
+  })
+
+  it ('retries only the selected failed row and counts results exclusively', () => {
+    const rows = [
+      buildPostImportRow ({ sourceRow: 1, importStatus: 'created', createdPostId: 1 }),
+      buildPostImportRow ({ sourceRow: 2, importStatus: 'skipped',
+	existingPostId: 2, skipReason: 'existing' }),
+      buildPostImportRow ({ sourceRow: 3, importStatus: 'failed',
+	importErrors: { base: ['failed'] } })]
+
+    expect (resultSummaryCounts (rows)).toEqual ({ created: 1, skipped: 1, failed: 1 })
+    expect (retryImportRow (rows, 3)[2]).toMatchObject ({
+      importStatus: 'pending',
+      importErrors: undefined })
+  })
+
+  it ('copies reset snapshot values instead of sharing mutable records', () => {
+    const row = buildPostImportRow ({ fieldWarnings: { title: ['warning'] } })
+    const initialised = initialisePreviewRows ([row])[0]
+    expect (initialised).toBeDefined ()
+    if (initialised == null)
+      return
+
+    initialised.attributes.title = 'changed'
+    initialised.fieldWarnings.title?.push ('another')
+
+    expect (initialised.resetSnapshot.attributes.title).toBe ('')
+    expect (initialised.resetSnapshot.fieldWarnings.title).toEqual (['warning'])
+  })
+})

frontend/src/lib/postImportRows.ts

@@ -0,0 +1,173 @@
+import type { PostImportResultRow,
+	      PostImportRow } from '@/lib/postImportTypes'
+
+const hasSkipReason = (row: PostImportRow): boolean =>
+    row.skipReason === 'existing'
+
+const hasValidationErrors = (row: PostImportRow): boolean =>
+    Object.keys (row.validationErrors ?? { }).length > 0
+
+const buildResetSnapshot = (row: PostImportRow) => ({
+    url: row.url,
+    attributes: { ...row.attributes },
+    provenance: { ...row.provenance },
+    tagSources: {
+	automatic: row.tagSources?.automatic ?? '',
+	manual: row.tagSources?.manual ?? '' },
+    fieldWarnings: Object.fromEntries (
+	Object.entries (row.fieldWarnings).map (([key, values]) => [key, [...values]])),
+    baseWarnings: [...row.baseWarnings],
+    metadataUrl: row.metadataUrl })
+
+
+export const processableImportRows = (rows: PostImportRow[]): PostImportRow[] =>
+    rows.filter (row => {
+	if (row.importStatus === 'created')
+	  return false
+	if (row.importStatus === 'skipped')
+	  return false
+	if (row.importStatus === 'failed')
+	  return false
+	if (hasValidationErrors (row))
+	  return false
+	return row.importStatus == null || row.importStatus === 'pending'
+    })
+
+export const creatableImportRows = (rows: PostImportRow[]): PostImportRow[] =>
+    processableImportRows (rows).filter (row => !(hasSkipReason (row)))
+
+
+export const reviewSummaryCounts = (rows: PostImportRow[]) => ({
+    total: rows.length,
+    submittable: rows.filter (row =>
+	creatableImportRows ([row]).length > 0
+	&& !(hasValidationErrors (row))).length,
+    skipPlanned: rows.filter (row =>
+	processableImportRows ([row]).length > 0
+	&& hasSkipReason (row)).length })
+
+
+export const resultSummaryCounts = (rows: PostImportRow[]) =>
+    rows.reduce (
+	(counts, row) => {
+	    if (row.importStatus === 'created')
+	      {
+		++counts.created
+		return counts
+	      }
+	    if (row.importStatus === 'skipped')
+	      {
+		++counts.skipped
+		return counts
+	      }
+	    if (row.importStatus === 'failed')
+	      ++counts.failed
+	    return counts
+	},
+	{ created: 0, skipped: 0, failed: 0 })
+
+
+export const mergeValidatedImportRows = (
+    current:   PostImportRow[],
+    validated: PostImportRow[],
+): PostImportRow[] => {
+    const validatedMap = new Map (validated.map (row => [row.sourceRow, row]))
+    return current.map (previous => {
+	if (
+	    previous.importStatus === 'created'
+	    || previous.importStatus === 'skipped'
+	    || previous.importStatus === 'failed')
+	  return previous
+
+	const row = validatedMap.get (previous.sourceRow)
+	if (row == null)
+	  return previous
+
+	const fieldWarnings =
+	    Object.keys (row.fieldWarnings).length > 0 || row.metadataUrl !== previous.metadataUrl
+	    ? { ...row.fieldWarnings }
+	    : { ...previous.fieldWarnings }
+	for (const [field, origin] of Object.entries (row.provenance))
+	  {
+	    if (origin === 'manual')
+	      delete fieldWarnings[field]
+	  }
+
+	return {
+	    ...previous,
+	    url: row.url,
+	    attributes: row.attributes,
+	    provenance: row.provenance,
+	    tagSources: row.tagSources,
+	    skipReason: row.skipReason,
+	    existingPostId: row.existingPostId,
+	    fieldWarnings,
+	    baseWarnings:
+		row.baseWarnings.length > 0 || row.metadataUrl !== previous.metadataUrl
+		? row.baseWarnings
+		: previous.baseWarnings,
+	    validationErrors: row.validationErrors,
+	    status: row.status,
+	    metadataUrl: row.metadataUrl,
+	    resetSnapshot:
+		row.metadataUrl !== previous.metadataUrl
+		? buildResetSnapshot (row)
+		: previous.resetSnapshot }
+    })
+}
+
+
+export const mergeImportResults = (
+    rows:    PostImportRow[],
+    results: PostImportResultRow[],
+): PostImportRow[] => {
+    const resultMap = new Map (results.map (row => [row.sourceRow, row]))
+    return rows.map (row => {
+	const result = resultMap.get (row.sourceRow)
+	if (result == null)
+	  return row
+
+	switch (result.status)
+	  {
+	  case 'created':
+	    return {
+		...row,
+		importStatus: 'created',
+		skipReason: undefined,
+		createdPostId: result.post.id,
+		existingPostId: undefined,
+		importErrors: result.errors }
+	  case 'skipped':
+	    return {
+		...row,
+		importStatus: 'skipped',
+		skipReason: 'existing',
+		createdPostId: undefined,
+		existingPostId: result.existingPostId,
+		importErrors: result.errors }
+	  case 'failed':
+	    return {
+		...row,
+		importStatus: 'failed',
+		skipReason: undefined,
+		createdPostId: undefined,
+		existingPostId: undefined,
+		importErrors: result.errors }
+	  }
+    })
+}
+
+
+export const retryImportRow = (
+    rows:      PostImportRow[],
+    sourceRow: number,
+): PostImportRow[] =>
+    rows.map (row =>
+	row.sourceRow === sourceRow && row.importStatus === 'failed'
+	? { ...row, importStatus: 'pending', importErrors: undefined }
+	: row)
+
+export const initialisePreviewRows = (rows: PostImportRow[]): PostImportRow[] =>
+    rows.map (row => ({
+	...row,
+	resetSnapshot: buildResetSnapshot (row) }))

frontend/src/lib/postImportSession.ts

@@ -0,0 +1,4 @@
+export * from '@/lib/postImportTypes'
+export * from '@/lib/postImportStorage'
+export * from '@/lib/postImportSourceValidation'
+export * from '@/lib/postImportRows'