Add nested posts UI cutover.

Render reply trees with permission-aware inline controls, and move hunt, profile, voting, submission, and hiding flows to post storage.

db/queries/posts.sql

@@ -0,0 +1,183 @@
+-- name: CreatePost :exec
+INSERT INTO posts (
+  id, parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
+)
+VALUES (
+  sqlc.arg(id),
+  sqlc.arg(parent_id),
+  sqlc.arg(author_id),
+  sqlc.arg(title),
+  sqlc.arg(body),
+  sqlc.arg(city),
+  sqlc.arg(post_date),
+  sqlc.arg(post_state),
+  sqlc.arg(created_at),
+  sqlc.arg(updated_at)
+);
+
+-- name: GetPost :one
+SELECT
+  p.id, p.parent_id, p.author_id, u.name AS author_name, u.role AS author_role,
+  p.title, p.body, p.city, p.post_date, p.post_state, p.created_at, p.updated_at
+FROM posts p
+JOIN users u ON u.id = p.author_id
+WHERE p.id = sqlc.arg(id);
+
+-- name: ListPostThread :many
+WITH RECURSIVE thread AS (
+  SELECT p.*
+  FROM posts p
+  WHERE p.id = sqlc.arg(root_id) AND p.parent_id IS NULL
+
+  UNION ALL
+
+  SELECT child.*
+  FROM posts child
+  JOIN thread parent ON child.parent_id = parent.id
+)
+SELECT
+  thread.id, thread.parent_id, thread.author_id,
+  u.name AS author_name, u.role AS author_role,
+  thread.title, thread.body, thread.city, thread.post_date,
+  thread.post_state, thread.created_at, thread.updated_at
+FROM thread
+JOIN users u ON u.id = thread.author_id
+ORDER BY thread.created_at, thread.id;
+
+-- name: GetRootPostVoteSummary :one
+SELECT
+  COALESCE(SUM(value), 0)::bigint AS score,
+  COALESCE(
+    MAX(value) FILTER (WHERE user_id = sqlc.arg(viewer_id)),
+    0
+  )::bigint AS user_vote
+FROM post_votes
+WHERE post_id = sqlc.arg(root_id);
+
+-- name: UpdatePost :execrows
+UPDATE posts
+SET
+  body = sqlc.arg(body),
+  updated_at = sqlc.arg(updated_at)
+WHERE id = sqlc.arg(id);
+
+-- name: UpdateRootPostState :execrows
+UPDATE posts
+SET
+  post_state = sqlc.arg(post_state),
+  updated_at = sqlc.arg(updated_at)
+WHERE id = sqlc.arg(id)
+  AND parent_id IS NULL;
+
+-- name: ListRootPosts :many
+WITH RECURSIVE roots AS (
+  SELECT p.*
+  FROM posts p
+  WHERE p.parent_id IS NULL
+    AND p.post_date = sqlc.arg(post_date)
+    AND p.post_state <> sqlc.arg(hidden_state)
+),
+thread AS (
+  SELECT roots.id AS root_id, child.id AS post_id, child.author_id
+  FROM roots
+  JOIN posts child ON child.parent_id = roots.id
+
+  UNION ALL
+
+  SELECT thread.root_id, child.id, child.author_id
+  FROM thread
+  JOIN posts child ON child.parent_id = thread.post_id
+),
+answered AS (
+  SELECT DISTINCT thread.root_id
+  FROM thread
+  JOIN users u ON u.id = thread.author_id
+  WHERE u.role = 'admin'
+),
+scores AS (
+  SELECT votes.post_id, SUM(votes.value)::bigint AS score
+  FROM roots
+  JOIN post_votes votes ON votes.post_id = roots.id
+  GROUP BY votes.post_id
+)
+SELECT
+  roots.id, roots.parent_id, roots.author_id,
+  u.name AS author_name, u.role AS author_role,
+  roots.title, roots.body, roots.city, roots.post_date,
+  roots.post_state, roots.created_at, roots.updated_at,
+  COALESCE(scores.score, 0)::bigint AS score,
+  (answered.root_id IS NOT NULL)::bool AS answered,
+  COALESCE(viewer_vote.value, 0)::bigint AS user_vote
+FROM roots
+JOIN users u ON u.id = roots.author_id
+LEFT JOIN scores ON scores.post_id = roots.id
+LEFT JOIN answered ON answered.root_id = roots.id
+LEFT JOIN post_votes viewer_vote
+  ON viewer_vote.user_id = sqlc.arg(viewer_id)
+  AND viewer_vote.post_id = roots.id
+ORDER BY score DESC, roots.created_at, roots.id
+LIMIT sqlc.arg(row_limit);
+
+-- name: ListRootPostsByAuthor :many
+SELECT
+  p.id, p.parent_id, p.author_id,
+  u.name AS author_name, u.role AS author_role,
+  p.title, p.body, p.city, p.post_date,
+  p.post_state, p.created_at, p.updated_at
+FROM posts p
+JOIN users u ON u.id = p.author_id
+WHERE p.parent_id IS NULL
+  AND p.author_id = sqlc.arg(author_id)
+  AND p.post_state <> sqlc.arg(hidden_state)
+ORDER BY p.created_at DESC, p.id DESC
+LIMIT sqlc.arg(row_limit);
+
+-- name: ListRootPostsAnsweredBy :many
+WITH RECURSIVE ancestors AS (
+  SELECT p.id, p.parent_id
+  FROM posts p
+  WHERE p.author_id = sqlc.arg(admin_id)
+    AND p.parent_id IS NOT NULL
+
+  UNION
+
+  SELECT parent.id, parent.parent_id
+  FROM posts parent
+  JOIN ancestors child ON child.parent_id = parent.id
+)
+SELECT DISTINCT
+  root.id, root.parent_id, root.author_id,
+  u.name AS author_name, u.role AS author_role,
+  root.title, root.body, root.city, root.post_date,
+  root.post_state, root.created_at, root.updated_at
+FROM posts root
+JOIN ancestors ON ancestors.id = root.id
+JOIN users u ON u.id = root.author_id
+WHERE root.parent_id IS NULL
+  AND root.post_state <> sqlc.arg(hidden_state)
+ORDER BY root.created_at DESC, root.id DESC
+LIMIT sqlc.arg(row_limit);
+
+-- name: PostIsVisibleRoot :one
+SELECT EXISTS(
+  SELECT 1
+  FROM posts
+  WHERE id = sqlc.arg(id)
+    AND parent_id IS NULL
+    AND post_state <> sqlc.arg(hidden_state)
+)::bool;
+
+-- name: DeletePostVote :exec
+DELETE FROM post_votes
+WHERE user_id = sqlc.arg(user_id)
+  AND post_id = sqlc.arg(post_id);
+
+-- name: UpsertPostVoteOnVisibleRoot :execrows
+INSERT INTO post_votes (user_id, post_id, value)
+SELECT sqlc.arg(user_id), sqlc.arg(post_id), sqlc.arg(value)
+FROM posts p
+WHERE p.id = sqlc.arg(post_id)
+  AND p.parent_id IS NULL
+  AND p.post_state <> sqlc.arg(hidden_state)
+ON CONFLICT (user_id, post_id) DO UPDATE
+SET value = excluded.value;

internal/store/memory.go

@@ -22,6 +22,8 @@ type Memory struct {
 	questions map[string]*RankedQuestion // id -> question
 	answers   map[string]*Answer         // questionID -> answer
 	votes     map[string]map[string]int  // questionID -> userID -> value
+	posts     map[string]*Post           // id -> post
+	postVotes map[string]map[string]int  // postID -> userID -> value
 }
 
 // NewMemory returns an empty Memory store.
@@ -32,6 +34,8 @@ func NewMemory() *Memory {
 		questions: map[string]*RankedQuestion{},
 		answers:   map[string]*Answer{},
 		votes:     map[string]map[string]int{},
+		posts:     map[string]*Post{},
+		postVotes: map[string]map[string]int{},
 	}
 }
 
@@ -372,6 +376,268 @@ func (m *Memory) UpsertAnswer(_ context.Context, a *Answer) error {
 	return nil
 }
 
+func (m *Memory) CreatePost(_ context.Context, post *Post) error {
+	if post == nil {
+		return fmt.Errorf("%w: post is nil", ErrInvalidPost)
+	}
+	if err := preparePost(post); err != nil {
+		return err
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if _, ok := m.users[post.AuthorID]; !ok {
+		return fmt.Errorf("%w: unknown author", ErrInvalidPost)
+	}
+	if _, exists := m.posts[post.ID]; exists {
+		return fmt.Errorf("%w: duplicate id", ErrInvalidPost)
+	}
+	if post.ParentID != nil {
+		if _, ok := m.posts[*post.ParentID]; !ok {
+			return fmt.Errorf("%w: unknown parent", ErrInvalidPost)
+		}
+	}
+	cp := clonePost(post)
+	cp.db = nil
+	m.posts[cp.ID] = cp
+	*post = *clonePost(cp)
+	return nil
+}
+
+func (m *Memory) GetPost(_ context.Context, id string) (*Post, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	post, ok := m.posts[id]
+	if !ok {
+		return nil, sql.ErrNoRows
+	}
+	return clonePostWithAuthor(post, m.users), nil
+}
+
+func (m *Memory) GetPostThread(_ context.Context, rootID string) (*Post, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	root, ok := m.posts[rootID]
+	if !ok || root.ParentID != nil {
+		return nil, sql.ErrNoRows
+	}
+	inThread := map[string]bool{rootID: true}
+	for changed := true; changed; {
+		changed = false
+		for id, post := range m.posts {
+			if inThread[id] || post.ParentID == nil || !inThread[*post.ParentID] {
+				continue
+			}
+			inThread[id] = true
+			changed = true
+		}
+	}
+	posts := make([]Post, 0, len(inThread))
+	for id := range inThread {
+		posts = append(posts, *clonePostWithAuthor(m.posts[id], m.users))
+	}
+	return buildPostTree(posts, rootID)
+}
+
+func (m *Memory) GetPostThreadForViewer(ctx context.Context, rootID, viewerID string) (*Post, error) {
+	root, err := m.GetPostThread(ctx, rootID)
+	if err != nil {
+		return nil, err
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, value := range m.postVotes[rootID] {
+		root.Score += value
+	}
+	root.UserVote = m.postVotes[rootID][viewerID]
+	root.Answered = m.threadContainsAdminReply(rootID)
+	return root, nil
+}
+
+func (m *Memory) UpdatePost(_ context.Context, post *Post) error {
+	if post == nil {
+		return fmt.Errorf("%w: post is nil", ErrInvalidPost)
+	}
+	body := strings.TrimSpace(post.Body)
+	if body == "" {
+		return fmt.Errorf("%w: body is required", ErrInvalidPost)
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	existing, ok := m.posts[post.ID]
+	if !ok {
+		return sql.ErrNoRows
+	}
+	existing.Body = body
+	existing.UpdatedAt = time.Now().UTC().Format(time.RFC3339Nano)
+	*post = *clonePostWithAuthor(existing, m.users)
+	return nil
+}
+
+func (m *Memory) ListRootPosts(_ context.Context, postDate, viewerID string) ([]Post, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	posts := make([]Post, 0)
+	for _, post := range m.posts {
+		if post.ParentID != nil || post.PostDate != postDate || post.PostState == PostStateHidden {
+			continue
+		}
+		cp := clonePostWithAuthor(post, m.users)
+		for _, value := range m.postVotes[post.ID] {
+			cp.Score += value
+		}
+		cp.UserVote = m.postVotes[post.ID][viewerID]
+		cp.Answered = m.threadContainsAdminReply(post.ID)
+		posts = append(posts, *cp)
+	}
+	sort.Slice(posts, func(i, j int) bool {
+		if posts[i].Score != posts[j].Score {
+			return posts[i].Score > posts[j].Score
+		}
+		if posts[i].CreatedAt != posts[j].CreatedAt {
+			return posts[i].CreatedAt < posts[j].CreatedAt
+		}
+		return posts[i].ID < posts[j].ID
+	})
+	if len(posts) > HuntListLimit {
+		posts = posts[:HuntListLimit]
+	}
+	return posts, nil
+}
+
+func (m *Memory) ListRootPostsByAuthor(_ context.Context, authorID string) ([]Post, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	posts := make([]Post, 0)
+	for _, post := range m.posts {
+		if post.ParentID != nil ||
+			post.AuthorID != authorID ||
+			post.PostState == PostStateHidden {
+			continue
+		}
+		posts = append(posts, *clonePostWithAuthor(post, m.users))
+	}
+	return sortProfilePosts(posts), nil
+}
+
+func (m *Memory) ListRootPostsAnsweredBy(_ context.Context, adminID string) ([]Post, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	posts := make([]Post, 0)
+	for _, root := range m.posts {
+		if root.ParentID != nil || root.PostState == PostStateHidden {
+			continue
+		}
+		participated := false
+		for _, post := range m.posts {
+			if post.AuthorID == adminID && m.postIsDescendantOf(post, root.ID) {
+				participated = true
+				break
+			}
+		}
+		if participated {
+			posts = append(posts, *clonePostWithAuthor(root, m.users))
+		}
+	}
+	return sortProfilePosts(posts), nil
+}
+
+func (m *Memory) SetRootPostState(_ context.Context, id string, state PostState) error {
+	switch state {
+	case PostStateVisible, PostStateHidden, PostStateLocked:
+	default:
+		return fmt.Errorf("%w: invalid post state", ErrInvalidPost)
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	post, ok := m.posts[id]
+	if !ok || post.ParentID != nil {
+		return sql.ErrNoRows
+	}
+	post.PostState = state
+	post.UpdatedAt = time.Now().UTC().Format(time.RFC3339Nano)
+	return nil
+}
+
+func sortProfilePosts(posts []Post) []Post {
+	sort.Slice(posts, func(i, j int) bool {
+		if posts[i].CreatedAt != posts[j].CreatedAt {
+			return posts[i].CreatedAt > posts[j].CreatedAt
+		}
+		return posts[i].ID > posts[j].ID
+	})
+	if len(posts) > ProfileListLimit {
+		posts = posts[:ProfileListLimit]
+	}
+	return posts
+}
+
+func (m *Memory) VotePost(_ context.Context, userID, postID string, value int) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if value != 1 && value != -1 && value != 0 {
+		return fmt.Errorf("invalid vote")
+	}
+	post, ok := m.posts[postID]
+	if !ok || post.ParentID != nil || post.PostState == PostStateHidden {
+		return ErrPostNotVotable
+	}
+	if m.postVotes[postID] == nil {
+		m.postVotes[postID] = map[string]int{}
+	}
+	if value == 0 {
+		delete(m.postVotes[postID], userID)
+		return nil
+	}
+	m.postVotes[postID][userID] = value
+	return nil
+}
+
+func (m *Memory) threadContainsAdminReply(rootID string) bool {
+	for id, post := range m.posts {
+		if id == rootID || !m.postIsDescendantOf(post, rootID) {
+			continue
+		}
+		if author := m.users[post.AuthorID]; author != nil && author.Role == RoleAdmin {
+			return true
+		}
+	}
+	return false
+}
+
+func (m *Memory) postIsDescendantOf(post *Post, rootID string) bool {
+	seen := map[string]bool{}
+	for post != nil && post.ParentID != nil {
+		if *post.ParentID == rootID {
+			return true
+		}
+		if seen[*post.ParentID] {
+			return false
+		}
+		seen[*post.ParentID] = true
+		post = m.posts[*post.ParentID]
+	}
+	return false
+}
+
+func clonePost(post *Post) *Post {
+	cp := *post
+	if post.ParentID != nil {
+		parentID := *post.ParentID
+		cp.ParentID = &parentID
+	}
+	cp.Replies = nil
+	return &cp
+}
+
+func clonePostWithAuthor(post *Post, users map[string]*User) *Post {
+	cp := clonePost(post)
+	if author := users[post.AuthorID]; author != nil {
+		cp.AuthorName = author.Name
+		cp.AuthorRole = author.Role
+	}
+	return cp
+}
+
 func (m *Memory) Vote(_ context.Context, userID, questionID string, value int) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()

internal/store/migrate.go

@@ -41,8 +41,9 @@ func migratePosts(ctx context.Context, exec execContext) error {
 	steps := []struct {
 		name string
 		sql  string
+		args []any
 	}{
-		{"create posts", `
+		{name: "create posts", sql: `
 CREATE TABLE IF NOT EXISTS posts (
   id TEXT PRIMARY KEY,
   parent_id TEXT REFERENCES posts(id) ON DELETE CASCADE,
@@ -51,50 +52,130 @@ CREATE TABLE IF NOT EXISTS posts (
   body TEXT NOT NULL,
   city TEXT NOT NULL DEFAULT '',
   post_date TEXT NOT NULL DEFAULT '',
-  hidden INTEGER NOT NULL DEFAULT 0,
+  post_state TEXT NOT NULL,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL,
-  CHECK (
+  CONSTRAINT posts_shape_check CHECK (
     (parent_id IS NULL AND title <> '' AND post_date <> '')
     OR
-    (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '' AND hidden = 0)
+    (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '')
   )
 )`},
-		{"index post replies", `
+		{name: "index post replies", sql: `
 CREATE INDEX IF NOT EXISTS idx_posts_parent_created
   ON posts(parent_id, created_at, id)`},
-		{"index root posts", `
+		{name: "index post authors", sql: `
+CREATE INDEX IF NOT EXISTS idx_posts_author_created
+  ON posts(author_id, created_at DESC, id DESC)`},
+		{name: "index root posts", sql: `
 CREATE INDEX IF NOT EXISTS idx_posts_root_date
-  ON posts(post_date, hidden)
+  ON posts(post_date, post_state)
   WHERE parent_id IS NULL`},
-		{"create post votes", `
+		{name: "create post votes", sql: `
 CREATE TABLE IF NOT EXISTS post_votes (
   user_id TEXT NOT NULL REFERENCES users(id),
   post_id TEXT NOT NULL REFERENCES posts(id) ON DELETE CASCADE,
   value INTEGER NOT NULL CHECK (value IN (-1, 1)),
   PRIMARY KEY (user_id, post_id)
 )`},
-		{"copy questions", `
+		{name: "copy questions", sql: `
 INSERT INTO posts (
-  id, parent_id, author_id, title, body, city, post_date, hidden, created_at, updated_at
+  id, parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
 )
 SELECT
-  id, NULL, author_id, title, body, city, hunt_date, hidden, created_at, created_at
+  id, NULL, author_id, title, body, city, hunt_date,
+  CASE WHEN hidden = 0 THEN $1 ELSE $2 END,
+  created_at, created_at
 FROM questions
-ON CONFLICT (id) DO NOTHING`},
-		{"copy answers", `
+ON CONFLICT (id) DO NOTHING`, args: []any{string(PostStateVisible), string(PostStateHidden)}},
+		{name: "copy answers", sql: `
 INSERT INTO posts (
-  id, parent_id, author_id, title, body, city, post_date, hidden, created_at, updated_at
+  id, parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
 )
 SELECT
-  'answer:' || question_id, question_id, author_id, '', body, '', '', 0, created_at, updated_at
+  'answer:' || question_id, question_id, author_id, '', body, '', '',
+  $1, created_at, updated_at
 FROM answers
-ON CONFLICT (id) DO NOTHING`},
-		{"copy votes", `
+ON CONFLICT (id) DO NOTHING`, args: []any{string(PostStateVisible)}},
+		{name: "copy votes", sql: `
 INSERT INTO post_votes (user_id, post_id, value)
 SELECT user_id, question_id, value
 FROM votes
 ON CONFLICT (user_id, post_id) DO NOTHING`},
+	}
+	for _, step := range steps {
+		if _, err := exec.ExecContext(ctx, step.sql, step.args...); err != nil {
+			return fmt.Errorf("%s: %w", step.name, err)
+		}
+	}
+	return nil
+}
+
+func migratePostVoteIndex(ctx context.Context, exec execContext) error {
+	if _, err := exec.ExecContext(ctx, `
+CREATE INDEX IF NOT EXISTS idx_post_votes_post_id
+  ON post_votes(post_id)`); err != nil {
+		return fmt.Errorf("idx_post_votes_post_id: %w", err)
+	}
+	return nil
+}
+
+func migratePostAuthorIndex(ctx context.Context, exec execContext) error {
+	if _, err := exec.ExecContext(ctx, `
+CREATE INDEX IF NOT EXISTS idx_posts_author_created
+  ON posts(author_id, created_at DESC, id DESC)`); err != nil {
+		return fmt.Errorf("idx_posts_author_created: %w", err)
+	}
+	return nil
+}
+
+func migratePostDate(ctx context.Context, exec execContext) error {
+	steps := []struct {
+		name string
+		sql  string
+	}{
+		{"rename post date", `
+DO $migration$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'posts'
+      AND column_name = 'hunt_date'
+  ) AND NOT EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'posts'
+      AND column_name = 'post_date'
+  ) THEN
+    ALTER TABLE posts RENAME COLUMN hunt_date TO post_date;
+  END IF;
+END
+$migration$`},
+		{"drop legacy root date index", `
+DROP INDEX IF EXISTS idx_posts_root_hunt`},
+		{"create root date index", `
+DO $migration$
+BEGIN
+  IF EXISTS (
+    SELECT 1
+    FROM information_schema.columns
+    WHERE table_schema = current_schema()
+      AND table_name = 'posts'
+      AND column_name = 'post_state'
+  ) THEN
+    CREATE INDEX IF NOT EXISTS idx_posts_root_date
+      ON posts(post_date, post_state)
+      WHERE parent_id IS NULL;
+  ELSE
+    CREATE INDEX IF NOT EXISTS idx_posts_root_date
+      ON posts(post_date, hidden)
+      WHERE parent_id IS NULL;
+  END IF;
+END
+$migration$`},
 	}
 	for _, step := range steps {
 		if _, err := exec.ExecContext(ctx, step.sql); err != nil {
@@ -104,6 +185,89 @@ ON CONFLICT (user_id, post_id) DO NOTHING`},
 	return nil
 }
 
+func migratePostState(ctx context.Context, exec execContext) error {
+	if _, err := exec.ExecContext(ctx, `
+ALTER TABLE posts
+  ADD COLUMN IF NOT EXISTS post_state TEXT`); err != nil {
+		return fmt.Errorf("add post state: %w", err)
+	}
+	hasHidden, err := migrationColumnExists(ctx, exec, "posts", "hidden")
+	if err != nil {
+		return fmt.Errorf("check hidden column: %w", err)
+	}
+	if hasHidden {
+		if _, err := exec.ExecContext(ctx, `
+UPDATE posts
+SET post_state = CASE
+  WHEN hidden = 0 THEN $1
+  ELSE $2
+END`, string(PostStateVisible), string(PostStateHidden)); err != nil {
+			return fmt.Errorf("copy hidden state: %w", err)
+		}
+	}
+
+	steps := []struct {
+		name string
+		sql  string
+	}{
+		{"drop root date index", `
+DROP INDEX IF EXISTS idx_posts_root_date`},
+		{"drop legacy post shape constraint", `
+ALTER TABLE posts DROP CONSTRAINT IF EXISTS posts_check`},
+		{"drop post shape constraint", `
+ALTER TABLE posts DROP CONSTRAINT IF EXISTS posts_shape_check`},
+		{"drop hidden", `
+ALTER TABLE posts DROP COLUMN IF EXISTS hidden`},
+		{"require post state", `
+ALTER TABLE posts ALTER COLUMN post_state SET NOT NULL`},
+		{"create post shape constraint", `
+ALTER TABLE posts
+  ADD CONSTRAINT posts_shape_check CHECK (
+    (parent_id IS NULL AND title <> '' AND post_date <> '')
+    OR
+    (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '')
+  )`},
+		{"create root date index", `
+CREATE INDEX idx_posts_root_date
+  ON posts(post_date, post_state)
+  WHERE parent_id IS NULL`},
+	}
+	for _, step := range steps {
+		if _, err := exec.ExecContext(ctx, step.sql); err != nil {
+			return fmt.Errorf("%s: %w", step.name, err)
+		}
+	}
+	return nil
+}
+
+func migrationColumnExists(
+	ctx context.Context,
+	exec execContext,
+	tableName string,
+	columnName string,
+) (bool, error) {
+	rows, err := exec.QueryContext(ctx, `
+SELECT EXISTS (
+  SELECT 1
+  FROM information_schema.columns
+  WHERE table_schema = current_schema()
+    AND table_name = $1
+    AND column_name = $2
+)`, tableName, columnName)
+	if err != nil {
+		return false, err
+	}
+	defer rows.Close()
+	if !rows.Next() {
+		return false, rows.Err()
+	}
+	var exists bool
+	if err := rows.Scan(&exists); err != nil {
+		return false, err
+	}
+	return exists, rows.Err()
+}
+
 type execContext interface {
 	ExecContext(ctx context.Context, query string, args ...any) (sql.Result, error)
 	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
@@ -151,6 +315,10 @@ CREATE TABLE IF NOT EXISTS schema_migrations (
 		{"002_user_profile_columns", migrateUserProfileColumns},
 		{"003_user_email", migrateUserEmail},
 		{"004_posts", migratePosts},
+		{"005_post_vote_post_id_index", migratePostVoteIndex},
+		{"006_post_date", migratePostDate},
+		{"007_post_state", migratePostState},
+		{"008_post_author_index", migratePostAuthorIndex},
 	}
 	for _, m := range migrations {
 		if applied[m.version] {

internal/store/migrate_posts_test.go

@@ -9,6 +9,8 @@ import (
 	"testing"
 
 	"github.com/google/uuid"
+
+	"plumber/internal/store/sqlc"
 )
 
 func TestMigratePostsCopiesLegacyData(t *testing.T) {
@@ -47,7 +49,9 @@ func TestMigratePostsCopiesLegacyData(t *testing.T) {
 
 	legacySchema := `
 CREATE TABLE users (
-  id TEXT PRIMARY KEY
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  role TEXT NOT NULL
 );
 CREATE TABLE questions (
   id TEXT PRIMARY KEY,
@@ -76,7 +80,8 @@ CREATE TABLE votes (
 		t.Fatal(err)
 	}
 	if _, err := conn.ExecContext(ctx, `
-INSERT INTO users (id) VALUES ('homeowner'), ('plumber');
+INSERT INTO users (id, name, role)
+VALUES ('homeowner', 'Home Owner', 'user'), ('plumber', 'The Plumber', 'admin');
 INSERT INTO questions (id, author_id, title, body, city, hunt_date, hidden, created_at)
 VALUES ('question-1', 'homeowner', 'Leaky sink', 'It drips.', 'Oakland', '2026-08-26', 0, '2026-08-26T08:00:00Z');
 INSERT INTO answers (question_id, author_id, body, created_at, updated_at)
@@ -92,6 +97,12 @@ VALUES ('homeowner', 'question-1', 1);`); err != nil {
 	if err := migratePosts(ctx, conn); err != nil {
 		t.Fatalf("migration is not idempotent: %v", err)
 	}
+	if err := migratePostVoteIndex(ctx, conn); err != nil {
+		t.Fatal(err)
+	}
+	if err := migratePostVoteIndex(ctx, conn); err != nil {
+		t.Fatalf("post vote index migration is not idempotent: %v", err)
+	}
 
 	var postCount, voteCount, legacyQuestionCount, legacyAnswerCount int
 	if err := conn.QueryRowContext(ctx, "SELECT count(*) FROM posts").Scan(&postCount); err != nil {
@@ -115,11 +126,40 @@ VALUES ('homeowner', 'question-1', 1);`); err != nil {
 			legacyAnswerCount,
 		)
 	}
+	var postVoteIndexCount int
+	if err := conn.QueryRowContext(ctx, `
+SELECT count(*)
+FROM pg_indexes
+WHERE schemaname = current_schema()
+  AND tablename = 'post_votes'
+  AND indexname = 'idx_post_votes_post_id'`).Scan(&postVoteIndexCount); err != nil {
+		t.Fatal(err)
+	}
+	if postVoteIndexCount != 1 {
+		t.Fatalf("post vote index count = %d, want 1", postVoteIndexCount)
+	}
+	var postAuthorIndexCount int
+	if err := conn.QueryRowContext(ctx, `
+SELECT count(*)
+FROM pg_indexes
+WHERE schemaname = current_schema()
+  AND tablename = 'posts'
+  AND indexname = 'idx_posts_author_created'`).Scan(&postAuthorIndexCount); err != nil {
+		t.Fatal(err)
+	}
+	if postAuthorIndexCount != 1 {
+		t.Fatalf("post author index count = %d, want 1", postAuthorIndexCount)
+	}
+	if _, err := conn.ExecContext(ctx, `
+INSERT INTO post_votes (user_id, post_id, value)
+VALUES ('homeowner', 'question-1', -1)`); err == nil {
+		t.Fatal("duplicate user/post vote unexpectedly succeeded")
+	}
 
 	var rootParent sql.NullString
-	var rootAuthor, title, rootBody, city, postDate, rootCreated, rootUpdated string
+	var rootAuthor, title, rootBody, city, postDate, rootState, rootCreated, rootUpdated string
 	if err := conn.QueryRowContext(ctx, `
-SELECT parent_id, author_id, title, body, city, post_date, created_at, updated_at
+SELECT parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
 FROM posts
 WHERE id = 'question-1'`).Scan(
 		&rootParent,
@@ -128,6 +168,7 @@ WHERE id = 'question-1'`).Scan(
 		&rootBody,
 		&city,
 		&postDate,
+		&rootState,
 		&rootCreated,
 		&rootUpdated,
 	); err != nil {
@@ -139,19 +180,21 @@ WHERE id = 'question-1'`).Scan(
 		rootBody != "It drips." ||
 		city != "Oakland" ||
 		postDate != "2026-08-26" ||
+		rootState != "visible" ||
 		rootCreated != "2026-08-26T08:00:00Z" ||
 		rootUpdated != rootCreated {
 		t.Fatalf("unexpected root post")
 	}
 
-	var replyParent, replyAuthor, replyBody, replyCreated, replyUpdated string
+	var replyParent, replyAuthor, replyBody, replyState, replyCreated, replyUpdated string
 	if err := conn.QueryRowContext(ctx, `
-SELECT parent_id, author_id, body, created_at, updated_at
+SELECT parent_id, author_id, body, post_state, created_at, updated_at
 FROM posts
 WHERE id = 'answer:question-1'`).Scan(
 		&replyParent,
 		&replyAuthor,
 		&replyBody,
+		&replyState,
 		&replyCreated,
 		&replyUpdated,
 	); err != nil {
@@ -160,6 +203,7 @@ WHERE id = 'answer:question-1'`).Scan(
 	if replyParent != "question-1" ||
 		replyAuthor != "plumber" ||
 		replyBody != "Replace the cartridge." ||
+		replyState != "visible" ||
 		replyCreated != "2026-08-26T09:00:00Z" ||
 		replyUpdated != "2026-08-26T09:05:00Z" {
 		t.Fatalf("unexpected reply post")
@@ -177,18 +221,244 @@ WHERE user_id = 'homeowner' AND post_id = 'question-1'`).Scan(&voteValue); err !
 
 	if _, err := conn.ExecContext(ctx, `
 INSERT INTO posts (
-  id, parent_id, author_id, title, body, city, post_date, hidden, created_at, updated_at
+  id, parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
 ) VALUES (
-  'invalid-reply', 'question-1', 'homeowner', 'Replies cannot have titles', 'Body', '', '', 0, 'now', 'now'
+  'invalid-reply', 'question-1', 'homeowner', 'Replies cannot have titles', 'Body', '', '',
+  'visible', 'now', 'now'
 )`); err == nil {
 		t.Fatal("reply with root-only title unexpectedly succeeded")
 	}
+
+	queries := sqlc.New(conn)
+	if err := queries.CreatePost(ctx, sqlc.CreatePostParams{
+		ID:        "follow-up",
+		ParentID:  sql.NullString{String: "answer:question-1", Valid: true},
+		AuthorID:  "homeowner",
+		Body:      "It is still dripping.",
+		PostState: string(PostStateVisible),
+		CreatedAt: "2026-08-26T10:00:00Z",
+		UpdatedAt: "2026-08-26T10:00:00Z",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	thread, err := queries.ListPostThread(ctx, "question-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(thread) != 3 ||
+		thread[0].ID != "question-1" ||
+		thread[1].ID != "answer:question-1" ||
+		thread[2].ID != "follow-up" {
+		t.Fatalf("recursive thread = %+v", thread)
+	}
+	nonRootThread, err := queries.ListPostThread(ctx, "answer:question-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(nonRootThread) != 0 {
+		t.Fatalf("non-root thread lookup returned %+v", nonRootThread)
+	}
+	if n, err := queries.UpdatePost(ctx, sqlc.UpdatePostParams{
+		ID:        "follow-up",
+		Body:      "The drip continues.",
+		UpdatedAt: "2026-08-26T10:05:00Z",
+	}); err != nil || n != 1 {
+		t.Fatalf("update rows=%d error=%v", n, err)
+	}
+	if n, err := queries.UpsertPostVoteOnVisibleRoot(ctx, sqlc.UpsertPostVoteOnVisibleRootParams{
+		UserID:      "plumber",
+		PostID:      "question-1",
+		Value:       1,
+		HiddenState: string(PostStateHidden),
+	}); err != nil || n != 1 {
+		t.Fatalf("vote rows=%d error=%v", n, err)
+	}
+	roots, err := queries.ListRootPosts(ctx, sqlc.ListRootPostsParams{
+		ViewerID:    "plumber",
+		RowLimit:    100,
+		PostDate:    "2026-08-26",
+		HiddenState: string(PostStateHidden),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(roots) != 1 ||
+		roots[0].Score != 2 ||
+		!roots[0].Answered ||
+		roots[0].UserVote != 1 {
+		t.Fatalf("root annotations = %+v", roots)
+	}
+	summary, err := queries.GetRootPostVoteSummary(ctx, sqlc.GetRootPostVoteSummaryParams{
+		ViewerID: "plumber",
+		RootID:   "question-1",
+	})
+	if err != nil || summary.Score != 2 || summary.UserVote != 1 {
+		t.Fatalf("root vote summary = %+v, %v", summary, err)
+	}
+	byAuthor, err := queries.ListRootPostsByAuthor(ctx, sqlc.ListRootPostsByAuthorParams{
+		AuthorID:    "homeowner",
+		HiddenState: string(PostStateHidden),
+		RowLimit:    50,
+	})
+	if err != nil || len(byAuthor) != 1 || byAuthor[0].ID != "question-1" {
+		t.Fatalf("roots by author = %+v, %v", byAuthor, err)
+	}
+	answeredBy, err := queries.ListRootPostsAnsweredBy(ctx, sqlc.ListRootPostsAnsweredByParams{
+		HiddenState: string(PostStateHidden),
+		AdminID:     "plumber",
+		RowLimit:    50,
+	})
+	if err != nil || len(answeredBy) != 1 || answeredBy[0].ID != "question-1" {
+		t.Fatalf("roots answered by admin = %+v, %v", answeredBy, err)
+	}
+	for _, state := range []PostState{PostStateLocked, PostStateVisible} {
+		n, err := queries.UpdateRootPostState(ctx, sqlc.UpdateRootPostStateParams{
+			PostState: string(state),
+			UpdatedAt: "2026-08-26T10:10:00Z",
+			ID:        "question-1",
+		})
+		if err != nil || n != 1 {
+			t.Fatalf("set root state %q rows=%d error=%v", state, n, err)
+		}
+	}
+
+	if _, err := conn.ExecContext(ctx, `
+DROP INDEX idx_posts_root_date;
+ALTER TABLE posts RENAME COLUMN post_date TO hunt_date;
+CREATE INDEX idx_posts_root_hunt
+  ON posts(hunt_date, post_state)
+  WHERE parent_id IS NULL;`); err != nil {
+		t.Fatal(err)
+	}
+	if err := migratePostDate(ctx, conn); err != nil {
+		t.Fatal(err)
+	}
+	if err := migratePostDate(ctx, conn); err != nil {
+		t.Fatalf("post date migration is not idempotent: %v", err)
+	}
+
+	var postDateColumnCount, huntDateColumnCount, rootDateIndexCount, legacyIndexCount int
+	if err := conn.QueryRowContext(ctx, `
+SELECT
+  count(*) FILTER (WHERE column_name = 'post_date'),
+  count(*) FILTER (WHERE column_name = 'hunt_date')
+FROM information_schema.columns
+WHERE table_schema = current_schema()
+  AND table_name = 'posts'`).Scan(&postDateColumnCount, &huntDateColumnCount); err != nil {
+		t.Fatal(err)
+	}
+	if err := conn.QueryRowContext(ctx, `
+SELECT
+  count(*) FILTER (WHERE indexname = 'idx_posts_root_date'),
+  count(*) FILTER (WHERE indexname = 'idx_posts_root_hunt')
+FROM pg_indexes
+WHERE schemaname = current_schema()
+  AND tablename = 'posts'`).Scan(&rootDateIndexCount, &legacyIndexCount); err != nil {
+		t.Fatal(err)
+	}
+	var migratedPostDate string
+	if err := conn.QueryRowContext(ctx, `
+SELECT post_date FROM posts WHERE id = 'question-1'`).Scan(&migratedPostDate); err != nil {
+		t.Fatal(err)
+	}
+	if postDateColumnCount != 1 ||
+		huntDateColumnCount != 0 ||
+		rootDateIndexCount != 1 ||
+		legacyIndexCount != 0 ||
+		migratedPostDate != "2026-08-26" {
+		t.Fatalf(
+			"post date migration columns=%d legacy_columns=%d indexes=%d legacy_indexes=%d date=%q",
+			postDateColumnCount,
+			huntDateColumnCount,
+			rootDateIndexCount,
+			legacyIndexCount,
+			migratedPostDate,
+		)
+	}
+
+	if _, err := conn.ExecContext(ctx, `
+DROP INDEX idx_posts_root_date;
+ALTER TABLE posts DROP CONSTRAINT posts_shape_check;
+ALTER TABLE posts ADD COLUMN hidden INTEGER NOT NULL DEFAULT 0;
+UPDATE posts SET hidden = CASE WHEN id = 'question-1' THEN 1 ELSE 0 END;
+ALTER TABLE posts DROP COLUMN post_state;
+ALTER TABLE posts ADD CONSTRAINT posts_check CHECK (
+  (parent_id IS NULL AND title <> '' AND post_date <> '')
+  OR
+  (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '' AND hidden = 0)
+);
+CREATE INDEX idx_posts_root_date
+  ON posts(post_date, hidden)
+  WHERE parent_id IS NULL;`); err != nil {
+		t.Fatal(err)
+	}
+	if err := migratePostState(ctx, conn); err != nil {
+		t.Fatal(err)
+	}
+	if err := migratePostState(ctx, conn); err != nil {
+		t.Fatalf("post state migration is not idempotent: %v", err)
+	}
+
+	var postStateColumnCount, hiddenColumnCount int
+	if err := conn.QueryRowContext(ctx, `
+SELECT
+  count(*) FILTER (WHERE column_name = 'post_state'),
+  count(*) FILTER (WHERE column_name = 'hidden')
+FROM information_schema.columns
+WHERE table_schema = current_schema()
+  AND table_name = 'posts'`).Scan(&postStateColumnCount, &hiddenColumnCount); err != nil {
+		t.Fatal(err)
+	}
+	var hiddenState, replyStateAfterMigration string
+	if err := conn.QueryRowContext(ctx, `
+SELECT post_state FROM posts WHERE id = 'question-1'`).Scan(&hiddenState); err != nil {
+		t.Fatal(err)
+	}
+	if err := conn.QueryRowContext(ctx, `
+SELECT post_state FROM posts WHERE id = 'answer:question-1'`).Scan(&replyStateAfterMigration); err != nil {
+		t.Fatal(err)
+	}
+	var postStateDataType string
+	if err := conn.QueryRowContext(ctx, `
+SELECT data_type
+FROM information_schema.columns
+WHERE table_schema = current_schema()
+  AND table_name = 'posts'
+  AND column_name = 'post_state'`).Scan(&postStateDataType); err != nil {
+		t.Fatal(err)
+	}
+	var stateIndexCount int
+	if err := conn.QueryRowContext(ctx, `
+SELECT count(*)
+FROM pg_indexes
+WHERE schemaname = current_schema()
+  AND tablename = 'posts'
+  AND indexname = 'idx_posts_root_date'
+  AND indexdef LIKE '%(post_date, post_state)%'`).Scan(&stateIndexCount); err != nil {
+		t.Fatal(err)
+	}
+	if postStateColumnCount != 1 ||
+		hiddenColumnCount != 0 ||
+		hiddenState != "hidden" ||
+		replyStateAfterMigration != "visible" ||
+		postStateDataType != "text" ||
+		stateIndexCount != 1 {
+		t.Fatalf(
+			"post state migration columns=%d hidden_columns=%d root=%q reply=%q type=%q indexes=%d",
+			postStateColumnCount,
+			hiddenColumnCount,
+			hiddenState,
+			replyStateAfterMigration,
+			postStateDataType,
+			stateIndexCount,
+		)
+	}
 }
 
 func TestMigratePostsReportsStep(t *testing.T) {
 	t.Parallel()
 
-	exec := &failingMigrationExec{failAt: 5}
+	exec := &failingMigrationExec{failAt: 6}
 	err := migratePosts(context.Background(), exec)
 	if err == nil || !strings.Contains(err.Error(), "copy questions") {
 		t.Fatalf("error = %v, want copy questions context", err)

internal/store/post.go

@@ -0,0 +1,488 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgconn"
+
+	"plumber/internal/pacific"
+	"plumber/internal/store/sqlc"
+)
+
+var (
+	ErrInvalidPost    = errors.New("invalid post")
+	ErrPostNotVotable = errors.New("post not votable")
+)
+
+type PostState string
+
+const (
+	PostStateVisible PostState = "visible"
+	PostStateHidden  PostState = "hidden"
+	PostStateLocked  PostState = "locked"
+)
+
+// Post is either a root question (ParentID nil) or a reply to another post.
+type Post struct {
+	ID         string
+	ParentID   *string
+	AuthorID   string
+	AuthorName string
+	AuthorRole Role
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  PostState
+	CreatedAt  string
+	UpdatedAt  string
+	Score      int
+	Answered   bool
+	UserVote   int
+	Replies    []*Post
+	db         *sql.DB
+}
+
+// NewPost returns a post bound to db.
+func NewPost(db *sql.DB) *Post {
+	return &Post{db: db}
+}
+
+// Create inserts a root post or reply according to ParentID.
+func (p *Post) Create(ctx context.Context) error {
+	if p == nil || p.db == nil {
+		return fmt.Errorf("post: no database")
+	}
+	if err := preparePost(p); err != nil {
+		return err
+	}
+	err := sqlc.New(p.db).CreatePost(ctx, sqlc.CreatePostParams{
+		ID:        p.ID,
+		ParentID:  nullableParentID(p.ParentID),
+		AuthorID:  p.AuthorID,
+		Title:     p.Title,
+		Body:      p.Body,
+		City:      p.City,
+		PostDate:  p.PostDate,
+		PostState: string(p.PostState),
+		CreatedAt: p.CreatedAt,
+		UpdatedAt: p.UpdatedAt,
+	})
+	return mapPostCreateError(err)
+}
+
+// Update changes only the post body and update timestamp.
+func (p *Post) Update(ctx context.Context) error {
+	if p == nil || p.db == nil {
+		return fmt.Errorf("post: no database")
+	}
+	p.Body = strings.TrimSpace(p.Body)
+	if p.Body == "" {
+		return fmt.Errorf("%w: body is required", ErrInvalidPost)
+	}
+	p.UpdatedAt = time.Now().UTC().Format(time.RFC3339Nano)
+	n, err := sqlc.New(p.db).UpdatePost(ctx, sqlc.UpdatePostParams{
+		ID:        p.ID,
+		Body:      p.Body,
+		UpdatedAt: p.UpdatedAt,
+	})
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return sql.ErrNoRows
+	}
+	return nil
+}
+
+func preparePost(p *Post) error {
+	p.ID = strings.TrimSpace(p.ID)
+	p.AuthorID = strings.TrimSpace(p.AuthorID)
+	p.Title = strings.TrimSpace(p.Title)
+	p.Body = strings.TrimSpace(p.Body)
+	p.City = strings.TrimSpace(p.City)
+	p.PostDate = strings.TrimSpace(p.PostDate)
+	if p.PostState == "" {
+		p.PostState = PostStateVisible
+	}
+	switch p.PostState {
+	case PostStateVisible, PostStateHidden, PostStateLocked:
+	default:
+		return fmt.Errorf("%w: invalid post state", ErrInvalidPost)
+	}
+	if p.AuthorID == "" {
+		return fmt.Errorf("%w: author is required", ErrInvalidPost)
+	}
+	if p.Body == "" {
+		return fmt.Errorf("%w: body is required", ErrInvalidPost)
+	}
+	if p.ParentID == nil {
+		if p.Title == "" {
+			return fmt.Errorf("%w: root title is required", ErrInvalidPost)
+		}
+		if p.PostDate == "" {
+			p.PostDate = pacific.Today()
+		}
+	} else {
+		parentID := strings.TrimSpace(*p.ParentID)
+		if parentID == "" {
+			return fmt.Errorf("%w: parent is required", ErrInvalidPost)
+		}
+		p.ParentID = &parentID
+		if p.Title != "" || p.City != "" || p.PostDate != "" || p.PostState != PostStateVisible {
+			return fmt.Errorf("%w: reply contains root-only fields", ErrInvalidPost)
+		}
+	}
+	if p.ID == "" {
+		p.ID = uuid.NewString()
+	}
+	now := time.Now().UTC().Format(time.RFC3339Nano)
+	if p.CreatedAt == "" {
+		p.CreatedAt = now
+	}
+	if p.UpdatedAt == "" {
+		p.UpdatedAt = p.CreatedAt
+	}
+	return nil
+}
+
+func nullableParentID(parentID *string) sql.NullString {
+	if parentID == nil {
+		return sql.NullString{}
+	}
+	return sql.NullString{String: *parentID, Valid: true}
+}
+
+func parentIDFromNull(parentID sql.NullString) *string {
+	if !parentID.Valid {
+		return nil
+	}
+	id := parentID.String
+	return &id
+}
+
+func mapPostCreateError(err error) error {
+	if err == nil {
+		return nil
+	}
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) {
+		switch pgErr.Code {
+		case "23503", "23505", "23514":
+			return fmt.Errorf("%w: %v", ErrInvalidPost, err)
+		}
+	}
+	return err
+}
+
+func postFromValues(
+	db *sql.DB,
+	id string,
+	parentID sql.NullString,
+	authorID, authorName, authorRole, title, body, city, postDate string,
+	postState string,
+	createdAt, updatedAt string,
+) Post {
+	return Post{
+		ID:         id,
+		ParentID:   parentIDFromNull(parentID),
+		AuthorID:   authorID,
+		AuthorName: authorName,
+		AuthorRole: Role(authorRole),
+		Title:      title,
+		Body:       body,
+		City:       city,
+		PostDate:   postDate,
+		PostState:  PostState(postState),
+		CreatedAt:  createdAt,
+		UpdatedAt:  updatedAt,
+		db:         db,
+	}
+}
+
+// GetPost returns one post without loading its replies.
+func GetPost(ctx context.Context, db *sql.DB, id string) (*Post, error) {
+	r, err := sqlc.New(db).GetPost(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	p := postFromValues(
+		db,
+		r.ID,
+		r.ParentID,
+		r.AuthorID,
+		r.AuthorName,
+		r.AuthorRole,
+		r.Title,
+		r.Body,
+		r.City,
+		r.PostDate,
+		r.PostState,
+		r.CreatedAt,
+		r.UpdatedAt,
+	)
+	return &p, nil
+}
+
+// GetPostThread returns a root post with all descendants nested under Replies.
+func GetPostThread(ctx context.Context, db *sql.DB, rootID string) (*Post, error) {
+	rows, err := sqlc.New(db).ListPostThread(ctx, rootID)
+	if err != nil {
+		return nil, err
+	}
+	posts := make([]Post, 0, len(rows))
+	for _, r := range rows {
+		posts = append(posts, postFromValues(
+			db,
+			r.ID,
+			r.ParentID,
+			r.AuthorID,
+			r.AuthorName,
+			r.AuthorRole,
+			r.Title,
+			r.Body,
+			r.City,
+			r.PostDate,
+			r.PostState,
+			r.CreatedAt,
+			r.UpdatedAt,
+		))
+	}
+	return buildPostTree(posts, rootID)
+}
+
+// GetPostThreadForViewer includes root voting and answered annotations.
+func GetPostThreadForViewer(
+	ctx context.Context,
+	db *sql.DB,
+	rootID string,
+	viewerID string,
+) (*Post, error) {
+	root, err := GetPostThread(ctx, db, rootID)
+	if err != nil {
+		return nil, err
+	}
+	summary, err := sqlc.New(db).GetRootPostVoteSummary(ctx, sqlc.GetRootPostVoteSummaryParams{
+		ViewerID: viewerID,
+		RootID:   rootID,
+	})
+	if err != nil {
+		return nil, err
+	}
+	root.Score = int(summary.Score)
+	root.UserVote = int(summary.UserVote)
+	root.Answered = postTreeContainsRole(root, RoleAdmin)
+	return root, nil
+}
+
+func postTreeContainsRole(post *Post, role Role) bool {
+	for _, reply := range post.Replies {
+		if reply.AuthorRole == role || postTreeContainsRole(reply, role) {
+			return true
+		}
+	}
+	return false
+}
+
+func buildPostTree(posts []Post, rootID string) (*Post, error) {
+	byID := make(map[string]*Post, len(posts))
+	for i := range posts {
+		posts[i].Replies = nil
+		byID[posts[i].ID] = &posts[i]
+	}
+	root, ok := byID[rootID]
+	if !ok || root.ParentID != nil {
+		return nil, sql.ErrNoRows
+	}
+	for i := range posts {
+		post := &posts[i]
+		if post.ID == rootID {
+			continue
+		}
+		if post.ParentID == nil {
+			return nil, fmt.Errorf("post %s is not in thread %s", post.ID, rootID)
+		}
+		parent, ok := byID[*post.ParentID]
+		if !ok {
+			return nil, fmt.Errorf("post %s has missing parent %s", post.ID, *post.ParentID)
+		}
+		parent.Replies = append(parent.Replies, post)
+	}
+	var sortReplies func(*Post)
+	sortReplies = func(post *Post) {
+		sort.Slice(post.Replies, func(i, j int) bool {
+			if post.Replies[i].CreatedAt != post.Replies[j].CreatedAt {
+				return post.Replies[i].CreatedAt < post.Replies[j].CreatedAt
+			}
+			return post.Replies[i].ID < post.Replies[j].ID
+		})
+		for _, reply := range post.Replies {
+			sortReplies(reply)
+		}
+	}
+	sortReplies(root)
+	return root, nil
+}
+
+// ListRootPosts returns visible root posts for a post date.
+func ListRootPosts(ctx context.Context, db *sql.DB, postDate, viewerID string) ([]Post, error) {
+	rows, err := sqlc.New(db).ListRootPosts(ctx, sqlc.ListRootPostsParams{
+		ViewerID:    viewerID,
+		RowLimit:    HuntListLimit,
+		PostDate:    postDate,
+		HiddenState: string(PostStateHidden),
+	})
+	if err != nil {
+		return nil, err
+	}
+	posts := make([]Post, 0, len(rows))
+	for _, r := range rows {
+		post := postFromValues(
+			db,
+			r.ID,
+			r.ParentID,
+			r.AuthorID,
+			r.AuthorName,
+			r.AuthorRole,
+			r.Title,
+			r.Body,
+			r.City,
+			r.PostDate,
+			r.PostState,
+			r.CreatedAt,
+			r.UpdatedAt,
+		)
+		post.Score = int(r.Score)
+		post.Answered = r.Answered
+		post.UserVote = int(r.UserVote)
+		posts = append(posts, post)
+	}
+	return posts, nil
+}
+
+// ListRootPostsByAuthor returns visible roots created by an author, newest first.
+func ListRootPostsByAuthor(ctx context.Context, db *sql.DB, authorID string) ([]Post, error) {
+	rows, err := sqlc.New(db).ListRootPostsByAuthor(ctx, sqlc.ListRootPostsByAuthorParams{
+		AuthorID:    authorID,
+		HiddenState: string(PostStateHidden),
+		RowLimit:    ProfileListLimit,
+	})
+	if err != nil {
+		return nil, err
+	}
+	posts := make([]Post, 0, len(rows))
+	for _, r := range rows {
+		posts = append(posts, postFromValues(
+			db,
+			r.ID,
+			r.ParentID,
+			r.AuthorID,
+			r.AuthorName,
+			r.AuthorRole,
+			r.Title,
+			r.Body,
+			r.City,
+			r.PostDate,
+			r.PostState,
+			r.CreatedAt,
+			r.UpdatedAt,
+		))
+	}
+	return posts, nil
+}
+
+// ListRootPostsAnsweredBy returns visible roots containing a reply by adminID.
+func ListRootPostsAnsweredBy(ctx context.Context, db *sql.DB, adminID string) ([]Post, error) {
+	rows, err := sqlc.New(db).ListRootPostsAnsweredBy(ctx, sqlc.ListRootPostsAnsweredByParams{
+		HiddenState: string(PostStateHidden),
+		AdminID:     adminID,
+		RowLimit:    ProfileListLimit,
+	})
+	if err != nil {
+		return nil, err
+	}
+	posts := make([]Post, 0, len(rows))
+	for _, r := range rows {
+		posts = append(posts, postFromValues(
+			db,
+			r.ID,
+			r.ParentID,
+			r.AuthorID,
+			r.AuthorName,
+			r.AuthorRole,
+			r.Title,
+			r.Body,
+			r.City,
+			r.PostDate,
+			r.PostState,
+			r.CreatedAt,
+			r.UpdatedAt,
+		))
+	}
+	return posts, nil
+}
+
+// SetRootPostState changes a root post's state.
+func SetRootPostState(ctx context.Context, db *sql.DB, id string, state PostState) error {
+	switch state {
+	case PostStateVisible, PostStateHidden, PostStateLocked:
+	default:
+		return fmt.Errorf("%w: invalid post state", ErrInvalidPost)
+	}
+	n, err := sqlc.New(db).UpdateRootPostState(ctx, sqlc.UpdateRootPostStateParams{
+		PostState: string(state),
+		UpdatedAt: time.Now().UTC().Format(time.RFC3339Nano),
+		ID:        id,
+	})
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return sql.ErrNoRows
+	}
+	return nil
+}
+
+// SetPostVote sets value to 1, -1, or 0 on a visible root post.
+func SetPostVote(ctx context.Context, db *sql.DB, userID, postID string, value int) error {
+	if value != 1 && value != -1 && value != 0 {
+		return fmt.Errorf("invalid vote")
+	}
+	q := sqlc.New(db)
+	if value == 0 {
+		visible, err := q.PostIsVisibleRoot(ctx, sqlc.PostIsVisibleRootParams{
+			ID:          postID,
+			HiddenState: string(PostStateHidden),
+		})
+		if err != nil {
+			return err
+		}
+		if !visible {
+			return ErrPostNotVotable
+		}
+		return q.DeletePostVote(ctx, sqlc.DeletePostVoteParams{
+			UserID: userID,
+			PostID: postID,
+		})
+	}
+	n, err := q.UpsertPostVoteOnVisibleRoot(ctx, sqlc.UpsertPostVoteOnVisibleRootParams{
+		UserID:      userID,
+		PostID:      postID,
+		Value:       int32(value),
+		HiddenState: string(PostStateHidden),
+	})
+	if err != nil {
+		return err
+	}
+	if n == 0 {
+		return ErrPostNotVotable
+	}
+	return nil
+}

internal/store/post_test.go

@@ -0,0 +1,272 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+func TestMapPostCreateError(t *testing.T) {
+	t.Parallel()
+
+	for _, code := range []string{"23503", "23505", "23514"} {
+		err := mapPostCreateError(&pgconn.PgError{Code: code})
+		if !errors.Is(err, ErrInvalidPost) {
+			t.Errorf("code %s error = %v, want ErrInvalidPost", code, err)
+		}
+	}
+	original := &pgconn.PgError{Code: "08006"}
+	if err := mapPostCreateError(original); !errors.Is(err, original) {
+		t.Errorf("unexpected database error was replaced: %v", err)
+	}
+}
+
+func TestMemoryPostLifecycle(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	mem := NewMemory()
+	homeowner := &User{Username: "homeowner", PasswordHash: "hash", Role: RoleUser}
+	plumber := &User{Username: "plumber", PasswordHash: "hash", Role: RoleAdmin}
+	voter := &User{Username: "voter", PasswordHash: "hash", Role: RoleUser}
+	for _, user := range []*User{homeowner, plumber, voter} {
+		if err := mem.CreateUser(ctx, user); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	root := &Post{
+		ID:        "root",
+		AuthorID:  homeowner.ID,
+		Title:     "Leaky sink",
+		Body:      "It drips.",
+		City:      "Oakland",
+		PostDate:  "2026-08-26",
+		CreatedAt: "2026-08-26T08:00:00Z",
+	}
+	if err := mem.CreatePost(ctx, root); err != nil {
+		t.Fatal(err)
+	}
+	if root.PostState != PostStateVisible {
+		t.Fatalf("default post state = %q, want visible", root.PostState)
+	}
+
+	rootID := root.ID
+	later := &Post{
+		ID:        "later",
+		ParentID:  &rootID,
+		AuthorID:  plumber.ID,
+		Body:      "Is it a single-handle faucet?",
+		CreatedAt: "2026-08-26T09:00:00Z",
+	}
+	earlier := &Post{
+		ID:        "earlier",
+		ParentID:  &rootID,
+		AuthorID:  plumber.ID,
+		Body:      "Can you share the model number?",
+		CreatedAt: "2026-08-26T08:30:00Z",
+	}
+	if err := mem.CreatePost(ctx, later); err != nil {
+		t.Fatal(err)
+	}
+	if err := mem.CreatePost(ctx, earlier); err != nil {
+		t.Fatal(err)
+	}
+
+	laterID := later.ID
+	nested := &Post{
+		ID:        "nested",
+		ParentID:  &laterID,
+		AuthorID:  homeowner.ID,
+		Body:      "Yes, it is.",
+		CreatedAt: "2026-08-26T09:30:00Z",
+	}
+	if err := mem.CreatePost(ctx, nested); err != nil {
+		t.Fatal(err)
+	}
+
+	thread, err := mem.GetPostThread(ctx, root.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if thread.AuthorName != homeowner.Name || thread.AuthorRole != RoleUser {
+		t.Fatalf("root author = %q %q", thread.AuthorName, thread.AuthorRole)
+	}
+	if len(thread.Replies) != 2 ||
+		thread.Replies[0].ID != earlier.ID ||
+		thread.Replies[1].ID != later.ID {
+		t.Fatalf("root replies are not oldest-first: %+v", thread.Replies)
+	}
+	if len(thread.Replies[1].Replies) != 1 || thread.Replies[1].Replies[0].ID != nested.ID {
+		t.Fatalf("nested reply missing: %+v", thread.Replies[1].Replies)
+	}
+
+	otherParent := earlier.ID
+	nested.ParentID = &otherParent
+	nested.AuthorID = voter.ID
+	nested.Body = "Yes—one handle."
+	if err := mem.UpdatePost(ctx, nested); err != nil {
+		t.Fatal(err)
+	}
+	saved, err := mem.GetPost(ctx, nested.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if saved.ParentID == nil || *saved.ParentID != later.ID {
+		t.Fatalf("update changed parent to %+v", saved.ParentID)
+	}
+	if saved.AuthorID != homeowner.ID {
+		t.Fatalf("update changed author to %q", saved.AuthorID)
+	}
+	if saved.Body != "Yes—one handle." || saved.UpdatedAt == saved.CreatedAt {
+		t.Fatalf("body update not applied: %+v", saved)
+	}
+
+	if err := mem.VotePost(ctx, voter.ID, root.ID, 1); err != nil {
+		t.Fatal(err)
+	}
+	roots, err := mem.ListRootPosts(ctx, root.PostDate, voter.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(roots) != 1 || roots[0].ID != root.ID {
+		t.Fatalf("root list = %+v", roots)
+	}
+	if roots[0].Score != 1 || roots[0].UserVote != 1 || !roots[0].Answered {
+		t.Fatalf("root annotations = %+v", roots[0])
+	}
+	if err := mem.VotePost(ctx, voter.ID, later.ID, 1); !errors.Is(err, ErrPostNotVotable) {
+		t.Fatalf("reply vote error = %v", err)
+	}
+	byAuthor, err := mem.ListRootPostsByAuthor(ctx, homeowner.ID)
+	if err != nil || len(byAuthor) != 1 || byAuthor[0].ID != root.ID {
+		t.Fatalf("roots by author = %+v, %v", byAuthor, err)
+	}
+	answeredBy, err := mem.ListRootPostsAnsweredBy(ctx, plumber.ID)
+	if err != nil || len(answeredBy) != 1 || answeredBy[0].ID != root.ID {
+		t.Fatalf("roots answered by admin = %+v, %v", answeredBy, err)
+	}
+	if err := mem.SetRootPostState(ctx, later.ID, PostStateHidden); !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("reply state error = %v, want sql.ErrNoRows", err)
+	}
+	if err := mem.SetRootPostState(ctx, root.ID, PostStateHidden); err != nil {
+		t.Fatal(err)
+	}
+	if roots, err := mem.ListRootPostsByAuthor(ctx, homeowner.ID); err != nil || len(roots) != 0 {
+		t.Fatalf("hidden author roots = %+v, %v", roots, err)
+	}
+	if roots, err := mem.ListRootPostsAnsweredBy(ctx, plumber.ID); err != nil || len(roots) != 0 {
+		t.Fatalf("hidden answered roots = %+v, %v", roots, err)
+	}
+}
+
+func TestMemoryPostValidation(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	mem := NewMemory()
+	homeowner := &User{Username: "homeowner", PasswordHash: "hash", Role: RoleUser}
+	if err := mem.CreateUser(ctx, homeowner); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name string
+		post *Post
+	}{
+		{
+			name: "root without title",
+			post: &Post{AuthorID: homeowner.ID, Body: "Body"},
+		},
+		{
+			name: "empty parent",
+			post: &Post{ParentID: ptr(""), AuthorID: homeowner.ID, Body: "Body"},
+		},
+		{
+			name: "missing parent",
+			post: &Post{ParentID: ptr("missing"), AuthorID: homeowner.ID, Body: "Body"},
+		},
+		{
+			name: "reply with root fields",
+			post: &Post{
+				ParentID: ptr("missing"),
+				AuthorID: homeowner.ID,
+				Title:    "Not allowed",
+				Body:     "Body",
+			},
+		},
+		{
+			name: "invalid post state",
+			post: &Post{
+				AuthorID:  homeowner.ID,
+				Title:     "Invalid state",
+				Body:      "Body",
+				PostState: PostState("archived"),
+			},
+		},
+		{
+			name: "reply with non-visible state",
+			post: &Post{
+				ParentID:  ptr("missing"),
+				AuthorID:  homeowner.ID,
+				Body:      "Body",
+				PostState: PostStateLocked,
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if err := mem.CreatePost(ctx, test.post); !errors.Is(err, ErrInvalidPost) {
+				t.Fatalf("error = %v, want ErrInvalidPost", err)
+			}
+		})
+	}
+
+	hidden := &Post{
+		ID:        "hidden",
+		AuthorID:  homeowner.ID,
+		Title:     "Hidden",
+		Body:      "Body",
+		PostDate:  "2026-08-26",
+		PostState: PostStateHidden,
+	}
+	if err := mem.CreatePost(ctx, hidden); err != nil {
+		t.Fatal(err)
+	}
+	if err := mem.VotePost(ctx, homeowner.ID, hidden.ID, 1); !errors.Is(err, ErrPostNotVotable) {
+		t.Fatalf("hidden root vote error = %v", err)
+	}
+
+	locked := &Post{
+		ID:        "locked",
+		AuthorID:  homeowner.ID,
+		Title:     "Locked",
+		Body:      "Body",
+		PostDate:  "2026-08-26",
+		PostState: PostStateLocked,
+	}
+	if err := mem.CreatePost(ctx, locked); err != nil {
+		t.Fatal(err)
+	}
+	if err := mem.VotePost(ctx, homeowner.ID, locked.ID, 1); err != nil {
+		t.Fatalf("locked root should remain votable: %v", err)
+	}
+	roots, err := mem.ListRootPosts(ctx, locked.PostDate, homeowner.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(roots) != 1 || roots[0].ID != locked.ID || roots[0].PostState != PostStateLocked {
+		t.Fatalf("locked root should remain visible: %+v", roots)
+	}
+
+	if _, err := mem.GetPostThread(ctx, "missing"); !errors.Is(err, sql.ErrNoRows) {
+		t.Fatalf("missing thread error = %v", err)
+	}
+}
+
+func ptr(value string) *string {
+	return &value
+}

internal/store/postgres_store.go

@@ -144,6 +144,48 @@ func (p *Postgres) UpsertAnswer(ctx context.Context, a *Answer) error {
 	return a.Upsert(ctx)
 }
 
+func (p *Postgres) CreatePost(ctx context.Context, post *Post) error {
+	post.db = p.db
+	return post.Create(ctx)
+}
+
+func (p *Postgres) GetPost(ctx context.Context, id string) (*Post, error) {
+	return GetPost(ctx, p.db, id)
+}
+
+func (p *Postgres) GetPostThread(ctx context.Context, rootID string) (*Post, error) {
+	return GetPostThread(ctx, p.db, rootID)
+}
+
+func (p *Postgres) GetPostThreadForViewer(ctx context.Context, rootID, viewerID string) (*Post, error) {
+	return GetPostThreadForViewer(ctx, p.db, rootID, viewerID)
+}
+
+func (p *Postgres) UpdatePost(ctx context.Context, post *Post) error {
+	post.db = p.db
+	return post.Update(ctx)
+}
+
+func (p *Postgres) ListRootPosts(ctx context.Context, postDate, viewerID string) ([]Post, error) {
+	return ListRootPosts(ctx, p.db, postDate, viewerID)
+}
+
+func (p *Postgres) ListRootPostsByAuthor(ctx context.Context, authorID string) ([]Post, error) {
+	return ListRootPostsByAuthor(ctx, p.db, authorID)
+}
+
+func (p *Postgres) ListRootPostsAnsweredBy(ctx context.Context, adminID string) ([]Post, error) {
+	return ListRootPostsAnsweredBy(ctx, p.db, adminID)
+}
+
+func (p *Postgres) SetRootPostState(ctx context.Context, id string, state PostState) error {
+	return SetRootPostState(ctx, p.db, id, state)
+}
+
+func (p *Postgres) VotePost(ctx context.Context, userID, postID string, value int) error {
+	return SetPostVote(ctx, p.db, userID, postID, value)
+}
+
 func (p *Postgres) Vote(ctx context.Context, userID, questionID string, value int) error {
 	return Vote(ctx, p.db, userID, questionID, value)
 }

internal/store/sqlc/models.go

@@ -25,7 +25,7 @@ type Post struct {
 	Body      string
 	City      string
 	PostDate  string
-	Hidden    int32
+	PostState string
 	CreatedAt string
 	UpdatedAt string
 }

internal/store/sqlc/posts.sql.go

@@ -0,0 +1,592 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: posts.sql
+
+package sqlc
+
+import (
+	"context"
+	"database/sql"
+)
+
+const createPost = `-- name: CreatePost :exec
+INSERT INTO posts (
+  id, parent_id, author_id, title, body, city, post_date, post_state, created_at, updated_at
+)
+VALUES (
+  $1,
+  $2,
+  $3,
+  $4,
+  $5,
+  $6,
+  $7,
+  $8,
+  $9,
+  $10
+)
+`
+
+type CreatePostParams struct {
+	ID        string
+	ParentID  sql.NullString
+	AuthorID  string
+	Title     string
+	Body      string
+	City      string
+	PostDate  string
+	PostState string
+	CreatedAt string
+	UpdatedAt string
+}
+
+func (q *Queries) CreatePost(ctx context.Context, arg CreatePostParams) error {
+	_, err := q.db.ExecContext(ctx, createPost,
+		arg.ID,
+		arg.ParentID,
+		arg.AuthorID,
+		arg.Title,
+		arg.Body,
+		arg.City,
+		arg.PostDate,
+		arg.PostState,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const deletePostVote = `-- name: DeletePostVote :exec
+DELETE FROM post_votes
+WHERE user_id = $1
+  AND post_id = $2
+`
+
+type DeletePostVoteParams struct {
+	UserID string
+	PostID string
+}
+
+func (q *Queries) DeletePostVote(ctx context.Context, arg DeletePostVoteParams) error {
+	_, err := q.db.ExecContext(ctx, deletePostVote, arg.UserID, arg.PostID)
+	return err
+}
+
+const getPost = `-- name: GetPost :one
+SELECT
+  p.id, p.parent_id, p.author_id, u.name AS author_name, u.role AS author_role,
+  p.title, p.body, p.city, p.post_date, p.post_state, p.created_at, p.updated_at
+FROM posts p
+JOIN users u ON u.id = p.author_id
+WHERE p.id = $1
+`
+
+type GetPostRow struct {
+	ID         string
+	ParentID   sql.NullString
+	AuthorID   string
+	AuthorName string
+	AuthorRole string
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  string
+	CreatedAt  string
+	UpdatedAt  string
+}
+
+func (q *Queries) GetPost(ctx context.Context, id string) (GetPostRow, error) {
+	row := q.db.QueryRowContext(ctx, getPost, id)
+	var i GetPostRow
+	err := row.Scan(
+		&i.ID,
+		&i.ParentID,
+		&i.AuthorID,
+		&i.AuthorName,
+		&i.AuthorRole,
+		&i.Title,
+		&i.Body,
+		&i.City,
+		&i.PostDate,
+		&i.PostState,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getRootPostVoteSummary = `-- name: GetRootPostVoteSummary :one
+SELECT
+  COALESCE(SUM(value), 0)::bigint AS score,
+  COALESCE(
+    MAX(value) FILTER (WHERE user_id = $1),
+    0
+  )::bigint AS user_vote
+FROM post_votes
+WHERE post_id = $2
+`
+
+type GetRootPostVoteSummaryParams struct {
+	ViewerID string
+	RootID   string
+}
+
+type GetRootPostVoteSummaryRow struct {
+	Score    int64
+	UserVote int64
+}
+
+func (q *Queries) GetRootPostVoteSummary(ctx context.Context, arg GetRootPostVoteSummaryParams) (GetRootPostVoteSummaryRow, error) {
+	row := q.db.QueryRowContext(ctx, getRootPostVoteSummary, arg.ViewerID, arg.RootID)
+	var i GetRootPostVoteSummaryRow
+	err := row.Scan(&i.Score, &i.UserVote)
+	return i, err
+}
+
+const listPostThread = `-- name: ListPostThread :many
+WITH RECURSIVE thread AS (
+  SELECT p.id, p.parent_id, p.author_id, p.title, p.body, p.city, p.post_date, p.post_state, p.created_at, p.updated_at
+  FROM posts p
+  WHERE p.id = $1 AND p.parent_id IS NULL
+
+  UNION ALL
+
+  SELECT child.id, child.parent_id, child.author_id, child.title, child.body, child.city, child.post_date, child.post_state, child.created_at, child.updated_at
+  FROM posts child
+  JOIN thread parent ON child.parent_id = parent.id
+)
+SELECT
+  thread.id, thread.parent_id, thread.author_id,
+  u.name AS author_name, u.role AS author_role,
+  thread.title, thread.body, thread.city, thread.post_date,
+  thread.post_state, thread.created_at, thread.updated_at
+FROM thread
+JOIN users u ON u.id = thread.author_id
+ORDER BY thread.created_at, thread.id
+`
+
+type ListPostThreadRow struct {
+	ID         string
+	ParentID   sql.NullString
+	AuthorID   string
+	AuthorName string
+	AuthorRole string
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  string
+	CreatedAt  string
+	UpdatedAt  string
+}
+
+func (q *Queries) ListPostThread(ctx context.Context, rootID string) ([]ListPostThreadRow, error) {
+	rows, err := q.db.QueryContext(ctx, listPostThread, rootID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPostThreadRow{}
+	for rows.Next() {
+		var i ListPostThreadRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ParentID,
+			&i.AuthorID,
+			&i.AuthorName,
+			&i.AuthorRole,
+			&i.Title,
+			&i.Body,
+			&i.City,
+			&i.PostDate,
+			&i.PostState,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRootPosts = `-- name: ListRootPosts :many
+WITH RECURSIVE roots AS (
+  SELECT p.id, p.parent_id, p.author_id, p.title, p.body, p.city, p.post_date, p.post_state, p.created_at, p.updated_at
+  FROM posts p
+  WHERE p.parent_id IS NULL
+    AND p.post_date = $3
+    AND p.post_state <> $4
+),
+thread AS (
+  SELECT roots.id AS root_id, child.id AS post_id, child.author_id
+  FROM roots
+  JOIN posts child ON child.parent_id = roots.id
+
+  UNION ALL
+
+  SELECT thread.root_id, child.id, child.author_id
+  FROM thread
+  JOIN posts child ON child.parent_id = thread.post_id
+),
+answered AS (
+  SELECT DISTINCT thread.root_id
+  FROM thread
+  JOIN users u ON u.id = thread.author_id
+  WHERE u.role = 'admin'
+),
+scores AS (
+  SELECT votes.post_id, SUM(votes.value)::bigint AS score
+  FROM roots
+  JOIN post_votes votes ON votes.post_id = roots.id
+  GROUP BY votes.post_id
+)
+SELECT
+  roots.id, roots.parent_id, roots.author_id,
+  u.name AS author_name, u.role AS author_role,
+  roots.title, roots.body, roots.city, roots.post_date,
+  roots.post_state, roots.created_at, roots.updated_at,
+  COALESCE(scores.score, 0)::bigint AS score,
+  (answered.root_id IS NOT NULL)::bool AS answered,
+  COALESCE(viewer_vote.value, 0)::bigint AS user_vote
+FROM roots
+JOIN users u ON u.id = roots.author_id
+LEFT JOIN scores ON scores.post_id = roots.id
+LEFT JOIN answered ON answered.root_id = roots.id
+LEFT JOIN post_votes viewer_vote
+  ON viewer_vote.user_id = $1
+  AND viewer_vote.post_id = roots.id
+ORDER BY score DESC, roots.created_at, roots.id
+LIMIT $2
+`
+
+type ListRootPostsParams struct {
+	ViewerID    string
+	RowLimit    int32
+	PostDate    string
+	HiddenState string
+}
+
+type ListRootPostsRow struct {
+	ID         string
+	ParentID   sql.NullString
+	AuthorID   string
+	AuthorName string
+	AuthorRole string
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  string
+	CreatedAt  string
+	UpdatedAt  string
+	Score      int64
+	Answered   bool
+	UserVote   int64
+}
+
+func (q *Queries) ListRootPosts(ctx context.Context, arg ListRootPostsParams) ([]ListRootPostsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRootPosts,
+		arg.ViewerID,
+		arg.RowLimit,
+		arg.PostDate,
+		arg.HiddenState,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRootPostsRow{}
+	for rows.Next() {
+		var i ListRootPostsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ParentID,
+			&i.AuthorID,
+			&i.AuthorName,
+			&i.AuthorRole,
+			&i.Title,
+			&i.Body,
+			&i.City,
+			&i.PostDate,
+			&i.PostState,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.Score,
+			&i.Answered,
+			&i.UserVote,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRootPostsAnsweredBy = `-- name: ListRootPostsAnsweredBy :many
+WITH RECURSIVE ancestors AS (
+  SELECT p.id, p.parent_id
+  FROM posts p
+  WHERE p.author_id = $3
+    AND p.parent_id IS NOT NULL
+
+  UNION
+
+  SELECT parent.id, parent.parent_id
+  FROM posts parent
+  JOIN ancestors child ON child.parent_id = parent.id
+)
+SELECT DISTINCT
+  root.id, root.parent_id, root.author_id,
+  u.name AS author_name, u.role AS author_role,
+  root.title, root.body, root.city, root.post_date,
+  root.post_state, root.created_at, root.updated_at
+FROM posts root
+JOIN ancestors ON ancestors.id = root.id
+JOIN users u ON u.id = root.author_id
+WHERE root.parent_id IS NULL
+  AND root.post_state <> $1
+ORDER BY root.created_at DESC, root.id DESC
+LIMIT $2
+`
+
+type ListRootPostsAnsweredByParams struct {
+	HiddenState string
+	RowLimit    int32
+	AdminID     string
+}
+
+type ListRootPostsAnsweredByRow struct {
+	ID         string
+	ParentID   sql.NullString
+	AuthorID   string
+	AuthorName string
+	AuthorRole string
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  string
+	CreatedAt  string
+	UpdatedAt  string
+}
+
+func (q *Queries) ListRootPostsAnsweredBy(ctx context.Context, arg ListRootPostsAnsweredByParams) ([]ListRootPostsAnsweredByRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRootPostsAnsweredBy, arg.HiddenState, arg.RowLimit, arg.AdminID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRootPostsAnsweredByRow{}
+	for rows.Next() {
+		var i ListRootPostsAnsweredByRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ParentID,
+			&i.AuthorID,
+			&i.AuthorName,
+			&i.AuthorRole,
+			&i.Title,
+			&i.Body,
+			&i.City,
+			&i.PostDate,
+			&i.PostState,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRootPostsByAuthor = `-- name: ListRootPostsByAuthor :many
+SELECT
+  p.id, p.parent_id, p.author_id,
+  u.name AS author_name, u.role AS author_role,
+  p.title, p.body, p.city, p.post_date,
+  p.post_state, p.created_at, p.updated_at
+FROM posts p
+JOIN users u ON u.id = p.author_id
+WHERE p.parent_id IS NULL
+  AND p.author_id = $1
+  AND p.post_state <> $2
+ORDER BY p.created_at DESC, p.id DESC
+LIMIT $3
+`
+
+type ListRootPostsByAuthorParams struct {
+	AuthorID    string
+	HiddenState string
+	RowLimit    int32
+}
+
+type ListRootPostsByAuthorRow struct {
+	ID         string
+	ParentID   sql.NullString
+	AuthorID   string
+	AuthorName string
+	AuthorRole string
+	Title      string
+	Body       string
+	City       string
+	PostDate   string
+	PostState  string
+	CreatedAt  string
+	UpdatedAt  string
+}
+
+func (q *Queries) ListRootPostsByAuthor(ctx context.Context, arg ListRootPostsByAuthorParams) ([]ListRootPostsByAuthorRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRootPostsByAuthor, arg.AuthorID, arg.HiddenState, arg.RowLimit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRootPostsByAuthorRow{}
+	for rows.Next() {
+		var i ListRootPostsByAuthorRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ParentID,
+			&i.AuthorID,
+			&i.AuthorName,
+			&i.AuthorRole,
+			&i.Title,
+			&i.Body,
+			&i.City,
+			&i.PostDate,
+			&i.PostState,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const postIsVisibleRoot = `-- name: PostIsVisibleRoot :one
+SELECT EXISTS(
+  SELECT 1
+  FROM posts
+  WHERE id = $1
+    AND parent_id IS NULL
+    AND post_state <> $2
+)::bool
+`
+
+type PostIsVisibleRootParams struct {
+	ID          string
+	HiddenState string
+}
+
+func (q *Queries) PostIsVisibleRoot(ctx context.Context, arg PostIsVisibleRootParams) (bool, error) {
+	row := q.db.QueryRowContext(ctx, postIsVisibleRoot, arg.ID, arg.HiddenState)
+	var column_1 bool
+	err := row.Scan(&column_1)
+	return column_1, err
+}
+
+const updatePost = `-- name: UpdatePost :execrows
+UPDATE posts
+SET
+  body = $1,
+  updated_at = $2
+WHERE id = $3
+`
+
+type UpdatePostParams struct {
+	Body      string
+	UpdatedAt string
+	ID        string
+}
+
+func (q *Queries) UpdatePost(ctx context.Context, arg UpdatePostParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, updatePost, arg.Body, arg.UpdatedAt, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const updateRootPostState = `-- name: UpdateRootPostState :execrows
+UPDATE posts
+SET
+  post_state = $1,
+  updated_at = $2
+WHERE id = $3
+  AND parent_id IS NULL
+`
+
+type UpdateRootPostStateParams struct {
+	PostState string
+	UpdatedAt string
+	ID        string
+}
+
+func (q *Queries) UpdateRootPostState(ctx context.Context, arg UpdateRootPostStateParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, updateRootPostState, arg.PostState, arg.UpdatedAt, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const upsertPostVoteOnVisibleRoot = `-- name: UpsertPostVoteOnVisibleRoot :execrows
+INSERT INTO post_votes (user_id, post_id, value)
+SELECT $1, $2, $3
+FROM posts p
+WHERE p.id = $2
+  AND p.parent_id IS NULL
+  AND p.post_state <> $4
+ON CONFLICT (user_id, post_id) DO UPDATE
+SET value = excluded.value
+`
+
+type UpsertPostVoteOnVisibleRootParams struct {
+	UserID      string
+	PostID      string
+	Value       int32
+	HiddenState string
+}
+
+func (q *Queries) UpsertPostVoteOnVisibleRoot(ctx context.Context, arg UpsertPostVoteOnVisibleRootParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, upsertPostVoteOnVisibleRoot,
+		arg.UserID,
+		arg.PostID,
+		arg.Value,
+		arg.HiddenState,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}

internal/store/store.go

@@ -37,6 +37,17 @@ type Store interface {
 	GetAnswer(ctx context.Context, questionID string) (*Answer, error)
 	UpsertAnswer(ctx context.Context, a *Answer) error
 
+	CreatePost(ctx context.Context, post *Post) error
+	GetPost(ctx context.Context, id string) (*Post, error)
+	GetPostThread(ctx context.Context, rootID string) (*Post, error)
+	GetPostThreadForViewer(ctx context.Context, rootID, viewerID string) (*Post, error)
+	UpdatePost(ctx context.Context, post *Post) error
+	ListRootPosts(ctx context.Context, postDate, viewerID string) ([]Post, error)
+	ListRootPostsByAuthor(ctx context.Context, authorID string) ([]Post, error)
+	ListRootPostsAnsweredBy(ctx context.Context, adminID string) ([]Post, error)
+	SetRootPostState(ctx context.Context, id string, state PostState) error
+	VotePost(ctx context.Context, userID, postID string, value int) error
+
 	// Vote sets the vote to 1, -1, or 0 (clear) on a visible question.
 	Vote(ctx context.Context, userID, questionID string, value int) error
 }

internal/web/posts.go

@@ -0,0 +1,216 @@
+package web
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"plumber/internal/store"
+)
+
+// handleCreatePost creates either a root question or a reply. Replies are
+// limited to the root author and admins, and cannot be added to hidden threads.
+func (s *Server) handleCreatePost(w http.ResponseWriter, r *http.Request) {
+	if !s.requireCSRF(w, r) {
+		return
+	}
+	user := currentUser(r)
+	if user == nil {
+		http.Error(w, "authentication required", http.StatusUnauthorized)
+		return
+	}
+
+	parentID := strings.TrimSpace(r.PostFormValue("parent_id"))
+	body := strings.TrimSpace(r.PostFormValue("body"))
+	if body == "" {
+		http.Error(w, "post body required", http.StatusBadRequest)
+		return
+	}
+
+	post := &store.Post{
+		AuthorID: user.ID,
+		Body:     truncateRunes(body, 12000),
+	}
+	var root *store.Post
+	if parentID == "" {
+		post.Title = truncateRunes(strings.TrimSpace(r.PostFormValue("title")), 120)
+		post.City = truncateRunes(strings.TrimSpace(r.PostFormValue("city")), 80)
+		if post.Title == "" {
+			http.Error(w, "post title required", http.StatusBadRequest)
+			return
+		}
+	} else {
+		parent, threadRoot, err := s.postAndRoot(r.Context(), parentID)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				http.NotFound(w, r)
+				return
+			}
+			http.Error(w, "could not load thread", http.StatusInternalServerError)
+			return
+		}
+		if threadRoot.PostState == store.PostStateHidden {
+			http.NotFound(w, r)
+			return
+		}
+		if !canReplyToThread(user, threadRoot) {
+			http.Error(w, "forbidden", http.StatusForbidden)
+			return
+		}
+		post.ParentID = &parent.ID
+		root = threadRoot
+	}
+
+	if err := s.store.CreatePost(r.Context(), post); err != nil {
+		if errors.Is(err, store.ErrInvalidPost) {
+			http.Error(w, "invalid post", http.StatusBadRequest)
+			return
+		}
+		http.Error(w, "could not save post", http.StatusInternalServerError)
+		return
+	}
+	if root == nil {
+		root = post
+	}
+	http.Redirect(
+		w,
+		r,
+		"/questions/"+url.PathEscape(root.ID)+"#post-"+url.PathEscape(post.ID),
+		http.StatusSeeOther,
+	)
+}
+
+// handleEditPost updates only a post's body after verifying that the current
+// homeowner owns it or that an admin is editing an admin-authored post.
+func (s *Server) handleEditPost(w http.ResponseWriter, r *http.Request) {
+	if !s.requireCSRF(w, r) {
+		return
+	}
+	user := currentUser(r)
+	if user == nil {
+		http.Error(w, "authentication required", http.StatusUnauthorized)
+		return
+	}
+
+	post, root, err := s.postAndRoot(r.Context(), chi.URLParam(r, "id"))
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			http.NotFound(w, r)
+			return
+		}
+		http.Error(w, "could not load post", http.StatusInternalServerError)
+		return
+	}
+	if !canEditPost(user, post) {
+		http.Error(w, "forbidden", http.StatusForbidden)
+		return
+	}
+
+	body := strings.TrimSpace(r.PostFormValue("body"))
+	if body == "" {
+		http.Error(w, "post body required", http.StatusBadRequest)
+		return
+	}
+	post.Body = truncateRunes(body, 12000)
+	if err := s.store.UpdatePost(r.Context(), post); err != nil {
+		if errors.Is(err, store.ErrInvalidPost) {
+			http.Error(w, "invalid post", http.StatusBadRequest)
+			return
+		}
+		if errors.Is(err, sql.ErrNoRows) {
+			http.NotFound(w, r)
+			return
+		}
+		http.Error(w, "could not save post", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(
+		w,
+		r,
+		"/questions/"+url.PathEscape(root.ID)+"#post-"+url.PathEscape(post.ID),
+		http.StatusSeeOther,
+	)
+}
+
+// postAndRoot loads a post and follows its immutable parent chain to the root.
+// It returns both so callers can authorize against the thread and redirect to it.
+func (s *Server) postAndRoot(ctx context.Context, postID string) (*store.Post, *store.Post, error) {
+	postID = strings.TrimSpace(postID)
+	if postID == "" {
+		return nil, nil, sql.ErrNoRows
+	}
+	post, err := s.store.GetPost(ctx, postID)
+	if err != nil {
+		return nil, nil, err
+	}
+	current := post
+	seen := map[string]bool{}
+	for current.ParentID != nil {
+		if seen[current.ID] {
+			return nil, nil, fmt.Errorf("post ancestry cycle at %s", current.ID)
+		}
+		seen[current.ID] = true
+		current, err = s.store.GetPost(ctx, *current.ParentID)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+	return post, current, nil
+}
+
+// canEditPost keeps homeowner posts owner-only while allowing admins to edit
+// posts authored by an admin.
+func canEditPost(user *store.User, post *store.Post) bool {
+	if user == nil || post == nil {
+		return false
+	}
+	if post.AuthorRole == store.RoleAdmin {
+		return user.Admin()
+	}
+	return user.ID == post.AuthorID
+}
+
+func canReplyToThread(user *store.User, root *store.Post) bool {
+	return user != nil &&
+		root != nil &&
+		root.PostState != store.PostStateHidden &&
+		(user.Admin() || user.ID == root.AuthorID)
+}
+
+func postLabel(post *store.Post) string {
+	if post == nil {
+		return ""
+	}
+	if post.ParentID == nil {
+		return "Question"
+	}
+	if post.AuthorRole == store.RoleAdmin {
+		return "Shop response"
+	}
+	return "Homeowner"
+}
+
+func postDepthClass(depth int) string {
+	switch depth {
+	case 0:
+		return "root"
+	case 1:
+		return "branch"
+	default:
+		return "deep"
+	}
+}
+
+func postPointers(posts []store.Post) []*store.Post {
+	out := make([]*store.Post, len(posts))
+	for i := range posts {
+		out[i] = &posts[i]
+	}
+	return out
+}

internal/web/posts_test.go

@@ -0,0 +1,380 @@
+package web
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"plumber/internal/pacific"
+	"plumber/internal/store"
+)
+
+func TestCreatePostRoutePermissions(t *testing.T) {
+	t.Parallel()
+
+	srv, mem := newTestServer(t, Config{})
+	handler := srv.Handler()
+	homeowner := seedUser(t, mem, uniq("homeowner"), "hunter22", store.RoleUser)
+	other := seedUser(t, mem, uniq("other"), "hunter22", store.RoleUser)
+	admin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
+	homeownerCookies := loginUser(t, handler, homeowner.Username, "hunter22")
+	otherCookies := loginUser(t, handler, other.Username, "hunter22")
+	adminCookies := loginUser(t, handler, admin.Username, "hunter22")
+	homeownerCSRF := csrfForCookies(t, handler, homeownerCookies)
+	otherCSRF := csrfForCookies(t, handler, otherCookies)
+	adminCSRF := csrfForCookies(t, handler, adminCookies)
+
+	rec := postForm(handler, "/posts", url.Values{
+		"title": {"No CSRF"},
+		"body":  {"Body"},
+	}, homeownerCookies)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("missing CSRF status = %d, want 403", rec.Code)
+	}
+
+	anonRec := httptest.NewRecorder()
+	handler.ServeHTTP(anonRec, httptest.NewRequest(http.MethodGet, "/login", nil))
+	anonCookies := anonRec.Result().Cookies()
+	anonCSRF := csrfFrom(anonRec.Body.String())
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf": {anonCSRF},
+		"title": {"Anonymous"},
+		"body":  {"Body"},
+	}, anonCookies)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous create status = %d, want 401", rec.Code)
+	}
+
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf": {homeownerCSRF},
+		"title": {"Leaky sink"},
+		"body":  {"It drips."},
+		"city":  {"Oakland"},
+	}, homeownerCookies)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("root create status = %d: %s", rec.Code, rec.Body.String())
+	}
+	roots, err := mem.ListRootPosts(context.Background(), pacific.Today(), homeowner.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(roots) != 1 ||
+		roots[0].AuthorID != homeowner.ID ||
+		roots[0].Title != "Leaky sink" ||
+		roots[0].PostState != store.PostStateVisible {
+		t.Fatalf("created root = %+v", roots)
+	}
+	root := roots[0]
+	if got := rec.Header().Get("Location"); got != "/questions/"+root.ID+"#post-"+root.ID {
+		t.Fatalf("root redirect = %q", got)
+	}
+
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf":     {homeownerCSRF},
+		"parent_id": {root.ID},
+		"body":      {"The model is 123."},
+	}, homeownerCookies)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("homeowner reply status = %d: %s", rec.Code, rec.Body.String())
+	}
+	thread, err := mem.GetPostThread(context.Background(), root.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(thread.Replies) != 1 || thread.Replies[0].AuthorID != homeowner.ID {
+		t.Fatalf("homeowner reply missing: %+v", thread)
+	}
+	homeownerReply := thread.Replies[0]
+
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf":     {adminCSRF},
+		"parent_id": {homeownerReply.ID},
+		"body":      {"Replace the cartridge."},
+	}, adminCookies)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("admin nested reply status = %d: %s", rec.Code, rec.Body.String())
+	}
+	thread, err = mem.GetPostThread(context.Background(), root.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(thread.Replies[0].Replies) != 1 ||
+		thread.Replies[0].Replies[0].AuthorID != admin.ID {
+		t.Fatalf("admin nested reply missing: %+v", thread)
+	}
+
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf":     {otherCSRF},
+		"parent_id": {homeownerReply.ID},
+		"body":      {"I should not be here."},
+	}, otherCookies)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("unrelated reply status = %d, want 403", rec.Code)
+	}
+
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf":     {homeownerCSRF},
+		"parent_id": {"missing"},
+		"body":      {"Missing parent"},
+	}, homeownerCookies)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("missing-parent reply status = %d, want 404", rec.Code)
+	}
+
+	hidden := &store.Post{
+		AuthorID:  homeowner.ID,
+		Title:     "Hidden thread",
+		Body:      "Body",
+		PostDate:  pacific.Today(),
+		PostState: store.PostStateHidden,
+	}
+	if err := mem.CreatePost(context.Background(), hidden); err != nil {
+		t.Fatal(err)
+	}
+	rec = postForm(handler, "/posts", url.Values{
+		"_csrf":     {homeownerCSRF},
+		"parent_id": {hidden.ID},
+		"body":      {"Hidden reply"},
+	}, homeownerCookies)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("hidden-thread reply status = %d, want 404", rec.Code)
+	}
+}
+
+func TestEditPostRoutePermissions(t *testing.T) {
+	t.Parallel()
+
+	srv, mem := newTestServer(t, Config{})
+	handler := srv.Handler()
+	homeowner := seedUser(t, mem, uniq("homeowner"), "hunter22", store.RoleUser)
+	other := seedUser(t, mem, uniq("other"), "hunter22", store.RoleUser)
+	admin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
+	secondAdmin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
+	if err := mem.SetUserRole(context.Background(), secondAdmin.ID, store.RoleAdmin); err != nil {
+		t.Fatal(err)
+	}
+	homeownerCookies := loginUser(t, handler, homeowner.Username, "hunter22")
+	otherCookies := loginUser(t, handler, other.Username, "hunter22")
+	adminCookies := loginUser(t, handler, admin.Username, "hunter22")
+	secondAdminCookies := loginUser(t, handler, secondAdmin.Username, "hunter22")
+	homeownerCSRF := csrfForCookies(t, handler, homeownerCookies)
+	otherCSRF := csrfForCookies(t, handler, otherCookies)
+	adminCSRF := csrfForCookies(t, handler, adminCookies)
+	secondAdminCSRF := csrfForCookies(t, handler, secondAdminCookies)
+
+	root := &store.Post{
+		AuthorID: homeowner.ID,
+		Title:    "Leaky sink",
+		Body:     "Original body",
+		PostDate: pacific.Today(),
+	}
+	if err := mem.CreatePost(context.Background(), root); err != nil {
+		t.Fatal(err)
+	}
+	rootID := root.ID
+	adminReply := &store.Post{
+		ParentID: &rootID,
+		AuthorID: admin.ID,
+		Body:     "Original answer",
+	}
+	if err := mem.CreatePost(context.Background(), adminReply); err != nil {
+		t.Fatal(err)
+	}
+
+	anonRec := httptest.NewRecorder()
+	handler.ServeHTTP(anonRec, httptest.NewRequest(http.MethodGet, "/login", nil))
+	rec := postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
+		"_csrf": {csrfFrom(anonRec.Body.String())},
+		"body":  {"Anonymous edit"},
+	}, anonRec.Result().Cookies())
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous edit status = %d, want 401", rec.Code)
+	}
+
+	rec = postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
+		"_csrf":     {homeownerCSRF},
+		"body":      {"Updated homeowner body"},
+		"parent_id": {adminReply.ID},
+		"author_id": {other.ID},
+	}, homeownerCookies)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("homeowner edit status = %d: %s", rec.Code, rec.Body.String())
+	}
+	saved, err := mem.GetPost(context.Background(), root.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if saved.Body != "Updated homeowner body" ||
+		saved.ParentID != nil ||
+		saved.AuthorID != homeowner.ID {
+		t.Fatalf("homeowner edit changed immutable fields: %+v", saved)
+	}
+
+	for name, session := range map[string]struct {
+		cookies []*http.Cookie
+		csrf    string
+	}{
+		"other homeowner": {otherCookies, otherCSRF},
+		"admin":           {adminCookies, adminCSRF},
+	} {
+		t.Run(name+" cannot edit homeowner post", func(t *testing.T) {
+			rec := postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
+				"_csrf": {session.csrf},
+				"body":  {"Unauthorized edit"},
+			}, session.cookies)
+			if rec.Code != http.StatusForbidden {
+				t.Fatalf("status = %d, want 403", rec.Code)
+			}
+		})
+	}
+
+	rec = postForm(handler, "/posts/"+adminReply.ID+"/edit", url.Values{
+		"_csrf": {homeownerCSRF},
+		"body":  {"Homeowner edit"},
+	}, homeownerCookies)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("homeowner editing admin post status = %d, want 403", rec.Code)
+	}
+
+	rec = postForm(handler, "/posts/"+adminReply.ID+"/edit", url.Values{
+		"_csrf": {secondAdminCSRF},
+		"body":  {"Updated admin answer"},
+	}, secondAdminCookies)
+	if rec.Code != http.StatusSeeOther {
+		t.Fatalf("admin edit status = %d: %s", rec.Code, rec.Body.String())
+	}
+	saved, err = mem.GetPost(context.Background(), adminReply.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if saved.Body != "Updated admin answer" ||
+		saved.ParentID == nil ||
+		*saved.ParentID != root.ID ||
+		saved.AuthorID != admin.ID {
+		t.Fatalf("admin edit changed immutable fields: %+v", saved)
+	}
+}
+
+func TestQuestionPageRendersNestedPostControls(t *testing.T) {
+	t.Parallel()
+
+	srv, mem := newTestServer(t, Config{})
+	handler := srv.Handler()
+	homeowner := seedUser(t, mem, uniq("homeowner"), "hunter22", store.RoleUser)
+	admin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
+	homeownerCookies := loginUser(t, handler, homeowner.Username, "hunter22")
+	adminCookies := loginUser(t, handler, admin.Username, "hunter22")
+
+	root := &store.Post{
+		AuthorID: homeowner.ID,
+		Title:    "Leaky sink",
+		Body:     "Water under the cabinet.",
+		City:     "Oakland",
+		PostDate: pacific.Today(),
+	}
+	if err := mem.CreatePost(context.Background(), root); err != nil {
+		t.Fatal(err)
+	}
+	homeownerReply := &store.Post{
+		ParentID: &root.ID,
+		AuthorID: homeowner.ID,
+		Body:     "The model number is 123.",
+	}
+	if err := mem.CreatePost(context.Background(), homeownerReply); err != nil {
+		t.Fatal(err)
+	}
+	adminReply := &store.Post{
+		ParentID: &homeownerReply.ID,
+		AuthorID: admin.ID,
+		Body:     "Replace the cartridge.",
+	}
+	if err := mem.CreatePost(context.Background(), adminReply); err != nil {
+		t.Fatal(err)
+	}
+	homeownerReply.Body = "The model number is 123A."
+	if err := mem.UpdatePost(context.Background(), homeownerReply); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/questions/"+root.ID, nil)
+	for _, cookie := range homeownerCookies {
+		req.AddCookie(cookie)
+	}
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("question page status = %d: %s", rec.Code, rec.Body.String())
+	}
+	body := rec.Body.String()
+	for _, want := range []string{
+		`id="post-` + root.ID + `"`,
+		`id="post-` + homeownerReply.ID + `"`,
+		`id="post-` + adminReply.ID + `"`,
+		`class="thread-post thread-post-branch`,
+		`class="thread-post thread-post-deep is-shop"`,
+		"Homeowner",
+		"Shop response",
+		"Edited",
+		`action="/posts"`,
+		`action="/posts/` + root.ID + `/edit"`,
+		`action="/posts/` + homeownerReply.ID + `/edit"`,
+		`>The model number is 123A.</textarea>`,
+		`removeAttribute('open')`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("question page missing %q: %s", want, body)
+		}
+	}
+	if strings.Contains(body, `action="/posts/`+adminReply.ID+`/edit"`) {
+		t.Fatalf("homeowner can edit admin reply: %s", body)
+	}
+
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/questions/"+root.ID, nil)
+	for _, cookie := range adminCookies {
+		req.AddCookie(cookie)
+	}
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK ||
+		!strings.Contains(rec.Body.String(), `action="/posts/`+adminReply.ID+`/edit"`) ||
+		strings.Contains(rec.Body.String(), `action="/posts/`+root.ID+`/edit"`) {
+		t.Fatalf("admin edit controls are incorrect: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
+func csrfForCookies(t *testing.T, handler http.Handler, cookies []*http.Cookie) string {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/submit", nil)
+	for _, cookie := range cookies {
+		req.AddCookie(cookie)
+	}
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("load CSRF form status = %d", rec.Code)
+	}
+	csrf := csrfFrom(rec.Body.String())
+	if csrf == "" {
+		t.Fatal("CSRF token missing")
+	}
+	return csrf
+}
+
+func postForm(
+	handler http.Handler,
+	path string,
+	values url.Values,
+	cookies []*http.Cookie,
+) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(values.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	for _, cookie := range cookies {
+		req.AddCookie(cookie)
+	}
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	return rec
+}

internal/web/profile.go

@@ -23,7 +23,7 @@ import (
 type profilePage struct {
 	page
 	States         []struct{ Code, Name string }
-	Questions      []store.RankedQuestion
+	Posts          []store.Post
 	QuestionsLabel string
 	UploadsEnabled bool
 	Error          string
@@ -255,16 +255,16 @@ func fitAvatar(img image.Image, maxDim int) image.Image {
 
 func (s *Server) renderProfile(w http.ResponseWriter, r *http.Request, u *store.User, errMsg, stateVal, emailVal string) {
 	var (
-		questions []store.RankedQuestion
-		label     string
-		err       error
+		posts []store.Post
+		label string
+		err   error
 	)
 	if u.Admin() {
 		label = "Questions you answered"
-		questions, err = s.store.ListQuestionsAnsweredBy(r.Context(), u.ID)
+		posts, err = s.store.ListRootPostsAnsweredBy(r.Context(), u.ID)
 	} else {
 		label = "Your questions"
-		questions, err = s.store.ListQuestionsByAuthor(r.Context(), u.ID)
+		posts, err = s.store.ListRootPostsByAuthor(r.Context(), u.ID)
 	}
 	if err != nil {
 		http.Error(w, "could not load questions", http.StatusInternalServerError)
@@ -275,7 +275,7 @@ func (s *Server) renderProfile(w http.ResponseWriter, r *http.Request, u *store.
 	s.exec(w, "profile", profilePage{
 		page:           p,
 		States:         geo.States,
-		Questions:      questions,
+		Posts:          posts,
 		QuestionsLabel: label,
 		UploadsEnabled: s.cfg.Blob.Enabled(),
 		Error:          errMsg,

internal/web/server.go

@@ -3,7 +3,6 @@ package web
 import (
 	"context"
 	"crypto/rand"
-	"database/sql"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -64,13 +63,12 @@ type huntPage struct {
 	Label       string
 	IsToday     bool
 	IsYesterday bool
-	Questions   []store.RankedQuestion
+	Posts       []*store.Post
 }
 
 type questionPage struct {
 	page
-	Question *store.RankedQuestion
-	Answer   *store.Answer
+	Question *store.Post
 }
 
 type submitPage struct {
@@ -90,11 +88,19 @@ type authPage struct {
 }
 
 type voteCtx struct {
-	User     *store.User
-	CSRF     string
-	View     string
-	Date     string
-	Question store.RankedQuestion
+	User *store.User
+	CSRF string
+	View string
+	Date string
+	Post *store.Post
+}
+
+type threadPostCtx struct {
+	User  *store.User
+	CSRF  string
+	Root  *store.Post
+	Post  *store.Post
+	Depth int
 }
 
 func New(st store.Store, sessionStore scs.Store, templateFS fs.FS, staticFS fs.FS, cfg Config) (*Server, error) {
@@ -105,12 +111,27 @@ func New(st store.Store, sessionStore scs.Store, templateFS fs.FS, staticFS fs.F
 		cfg.Mail = mail.Nop{}
 	}
 	funcMap := template.FuncMap{
-		"voteCtx": func(user *store.User, csrf, view, date string, q store.RankedQuestion) voteCtx {
-			return voteCtx{User: user, CSRF: csrf, View: view, Date: date, Question: q}
+		"voteCtx": func(user *store.User, csrf, view, date string, post *store.Post) voteCtx {
+			return voteCtx{User: user, CSRF: csrf, View: view, Date: date, Post: post}
+		},
+		"postCtx": func(user *store.User, csrf string, root, post *store.Post, depth int) threadPostCtx {
+			return threadPostCtx{User: user, CSRF: csrf, Root: root, Post: post, Depth: depth}
+		},
+		"add":         func(a, b int) int { return a + b },
+		"rank":        func(i int) int { return i + 1 },
+		"isAdmin":     func(u *store.User) bool { return u.Admin() },
+		"canReply":    canReplyToThread,
+		"canEditPost": canEditPost,
+		"postLabel":   postLabel,
+		"postDepth":   postDepthClass,
+		"isEdited":    func(post *store.Post) bool { return post != nil && post.UpdatedAt != post.CreatedAt },
+		"postTime": func(value string) string {
+			t, err := time.Parse(time.RFC3339Nano, value)
+			if err != nil {
+				return value
+			}
+			return t.In(pacific.Loc).Format("Jan 2, 2006 · 3:04 PM")
 		},
-		"add":          func(a, b int) int { return a + b },
-		"rank":         func(i int) int { return i + 1 },
-		"isAdmin":      func(u *store.User) bool { return u.Admin() },
 		"pacificLabel": pacific.Label,
 		"locationTag": func(u *store.User) string {
 			if u != nil {
@@ -177,6 +198,8 @@ func (s *Server) Handler() http.Handler {
 	r.Post("/questions/{id}/vote", s.handleVote)
 	r.Post("/questions/{id}/answer", s.handleAnswer)
 	r.Post("/questions/{id}/hide", s.handleHide)
+	r.Post("/posts", s.handleCreatePost)
+	r.Post("/posts/{id}/edit", s.handleEditPost)
 	r.Get("/login", s.handleLoginForm)
 	r.Post("/login", s.handleLogin)
 	r.Get("/register", s.handleRegisterForm)
@@ -279,7 +302,7 @@ func (s *Server) renderHunt(w http.ResponseWriter, r *http.Request, date string)
 	if u := currentUser(r); u != nil {
 		viewer = u.ID
 	}
-	questions, err := s.store.ListHunt(r.Context(), date, viewer)
+	posts, err := s.store.ListRootPosts(r.Context(), date, viewer)
 	if err != nil {
 		http.Error(w, "could not load questions", http.StatusInternalServerError)
 		return
@@ -295,7 +318,7 @@ func (s *Server) renderHunt(w http.ResponseWriter, r *http.Request, date string)
 		Label:       label,
 		IsToday:     pacific.IsToday(date),
 		IsYesterday: pacific.IsYesterday(date),
-		Questions:   questions,
+		Posts:       postPointers(posts),
 	})
 }
 
@@ -339,17 +362,17 @@ func (s *Server) handleSubmit(w http.ResponseWriter, r *http.Request) {
 	if len(city) > 80 {
 		city = truncateRunes(city, 80)
 	}
-	q := &store.RankedQuestion{
+	post := &store.Post{
 		AuthorID: u.ID,
 		Title:    title,
 		Body:     body,
 		City:     city,
 	}
-	if err := s.store.CreateQuestion(r.Context(), q); err != nil {
+	if err := s.store.CreatePost(r.Context(), post); err != nil {
 		http.Error(w, "could not save question", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/questions/"+url.PathEscape(q.ID), http.StatusSeeOther)
+	http.Redirect(w, r, "/questions/"+url.PathEscape(post.ID), http.StatusSeeOther)
 }
 
 func (s *Server) handleQuestion(w http.ResponseWriter, r *http.Request) {
@@ -358,29 +381,14 @@ func (s *Server) handleQuestion(w http.ResponseWriter, r *http.Request) {
 	if u := currentUser(r); u != nil {
 		viewer = u.ID
 	}
-	q, err := s.store.GetQuestion(r.Context(), id, viewer)
-	if err != nil || (q.Hidden && !currentUser(r).Admin()) {
+	post, err := s.store.GetPostThreadForViewer(r.Context(), id, viewer)
+	if err != nil || (post.PostState == store.PostStateHidden && !currentUser(r).Admin()) {
 		http.NotFound(w, r)
 		return
 	}
-	var ans *store.Answer
-	if q.Answered {
-		ans, err = s.store.GetAnswer(r.Context(), q.ID)
-		if err != nil {
-			if errors.Is(err, sql.ErrNoRows) {
-				log.Printf("question %s marked answered but answer missing", q.ID)
-				http.Error(w, "answer unavailable", http.StatusInternalServerError)
-				return
-			}
-			log.Printf("get answer %s: %v", q.ID, err)
-			http.Error(w, "could not load answer", http.StatusInternalServerError)
-			return
-		}
-	}
 	s.exec(w, "question", questionPage{
-		page:     s.basePage(r, q.Title),
-		Question: q,
-		Answer:   ans,
+		page:     s.basePage(r, post.Title),
+		Question: post,
 	})
 }
 
@@ -410,8 +418,8 @@ func (s *Server) handleVote(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid vote", http.StatusBadRequest)
 		return
 	}
-	if err := s.store.Vote(r.Context(), u.ID, id, value); err != nil {
-		if errors.Is(err, store.ErrHiddenOrMissing) {
+	if err := s.store.VotePost(r.Context(), u.ID, id, value); err != nil {
+		if errors.Is(err, store.ErrPostNotVotable) {
 			http.Error(w, "not found", http.StatusNotFound)
 			return
 		}
@@ -425,17 +433,17 @@ func (s *Server) handleVote(w http.ResponseWriter, r *http.Request) {
 			s.renderLeaderboard(w, r, date)
 			return
 		}
-		q, err := s.store.GetQuestion(r.Context(), id, u.ID)
+		post, err := s.store.GetPostThreadForViewer(r.Context(), id, u.ID)
 		if err != nil {
 			http.Error(w, "not found", http.StatusNotFound)
 			return
 		}
 		s.exec(w, "vote", voteCtx{
-			User:     u,
-			CSRF:     s.sessions.GetString(r.Context(), "csrf"),
-			View:     "question",
-			Date:     q.HuntDate,
-			Question: *q,
+			User: u,
+			CSRF: s.sessions.GetString(r.Context(), "csrf"),
+			View: "question",
+			Date: post.PostDate,
+			Post: post,
 		})
 		return
 	}
@@ -458,15 +466,15 @@ func (s *Server) renderLeaderboard(w http.ResponseWriter, r *http.Request, date
 	if u := currentUser(r); u != nil {
 		viewer = u.ID
 	}
-	questions, err := s.store.ListHunt(r.Context(), date, viewer)
+	posts, err := s.store.ListRootPosts(r.Context(), date, viewer)
 	if err != nil {
 		http.Error(w, "could not load questions", http.StatusInternalServerError)
 		return
 	}
 	s.exec(w, "leaderboard", huntPage{
-		page:      s.basePage(r, ""),
-		Date:      date,
-		Questions: questions,
+		page:  s.basePage(r, ""),
+		Date:  date,
+		Posts: postPointers(posts),
 	})
 }
 
@@ -488,65 +496,27 @@ func (s *Server) handleAnswer(w http.ResponseWriter, r *http.Request) {
 	if len(body) > 12000 {
 		body = truncateRunes(body, 12000)
 	}
-	q, err := s.store.GetQuestion(r.Context(), id, u.ID)
-	if err != nil {
+	root, err := s.store.GetPost(r.Context(), id)
+	if err != nil || root.ParentID != nil || root.PostState == store.PostStateHidden {
 		http.NotFound(w, r)
 		return
 	}
-	_, priorErr := s.store.GetAnswer(r.Context(), id)
-	wasNew := errors.Is(priorErr, sql.ErrNoRows)
-	if priorErr != nil && !wasNew {
-		http.Error(w, "could not load answer", http.StatusInternalServerError)
-		return
+	reply := &store.Post{
+		ParentID: &root.ID,
+		AuthorID: u.ID,
+		Body:     body,
 	}
-	ans := &store.Answer{
-		QuestionID: id,
-		AuthorID:   u.ID,
-		Body:       body,
-	}
-	if err := s.store.UpsertAnswer(r.Context(), ans); err != nil {
+	if err := s.store.CreatePost(r.Context(), reply); err != nil {
 		http.Error(w, "could not save answer", http.StatusInternalServerError)
 		return
 	}
-	if wasNew {
-		s.notifyQuestionAnswered(q, body, u.ID)
-	}
-	saved, err := s.store.GetAnswer(r.Context(), id)
-	if err != nil {
-		http.Error(w, "could not load answer", http.StatusInternalServerError)
-		return
-	}
+	location := "/questions/" + url.PathEscape(id) + "#post-" + url.PathEscape(reply.ID)
 	if isHTMX(r) {
-		s.exec(w, "answer", questionPage{page: s.basePage(r, ""), Answer: saved})
+		w.Header().Set("HX-Redirect", location)
+		w.WriteHeader(http.StatusSeeOther)
 		return
 	}
-	http.Redirect(w, r, "/questions/"+url.PathEscape(id), http.StatusSeeOther)
-}
-
-func (s *Server) notifyQuestionAnswered(q *store.RankedQuestion, answerBody, adminID string) {
-	if q == nil || s.cfg.Mail == nil {
-		return
-	}
-	author, err := s.store.UserByID(context.Background(), q.AuthorID)
-	if err != nil || author == nil || author.Email == "" || author.ID == adminID {
-		return
-	}
-	msg := mail.QuestionAnswered{
-		ToEmail:       author.Email,
-		ToName:        author.Name,
-		QuestionID:    q.ID,
-		QuestionTitle: q.Title,
-		AnswerBody:    answerBody,
-	}
-	go func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		if err := s.cfg.Mail.NotifyQuestionAnswered(ctx, msg); err != nil {
-			log.Printf("notify answer %s: %v", q.ID, err)
-			return
-		}
-		log.Printf("notify answer %s: accepted", q.ID)
-	}()
+	http.Redirect(w, r, location, http.StatusSeeOther)
 }
 
 func (s *Server) handleHide(w http.ResponseWriter, r *http.Request) {
@@ -559,17 +529,17 @@ func (s *Server) handleHide(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	id := chi.URLParam(r, "id")
-	q, err := s.store.GetQuestion(r.Context(), id, u.ID)
-	if err != nil {
+	post, err := s.store.GetPost(r.Context(), id)
+	if err != nil || post.ParentID != nil {
 		http.NotFound(w, r)
 		return
 	}
-	if err := s.store.HideQuestion(r.Context(), id); err != nil {
+	if err := s.store.SetRootPostState(r.Context(), id, store.PostStateHidden); err != nil {
 		http.Error(w, "could not hide", http.StatusInternalServerError)
 		return
 	}
 	if isHTMX(r) && r.PostFormValue("view") == "list" {
-		s.renderLeaderboard(w, r, q.HuntDate)
+		s.renderLeaderboard(w, r, post.PostDate)
 		return
 	}
 	if isHTMX(r) {

internal/web/server_test.go

@@ -19,7 +19,6 @@ import (
 
 	"plumber"
 	"plumber/internal/blob"
-	"plumber/internal/mail"
 	"plumber/internal/pacific"
 	"plumber/internal/store"
 )
@@ -417,21 +416,21 @@ func TestProfileAdminAnsweredListAndAvatarUpload(t *testing.T) {
 	alice := seedUser(t, mem, aliceName, "hunter22", store.RoleUser)
 	adminCookies := loginUser(t, h, hubName, "hunter22")
 
-	q := &store.RankedQuestion{
+	root := &store.Post{
 		AuthorID: alice.ID,
 		Title:    "Drip",
 		Body:     "Under sink",
 		City:     "Oakland",
 	}
-	if err := mem.CreateQuestion(context.Background(), q); err != nil {
+	if err := mem.CreatePost(context.Background(), root); err != nil {
 		t.Fatal(err)
 	}
-	ans := &store.Answer{
-		QuestionID: q.ID,
-		AuthorID:   hub.ID,
-		Body:       "Replace the cartridge.",
+	reply := &store.Post{
+		ParentID: &root.ID,
+		AuthorID: hub.ID,
+		Body:     "Replace the cartridge.",
 	}
-	if err := mem.UpsertAnswer(context.Background(), ans); err != nil {
+	if err := mem.CreatePost(context.Background(), reply); err != nil {
 		t.Fatal(err)
 	}
 
@@ -493,14 +492,14 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 	adminCookies := loginUser(t, h, adminName, "hunter22")
 	userCookies := loginUser(t, h, userName, "hunter22")
 
-	q := &store.RankedQuestion{
+	q := &store.Post{
 		AuthorID: user.ID,
 		Title:    "Pipe noise",
 		Body:     "Clanking",
 		City:     "SF",
-		HuntDate: pacific.Today(),
+		PostDate: pacific.Today(),
 	}
-	if err := mem.CreateQuestion(context.Background(), q); err != nil {
+	if err := mem.CreatePost(context.Background(), q); err != nil {
 		t.Fatal(err)
 	}
 
@@ -556,7 +555,7 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 	if rec.Code != 200 {
 		t.Fatalf("vote htmx %d %s", rec.Code, rec.Body.String())
 	}
-	got, err := mem.GetQuestion(context.Background(), q.ID, user.ID)
+	got, err := mem.GetPostThreadForViewer(context.Background(), q.ID, user.ID)
 	if err != nil || got.UserVote != 1 || got.Score != 1 {
 		t.Fatalf("vote not applied: %+v %v", got, err)
 	}
@@ -581,7 +580,7 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 		t.Fatalf("non-admin answer want 403, got %d", rec.Code)
 	}
 
-	// Admin answer success (HTMX)
+	// Admin answer compatibility route creates a reply and redirects the thread.
 	rec = httptest.NewRecorder()
 	req = httptest.NewRequest(http.MethodGet, "/questions/"+q.ID, nil)
 	for _, c := range adminCookies {
@@ -598,22 +597,37 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 	}
 	rec = httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Tighten the nuts") {
+	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("admin answer: %d %s", rec.Code, rec.Body.String())
 	}
-	if body := rec.Body.String(); !strings.Contains(body, `class="answer-editor"`) ||
-		!strings.Contains(body, "<summary>Edit answer</summary>") ||
+	thread, err := mem.GetPostThread(context.Background(), q.ID)
+	if err != nil || len(thread.Replies) != 1 {
+		t.Fatalf("admin reply missing: %+v %v", thread, err)
+	}
+	adminReply := thread.Replies[0]
+	if adminReply.AuthorID != admin.ID || adminReply.Body != "Tighten the nuts." {
+		t.Fatalf("unexpected admin reply: %+v", adminReply)
+	}
+	if got := rec.Header().Get("HX-Redirect"); got != "/questions/"+q.ID+"#post-"+adminReply.ID {
+		t.Fatalf("admin answer redirect = %q", got)
+	}
+
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/questions/"+q.ID, nil)
+	for _, c := range adminCookies {
+		req.AddCookie(c)
+	}
+	h.ServeHTTP(rec, req)
+	if body := rec.Body.String(); !strings.Contains(body, "Tighten the nuts.") ||
+		!strings.Contains(body, "<summary>Edit</summary>") ||
 		!strings.Contains(body, ">Tighten the nuts.</textarea>") ||
 		!strings.Contains(body, `type="reset" class="btn btn-ghost"`) ||
 		!strings.Contains(body, `removeAttribute('open')`) ||
-		strings.Contains(body, `<details class="answer-editor" open`) {
-		t.Fatalf("admin answer editor is not collapsed and populated: %s", body)
-	}
-	if _, err := mem.GetAnswer(context.Background(), q.ID); err != nil {
-		t.Fatal(err)
+		strings.Contains(body, `<details class="post-composer" open`) {
+		t.Fatalf("admin reply editor is not collapsed and populated: %s", body)
 	}
 
-	// The public answer is visible to its author, but editing remains admin-only.
+	// The public reply is visible to the root author, but editing remains admin-only.
 	rec = httptest.NewRecorder()
 	req = httptest.NewRequest(http.MethodGet, "/questions/"+q.ID, nil)
 	for _, c := range userCookies {
@@ -623,8 +637,8 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "Tighten the nuts.") {
 		t.Fatalf("question author cannot see answer: %d %s", rec.Code, rec.Body.String())
 	}
-	if strings.Contains(rec.Body.String(), `class="answer-editor"`) {
-		t.Fatalf("question author can see admin answer editor: %s", rec.Body.String())
+	if strings.Contains(rec.Body.String(), `/posts/`+adminReply.ID+`/edit`) {
+		t.Fatalf("question author can edit admin reply: %s", rec.Body.String())
 	}
 
 	// Hide invalid id
@@ -659,8 +673,8 @@ func TestMutationsVoteAnswerHideAndCSRF(t *testing.T) {
 	if rec.Code != http.StatusSeeOther {
 		t.Fatalf("hide %d %s", rec.Code, rec.Body.String())
 	}
-	hidden, err := mem.GetQuestion(context.Background(), q.ID, admin.ID)
-	if err != nil || !hidden.Hidden {
+	hidden, err := mem.GetPost(context.Background(), q.ID)
+	if err != nil || hidden.PostState != store.PostStateHidden {
 		t.Fatalf("question not hidden: %+v %v", hidden, err)
 	}
 }
@@ -713,113 +727,6 @@ func TestRegisterRequiresEmail(t *testing.T) {
 	}
 }
 
-func TestAnswerNotifyFirstOnly(t *testing.T) {
-	recMail := &mail.Recording{}
-	srv, mem := newTestServer(t, Config{Mail: recMail})
-	h := srv.Handler()
-	adminName := uniq("adm")
-	askName := uniq("ask")
-	admin := seedUser(t, mem, adminName, "hunter22", store.RoleAdmin)
-	asker := seedUser(t, mem, askName, "hunter22", store.RoleUser)
-	adminCookies := loginUser(t, h, adminName, "hunter22")
-
-	q := &store.RankedQuestion{
-		AuthorID: asker.ID,
-		Title:    "Leaky sink",
-		Body:     "Drip",
-		City:     "Oakland",
-		HuntDate: pacific.Today(),
-	}
-	if err := mem.CreateQuestion(context.Background(), q); err != nil {
-		t.Fatal(err)
-	}
-
-	postAnswer := func(body string) {
-		t.Helper()
-		w := httptest.NewRecorder()
-		req := httptest.NewRequest(http.MethodGet, "/questions/"+q.ID, nil)
-		for _, c := range adminCookies {
-			req.AddCookie(c)
-		}
-		h.ServeHTTP(w, req)
-		csrf := csrfFrom(w.Body.String())
-		form := strings.NewReader("_csrf=" + csrf + "&body=" + body)
-		req = httptest.NewRequest(http.MethodPost, "/questions/"+q.ID+"/answer", form)
-		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		req.Header.Set("HX-Request", "true")
-		for _, c := range adminCookies {
-			req.AddCookie(c)
-		}
-		w = httptest.NewRecorder()
-		h.ServeHTTP(w, req)
-		if w.Code != 200 {
-			t.Fatalf("answer %d %s", w.Code, w.Body.String())
-		}
-	}
-
-	postAnswer("First+reply")
-	deadline := time.Now().Add(2 * time.Second)
-	var msgs []mail.QuestionAnswered
-	for time.Now().Before(deadline) {
-		msgs = recMail.Snapshot()
-		if len(msgs) > 0 {
-			break
-		}
-		time.Sleep(10 * time.Millisecond)
-	}
-	if len(msgs) != 1 {
-		t.Fatalf("first answer notifies once, got %d", len(msgs))
-	}
-	if msgs[0].ToEmail != asker.Email || msgs[0].QuestionID != q.ID {
-		t.Fatalf("unexpected notify: %+v", msgs[0])
-	}
-	if msgs[0].AnswerBody != "First reply" {
-		t.Fatalf("answer body %q", msgs[0].AnswerBody)
-	}
-
-	postAnswer("Edited+reply")
-	time.Sleep(50 * time.Millisecond)
-	if recMail.Len() != 1 {
-		t.Fatalf("edit must not notify again, got %d", recMail.Len())
-	}
-
-	// Author without email is skipped
-	recMail2 := &mail.Recording{}
-	srv2, mem2 := newTestServer(t, Config{Mail: recMail2})
-	h2 := srv2.Handler()
-	admin2 := seedUser(t, mem2, uniq("adm2"), "hunter22", store.RoleAdmin)
-	noMail := &store.User{Username: uniq("silent"), PasswordHash: admin.PasswordHash, Role: store.RoleUser, Email: ""}
-	hash, _ := bcrypt.GenerateFromPassword([]byte("hunter22"), bcrypt.MinCost)
-	noMail.PasswordHash = string(hash)
-	if err := mem2.CreateUser(context.Background(), noMail); err != nil {
-		t.Fatal(err)
-	}
-	q2 := &store.RankedQuestion{AuthorID: noMail.ID, Title: "Quiet", Body: "x", HuntDate: pacific.Today()}
-	if err := mem2.CreateQuestion(context.Background(), q2); err != nil {
-		t.Fatal(err)
-	}
-	cookies := loginUser(t, h2, admin2.Username, "hunter22")
-	w := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodGet, "/questions/"+q2.ID, nil)
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-	h2.ServeHTTP(w, req)
-	csrf := csrfFrom(w.Body.String())
-	form := strings.NewReader("_csrf=" + csrf + "&body=Hello")
-	req = httptest.NewRequest(http.MethodPost, "/questions/"+q2.ID+"/answer", form)
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-	w = httptest.NewRecorder()
-	h2.ServeHTTP(w, req)
-	time.Sleep(50 * time.Millisecond)
-	if recMail2.Len() != 0 {
-		t.Fatalf("empty email must skip notify, got %d", recMail2.Len())
-	}
-}
-
 // TestRegisterThrottleUsesTCPPeerThroughRouter ensures forged X-Forwarded-For
 // cannot bypass rate limits when the direct peer is outside TrustedProxies.
 // This must go through Handler() so middleware ordering bugs are caught.

schema.sql

@@ -50,21 +50,24 @@ CREATE TABLE IF NOT EXISTS posts (
   body TEXT NOT NULL,
   city TEXT NOT NULL DEFAULT '',
   post_date TEXT NOT NULL DEFAULT '',
-  hidden INTEGER NOT NULL DEFAULT 0,
+  post_state TEXT NOT NULL,
   created_at TEXT NOT NULL,
   updated_at TEXT NOT NULL,
-  CHECK (
+  CONSTRAINT posts_shape_check CHECK (
     (parent_id IS NULL AND title <> '' AND post_date <> '')
     OR
-    (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '' AND hidden = 0)
+    (parent_id IS NOT NULL AND title = '' AND city = '' AND post_date = '')
   )
 );
 
 CREATE INDEX IF NOT EXISTS idx_posts_parent_created
   ON posts(parent_id, created_at, id);
 
+CREATE INDEX IF NOT EXISTS idx_posts_author_created
+  ON posts(author_id, created_at DESC, id DESC);
+
 CREATE INDEX IF NOT EXISTS idx_posts_root_date
-  ON posts(post_date, hidden)
+  ON posts(post_date, post_state)
   WHERE parent_id IS NULL;
 
 CREATE TABLE IF NOT EXISTS post_votes (
@@ -74,6 +77,9 @@ CREATE TABLE IF NOT EXISTS post_votes (
   PRIMARY KEY (user_id, post_id)
 );
 
+CREATE INDEX IF NOT EXISTS idx_post_votes_post_id
+  ON post_votes(post_id);
+
 CREATE TABLE IF NOT EXISTS sessions (
   token TEXT PRIMARY KEY,
   data BYTEA NOT NULL,

static/app.css

@@ -552,12 +552,14 @@ input:focus, textarea:focus, .btn:focus-visible, .chip:focus-visible, .vote-btn:
   padding: 18px 14px;
 }
 
+.post-content { min-width: 0; }
+
 .question-page h1 {
   font-size: clamp(1.5rem, 3.5vw, 2.1rem);
   line-height: 1.15;
 }
 
-.q-body, .answer-body {
+.post-body {
   white-space: pre-wrap;
   margin: 14px 0 0;
   text-wrap: pretty;
@@ -574,18 +576,7 @@ input:focus, textarea:focus, .btn:focus-visible, .chip:focus-visible, .vote-btn:
 }
 .crumb a:hover { color: var(--signal); }
 
-.answer {
-  margin-top: 16px;
-  padding: 20px 18px;
-  background: var(--panel);
-  border: 1px solid var(--line);
-}
-
-.answer.is-in {
-  border-color: var(--signal);
-}
-
-.answer-kicker {
+.post-kicker {
   margin: 0 0 6px;
   font-family: var(--mono);
   text-transform: uppercase;
@@ -595,27 +586,99 @@ input:focus, textarea:focus, .btn:focus-visible, .chip:focus-visible, .vote-btn:
   color: var(--signal);
 }
 
-.answer h2 {
-  margin: 0;
-  font-size: 1.15rem;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  text-transform: uppercase;
+.conversation {
+  margin-top: 32px;
 }
 
-.byline {
+.conversation-head {
+  margin-bottom: 12px;
+  padding-bottom: 12px;
+  border-bottom: 1px solid var(--line);
+}
+
+.conversation h2 {
+  margin: 0;
+  font-size: 1.25rem;
+  font-weight: 500;
+}
+
+.conversation-head .eyebrow {
+  margin-bottom: 5px;
+}
+
+.thread {
+  display: grid;
+  gap: 12px;
+}
+
+.thread-post {
+  position: relative;
+  padding: 16px;
+  background: var(--panel);
+  border: 1px solid var(--line);
+  border-left: 2px solid var(--zinc);
+  overflow-wrap: anywhere;
+}
+
+.thread-post.is-shop {
+  border-left-color: var(--signal);
+}
+
+.thread-post:target,
+.q-detail:target {
+  outline: 2px solid var(--signal);
+  outline-offset: 3px;
+}
+
+.thread-post-branch,
+.thread-post-deep {
+  margin-left: clamp(12px, 4vw, 28px);
+}
+
+.thread-post-deep .thread-post-deep {
+  margin-left: 0;
+}
+
+.post-replies {
+  display: grid;
+  gap: 12px;
+  margin-top: 12px;
+}
+
+.post-meta {
   margin: 6px 0 0;
   color: var(--muted);
   font-family: var(--mono);
   font-size: 0.72rem;
 }
 
-.answer-editor {
-  margin-top: 16px;
+.edited {
+  display: inline-block;
+  margin-left: 8px;
+  color: var(--zinc);
+  font-size: 0.65rem;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+
+.post-actions {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: flex-start;
+  gap: 0 16px;
+  margin-top: 10px;
   border-top: 1px solid var(--line);
 }
 
-.answer-editor summary {
+.post-composer {
+  min-width: 0;
+}
+
+.post-composer[open] {
+  flex: 1 0 100%;
+}
+
+.post-composer summary {
   display: flex;
   width: fit-content;
   min-height: 44px;
@@ -630,23 +693,34 @@ input:focus, textarea:focus, .btn:focus-visible, .chip:focus-visible, .vote-btn:
   list-style: none;
 }
 
-.answer-editor summary::-webkit-details-marker { display: none; }
-.answer-editor summary:hover,
-.answer-editor[open] summary { color: var(--signal); }
-.answer-editor summary:focus-visible {
+.post-composer summary::-webkit-details-marker { display: none; }
+.post-composer summary::marker { content: ""; }
+.post-composer summary:hover,
+.post-composer[open] summary { color: var(--signal); }
+.post-composer summary:focus-visible {
   outline: 2px solid var(--signal);
   outline-offset: 2px;
 }
 
-.answer-editor .answer-form { margin-top: 4px; }
+.post-form {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+  width: 100%;
+  margin: 0 0 14px;
+}
 
-.answer-form-actions {
+.post-form-actions {
   display: flex;
   flex-wrap: wrap;
   gap: 8px;
 }
 
-.answer-form-actions .btn { flex: 1 1 10rem; }
+.post-form-actions .btn { flex: 1 1 10rem; }
+
+.post-hide {
+  margin: 0;
+}
 
 .waiting { color: var(--muted); margin: 0; font-family: var(--mono); font-size: 0.8rem; }
 

templates/partials/_answer.html

@@ -1,28 +0,0 @@
-{{define "answer"}}
-<section id="answer-block" class="answer{{if .Answer}} is-in{{end}}">
-  {{if .Answer}}
-    <p class="answer-kicker">Shop response</p>
-    <h2>Answer</h2>
-    <p class="byline">{{.Answer.AuthorName}} · 22 years, Bay Area</p>
-    <p class="answer-body">{{.Answer.Body}}</p>
-    {{if isAdmin .User}}
-      <details class="answer-editor">
-        <summary>Edit answer</summary>
-        <form class="answer-form" method="post" action="/questions/{{.Answer.QuestionID}}/answer"
-          hx-post="/questions/{{.Answer.QuestionID}}/answer" hx-target="#answer-block" hx-swap="outerHTML">
-          <input type="hidden" name="_csrf" value="{{.CSRF}}">
-          <label for="answer-body">Edit answer</label>
-          <textarea id="answer-body" name="body" rows="8" required maxlength="12000">{{.Answer.Body}}</textarea>
-          <div class="answer-form-actions">
-            <button type="submit" class="btn btn-primary">Save answer</button>
-            <button type="reset" class="btn btn-ghost"
-              onclick="this.closest('details').removeAttribute('open')">Cancel</button>
-          </div>
-        </form>
-      </details>
-    {{end}}
-  {{else}}
-    <p class="waiting">No answer yet. Check back after the hunt.</p>
-  {{end}}
-</section>
-{{end}}

templates/partials/_list.html

@@ -1,6 +1,6 @@
 {{define "leaderboard"}}
 <ol id="leaderboard" class="board" start="1">
-  {{if not .Questions}}
+  {{if not .Posts}}
     <li class="empty">
       {{if eq .Date .Today}}
         <p class="empty-kicker">Queue empty</p>
@@ -10,20 +10,20 @@
       {{end}}
     </li>
   {{else}}
-    {{range $i, $q := .Questions}}
+    {{range $i, $post := .Posts}}
       <li class="row">
         <span class="rank" aria-hidden="true">{{rank $i}}</span>
-        {{template "vote" (voteCtx $.User $.CSRF "list" $.Date $q)}}
+        {{template "vote" (voteCtx $.User $.CSRF "list" $.Date $post)}}
         <div class="row-body">
-          <a class="q-title" href="/questions/{{$q.ID}}">{{$q.Title}}</a>
+          <a class="q-title" href="/questions/{{$post.ID}}">{{$post.Title}}</a>
           <p class="meta">
-            <span>{{$q.AuthorName}}</span>
-            {{if $q.City}}<span class="dot" aria-hidden="true">·</span><span>{{$q.City}}</span>{{end}}
-            {{if $q.Answered}}<span class="badge">Answered</span>{{end}}
+            <span>{{$post.AuthorName}}</span>
+            {{if $post.City}}<span class="dot" aria-hidden="true">·</span><span>{{$post.City}}</span>{{end}}
+            {{if $post.Answered}}<span class="badge">Answered</span>{{end}}
           </p>
           {{if isAdmin $.User}}
-            <form class="inline-hide" method="post" action="/questions/{{$q.ID}}/hide"
-              hx-post="/questions/{{$q.ID}}/hide" hx-target="#leaderboard" hx-swap="outerHTML">
+            <form class="inline-hide" method="post" action="/questions/{{$post.ID}}/hide"
+              hx-post="/questions/{{$post.ID}}/hide" hx-target="#leaderboard" hx-swap="outerHTML">
               <input type="hidden" name="_csrf" value="{{$.CSRF}}">
               <input type="hidden" name="view" value="list">
               <button type="submit" class="linkish">Hide</button>

templates/partials/_post.html

@@ -0,0 +1,67 @@
+{{define "postActions"}}
+<div class="post-actions">
+  {{if canReply .User .Root}}
+    <details class="post-composer">
+      <summary>Reply</summary>
+      <form class="post-form" method="post" action="/posts">
+        <input type="hidden" name="_csrf" value="{{.CSRF}}">
+        <input type="hidden" name="parent_id" value="{{.Post.ID}}">
+        <label for="reply-{{.Post.ID}}">Reply to {{.Post.AuthorName}}</label>
+        <textarea id="reply-{{.Post.ID}}" name="body" rows="5" required maxlength="12000"></textarea>
+        <div class="post-form-actions">
+          <button type="submit" class="btn btn-primary">Post reply</button>
+          <button type="reset" class="btn btn-ghost"
+            onclick="this.closest('details').removeAttribute('open')">Cancel</button>
+        </div>
+      </form>
+    </details>
+  {{end}}
+  {{if canEditPost .User .Post}}
+    <details class="post-composer">
+      <summary>Edit</summary>
+      <form class="post-form" method="post" action="/posts/{{.Post.ID}}/edit">
+        <input type="hidden" name="_csrf" value="{{.CSRF}}">
+        <label for="edit-{{.Post.ID}}">Edit post</label>
+        <textarea id="edit-{{.Post.ID}}" name="body" rows="5" required
+          maxlength="12000">{{.Post.Body}}</textarea>
+        <div class="post-form-actions">
+          <button type="submit" class="btn btn-primary">Save changes</button>
+          <button type="reset" class="btn btn-ghost"
+            onclick="this.closest('details').removeAttribute('open')">Cancel</button>
+        </div>
+      </form>
+    </details>
+  {{end}}
+  {{if and (not .Post.ParentID) (isAdmin .User)}}
+    <form class="post-hide" method="post" action="/questions/{{.Post.ID}}/hide">
+      <input type="hidden" name="_csrf" value="{{.CSRF}}">
+      <button type="submit" class="linkish">Hide</button>
+    </form>
+  {{end}}
+</div>
+{{end}}
+
+{{define "threadReply"}}
+{{$ctx := .}}
+<article id="post-{{.Post.ID}}"
+  class="thread-post thread-post-{{postDepth .Depth}}{{if eq .Post.AuthorRole "admin"}} is-shop{{end}}">
+  <header class="post-head">
+    <p class="post-kicker">{{postLabel .Post}}</p>
+    <p class="post-meta">
+      <span>{{.Post.AuthorName}}</span>
+      <span class="dot" aria-hidden="true">·</span>
+      <time datetime="{{.Post.CreatedAt}}">{{postTime .Post.CreatedAt}}</time>
+      {{if isEdited .Post}}<span class="edited">Edited</span>{{end}}
+    </p>
+  </header>
+  <p class="post-body">{{.Post.Body}}</p>
+  {{template "postActions" .}}
+  {{if .Post.Replies}}
+    <div class="post-replies">
+      {{range .Post.Replies}}
+        {{template "threadReply" (postCtx $ctx.User $ctx.CSRF $ctx.Root . (add $ctx.Depth 1))}}
+      {{end}}
+    </div>
+  {{end}}
+</article>
+{{end}}

templates/partials/_vote.html

@@ -1,26 +1,26 @@
 {{define "vote"}}
-<div id="vote-{{.Question.ID}}" class="vote">
+<div id="vote-{{.Post.ID}}" class="vote">
   {{if .User}}
-    <form method="post" action="/questions/{{.Question.ID}}/vote"
-      hx-post="/questions/{{.Question.ID}}/vote"
-      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
+    <form method="post" action="/questions/{{.Post.ID}}/vote"
+      hx-post="/questions/{{.Post.ID}}/vote"
+      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Post.ID}}" hx-swap="outerHTML"{{end}}>
       <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      {{if eq .Question.UserVote 1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="1">{{end}}
+      {{if eq .Post.UserVote 1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="1">{{end}}
       <input type="hidden" name="view" value="{{.View}}">
       <input type="hidden" name="date" value="{{.Date}}">
-      <button type="submit" class="vote-btn{{if eq .Question.UserVote 1}} is-up{{end}}" aria-label="Upvote" aria-pressed="{{if eq .Question.UserVote 1}}true{{else}}false{{end}}">
+      <button type="submit" class="vote-btn{{if eq .Post.UserVote 1}} is-up{{end}}" aria-label="Upvote" aria-pressed="{{if eq .Post.UserVote 1}}true{{else}}false{{end}}">
         <svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path d="M9 3.5 15 12H3z" fill="currentColor"/></svg>
       </button>
     </form>
-    <span class="score" aria-label="Net score {{.Question.Score}}">{{.Question.Score}}</span>
-    <form method="post" action="/questions/{{.Question.ID}}/vote"
-      hx-post="/questions/{{.Question.ID}}/vote"
-      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Question.ID}}" hx-swap="outerHTML"{{end}}>
+    <span class="score" aria-label="Net score {{.Post.Score}}">{{.Post.Score}}</span>
+    <form method="post" action="/questions/{{.Post.ID}}/vote"
+      hx-post="/questions/{{.Post.ID}}/vote"
+      {{if eq .View "list"}}hx-target="#leaderboard" hx-swap="outerHTML"{{else}}hx-target="#vote-{{.Post.ID}}" hx-swap="outerHTML"{{end}}>
       <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      {{if eq .Question.UserVote -1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="-1">{{end}}
+      {{if eq .Post.UserVote -1}}<input type="hidden" name="value" value="0">{{else}}<input type="hidden" name="value" value="-1">{{end}}
       <input type="hidden" name="view" value="{{.View}}">
       <input type="hidden" name="date" value="{{.Date}}">
-      <button type="submit" class="vote-btn{{if eq .Question.UserVote -1}} is-down{{end}}" aria-label="Downvote" aria-pressed="{{if eq .Question.UserVote -1}}true{{else}}false{{end}}">
+      <button type="submit" class="vote-btn{{if eq .Post.UserVote -1}} is-down{{end}}" aria-label="Downvote" aria-pressed="{{if eq .Post.UserVote -1}}true{{else}}false{{end}}">
         <svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path d="M9 14.5 3 6h12z" fill="currentColor"/></svg>
       </button>
     </form>
@@ -28,7 +28,7 @@
     <a class="vote-btn" href="/login" hx-get="/auth/prompt" hx-target="#flash" aria-label="Sign in to upvote">
       <svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path d="M9 3.5 15 12H3z" fill="currentColor"/></svg>
     </a>
-    <span class="score" aria-label="Net score {{.Question.Score}}">{{.Question.Score}}</span>
+    <span class="score" aria-label="Net score {{.Post.Score}}">{{.Post.Score}}</span>
     <a class="vote-btn" href="/login" hx-get="/auth/prompt" hx-target="#flash" aria-label="Sign in to downvote">
       <svg width="18" height="18" viewBox="0 0 18 18" aria-hidden="true"><path d="M9 14.5 3 6h12z" fill="currentColor"/></svg>
     </a>

templates/profile.html

@@ -43,12 +43,12 @@
 
   <section class="profile-questions" aria-labelledby="profile-q-heading">
     <h2 id="profile-q-heading">{{.QuestionsLabel}}</h2>
-    {{if .Questions}}
+    {{if .Posts}}
       <ul class="profile-q-list">
-        {{range .Questions}}
+        {{range .Posts}}
           <li>
             <a href="/questions/{{.ID}}">{{.Title}}</a>
-            <span class="meta">{{.HuntDate}}</span>
+            <span class="meta">{{.PostDate}}</span>
           </li>
         {{end}}
       </ul>

templates/question.html

@@ -1,37 +1,41 @@
 {{define "question"}}
 {{template "header" .}}
 <main id="main" class="wrap question-page">
-  <p class="crumb"><a href="{{if eq .Question.HuntDate .Today}}/{{else}}/hunt/{{.Question.HuntDate}}{{end}}">← {{pacificLabel .Question.HuntDate}}</a></p>
-  <article class="q-detail">
-    {{template "vote" (voteCtx .User .CSRF "question" .Question.HuntDate .Question)}}
-    <div>
+  <p class="crumb"><a href="{{if eq .Question.PostDate .Today}}/{{else}}/hunt/{{.Question.PostDate}}{{end}}">← {{pacificLabel .Question.PostDate}}</a></p>
+  <article id="post-{{.Question.ID}}" class="q-detail">
+    {{template "vote" (voteCtx .User .CSRF "question" .Question.PostDate .Question)}}
+    <div class="post-content">
+      <p class="post-kicker">Question</p>
       <h1>{{.Question.Title}}</h1>
       <p class="meta">
         <span>{{.Question.AuthorName}}</span>
         {{if .Question.City}}<span class="dot" aria-hidden="true">·</span><span>{{.Question.City}}</span>{{end}}
         <span class="dot" aria-hidden="true">·</span>
-        <a href="{{if eq .Question.HuntDate .Today}}/{{else}}/hunt/{{.Question.HuntDate}}{{end}}">{{.Question.HuntDate}}</a>
+        <a href="{{if eq .Question.PostDate .Today}}/{{else}}/hunt/{{.Question.PostDate}}{{end}}">{{.Question.PostDate}}</a>
+        {{if eq .Question.PostState "locked"}}<span class="badge">Locked</span>{{end}}
+        {{if eq .Question.PostState "hidden"}}<span class="badge">Hidden</span>{{end}}
+        {{if isEdited .Question}}<span class="edited">Edited</span>{{end}}
       </p>
-      <p class="q-body">{{.Question.Body}}</p>
-      {{if isAdmin .User}}
-        <form method="post" action="/questions/{{.Question.ID}}/hide"
-          hx-post="/questions/{{.Question.ID}}/hide" hx-target="body">
-          <input type="hidden" name="_csrf" value="{{.CSRF}}">
-          <button type="submit" class="linkish">Hide this question</button>
-        </form>
-      {{end}}
+      <p class="post-body">{{.Question.Body}}</p>
+      {{template "postActions" (postCtx .User .CSRF .Question .Question 0)}}
     </div>
   </article>
-  {{template "answer" .}}
-  {{if and (isAdmin .User) (not .Answer)}}
-    <form class="answer-form" method="post" action="/questions/{{.Question.ID}}/answer"
-      hx-post="/questions/{{.Question.ID}}/answer" hx-target="#answer-block" hx-swap="outerHTML">
-      <input type="hidden" name="_csrf" value="{{.CSRF}}">
-      <label for="answer-body">Write the answer</label>
-      <textarea id="answer-body" name="body" rows="8" required maxlength="12000"></textarea>
-      <button type="submit" class="btn btn-primary">Save answer</button>
-    </form>
-  {{end}}
+  <section class="conversation" aria-labelledby="conversation-heading">
+    <div class="conversation-head">
+      <p class="eyebrow">Thread</p>
+      <h2 id="conversation-heading">Conversation</h2>
+    </div>
+    {{if .Question.Replies}}
+      <div class="thread">
+        {{$page := .}}
+        {{range .Question.Replies}}
+          {{template "threadReply" (postCtx $page.User $page.CSRF $page.Question . 1)}}
+        {{end}}
+      </div>
+    {{else}}
+      <p class="waiting">No replies yet.</p>
+    {{end}}
+  </section>
 </main>
 {{template "footer" .}}
 {{end}}