# Quizzes A quiz is user-generated content like a gist or a project: it has an owner, a slug, comments, votes, bookmarks and reactions. Any signed-in member authors quizzes, every member plays them, and guests read published ones. **Publishing is terminal.** A draft is fully editable; the moment its owner publishes it, the quiz, its questions and its options are frozen forever. There is no unpublish and no post-publish edit, which is what makes two members' scores on the same quiz comparable. Every write endpoint on a published quiz returns `400`; only delete still works. Publish validates the whole quiz first and refuses with the exact list of problems. Playing a quiz creates an **attempt**. There is at most one in-progress attempt per member per quiz - starting again returns the existing one. Each question can be answered exactly once; a second submit returns `400` and credits nothing. A time limit is stored on the attempt and evaluated lazily on read, so an expired attempt reads as `expired` with no background process involved. Seven question kinds are graded deterministically. The eighth, `free_text`, is graded by the internal AI gateway against the author's criteria and billed to the answering member's own API key. When the gateway is unavailable the answer is still graded, by a deterministic token-overlap fallback, and the answer carries `graded_by: "fallback"` so the degradation is visible rather than silent. `graded_by` is one of `auto`, `ai`, `fallback`. **Correct answers are never served to a player mid-attempt.** `is_correct` on the options and `correct_boolean` / `expected_answer` / `numeric_value` / `match_value` on the question are omitted unless the viewer owns the quiz, or the question has already been answered in this attempt and the quiz has `reveal_answers` on. A public export of a published quiz omits them too; the owner's export includes them. The **scoreboard** at `/quizzes/scoreboard` sums each member's **best** completed attempt per quiz, never the sum of all attempts, so replaying a quiz can raise a member's contribution to their personal best and never beyond it. Quizzes a member wrote themselves count like any other. All endpoints negotiate HTML or JSON. POST bodies are form encoded (`application/x-www-form-urlencoded`). Action POSTs answer `{"ok": true, "redirect": "...", "data": {...}}`; an invalid domain operation answers `400` as `{"error": {"status": 400, "message": "..."}}`.