v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/db/startup.ts

@@ -1,5 +1,6 @@
 /**
- * Housekeeping run when the database is opened.
+ * Deletes what has expired and seeds the first admin, each time connection.ts
+ * opens the database.
  *
  * @module
  */
@@ -13,22 +14,22 @@ import {
 } from "../config.ts";
 
 /**
- * Runs once when the database is opened, after the migrations: drops what has
- * expired (reset tokens, unused invites, orphaned attachments), and seeds the
- * default admin (admin/admin) on an empty instance.
+ * Runs after the migrations, each time the server starts. It deletes used or
+ * expired reset tokens, invites past their validity and attachments nothing
+ * links to. On an instance with no users, it creates the user `admin` with the
+ * password `admin`, which whoever installs it must change.
  */
 export async function runStartupTasks(db: DatabaseSync): Promise<void> {
-  // Purge expired/used password reset tokens
   db.prepare(
     `DELETE FROM password_reset_tokens WHERE expires_at < datetime('now') OR used_at IS NOT NULL;`,
   ).run();
 
-  // Purge expired unused invites
   db.prepare(
     `DELETE FROM invites WHERE used_at IS NULL AND created_at < datetime('now', '-${UNUSED_INVITES_RETENTION_DAYS} days');`,
   ).run();
 
-  // Prune orphaned attachments (uploaded but never linked to a resource) older than 1 hour
+  // An image is uploaded as soon as it's pasted, and linked only when the text
+  // it's pasted into is saved, so a fresh one is left alone.
   const orphanedAttachments = db.prepare(
     `SELECT id FROM attachments WHERE resource_id IS NULL AND created_at < datetime('now', '-${ORPHANED_ATTACHMENTS_RETENTION_HOURS} hour');`,
   ).all() as { id: string }[];
@@ -41,11 +42,12 @@ export async function runStartupTasks(db: DatabaseSync): Promise<void> {
     ).run();
   }
 
-  // Create default admin user if no users exist
+  // Registration needs an invite, so the first user can only come from here.
   const userCount = db.prepare(`SELECT COUNT(*) as count FROM users`).get() as {
     count: number;
   };
   if (userCount.count === 0) {
+    // The format of hashPassword in lib/jwt.ts, which verifies it.
     const salt = randomBytes(16).toString("hex");
     const hash = scryptSync("admin", salt, 64).toString("hex");
     const passwordHash = `${hash}.${salt}`;