v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/model/user.ts

@@ -1,6 +1,7 @@
 /**
- * The `users` table: its row type, its guard, its mappers to and from the
- * stored {@link User}, and the views of a user the API sends.
+ * Types and guards the rows of `users`, and converts them to the {@link User}
+ * that `user-service.ts` returns. A route turns a `User` into what it may send
+ * with {@link toPublicUser} or {@link toSelfUser}.
  *
  * @module
  */
@@ -13,56 +14,65 @@ import {
   type SelfUser,
 } from "../../shared/user.ts";
 
-/** A user as stored: what they see of themselves, plus the password hash. */
+/**
+ * Returned by the lookups of `user-service.ts`. It must never be sent as is:
+ * it carries the password hash.
+ */
 export interface User extends SelfUser {
-  /** The scrypt hash of the password, as `hash.salt`. */
+  /** From `hashPassword`, as `hash.salt`. */
   passwordHash: string;
 }
 
-/** Returns what anyone may see of `user`: no hash, no email. */
+/**
+ * Returns what anyone may see of `user`, without the hash and the email. Every
+ * route that sends another user's profile goes through it.
+ */
 export function toPublicUser(
   { passwordHash: _, email: _email, ...user }: User,
 ): PublicUser {
   return user;
 }
 
-/** Returns what `user` sees of themselves: everything but the hash. */
+/**
+ * Returns what `user` sees of themselves, without the hash, for the routes
+ * that answer the caller's own account.
+ */
 export function toSelfUser({ passwordHash: _, ...user }: User): SelfUser {
   return user;
 }
 
-/** A row of the `users` table. */
+/**
+ * Selected by `user-service.ts` and `follow-service.ts`, and converted by
+ * {@link userRowToApi}. It leaves out `chat_read_at` and `tokens_valid_after`,
+ * which only the chat's read state and `getSessionState` query.
+ */
 export interface UserRow {
-  /** The user's id. */
   id: string;
-  /** The user's name, unique. */
   username: string;
-  /** The scrypt hash of the password, as `hash.salt`. */
   password_hash: string;
-  /** The user's role. */
   role: Role;
-  /** When the user registered. */
   created_at: string;
-  /** When the profile was last changed, if ever. */
+  /** Bumped by any profile or avatar change. */
   updated_at: string | null;
-  /** The avatar's type, null without one. */
+  /** Null without an avatar. */
   avatar_mime: string | null;
-  /** The user's profile text, in Markdown. */
+  /** Markdown. */
   description: string | null;
-  /** The id of the user whose invite they registered with. */
+  /** Null for the seeded admin, who had no inviter. */
   invited_by: string | null;
   /**
-   * The inviter's name; present only when the query joins it (`LEFT JOIN users
-   * i ON i.id = u.invited_by`).
+   * Joined from the inviter's row rather than stored, and undefined when the
+   * query doesn't join it. The guard doesn't check it.
    */
   invited_by_username: string | null;
-  /** The user's email address. */
   email: string;
-  /** Any other column the query selects. */
   [key: string]: SQLOutputValue;
 }
 
-/** Checks whether `obj` is a {@link UserRow}. */
+/**
+ * Checks whether `obj`, a row selected with the columns of {@link UserRow}, is
+ * one.
+ */
 export function isUserRow(obj: unknown): obj is UserRow {
   return !!obj &&
     typeof obj === "object" &&
@@ -82,7 +92,7 @@ export function isUserRow(obj: unknown): obj is UserRow {
     "email" in obj && typeof obj.email === "string";
 }
 
-/** Converts a row to the stored {@link User}. */
+/** Converts a row to a {@link User}, turning nulls into undefined. */
 export function userRowToApi(row: UserRow): User {
   return {
     id: row.id,
@@ -100,7 +110,10 @@ export function userRowToApi(row: UserRow): User {
   };
 }
 
-/** Converts a {@link User} back to a row, without the join-only columns. */
+/**
+ * Converts a {@link User} back to a row, for `updateUser`. A `User` has no
+ * inviter id, so `invited_by` comes out null: don't write it back.
+ */
 export function userApiToRow(user: User): UserRow {
   return {
     id: user.id,