v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/remote/public-address.ts

@@ -1,8 +1,8 @@
 /**
- * Guards for server-side fetches of user-supplied URLs (link previews, the
- * image proxy, Bandcamp resolution): the server must not become a way to reach
- * addresses only it can see — loopback, the LAN, container networks, or the
- * cloud metadata endpoint at 169.254.169.254.
+ * Tells private addresses from public ones, so that a user-supplied URL can't
+ * make the server fetch what only it can reach: loopback, the LAN, container
+ * networks or the cloud metadata endpoint at 169.254.169.254. `fetch.ts` checks
+ * every hop with it.
  *
  * @module
  */
@@ -83,8 +83,9 @@ function isPrivateIPv6(b: number[]): boolean {
 }
 
 /**
- * Checks whether `ip` is an IP literal outside the public internet. Non-IPs
- * are false.
+ * Checks whether `ip` is an IPv4 or IPv6 address outside the public internet.
+ * An IPv4 address carried in IPv6 is judged as IPv4. Anything that isn't an IP
+ * address is false, so a hostname must be resolved first.
  */
 export function isPrivateAddress(ip: string): boolean {
   const v4 = parseIPv4(ip);
@@ -106,9 +107,9 @@ function bareHostname(url: URL): string {
 }
 
 /**
- * Checks whether `url`'s host is private without DNS: a private IP literal,
- * or a name that is local by definition. Names still need resolving (see
- * resolvePublicAddress) — this only rejects what is obvious without DNS.
+ * Checks whether the host of `url` is private without a DNS lookup: a private
+ * IP address, or `localhost` and its subdomains. `isValidHttpUrl` uses it to
+ * reject a link early; only {@link resolvePublicAddress} is a real guard.
  */
 export function isPrivateHostname(url: URL): boolean {
   const host = bareHostname(url).toLowerCase();
@@ -117,13 +118,13 @@ export function isPrivateHostname(url: URL): boolean {
 }
 
 /**
- * Resolves `url`'s host and returns one of its addresses, or throws if the
- * host is private or any address it resolves to is (a name with both a public
- * and a private record is refused outright, since the fetch may pick either).
+ * Resolves the host of `url` and returns one of its addresses, all of which
+ * must be public: the fetch may pick any of them. `fetchWithTimeout` calls it
+ * before each hop.
  *
- * The fetch itself resolves again, so a DNS server answering differently the
- * second time (rebinding) isn't fully excluded; the curl fallback pins the
- * address this returns.
+ * Only the curl fallback connects to the address returned. Deno's fetch
+ * resolves the name again, so a DNS server that answers differently the second
+ * time (rebinding) can still get through.
  *
  * @throws {Error} When the host is private, can't be resolved, or resolves to
  * a private address.