v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/routes/dumps.ts

@@ -1,6 +1,7 @@
 /**
- * The dump routes. `:dumpId` takes an id or a slug; a private dump exists only
- * for its poster.
+ * Posts, reads, edits and deletes dumps, for the index feed, the dump page, its
+ * edit page and the create form. `:dumpId` takes an id or a slug. A private
+ * dump answers 404 to anyone but its poster, moderators included.
  *
  * - `POST /api/dumps` — signed in. Posts a link (JSON body) or a file
  *   (multipart `file`, with `title`, `comment`, `isPrivate` and `categoryIds`).
@@ -14,9 +15,10 @@
  * - `GET /api/dumps/:dumpId/playlists` — optional sign-in. Answers the
  *   playlists it appears in.
  * - `GET /api/dumps?page=&limit=` — optional sign-in. Answers a page of the
- *   dumps, newest first.
+ *   dumps the caller may see, newest first.
  * - `PUT /api/dumps/:dumpId/file` — signed in, as its poster or with
- *   `dump:moderate`. Replaces a file dump's upload (multipart).
+ *   `dump:moderate`. Replaces a file dump's upload and comment, and any of its
+ *   title, categories and visibility (multipart).
  * - `PUT /api/dumps/:dumpId` — signed in, as its poster or with
  *   `dump:moderate`. Updates its title, comment, visibility, categories, and a
  *   link's URL.
@@ -73,16 +75,18 @@ import { getDumpVoters } from "../services/vote-service.ts";
 import { getRelatedDumps } from "../services/backlink-service.ts";
 import { getPlaylistsForDump } from "../services/playlist-service.ts";
 
-/** The router serving the endpoints the module doc lists. */
+/**
+ * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
+ * An `APIException` thrown by a handler becomes the JSON error response there.
+ */
 const router: Router = new Router({ prefix: "/api/dumps" });
 
-// Every route here takes a slug or an id; the services below them key on the
-// id, so mutations always pass `dump.id` from the resolved dump, never the raw
-// parameter.
+// Each handler resolves `:dumpId` with getDump, which checks privacy and takes
+// a slug, and passes `dump.id` on: the services' writes match on the id alone.
 
 /**
- * Reads the category ids that arrive on the multipart create path as a
- * JSON-encoded string field; empty when it is missing or malformed.
+ * Parses a multipart form's `categoryIds`, a JSON array sent as a string. A
+ * missing or malformed value counts as no category.
  */
 function parseCategoryIds(value: FormDataEntryValue | null): string[] {
   if (typeof value !== "string" || !value) return [];
@@ -191,7 +195,6 @@ router.get("/:dumpId/related", async (ctx) => {
 
 router.get("/:dumpId/playlists", async (ctx) => {
   const requestingUserId = await parseOptionalAuth(ctx) ?? undefined;
-  // Resolve through getDump so private dumps 404 for anyone but their owner.
   const dump = getDump(ctx.params.dumpId, requestingUserId);
   const playlists = getPlaylistsForDump(dump.id, requestingUserId);
   const responseBody: APIResponse<Playlist[]> = {
@@ -309,7 +312,8 @@ router.put("/:dumpId/thumbnail", authMiddleware, async (ctx) => {
   const data = new Uint8Array(await file.arrayBuffer());
   const mime = validateImageUpload(data);
 
-  // DB update first (resolves slug → id), then file write.
+  // The record is written first. If the file write then fails, the thumbnail
+  // route finds no custom file and falls back to the generated thumbnail.
   const updatedDump = setDumpThumbnail(dump.id, mime);
   const filePath = `${THUMBNAILS_DIR}/${dump.id}-custom`;
   await Deno.mkdir(THUMBNAILS_DIR, { recursive: true });