v3: comments say what the code can't — the documentation pass wanted JSDoc on every export and every field of an exported interface, which filled the code with restatements ("The dump.", "Whether it is loading.", "The props of X.", "Renders the X.") and module docs that told a reader nothing ("The hot and new feeds, and the props every main feed of the index takes."); some were wrong as well as vague. Every comment in api/, shared/ and src/ is rewritten under one rule, now stated in the README's "Comments" section: every module and export still has a JSDoc, and it gives context (who uses it and where), usage (what a caller must know: a precondition, what it leaves to the caller, a side effect) or its place in the chain (where its input comes from, where its output goes); a field, parameter, private function or local gets one only when it adds to its parent's, and context about a whole type goes on the type; a type's doc is phrased from the value's side ("Returned to Y by X when Z", "Passed to Y by X"); full sentences, as short as they can be, no label-colon-list; // goes wherever the code isn't obvious and says why, and the section banners and narration go. Every claim was checked against the code, which turned up some forty comments that were wrong: DumpCard's claimed it was only used by the hot and new feeds, the WebSocket welcome claimed to be a socket's first message (presence comes first), UpdateUserRequest said null removes a description (it keeps it), deletedDumpIds leaves out that it also holds dumps made private, THEME_COLOR claimed to mirror index.html's, and the like. The routers' JSDoc now says where they are mounted and what becomes of a thrown APIException. doc-lint.ts lets a field without a doc through; a module or export without one still fails. No code changes; 204 backend and 628 frontend tests pass, and doc:lint, deno check, deno lint and tsc are clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/routes/users.ts

@@ -1,6 +1,7 @@
 /**
- * The user and account routes. Public profiles never carry the password hash or
- * the email.
+ * Serves accounts (sign-up, sign-in, tokens, passwords) and user profiles,
+ * with what each user posted, upvoted, follows and invited. A profile sent to
+ * anyone but its user goes through `toPublicUser`, which drops the email.
  *
  * - `POST /api/users/register` — public, with a valid invite. Creates an
  *   account, sends the welcome email, and answers the user and their tokens.
@@ -106,15 +107,18 @@ import {
   getFollowedUsersByUser,
 } from "../services/follow-service.ts";
 
-/** The router serving the endpoints the module doc lists. */
+/**
+ * Mounted by `api/main.ts` behind the error, Open Graph and CORS middleware.
+ * An `APIException` thrown by a handler becomes the JSON error response there.
+ */
 const router: Router = new Router({ prefix: "/api/users" });
 
-/** Login attempts per account: a burst of 10, then one every 30s. */
+/** Allows a burst of 10 login attempts per account, then one every 30s. */
 const LOGIN_LIMIT: RateLimit = { capacity: 10, refill: 1 / 30 };
 
 /**
- * Issues `user` a session token, plus the media-only token that goes in file
- * and thumbnail URLs (see {@link createMediaToken}).
+ * Returns a new session token and media token for `user`, as sign-up, sign-in
+ * and a password change answer them.
  */
 async function issueTokens(user: User): Promise<AuthTokens> {
   return {
@@ -138,8 +142,8 @@ router.post("/register", async (ctx) => {
     );
   }
 
-  // Claim the invite up front (throws 404/409 if bad) and hand it back if the
-  // account can't be created, so one invite can't open two accounts.
+  // Claimed before the async account creation, so that one invite can't open
+  // two accounts, and handed back if the creation fails.
   const inviterId = claimInvite(body.inviteToken);
 
   let user;
@@ -150,7 +154,7 @@ router.post("/register", async (ctx) => {
     throw err;
   }
 
-  // Send welcome email (fire-and-forget)
+  // Not awaited: a slow or failing SMTP server mustn't hold up the sign-up.
   if (isEmailEnabled()) {
     const emailMarkdown = WELCOME_EMAIL_BODY
       .replaceAll("{{username}}", user.username)
@@ -255,6 +259,8 @@ router.get("/me/media-token", authMiddleware, async (ctx: AuthContext) => {
   ctx.response.body = responseBody;
 });
 
+// Answers the same whatever happens, so it can't tell which addresses have an
+// account.
 router.post("/request-password-reset", async (ctx) => {
   const body: unknown = await ctx.request.body.json();
   const email = fieldOf(body, "email");
@@ -339,10 +345,9 @@ router.patch("/me", authMiddleware, async (ctx: AuthContext) => {
       "Invalid request",
     );
   }
-  // Only the profile fields. The role is assigned by an admin, the password
-  // changes through /me/change-password (which asks for the current one), and
-  // the username is fixed — a token alone must not be able to change any of
-  // them.
+  // Only the profile fields: a stolen token alone must not change the role,
+  // the password (which needs the current one) or the username (which is
+  // fixed).
   const updated = await updateUser(ctx.state.user.userId, {
     description: body.description,
     email: body.email,
@@ -370,8 +375,7 @@ router.patch(
         "Invalid role",
       );
     }
-    // Disallow changing your own role: prevents an admin from accidentally
-    // locking themselves out, and self-promotion is meaningless anyway.
+    // So that an admin can't demote themselves by mistake and leave no admin.
     if (ctx.params.userId === ctx.state.user.userId) {
       throw new APIException(
         APIErrorCode.VALIDATION_ERROR,