For agents, on top of README.md, which they read first.

• The invariants for these files are one folder up, in apps/lmjtfy/CLAUDE.md, which loads with this one.
• A visitor's comment on a vote (/comment) is never logged, echoed or put in an event. It goes from the request to Ask::Comment and into comments as a bound value, and every error and event says only how it ended (Unsaid). It is untrusted text: pages show it through maud's escaping only, and the owner's backend must show it as text. comments takes INSERT only, like events; read it through vote_comments and votes_commented. The box's text lives in the comment signal, so do not patch the textarea.