EqualifyEverything / equalify-iris

The reference config told a deployer there are per-user accounts, and hid the fact that the value it was describing can only be set once. **`config.example.yaml:403`** said `max_review_iterations` "seeds each user's account default on first auth". There are no users: Iris has one GitHub identity held by the server, which the README's own heading says. The comment now describes what the code does — the value is read once, when Iris first resolves its GitHub identity, to seed the deployment account's default every later session inherits. **Round 1 found the fact behind that wording, and it is a footgun.** `upsertUser` refreshes `github_login` alone on an existing row, so `defaultMaxIter` is written by the `INSERT` and nowhere else. An operator who raises the cap on a deployment that has run once and restarts sees no change at all. Both places a person reads the number now say so: `config.example.yaml` (it takes a recreated `data/iris.sqlite`, which drops session history, so set it before the first run) and `docs/API.md` § `GET /v1/me`, which reports the stored account value rather than config. `src/store/db.ts:1036` keeps "On first auth a user account is provisioned" on purpose — that comment sits on the schema, and the table is `users`. Two review rounds, both approved, round 2 with nothing new. Two comments changed; no code path touched. Gates: typecheck clean, 1,707 tests pass, anchors 440 links / 0 bad. Refs #467 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>