Who can comment
Only signed-in customers of the portal, not anonymous visitors and not admin users. A suspended or signed-out customer is refused ("Please sign in to comment."). Comments are plain text, up to 4,000 characters, shown with line breaks.
What state a comment arrives in
Pending by default. Approved at once if auto-approve is on. Silently filed as Spam if it has more than 2 links or a blocklisted phrase, even though the sender is told it awaits moderation. Only approved, non-trashed comments are public. Nothing expires or auto-approves later. Protections: a hidden trap field, 10 comments per address per hour, and a per-customer hourly limit.
These comment settings (auto-approve, link limit, blocklist, rate limit, comments on/off) have no admin screen today; they can be changed only through the API.
The moderation page
Tabs: Pending (default), Approved, Spam, Trash. 25 per page, no search. Each row has Approve, Reject, Mark as spam and Delete (to Trash); any status can move to any other. There is no Rejected tab, so a rejected comment disappears from every tab. In Trash: Restore, and Delete permanently (purge permission). Bulk: Approve, Mark as spam and Delete Selected, up to 100; no bulk Reject or purge.
Replies
A reply must answer an approved comment on the same post. Moving a parent to Trash, Rejected or Spam leaves its replies approved; they then show as top-level comments. Permanently deleting a comment deletes all its replies, and the dialog does not warn you.
Notifications
A new pending comment sends an in-app bell to every admin (not for auto-approved or spam). No email is sent to the commenter or staff about comments, and approving or rejecting notifies nobody.
Permissions
cms.blog.moderate for the page and actions; cms.blog.purge for permanent deletion.