Embed a hosted Comment form

The Project Backend first verifies its browser session, Project Membership, visibility of the exact resource, and that the Platform Account may contribute. It then issues a Browser Resource Grant with the action comments:write, exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and comments:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/create as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered form without JavaScript. The browser submits the same bound fields plus one required plain-text body of at most 4,000 characters.

A successful submission consumes the grant and creates exactly one top-level Comment for its bound Platform Account and resource. MiniCenter stores the body as plain text; HTML-looking input is not interpreted. Replay, expiry, or any mismatch in Project Client, resource, action, continuation, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits the author identity, token, body, and Project Credential. The Project Backend remains responsible for contribution policy, resource visibility, and degraded behavior.