Embed a hosted Comment edit form

The Project Backend verifies its browser session, Project Membership, visibility of the exact resource, and that the Platform Account authored the exact visible Comment. It then issues a Browser Resource Grant with the Comment-qualified action comments:write/{comment_id}/edit, exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and comments:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/{comment_id}/edit as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered form without JavaScript. The browser submits the same bound fields plus replacement plain-text body of at most 4,000 characters.

A successful submission consumes the grant and records an immutable revision for the exact Comment. The Comment must still belong to the bound author, Project Client, and resource and must not be removed. Replay, expiry, or any mismatch in author, Comment, Project Client, resource, action, continuation, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits author identity, token, submitted body, revision details, and Project Credential. The Project Backend remains responsible for author and visibility policy before issuing each grant.