Embed a hosted Comment reaction form

The Project Backend verifies its browser session, Project Membership, visibility of the exact resource, and permission to react to the exact Comment. It then issues a Browser Resource Grant with the Comment-qualified action reactions:write/{comment_id}, exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and reactions:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/{comment_id}/react as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered form without JavaScript. The browser submits the same bound fields plus one reaction_type from the closed vocabulary like, celebrate, insightful, support, or none. none clears the Platform Account's existing reaction.

A successful submission consumes the grant and stores at most one reaction for the bound Platform Account and Comment. The Comment must still belong to the bound Project Client and resource and must not be removed. Replay, expiry, or any mismatch in Comment, Project Client, resource, action, continuation, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits Platform Account identity, token, selected reaction, aggregate counts, and Project Credential. The Project Backend remains responsible for Membership, visibility, and interaction policy before issuing each grant.