Embed a hosted Comment removal confirmation

The Project Backend verifies its browser session, Project Membership, visibility of the exact resource, and that the Platform Account authored the exact visible Comment. It then issues a Browser Resource Grant with the Comment-qualified action comments:write/{comment_id}/remove, exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and comments:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/{comment_id}/remove as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered confirmation without JavaScript. The confirmation states that removal is irreversible, leaves replies in place, and does not remove the Platform Account. Confirmation submits the same bound fields plus confirm=remove.

A successful submission consumes the grant and replaces the exact Comment with a terminal tombstone. Immutable revisions and existing replies remain; the Comment body is no longer returned by ordinary reads. Replay, expiry, or any mismatch in author, Comment, Project Client, resource, action, continuation, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits author identity, token, retained body, removal time, and Project Credential. The Project Backend remains responsible for author and visibility policy before issuing each grant.