Embed a hosted direct-reply form

The Project Backend first verifies its browser session, Project Membership, visibility of the exact resource, and permission to reply beneath the exact top-level Comment. It then issues a Browser Resource Grant with the parent-qualified action comments:write/{comment_id}, exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and comments:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/{comment_id}/reply as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered form without JavaScript. The browser submits the same bound fields plus one required plain-text body of at most 4,000 characters.

A successful submission consumes the grant and creates exactly one direct reply beneath the bound top-level Comment. The parent must belong to the same Project Client and exact opaque resource, must not be removed, and cannot itself be a reply. Replay, expiry, or any mismatch in parent, Project Client, resource, action, continuation, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits the author identity, token, body, parent details, and Project Credential. The Project Backend remains responsible for contribution policy, parent visibility, and degraded behavior.