Embed a hosted Comment report form

The Project Backend first verifies its browser session, Project Membership, visibility of the exact resource, and that the Platform Account may report the Comment. It then issues a Browser Resource Grant with the qualified action reports:write/{comment_id}, the exact resource tuple, Platform Account, and registered browser Origin. The Project Client must allow both resource-grants:write and reports:write; the Project Credential remains on the server.

Submit the grant to POST /api/v1/community/comments/{comment_id}/report as application/x-www-form-urlencoded with token, project_client_id, resource_type, and resource_id. MiniCenter returns an accessible, server-rendered form containing only spam, harassment, hate, violence, and sexual_content. No JavaScript or free text is accepted.

The form submits the same fields plus reason to the same URL. A successful submission consumes the grant and records one report for its bound Platform Account and Comment. Replay, expiry, duplicate reporting, or any mismatch in Comment, Project Client, resource, qualified action, or Origin returns the same generic unavailable page. Request a fresh authorization instead of retrying the token.

Every response is no-store, uses no-referrer, and may be framed only by the exact active Origin. The result omits the reporter identity, token, Comment body, moderation state, and Project Credential. Reporting does not automatically restrict or remove a Comment; the Project Backend remains responsible for moderation and degraded behavior.