Fix giscus like button not persisting first reaction (#1312)

[soyalejolopez]

Problem

On a resource detail page (e.g. #purview-audit-copilot-report), clicking the giscus 👍 "like" made it vanish and not stick — it only appeared after a manual page refresh.

Root cause: The like is the embedded giscus reaction, mapped to a GitHub Discussion in the "Resource Votes" category. On resources with no backing Discussion yet, the first reaction hits giscus bug #1312: giscus creates the discussion and records the reaction server-side, but the client never refetches, so the 👍 visually reverts.

There was already a workaround, but it was self-defeating: the remount timer re-checked giscusState.hasDiscussion, which flips true the instant the discussion is created — cancelling the very remount meant to make the like stick.

Fix

All changes are in the giscus block of index.html:

• Event-driven remount — track whether a discussion existed at mount time (existedAtMount); when emit-metadata reports the discussion was just created by the user's reaction, remount giscus once to pull the persisted 👍.
• Fixed the blur-timer fallback — removed the counterproductive hasDiscussion re-check from the fired callback so the remount actually fires; delay bumped 2500ms → 3000ms so the server write settles first.
• Re-arm safeguard — if a speculative (blur-triggered) refetch lands and there's still no discussion (e.g. the user focused the widget to sign in rather than react), refetched is cleared so a later genuine first reaction can still recover. Guarded by a speculativeRefetch flag so genuine reactions stay single-remount (no loops, no double-remount).

Validation

• Loaded the page over a local HTTP server: zero console errors, giscus mounts, detail view renders.
• Reviewed by GPT 5.6 Sol: first pass caught the wasted-refetch edge case; after the re-arm fix → PASS, no remaining issues.

Net change: 1 file changed, 35 insertions(+), 4 deletions(-).

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

🛰️ PR Sweeper report

Risk: 🟠 MEDIUM · Security gate: ✅ passing · Files: 9

🔒 Automated guardrails (authoritative)

	Category	Location	Finding
⚠️	scope	—	Touches security-sensitive path(s): .github/workflows/build-catalog.yml, .github/workflows/content-spring-cleaning.yml, .github/workflows/traffic-stats.yml, .github/workflows/update-message-center.yml. Maintainer + security review required.
ℹ️	scope	—	Change(s) outside known content roots: index.html.

🤖 Dual-model AI review (advisory)

AI review unavailable for this run (models not reachable or no diff). Guardrails above are unaffected.

• GPT-class reviewer (openai/gpt-5): skipped — GitHub Models HTTP 413: {"error":{"code":"tokens_limit_reached","message":"Request body too large for gpt-5 model. Max size: 4000 tokens.","details":"Request body too large for gpt-5 model. Max size: 4000 tokens."}}
• Deep-reasoning reviewer (openai/o3): skipped — GitHub Models HTTP 413: {"error":{"code":"tokens_limit_reached","message":"Request body too large for o3 model. Max size: 4000 tokens.","details":"Request body too large for o3 model. Max size: 4000 tokens."}}

---

The automated guardrails are authoritative and gate the security status. The AI review is advisory and never auto-merges. Thanks for contributing to FastTrack! 🛩️