# Contact support from Help

Recipient is exactly `support@caterium.ru` (address explicitly corrected by the user on 2026-09-21). The Help dialog offers a human support tab and an unanswered-question call to action. It also works without login. The AI assistant stays separate.

Submission uses same-origin `/api/support.php`, not mailto. Required: name, reply email, topic, subject and message. Diagnostics are opt-in and contain only browser, viewport, current section and release strings. No SDK, session, token, order, customer record or URL query/hash is serialized. Drafts remain in memory on errors/close and are cleared on account/workspace changes. Only confirmed `202 accepted` clears the message. No autoresponder, attachments, arbitrary recipient or database access.

The PHP endpoint uses the existing Timeweb shared-hosting mail agent. From and envelope sender: no-reply@caterium.ru; Reply-To is the validated user email, noted as self-reported in the message. The recipient is hardcoded. Hosting must have PHP mail enabled and the sender domain mail/DNS policy must allow hosting mail. Mail acceptance is NOT proof of inbox delivery.
References: https://timeweb.com/ru/docs/pochta/osnovnye-voprosy-po-rabote-s-pochtoj/rabota-s-php-mail/ and https://www.php.net/manual/en/function.mail.php

Guards: exact host/origin, JSON-only POST, secure HttpOnly SameSite CSRF session, length/type checks, no header injection, honeypot, locked limits (5/IP/hour, 3/reply-email/hour, 60 total/hour), idempotency for 48 hours and pending state before delivery. Failed/uncertain mail never returns success. Rate/idempotency records hold hashes/statuses, NOT bodies or plaintext contacts, outside public_html in .caterium-support (0700/0600), pruned after 48 hours on submissions. Optional server-only CATERIUM_SUPPORT_STATE_DIR must also be outside the web root. Deployment does not delete it. Mail/session server retention is separate.

Automated tests do not send real mail: unit tests capture mail(); UI tests mock the endpoint; publication checks real PHP session/CSRF and cross-origin rejection plus exact public JS and the rendered form on 390/1440 px. Confirm mailbox receipt with one labelled message before announcing end-to-end delivery. No live customer data or MFA altered.