Backed by: @pithy-sh/support, the in-app half.
The channel with no spoofing problem
Unlike mail, which needs provenance. The support inbox is the other intake, classification sorts both, and Using Support is the capability underneath.
An in-app submission has no From: to spoof.
The session is the identity, and the route’s own gate proved it before the handler ran — which is why these threads carry accountLinkSource: "session" and can be trusted with the account’s history beside them.
Two hundred lines of sender authentication earn the right to say a mail thread belongs to a customer. This channel needs none of it.
The context the app supplies
Screen, build, platform, environment, locale — what the user should not have to type.
That set is closed. An undeclared key is refused rather than stored, because the risk of an open bag is an app passing its whole client state through it and quietly landing a customer’s data in an inbox a console renders.
The submitter’s own category
declaredCategory is written once, when the thread opens — never again, and never by the classifier.
A key outside your taxonomy is refused, not stored and not downgraded.
Stored, the column becomes a client-writable vocabulary and your filters grow a long tail of one-offs. Downgraded, a broken chooser becomes indistinguishable from somebody who genuinely chose nothing.
The model gets the fallback because a model cannot be told it was wrong. A client can, and a 400 is how it is told.
Sent alongside a thread id it is refused too — ignoring a second claim is a chooser that does nothing, and honoring it lets a follow-up rewrite the premise the thread was opened on.
The route this reads is deliberately ungated
An adopter whose own model needs act-on-behalf-of puts that check in their own middleware — passing a signed-out caller through, so the route’s own gate answers 401 rather than a 403 telling somebody who was never signed in that they are forbidden.
Same table as the mail
Same classifier, same taxonomy, same console. These appear in the support inbox alongside mail, filtered by channel.