The file-serving endpoint checked only that a request came from a logged-in user, not whether that user had any right to the ticket, project, or KB article a file actually belonged to — anyone who knew or guessed a stored filename could pull it down. Every download now looks up its parent record first and applies that record's own access rule: ticket attachments check requester ownership for Viewers, project attachments block Viewers outright, KB attachments require Tech role or higher across the board.

The "Viewers only see their own tickets" rule was only ever enforced as a client-side filter on the board's list view — the single-ticket endpoint returned full details for any ticket ID to any logged-in user with no ownership check at all. Now verifies the requester's email matches the viewer's own session before returning anything.

Link tickets that share the same root cause — a server outage reported five separate times, for instance — without merging them into one record. Each ticket keeps its own status and history; the link just says "these are connected." Collapsed by default in the ticket modal, same searchable-picker pattern used throughout the app.

Mark key contacts at a company with a ⭐ Point of Contact flag, shown right on their directory card. Groundwork for more targeted notifications down the line.

Drag-to-reorder articles within a category, Admin/Superuser only. Only active on the default "Recently Updated" sort within a single category — switching to Alphabetical, Most Viewed, or "All Articles" hides the drag handles since an imposed sort and a manual one can't coexist.

Sort dropdown on the article list — Recently Updated, Alphabetical, Most Viewed. View counts can now be hidden app-wide via a Settings toggle for teams that don't care about that metric.

Any article untouched for 180+ days (configurable) gets a quiet warning badge in the list and a banner on the article itself, with a one-click "Mark as Reviewed" that resets the clock without requiring a real edit. IT documentation rots fast — this surfaces it before someone follows outdated instructions.

The ticket number at the top of the modal is now a real link to /ticket.php, opening in a new tab so it doesn't disrupt your place on the board — useful for grabbing a shareable, bookmarkable link straight from the modal instead of digging one out of an email.

Relied on browser history, which is empty the moment the page is opened in a fresh tab — exactly what the new ticket-number link now does. Falls back to a direct trip to the dashboard when there's no real history to return to.

Reports can now be given a name that drives both the email subject and the header inside the email itself. A Show Date/Time toggle adds Created and Last Updated timestamps under each ticket — built specifically for tracking active incidents at a glance. Recipients field now accepts comma-separated addresses, validated individually so one typo doesn't block the whole send.

Superuser/Admin only. Click-to-edit on the Created field in the ticket modal, matching the title-edit interaction elsewhere. Built for outage tracking — a server that went down at 2am might not get logged until hours later, and the ticket's timeline should reflect when the incident actually started. Every change is independently audit-logged given how sensitive backdating history is.

Every toggle in Settings used a .toggle/.toggle-slider class pattern with zero backing styles — the switch "knob" was rendering as raw, unstyled browser default underneath. Added proper styling once in the shared stylesheet, fixing every toggle across the app at the same time.

A leftover, hardcoded catIcon() function in app.js — with a tiny 5-category lookup table left over from before the dynamic category system existed — was silently overriding the correct, live version defined on the dashboard, due to how deferred scripts load relative to inline page scripts. Any category outside that old hardcoded list fell back to a generic clipboard icon. Removed the stale duplicate.

The ticket detail modal never had the same unsaved-changes protection the New Ticket modal has always had. Added it, detecting unsaved text specifically in the note composer — an empty note closes normally, a real one prompts before discarding.

A stretch of unwanted whitespace in published articles turned out to have three separate, unrelated contributors layered on top of each other: images with no reserved dimensions causing a real layout shift as they loaded, Quill's default editing-box CSS imposing a minimum height meant for a live editor rather than a read-only page, and a stray 24px margin on the category/views badge row. Each is now addressed at its actual source rather than papered over.

An earlier fix aimed at removing "leftover empty paragraphs" was actually removing intentional blank-line spacing between paragraphs — the exact formatting technique most people use instinctively when writing. Articles now preserve blank lines exactly as typed.

Quill's default styling for both was too close to the app's own dark background to read as distinct. Blockquote now gets a left border in the app's accent color with a tinted background; code blocks get a genuinely dark background with monospace accent-colored text.

The KB is Tech/Superuser/Admin only — end users were locked out of the whole section earlier in development, which quietly made the Internal/Public distinction meaningless since both settings resolved to the same audience. Removed the toggle entirely rather than leave a field that looks like it does something but doesn't.

Small count next to the list title, updating live as you switch categories or search.

Quill's editor theme defaults to a light-page color scheme — dark toolbar icons and near-black placeholder text, both close to invisible against this app's dark background. Restyled the toolbar, formatting dropdown, and placeholder/typed text to match the app's own theme.

Expanded from a handful of basics to the full set Quill supports — strikethrough, all six heading levels, text/highlight color, font, alignment, blockquote, code block, indent, and sub/superscript.

The print icon on an article now prints just the article itself — no sidebar, nav, or metadata panel — with the dark theme's light text forced to plain black so it's actually legible on paper or in a saved PDF.

Links inside article bodies now use the active theme's own accent color rather than Quill's default blue — correctly follows whichever of the 10 themes is active, not just the dark default.

A dedicated Credentials section on each article, separate from the free-text body — label, username, password, AES-256 encrypted at rest using the same encryption already backing SMTP credentials. Passwords stay masked behind dots with a reveal (auto re-hides after a few seconds) or copy-to-clipboard action. The decrypted value is never included in a normal page load — it's only ever fetched the instant someone clicks reveal or copy, and each of those is its own individually audit-logged event.

New Admin-only Settings tab for sending one-off announcement emails — new features, planned maintenance, whatever's worth a heads-up. Target specific people, your whole internal team, or (in Multi-Company Mode) an entire client's contacts, individually or all at once. %name% and %company% personalize each email per recipient at send time. Uses the same branded template as scheduled reports and assignment notifications.

The overview pills' New/In Progress/Waiting counts naturally exclude Done tickets since they're filtered by status directly — but Urgent and High are priority-based counts with no such built-in exclusion, so a closed urgent ticket kept inflating the Urgent pill indefinitely. Both now explicitly exclude Done tickets, matching the rest of the row.

The biggest addition since launch. Full-page rich-text article editor with inline image upload, drag-resize/align on images, and a lightbox for viewing them. Categories are manageable in Settings with a locked set of sensible defaults you can't accidentally delete. Articles can attach files directly and cross-reference each other as Related Articles. Searchable straight from inside a ticket, so a tech can pull up the relevant doc without ever leaving what they're working on.

Adding someone to a project's team now sends the same kind of assignment email tickets have always sent, with a direct link into the project. Toggle in Settings → Notifications.

Every file uploaded or removed from a ticket, project, or KB article writes a proper audit entry — batch uploads log as one readable summary rather than one entry per file.

A find-and-replace while wiring up project assignment emails accidentally deleted the function signature for an unrelated, already-existing email function in the same file, breaking the whole file's syntax. A full php -l lint sweep is now standard practice after every build specifically because of this.

Clicking an image or video attachment on a ticket or project now opens it in a full-size overlay instead of a bare new tab or forced download. Left/right arrows (and arrow keys) browse the rest of that ticket's or project's media without closing and reopening. PDFs and other file types are unaffected — they still open in a new tab, where the browser's own viewer already does a better job than a cramped lightbox could.

Video files can now be attached to tickets and projects alongside images and documents. Video attachments get a thumbnail with a play icon and open in the new lightbox with full playback controls.

A file renamed to spoof an allowed extension (e.g. a disguised executable claiming to be a .pdf) previously passed validation on filename alone. Every upload is now checked against its real magic bytes — the signature actually embedded in the file — before being accepted, covering every allowed type including the new .mp4.

Settings → General displayed its own separate hardcoded copy of the allowed extensions list, independent from the one actually enforced by the upload endpoint — editing one didn't update the other. Both now read from a single shared source, so what Settings displays and what the server actually accepts can no longer disagree.

Previously only status changes were logged — reassigning a tech, changing priority/category, linking a project, editing the title, and every project field (status, progress, due date, blocked reason, department, team assignment) now write their own audit entry. Assigned-to and location changes resolve to the actual name, not a raw ID.

The "Send Email" button on Custom Report only applied the date range — status, priority, category, location, and assigned filters were silently ignored, so the emailed report didn't match what was on screen. Now uses the same filtered query as the in-app preview and CSV export, with a "Filters applied" summary line in the email itself so the recipient can see exactly what was included.

Status changes and bulk updates were logging as raw {"from":"...","to":"..."} strings instead of readable text. Now reads as plain English, e.g. "Status changed from In Progress to Waiting on User" and "Bulk updated 5 tickets: status → Done".

Ticket and project deletions logged only a numeric ID, which no longer resolves to anything once the record is gone. Now captures the ticket/project number and title before deleting, so the audit trail stays meaningful after the fact.

The ticket number column in Daily/Weekly/Monthly report emails had zero padding and sat right at the edge of its column width, so longer ticket numbers visually merged into the title text next to them. Widened the column and added spacing.

Daily, Weekly/Monthly, and Projects report emails widened from 680px to 740px, giving the title column more room on rows with a lot of per-row data (status, priority, assignee, date).

Weekly/Monthly report email now shows a small caption under "IT Projects" noting the configured completed-projects window and that project dates shown are estimated completion, not creation or last-touched.

Tickets can now be linked to a project right from the ticket modal — searchable field, only shows Planning/Active/On Hold projects. Linked tickets show a small project tag on the board and in list view. The project side gets a permanent Linked Tickets list with an Add Ticket picker — closed tickets stay listed with their status badge rather than disappearing, so it doubles as a record of everything that was ever part of the project.

Small spinner in the topbar shows while ticket data is refreshing — on page load, filter changes, and search.

Widened to 75% of viewport with a two-column layout — structured fields, checklist, and linked tickets on the left, Attachments and Progress Notes grouped together on the right so photos and their related notes sit next to each other instead of getting buried at the bottom of a long scroll.

Both modals now cap at 90% viewport height with the header and footer pinned in place — only the content in between scrolls. Previously the entire modal (including the header) scrolled as one long block on tickets/projects with a lot of content.

Opening any modal now locks scrolling on the page underneath it. Previously the page behind the modal could still be scrolled, most noticeably when scrolling past the bottom of a modal's content.

Scrolling quickly inside a modal's content could hit the top or bottom edge and "spill over" into the page behind it, making the whole page jump. Added overscroll-behavior: contain to stop scroll from chaining past the modal's boundary.

Static assets (app.js, app.css, theme CSS) are cached in the browser for a month by design, but had no way to bust that cache when a new version shipped — meaning a browser could keep running old JS/CSS for weeks after an update. Asset URLs are now suffixed with the app version, so every release automatically forces a fresh fetch for everyone.

Settings → General checks ticketfoundry.net for the latest version and shows a dismissible banner when an update is available, with a link to the changelog. Cached for 24 hours, fails silently if offline, visible to Admin and Superuser only.

Settings → Backup now supports Daily, Weekly, or Monthly automatic backups on top of the existing manual download. Configurable retention count, optional inclusion of uploaded attachments, day-of-week/day-of-month picker, a one-click Run Now button, and a live list of stored backups with download/delete. Driven by a single cron job hitting cron/backup.php — safe to call daily regardless of schedule since it's a no-op unless a backup is actually due.

Techs, Superusers, and Admins can merge a duplicate ticket into another from the ticket modal. The merged ticket is marked Done and linked to the survivor — no data moves, notes and attachments stay exactly where they are, each side just shows a link to the other. Merge picker includes live ticket search by number or title.

Custom Report sidebar now includes a Location dropdown alongside Status, Priority, Category, and Assigned To. Applies to Generate Report, CSV export, and print.

The Manager field on directory entries now searches the directory live as you type, matching the same autocomplete behavior as Requester Name on ticket creation. Applied to both the Directory page and the Users & Access directory modal in Settings.

Dashboard widget showing open tickets with no assigned tech. Color-coded aging dots, priority/category/requester on each row. Claim button lets techs self-assign in one click. Configurable sort order (priority, oldest, newest). Hides automatically when nothing is unassigned. Toggle, claim button, and sort all configurable in Settings.

When email isn't set up, admins see a yellow warning banner on the dashboard with a direct link to Settings. Disappears automatically once email is configured.

When creating a user with Send Welcome Email toggled on but no email provider configured, the setup link is shown directly in the modal so the admin can copy and share it manually instead of the invite silently failing.

Completed tickets and projects show the first 7 cards with a Show X more button at the bottom. Keeps the board layout clean without hiding anything permanently. Click again to collapse back.

All create, update, and delete actions on companies, locations, directory entries, and categories now appear in the audit log. Previously these left no trace.

Configurable retention period in Settings General: 30, 60, 90, 180 days, 1 year, or Forever. Default 60 days. Auto-purge runs with the daily cron job and logs how many entries were removed.

Directory edit permissions expanded to include the Tech role. Techs are the ones logging tickets day to day and need to be able to add someone on the fly without waiting for an admin.

Kanban columns now show context-aware messages instead of nothing. Done column says No completed tickets. Directory distinguishes between no entries and no search results. List view empty state includes a hint to adjust filters.

Reports were filtering completed projects on updated_at which gets bumped on every edit, causing old completed projects to keep reappearing. Now uses completed_at with a fallback for projects completed before that column existed.

Selecting Unassigned in the ticket modal was sending an empty string instead of NULL. The PATCH handler now converts empty string to NULL for assigned_to and location_id.

PHP error output was not suppressed at the application level, meaning raw error messages could leak stack traces and file paths to end users. Now set in db.php which is included by every page.

get_client_ip() trusted X-Forwarded-For and CF-Connecting-IP unconditionally, letting any client spoof their IP and bypass login rate limiting. Now only trusts forwarded headers when the direct connection comes from a private/loopback range — a legitimate reverse proxy.

Settings General Directory: Multi-Company Mode toggle (renamed from MSP Mode). When enabled, directory entries are assigned to a specific company from the Companies list. Company filter appears in the directory. Organization tab renames to Organizations.

New Companies tab in Settings Organizations (visible when Multi-Company Mode is on). Add, edit, and disable companies. Assign locations to each company inline — pick an existing unassigned location or create a new one with full address fields right from the company card.

Clicking a directory card now opens a read-only profile view with avatar initials, name, job title, contact details, and recent ticket history. Edit button switches to the edit form. Cancel returns to the profile view.

Settings General Directory now includes: Show Job Titles, Show Manager Field, Require Email on Entries, Default Sort, and Cards Per Page.

Directory paginates client-side using the Cards Per Page setting with Prev/Next controls. Resets to page 1 on filter change.

Locations now have Address Line 2 for suite and floor info. The Locations tab has a search box and company filter. Company name shown as a pill badge on each location row.

Configurable retention in Settings General. Auto-purge runs with the daily cron.

Fixed an issue in reset-password.php where a reset link could remain valid after being used. Tokens are now correctly invalidated on successful password change.

Tightened the URL validation on the post-login redirect parameter to close a protocol-relative URL edge case.

File downloads now enforce the same access rules as ticket visibility. Viewer accounts are limited to attachments on their own tickets and cannot access project attachments.

The attachment delete endpoint now enforces a minimum tech-level role. Previously any authenticated user could delete attachments by ID.

Uploaded files are now verified against their actual content via magic bytes in addition to extension checking.

Sanitized the Content-Disposition filename header to prevent injection via specially crafted filenames.

The forgot password form was missing CSRF token validation. Added token generation and verification consistent with the rest of the app.

forgot-password.php and reset-password.php were using a bare session_start() instead of session_start_secure(). Fixed. SameSite=Strict also added to the session cookie across the whole app.

All three cron scripts were comparing the authorization key with !==. Switched to hash_equals() across daily-report.php, monthly-report.php, and never-logged-in.php.

Added cron/ to the blocked paths in both nginx.conf.example and web.config. Cron endpoints are key-protected but there's no reason they should be web-accessible at all.

Build date updated to 2026-06-15.

All header() redirects across index.php, logout.php, settings.php, ticket.php, and auth.php were using app_url() which produced broken paths on IIS when SCRIPT_NAME returned / or empty string. Replaced every redirect with config('site_url') directly — no more IIS path manipulation possible.

All three cron scripts were using !== for key comparison, vulnerable to timing attacks. Changed to hash_equals() on daily-report.php, monthly-report.php, and never-logged-in.php.

Viewers could PATCH any ticket by ID — the role check only stripped assigned_to but didn't prevent editing tickets they didn't submit. Now verifies the requester_email matches the viewer's session email before allowing any edits.

department_id and location_id were accepted on ticket creation without verifying they exist as active records. Invalid IDs are now silently nulled before insert.

Board now fills the full page height — no dead space below columns when tickets are few. All four columns stretch to equal height via flex chain from page-body down through kanbanView to the board.

Projects page now shows the OVERVIEW label above the stats pills to match the Tickets board layout.

New Ticket modal and Projects attachment drop zone were hardcoded to 10MB. Both now read from config('max_upload_mb'). Server-side MAX_FILE_MB constant in api/attachments.php also reads from config.

Uploads Backup button was btn-secondary while Database Backup was btn-primary. Both now btn-primary for consistency.

api/attachments.php added realpath() checks on both the file serve and delete endpoints to prevent path traversal. Flagged by Akido security scan.

app.py from the original Python/Flask prototype was still in the repository, triggering false positive security alerts. Removed.

Ticket list view now paginates. Page size configurable in Settings → General: 25 / 50 / 100 / All. Defaults to 25. Pagination bar shows current range and total count. Filters and search reset to page 1 automatically.

Project cards can now be dragged between Planning, Active, On Hold, and Complete columns — same as the ticket board. Status updates automatically on drop via PATCH.

External Ticket Submission settings moved out of General into a dedicated Submit Form tab. General tab is significantly less cluttered.

Tickets Per Page and Completed Projects Window cards now have explicit Save buttons. Audit log entries added for meaningful settings changes: company name, ticket format, notifications, email provider, and submit form enable/disable.

Kanban board Done column now has a fixed height with its own scroll, so a long completed list doesn't push the other columns off screen.

Clicking the backdrop or ✕ while title or description has content now shows a "Discard changes?" confirmation. Prevents accidentally losing a ticket mid-entry.

Projects page now shows the OVERVIEW label above the stats pills to match the Tickets board layout.

Removed the ▲ Hide button from the overview stats bar — not a commonly used feature and added visual noise.

api/notes.php was calling require_csrf_header() which doesn't exist — fixed to require_csrf(). Adding notes to projects was returning a 500.

updateBulkBar, toggleSelectAll, clearBulkSelection, bulkApply and handleRowClick functions were referenced but never inserted into dashboard.php. Checkboxes showed but nothing happened on click.

Bulk bar had display:none set twice in its inline style — JS was setting it to flex but the second declaration overrode it. Bar never appeared.

New Backup tab in Settings. One-click download of a full SQL dump — all tickets, users, settings, comments, attachment metadata. Second button downloads a zip of the uploads/ folder. Requires ZipArchive PHP extension for uploads backup.

Settings was saving the API key as email_api_key but mailer.php looked for postmark_api_key (and sendgrid_api_key etc). API email worked on initial setup but broke after re-saving settings. Now saves under the correct provider-specific key.

send_via_phpmailer() was catching the base Exception class instead of PHPMailer\PHPMailer\Exception. On some servers the catch never fired, the exception bubbled up uncaught, and the API returned a 500. Fixed to catch the correct namespaced exception plus a Throwable fallback.

SMTP/API failures now return the actual error message in the toast — authentication failure, connection refused, bad API key etc — instead of a generic "Request Failed".

Sidebar logo section and topbar were different heights causing the horizontal divider lines to not align. Both set to a fixed 64px height with flex centering.

Default theme picker in Settings was taking up excessive space. Swatches reduced in height and reorganised into a compact 2-column grid with max-width constraint.

Every page was throwing a 404 for /assets/css/app-mobile.css — the file was referenced in layout_header.php but never existed. Mobile styles extracted from inline style block into a proper app-mobile.css file.

Version number and build date now shown at the bottom of Settings → General with a link to the changelog.

New Backup tab in Settings. One-click download of a full SQL dump of the database — all tickets, users, settings, comments, attachment metadata. Second button downloads a zip of the uploads/ folder. Requires ZipArchive PHP extension for uploads backup. CSRF-protected GET download endpoint.

send_via_phpmailer() was catching the base Exception class instead of PHPMailer\PHPMailer\Exception. On some servers (notably IIS) the catch block never fired, the exception bubbled up uncaught, and the API returned a 500 with no error detail. Fixed to catch the correct namespaced exception plus a Throwable fallback.

SMTP failures now return the actual PHPMailer error message (authentication failure, connection refused, etc.) instead of a generic "Request Failed". Decrypt failures return a specific message. Empty password after decryption returns a specific message.

First production-ready release. Packaged as ticket-foundry-v1.0.zip — clean install, no setup artifacts, LICENSE.txt included, install guide redirects to ticketfoundry.net for always-current docs.

tf_tickets has a foreign key to tf_locations, and tf_attachments has a foreign key to tf_projects — but both referenced tables were defined later in schema.sql. MySQL silently failed to create tf_tickets, tf_comments, and tf_attachments on fresh installs. Fixed table creation order so all foreign key dependencies are satisfied.

Schema was missing used and ip_address columns on tf_password_resets. Forgot Password page threw a 500 on any fresh install. Both columns added to schema.

mailer.php was requiring /includes/phpmailer/ (lowercase) but the folder is /includes/PHPMailer/ (uppercase). On Linux filesystems this is case-sensitive — PHPMailer was never found, silently fell back to PHP mail(), which failed. All four require_once paths corrected to match actual folder name.

7-Day Report → Weekly Report, 30-Day Report → Monthly Report. Clearer labelling throughout the Reports page.

Each report schedule (Daily, Weekly, Monthly) now has a customisable Email Subject field. Supports {company} and {date} placeholders. Defaults to sensible values, saves to config, substituted at send time in cron scripts.

Weekly and Monthly report schedules previously only had a day picker with no time. Time picker added to both, defaulting to 08:00. Cron scripts read the configured time and exit silently if it's not the right hour.

Category was read-only in the ticket modal — no way to change it after creation. Now a dropdown matching the status and priority selectors. Changes save instantly via updateTicketField(). Viewers still see it as read-only text.

Notes on the direct ticket page (ticket.php) were displaying raw HTML tags instead of rendered content. Quill stores notes as HTML — the template was using htmlspecialchars() which escaped the tags. Fixed to output raw HTML.

Comments query on ticket.php was selecting u.username instead of COALESCE(u.full_name, u.username). Fixed to show display name consistently.

profile.php was only listing 6 themes — missing Midnight, Light, Warm, and High Contrast. All 10 themes now available in the profile theme picker.

Added try/catch with verbose output to never-logged-in.php. Previously silent failures showed Done. Sent: 0 with no indication of what went wrong. Now prints per-user status and any exception messages directly in the response.

Commercial use license included in the package. One purchase = one install. No redistribution, reselling, or sublicensing. PHPMailer LGPL license also included in includes/PHPMailer/LICENSE.

All Beta wording removed. Before You Begin section rebuilt with separate dependency tables for PHP extensions, Apache, IIS, and Nginx. Step 3 (Schema Import) updated to reflect automatic import via setup wizard — manual phpMyAdmin fallback moved to a collapsible details block.

The reformat query was triggering MySQL's ON UPDATE CURRENT_TIMESTAMP on the updated_at column, stamping every ticket with the exact moment the reformat ran. This skewed Average Resolve Time in reports to show absurd numbers (20+ days) for old tickets. Fixed by explicitly setting updated_at = updated_at in the UPDATE statement to bypass the auto-update trigger.

Added "Reformat All Ticket Numbers" button in Settings → General → Ticket Number Format. Rewrites all existing ticket numbers to match the current prefix/date/padding configuration using each ticket's original created_at date. Useful when migrating from an old format (e.g. TF-0001) to the new format (EPI-20260520-00085). Logs to audit log. Cannot be undone.

Removed the "Newest First / Oldest First / By Priority" dropdown from the list view filter bar. Column headers already handle sorting by clicking — the dropdown was redundant and added clutter.

Category column in tf_tickets was defined as ENUM, silently rejecting any new categories added after install and falling back to 'Other'. Altered to VARCHAR(100). Category dropdown added to ticket modal so category can be changed inline like status and priority. catIcon() function was undefined — now built from a live CAT_MAP loaded from tf_categories at page load so new categories show their icons automatically.

Completely rewritten setup.php — zero dependencies on auth.php or db.php. Reads DB credentials via regex, handles schema import, admin account creation, site settings, ticket number format, email config, and generates encryption key on finish. Works on Apache, IIS, and Nginx.

Added web.config as full IIS equivalent of .htaccess — URL rewriting, security headers, blocked paths. Also added nginx.conf.example for Nginx installs. Ticket Foundry now officially supports Apache, IIS, and Nginx on any OS.

install-guide.html — single HTML file covering prerequisites, step-by-step setup, all email providers, cron job setup, server types (Apache/IIS/Nginx/Raspberry Pi), internal DNS, troubleshooting, and security recommendations.

Added missing tables: tf_locations (with address/city/state/zip), tf_categories, tf_directory, tf_password_resets, tf_remember_tokens, tf_templates, tf_project_checklist, tf_project_attachments. Fixed tf_tickets: added location_id, source, VARCHAR category. ticket_number expanded to VARCHAR(40).

Notes can now be marked Internal Only — skips email notification to requester and is hidden from viewer accounts. Displayed with purple indicator in the note thread. is_internal column added to tf_comments.

Urgent, New, In Progress, Waiting, Total Open, and Completed 7-Day pills are now clickable filters. Click to filter the board, click again to clear. Active pill highlights with acid green label.

New dropdown in the filter bar lets admins and techs filter tickets by assigned tech, including an Unassigned option. Auto-populated from active staff accounts.

Location dropdown added to ticket detail modal. Techs/admins can change it inline. Viewers see it as read-only text.

Categories in Settings → Organization can be reordered by dragging. Order persists to DB and reflects immediately in all dropdowns.

Category icon field replaced with a click-to-open emoji grid — 64 IT-relevant emojis across 8 categories. Click the icon preview to open, click any emoji to select.

Template category dropdown was hardcoded. Now loads live from tf_categories so new categories appear automatically.

Settings → General now includes a Max Attachment Size dropdown (2/5/10/20/50MB). Shows server PHP limits inline so admins know the ceiling. All attachment upload areas read from config.

Added Light, Midnight, Warm, and High Contrast themes. All 10 themes available in both Settings → General and My Profile. Theme switcher whitelist updated to include all options.

Setup wizard generates a unique AES-256 encryption key on finish and writes it to tf_config.php. SMTP passwords and all API keys (Mailgun, Postmark, SendGrid, Brevo) are encrypted before being stored in tf_config table.

User email now stored in session on login, enabling viewer ticket filtering by requester_email.

Viewers were previously filtered by assigned_to which showed nothing since tickets aren't assigned to requesters. Now filters by requester_email so viewers see all tickets they submitted.

mailer.php was only routing to API when email_method === 'api'. Named providers (mailgun, postmark, sendgrid, brevo) now correctly route to send_via_api(). Provider-specific API key lookup fixed.

All notify calls wrapped in try/catch. Email failures logged to PHP error_log and audit_log (action: email.error) but don't prevent ticket/comment creation.

REGEXP_REPLACE used for ticket number generation is MySQL 8.0+ only. Replaced with COUNT(*) + preg_match on last ticket number — works on all MySQL/MariaDB versions. Fixed in both api/tickets.php and submit.php.

Added source column to tickets (web_form vs internal). Fixed duplicate ticket number bug. Try/catch on insert returns friendly error instead of fatal. Ticket number VARCHAR expanded to 40 chars.

user-guide.html — complete user documentation with light/dark toggle, role-based content filtering (Admin/Tech/Viewer), live demo widgets for the ticket board, new ticket form, status updates, and theme picker. Searchable, collapsible FAQ.

Standalone PHP/MySQL sandbox app hosted at sandbox.ticketfoundry.net. Separate DB instance (tf_sandbox), no login required, built as a live interactive demo of the full product. Multiple sessions across two weeks to get it production-ready.

Sidebar role switcher lets visitors flip between Admin, Tech, Manager, and End User views without creating an account. Each role shows exactly what a real user in that role would see — different nav, different permissions, different ticket visibility.

Cron job wipes and re-seeds the sandbox DB every 7 days automatically. Manual reset.php available — upload it, hit the URL with the secret key, everything resets, delete the file. Prevents the sandbox from accumulating garbage indefinitely.

All user-submitted content passes through filter.php before hitting the DB. Catches slurs, profanity, and other obvious abuse. Because that's how people on the internet are.

Sandbox launches with realistic seed tickets, projects, and users. Includes the classics: "Printer has chosen violence again", "It worked yesterday", and "Replace the spreadsheet pretending to be a system". Restores to this state on every reset.

Full settings panel is visible so visitors can explore every configuration option — but nothing persists. Company name locked to "Ticket Foundry Sandbox". All 10 themes available and switchable per-session.

Audit log page shows realistic fake entries rather than real activity. Demonstrates the feature without exposing actual sandbox usage data or building up a real log that gets wiped on reset.

Reports generate and download as PDF normally. All email send buttons replaced with "Emails disabled for sandbox" message. No outbound email from the sandbox environment.

Attachment drag-drop area visible but non-functional. Upload endpoint returns a polite rejection. The placeholder UI is there so visitors can see the feature exists without opening a file upload endpoint to the public internet.

.htaccess blocks direct access to /includes, .sql files, and reset.php by default. TF_SANDBOX constant guards all include files — direct HTTP requests to includes/ return 403. Relative path includes throughout for portability.