Changelog

Tickets now carry the metadata your agents and managers actually need.

• New type enum: question / incident / problem / task / feature_request (Zendesk + Jira parity)
• Free-form tags array (max 20 per ticket, max 32 chars each) for cross-cutting labels
• Optional due_date distinct from the SLA clock — for promised deadlines
• TicketWatcher join table — agents subscribe to tickets they did not author and get notified of every reply
• Migrations are forward-only and back-compat with existing category data

Point your own domain (e.g. support.acme.com) at your helpdash workspace.

• DNS-validated TXT proof flow built into the Tenant module
• Caddy reverse-proxy auto-issues and renews Let's Encrypt certificates
• One row per (tenant, host) pair — globally-unique enforcement at the database layer
• Hot-path resolver checks the host on every unauthenticated request before any tenant context is bound
• Pro and Enterprise plans

Operating support for many tenants now has the safety rails it deserves.

• Separate auth:platform-admin JWT guard — platform tokens cannot be reused on tenant routes
• Impersonation issues a tenant-context JWT carrying an imp_platform claim referencing the original platform admin
• Every action — login, tenant CRUD, suspend, impersonate — recorded in platform_audit_logs (polymorphic, survives tenant cascade-delete)
• Suspended tenants and inactive users cannot be impersonated

Agents are no longer penalised for time spent waiting on someone else.

• WAITING_ON_CUSTOMER and WAITING_ON_THIRD_PARTY statuses pause the SLA clock
• When the ticket leaves a paused state, sla_due_at is re-extended by the elapsed pause duration
• Audit Task #28 (P1-5) — fixes the previous behaviour where pause periods still counted toward the breach window

Three Pro-tier modules shipped together.

• CSAT: signed survey link sent on ticket resolve; tenant rollup + cross-tenant analytics for platform admins
• Knowledge Base: per-tenant articles with revisions, view counters, and feedback capture
• Customer Portal: end-customers submit and follow tickets via magic-link auth (no password)
• All three are exposed through the embeddable widget — drop one script tag, get all three