A client's page now lists the tickets Wegweiser opened for it

Each client's page now has a Tickets section: the tickets Wegweiser holds open in your helpdesk for that client, the ones it closed in the last 30 days, and a switch that keeps the client out of new ones. It appears as soon as a ticketing integration is connected, and today that means Zammad.

What the section shows

Open Organisations, pick a client, and the page rail carries Tickets with the number open.

Each row names the machine, the condition that raised the ticket, the date it opened, and a link that opens the ticket in Zammad. There are four conditions: a honey account was used, a drive is reporting its own failure, a malware or IOC detection wasn't suppressed, or a machine crossed down through the health threshold. Under the open tickets sit the ones closed in the last 30 days, up to ten, marked "Resolved by Wegweiser" or "Closed by a technician".

A line at the top says whether a new ticket can be filed for this client today, and when it can't, which switch is stopping it.

One switch covers every ticketing integration

A master can tick Exclude this client from new tickets, in every ticketing integration. It's a veto: whatever the Zammad wizard says about the client, no new ticket is filed for it.

The switch covers new tickets only. A ticket already open goes on being appended to, and is resolved when the condition clears, because stopping mid-flight leaves a technician working a ticket Wegweiser has stopped talking about.

The Zammad sync had two faults

Unticking a client in the Zammad wizard closed its open tickets with "Resolved - Wegweiser no longer sees this" while the condition was still on the machine. Open tickets are now appended to, and resolved only when the condition clears.

A condition that came back after Wegweiser had resolved its ticket found that ticket closed and was marked abandoned, so it didn't get a second ticket. It now gets a new one on the same row.

A help request binds only inside its own client

A help request sent from one client's machine could bind another client's tickets to the machine it came from, and show that machine to technicians who had been given only the other client.

One rung of the ladder Wegweiser climbs to match a ticket to a machine is the single machine that person has raised help requests from in the past twelve months. It was the only rung starting from the ticket's From address that wasn't held to the ticket's organisation, and the address on a help request is whatever the person typed into the form.

The rung now looks inside the ticket's organisation when the ticket names one.

We read the rest of that path end to end against Zammad's own source. The subject and the body reach a suggestion at most, the sender's display name reaches no rung, and the ticket field Wegweiser trusts can be written only by the desk's own agents and by our token. A suggestion doesn't start a case.

Inline scripts run only with the page's nonce

Wegweiser's enforced content security policy allowed script-src 'self' 'unsafe-inline' js.stripe.com, so an HTML injection anywhere in the app could run script. It's now 'self', the response's own nonce and Stripe, with no 'unsafe-inline' and no 'unsafe-eval'.

The strict policy had been running in report-only mode since 2026-10-01. Six days of reports from real browsers named nothing of ours, and a sweep that loaded 167 pages signed in and out in Chromium collected no violation.

Your machines now report the network around them

Every machine with an agent posts, once a day, what it declares about its network: the default gateway and the gateway's MAC, its own addresses, DNS, time source, mapped drives and network mounts, WSUS, ODBC data sources, hosts entries, and on a Hyper-V guest the host it runs on. It's osquery, so there's no agent release to take.

There's no page for it yet. This is the measuring phase of estate and discovery. The second half, which machine is talking to which, samples only on our own fleet while we work out how often a machine has to be asked.

Also in this release

A VSA alert is placed by its computer field alone. A quoted string anywhere in an alert that matched a device name used to be enough to move that alert to another machine, and so to another client.

An import or an invitation answers about your tenant only. The user-import preview and the single invitation said "already has an account" for an address that had one in any tenant. That told one MSP who else runs Wegweiser.

An agent update is verified twice. The supervisor that installs it as SYSTEM or root re-checks the digest, the size and the signature itself before it stops the service.

A DocuVault key that can do more than read is refused when you connect it, and a password typed into a documentation note is redacted before the note reaches a model.

The agent builds on go1.26.9, which fixes the HTTP/2 encoder race published as GO-2026-6617 on 2026-10-08.