The partial-update controller (status transitions incl. requires_comment
with the comment in the same transaction, field edits, visibility,
audit delta, status-change notifications) was defined inline inside
api/update_ticket.php, so nothing else could reuse it. Moved it verbatim
to controllers/ApiTicketController.php so the MCP update_status tool can
run the exact same code path as the web UI; update_ticket.php now just
require_once's it. The class body is byte-identical to the original
(diffed against HEAD, modulo the 4-space dedent).
Verified the web endpoint over real HTTP with a real session + CSRF:
Open -> In Progress succeeds, In Progress -> Closed without a comment is
refused with requires_comment (400), and with a comment closes the
ticket and persists the reason.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X
