Document the two-URL-depths trap and how it was fixed Running-on-nginx gains a full write-up: what broke (relative redirects in auth/ resolving to /auth/index.php once the page was reachable at its real path), why the routing tests passed anyway (they only covered signed-OUT journeys), the rule to follow, the BASE_URL idiom for all four kinds of outbound path, and the assertion that now guards it. Includes the irony worth remembering: the auth/.htaccess guard removed in #68 existed for exactly this reason, but its comment named only "relative assets", so the redirect targets were missed. Root-Folder-Tidy's correction notice now carries the rule and links to it.
Running on nginx (new); Root folder tidy correction notice for #68; Installation now says nginx needs its config
Root-Folder-Tidy: document the root tidy + canonical /login URL New page covering every move (auth/, tickets/csat/, scripts/, tests/), the URL contract (/login canonical, legacy 301s, OAuth callbacks unchanged externally), the MultiViews story, the guard .htaccess pattern, and rules for future root-level pages. Linked from the sidebar under Architecture; the Architecture directory tree and file-locations table updated to match. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>