# Status

## 2026-07-18

- Created the independent static workbench project and `layouts.worldapi.org` nginx vhost.
- Added Let's Encrypt certificate; certificate currently expires 2026-10-16 and is covered by the existing certbot renewal service.
- Verified nginx configuration and reload.
- Verified origin HTTPS and public Cloudflare HTTPS responses return the expected workbench HTML.
- Added the first fixture at `/notes/logged-in/`: desktop sidebar + reader, narrow-screen list-first behavior, and `.list`/`.reader` state hooks for the eventual application.

### Audit — not accepted as working

- `layouts.worldapi.org` CSS is currently cached by Cloudflare for 86400 seconds. The public `notes.css` is stale and still contains the original CDN import and desktop-first implementation; it does not match the current origin file.
- Current origin CSS hides `notes-sidebar` in the desktop `.list` state because of the final media-query selector.
- `layout.php` and partials are directly reachable and emit PHP warnings when opened without variables.
- The include direction does not yet implement the agreed `layout.php` shell including a selected detail page cleanly.
- Naming is inconsistent: the folder is `logged-in`, markup uses `.authenticated`, and README terminology changed during implementation.
- The fixture has not been tested as a rendered layout at narrow and wide widths. Earlier HTTP delivery checks were incorrectly reported as layout verification.
- Root documentation previously referenced deleted `/anonymous/` and `/authenticated/` folders and described the now-PHP workbench as static; corrected during this audit.
- Established rules are recorded in `docs/conventions.md`.