ToolboxAid · ToolboxAid · Jun 28, 2026
diff --git a/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS.md b/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS.md
@@ -117,7 +117,7 @@ Rules:
 
 ## Current Version/Date
 
-- Project Instructions Version: 2026.06.28.007
+- Project Instructions Version: 2026.06.28.008
 - Date: 2026-06-28
 - Owner: OWNER
 

diff --git a/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS_VERSION.md b/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS_VERSION.md
@@ -1,6 +1,6 @@
 # Project Instructions Version
 
-Current Project Instructions Version: 2026.06.28.007
+Current Project Instructions Version: 2026.06.28.008
 
 Last Updated: 2026-06-28
 
@@ -15,6 +15,7 @@ Last Updated: 2026-06-28
 - Added repository layout scaffold governance for `www/`, `api/`, and `dev/local-runtime/`.
 - Added `www/` migration map for safe browser-served application movement planning.
 - Added local route-root compatibility toggle documentation for future `www/` activation.
+- Moved browser-served application files under `www/` and made local static serving prefer `www/` by default.
 - Codex must read this version file and the latest repository copy of `PROJECT_INSTRUCTIONS.md` before performing work.
 - Codex must discard previously remembered Project Instructions and treat the repository copy as authoritative.
 - Codex must validate canonical report and ZIP paths, branching model, and legacy path avoidance before work proceeds.
diff --git a/dev/build/ProjectInstructions/PROJECT_STATE.md b/dev/build/ProjectInstructions/PROJECT_STATE.md
@@ -1,7 +1,7 @@
 # Project State
 
 ```yaml
-project_state_version: "2026.06.28.007"
+project_state_version: "2026.06.28.008"
 last_updated: "2026-06-28"
 current_main_commit: "40de767476d70cadfd1292c916844c2f31b6f185"
 repository_status:
@@ -10,36 +10,23 @@ repository_status:
   runtime_database: "Postgres"
   creator_metadata: "API to Postgres"
   creator_assets: "API to R2"
-project_instructions_version: "2026.06.28.007"
-repository_structure_version: "2026.06.28.007"
-canonical_layout_version: "2026.06.28.007"
+project_instructions_version: "2026.06.28.008"
+repository_structure_version: "2026.06.28.008"
+canonical_layout_version: "2026.06.28.008"
 active_teams:
   - "Owner"
   - "Alfa"
   - "Bravo"
   - "Charlie"
   - "Delta"
   - "Golf"
-latest_owner_pr: "PR_26180_OWNER_007-www-route-root-compatibility"
-latest_structure_pr: "PR_26180_OWNER_007-www-route-root-compatibility"
+latest_owner_pr: "PR_26180_OWNER_008-move-www-application"
+latest_structure_pr: "PR_26180_OWNER_008-move-www-application"
 valid_top_level_folders:
-  - "account/"
-  - "admin/"
   - "api/"
-  - "assets/"
-  - "community/"
-  - "company/"
   - "deploy/"
   - "dev/"
-  - "docs/"
-  - "games/"
-  - "learn/"
-  - "legal/"
-  - "marketplace/"
-  - "memberships/"
-  - "owner/"
   - "src/"
-  - "toolbox/"
   - "www/"
 valid_dev_folders:
   - "dev/archive/"

diff --git a/dev/build/ProjectInstructions/backlog/BACKLOG_MASTER.md b/dev/build/ProjectInstructions/backlog/BACKLOG_MASTER.md
@@ -39,9 +39,9 @@ The backlog is the authoritative source for determining the next logical PRs.
 - Team: Owner
 - Product Area: Repository Architecture Simplification
 - Status: Active
-- Percent Complete: 20%
-- Active PR: PR_26180_OWNER_007-www-route-root-compatibility
-- Next Milestone: Move browser-served application to `www/`
+- Percent Complete: 30%
+- Active PR: PR_26180_OWNER_008-move-www-application
+- Next Milestone: Move server/API application files into `api/`
 - Source / Reference: `dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md`; `dev/build/ProjectInstructions/repository/www_migration_map.md`
 
 ## Game Journey MVP

diff --git a/dev/build/ProjectInstructions/repository/canonical_repository_structure.md b/dev/build/ProjectInstructions/repository/canonical_repository_structure.md
@@ -7,36 +7,19 @@ Establish the canonical repository structure for future development and reduce t
 ## Canonical Structure
 
 Valid top-level folders:
-- account/
-- admin/
 - api/
-- assets/
-- community/
-- company/
 - deploy/
 - dev/
-- docs/
-- games/
-- learn/
-- legal/
-- marketplace/
-- memberships/
-- owner/
 - src/
-- toolbox/
 - www/
 
 Root product and repo sections:
-- account/, admin/, community/, company/, learn/, legal/, marketplace/, memberships/, and owner/ are production website sections.
-- assets/ contains production website and tool assets.
+- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, and browser assets.
 - api/ is the target Node/API/server application surface for the repository layout simplification workstream.
-- docs/ is production Docs & Help content.
-- games/ is public game discovery.
-- toolbox/ is the Creator toolbox/workspace.
 - deploy/ contains deployment configuration.
 - dev/ contains the development workspace.
 - src/ contains deployable application/runtime/API source.
-- www/ is the target browser-served application surface for the repository layout simplification workstream.
+- repository root contains standard repository configuration and top-level application shells only.
 
 Deployable application source:
 - src/web/{feature-name}/
@@ -75,19 +58,19 @@ Dev workspace ownership:
 - dev/tools/ owns development-only tooling.
 - dev/workspace/ owns generated output: tmp, zips, logs, generated files, and test-results.
 
-Tools:
-- toolbox/{tool-name}/index.html
+Browser-served tools:
+- www/toolbox/{tool-name}/index.html
 
-Tool assets:
-- assets/toolbox/{tool-name}/js/index.js
-- assets/toolbox/{tool-name}/css/index.css
+Browser-served tool assets:
+- www/assets/toolbox/{tool-name}/js/index.js
+- www/assets/toolbox/{tool-name}/css/index.css
 
 Themes:
-- assets/theme-v1/
-- assets/theme-v2/
+- www/assets/theme-v1/
+- www/assets/theme-v2/
 
 Shared JavaScript:
-- assets/js/shared/
+- www/assets/js/shared/
 
 Legacy transition buckets:
 - src/advanced/
@@ -101,16 +84,16 @@ These legacy transition buckets may remain until explicit migration PRs move the
 
 ## Rules
 
-- Root is production website and standard repository configuration only.
-- www/ is the browser-served application target surface for migration.
+- Root is standard repository configuration and top-level application shells only.
+- www/ is the browser-served application surface.
 - api/ is the Node/API/server application target surface for migration.
 - src/ is deployable application/runtime/API code.
 - dev/ is development workspace only.
 - deploy/ is deployment configuration.
-- docs/ is production Docs & Help content.
+- docs/ routes are served from `www/docs/`.
 - Theme first.
 - Tool CSS second.
-- Shared functionality belongs in assets/js/shared/.
+- Browser-served shared functionality belongs in `www/assets/js/shared/`.
 - No new scattered JS folders.
 - No new scattered CSS folders.
 - Do not create new folders unless they fit the documented canonical structure.

diff --git a/dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md b/dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md
@@ -116,37 +116,42 @@ Rules:
    - Document current browser-served root paths, imports, local server behavior, test assumptions, compatibility needs, and validation lanes.
    - Do not move browser files or change package commands.
 
-3. `PR_26180_OWNER_007-move-www-application`
+3. `PR_26180_OWNER_007-www-route-root-compatibility`
+   - Prepare runtime/test route-root compatibility for the future `www/` move.
+   - Preserve public URLs.
+   - Keep repository-root serving as the default until the actual move.
+
+4. `PR_26180_OWNER_008-move-www-application`
    - Move browser-served application files into `www/`.
    - Include root HTML pages, `assets/`, `toolbox/`, `account/`, `legal/`, `learn/`, `play/`, and other browser-served static routes.
    - Update internal static references only as needed.
    - Do not move API/server files.
 
-4. `PR_26180_OWNER_008-move-api-application`
+5. `PR_26180_OWNER_009-move-api-application`
    - Move server/API application files into `api/`.
    - Include Local API server runtime files, API routes, services, database, storage, auth, publishing, and admin server code.
    - Do not move developer-only startup orchestration.
    - Browser code must not import from `api/`.
 
-5. `PR_26180_OWNER_009-move-dev-local-runtime`
+6. `PR_26180_OWNER_010-move-dev-local-runtime`
    - Move developer-only local runtime into `dev/local-runtime/`.
    - Include team-aware bootstrap, port config, local startup orchestration, local diagnostics, and browser launch support.
    - Update `package.json` commands to point to the new local-runtime paths.
 
-6. `PR_26180_OWNER_010-move-tests-and-validation`
+7. `PR_26180_OWNER_011-move-tests-and-validation`
    - Ensure all tests and validation suites live under `dev/tests/` or the current canonical dev test structure.
    - Update test paths after the `www/`, `api/`, and `dev/` migrations.
    - Do not change behavior.
 
-7. `PR_26180_OWNER_011-update-ci-and-scripts`
+8. `PR_26180_OWNER_012-update-ci-and-scripts`
    - Update CI, package scripts, validation scripts, and developer utilities for the new layout.
    - Preserve `npm run dev:bootstrap`, `npm run dev:api`, `npm run dev:web`, and `npm run dev:local-api`.
 
-8. `PR_26180_OWNER_012-remove-legacy-layout`
+9. `PR_26180_OWNER_013-remove-legacy-layout`
    - Remove or retire obsolete legacy paths after all references are updated.
    - Hard stop if any runtime, test, or CI reference still points to old locations.
 
-9. `PR_26180_OWNER_013-final-layout-validation`
+10. `PR_26180_OWNER_014-final-layout-validation`
    - Validate final repository layout.
    - Confirm `www/` owns the browser-served app, `api/` owns the server app, and `dev/` owns the developer workspace.
    - Confirm runtime does not depend on `dev/`, browser code does not import `api/`, and legacy references are removed or documented.

diff --git a/dev/build/ProjectInstructions/repository/www_migration_map.md b/dev/build/ProjectInstructions/repository/www_migration_map.md
@@ -1,27 +1,27 @@
 # www Migration Map
 
-Status: Active planning map
+Status: Implemented migration map
 Owner: Owner
 Workstream: Repository Architecture Simplification
-PR: PR_26180_OWNER_006-www-migration-map
+PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application
 
 ## Purpose
 
 Document the current browser-served repository surface and the safe sequence required before moving files into `www/`.
 
-This map is a no-runtime-change governance artifact. It does not move browser files, change package commands, change local server behavior, or update runtime imports.
+This map began as a no-runtime-change governance artifact. `PR_26180_OWNER_008-move-www-application` used it to move browser-served files under `www/` while preserving public URLs.
 
 ## Executive Summary
 
-The browser-served application currently depends on repository-root static serving.
+The browser-served application now lives under `www/`.
 
-Current local runtime, test helpers, and browser pages assume URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` resolve from the repository root.
+Current local runtime, test helpers, and browser pages keep URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` while resolving browser-served files from `www/`.
 
-Moving browser files into `www/` is feasible, but the move must preserve public route URLs while changing the filesystem lookup root. A direct folder move without route compatibility would break Playwright tests, local API static serving, team-aware bootstrap static serving, Node test root aliases, and browser imports that still reference root-level `src/`, `toolbox/`, and `assets/`.
+The move preserved public route URLs while changing the filesystem lookup root. Repository-root fallback remains available for transition-only compatibility, including browser imports that still reference root-level `src/`.
 
 ## Current Browser-Served Surface
 
-Current root-level browser-served entry points and folders include:
+Current browser-served entry points and folders now live under `www/`:
 
 | Path | Current role | Files | HTML files | Move target |
 | --- | --- | ---: | ---: | --- |
@@ -75,7 +75,7 @@ These URLs should continue working for users and tests during the move:
 - `/marketplace/index.html`
 - `/memberships/index.html`
 
-### Rewrite filesystem lookup paths
+### Rewritten filesystem lookup paths
 
 Static servers and test helpers should map public URLs to `www/` filesystem paths after the move:
 
@@ -172,17 +172,21 @@ Recommended approach for the actual move PR:
 
 ## Route Root Compatibility Toggle
 
-`PR_26180_OWNER_007-www-route-root-compatibility` installs the local compatibility switch without moving browser files.
+`PR_26180_OWNER_007-www-route-root-compatibility` installed the local compatibility switch without moving browser files.
 
-The future activation toggle is:
+`PR_26180_OWNER_008-move-www-application` moves browser-served files into `www/` and makes local static serving prefer `www/` by default.
+
+The local static serving root is now `www/` by default. The explicit activation toggle remains:
 
 ```text
 GAMEFOUNDRY_LOCAL_WEB_ROOT=www
 ```
 
-Default behavior remains current repository-root static serving when `GAMEFOUNDRY_LOCAL_WEB_ROOT` is unset, empty, `.`, `root`, or `repo-root`.
+Default behavior is now `www/` static serving when `GAMEFOUNDRY_LOCAL_WEB_ROOT` is unset or empty.
+
+When `GAMEFOUNDRY_LOCAL_WEB_ROOT=www`, local static serving explicitly prefers `www/` for public browser URLs while retaining repository-root fallback for compatibility during migration.
 
-When `GAMEFOUNDRY_LOCAL_WEB_ROOT=www`, local static serving prefers `www/` for public browser URLs while retaining repository-root fallback for compatibility during migration.
+When local validation needs the prior root behavior, `GAMEFOUNDRY_LOCAL_WEB_ROOT=repo-root` resolves static files from the repository root.
 
 This toggle is for local runtime and test helpers only. It does not change production deployment, public URLs, API routes, or package commands.
 

diff --git a/dev/reports/PR_26180_OWNER_008-move-www-application_branch-validation.md b/dev/reports/PR_26180_OWNER_008-move-www-application_branch-validation.md
@@ -0,0 +1,26 @@
+# PR_26180_OWNER_008 Branch Validation
+
+## Result
+
+PASS
+
+## Checks
+
+| Check | Result |
+|---|---|
+| Startup validation completed | PASS |
+| Project Instructions version loaded | PASS: `2026.06.28.007` at task start; PR updates docs to `2026.06.28.008` |
+| `PROJECT_BRANCHING_POLICY.md` loaded | PASS |
+| Current branch | PASS: `PR_26180_OWNER_008-move-www-application` |
+| Stacked base branch | PASS: created from `PR_26180_OWNER_007-www-route-root-compatibility` |
+| Worktree before branch creation | PASS: clean |
+| Reports path | PASS: `dev/reports/` |
+| ZIP path | PASS: `dev/workspace/zips/` |
+
+## Dependency Order
+
+1. `PR_26180_OWNER_006-www-migration-map`
+2. `PR_26180_OWNER_007-www-route-root-compatibility`
+3. `PR_26180_OWNER_008-move-www-application`
+
+PR008 must be reviewed and merged after PR007.
diff --git a/dev/reports/PR_26180_OWNER_008-move-www-application_manual-validation-notes.md b/dev/reports/PR_26180_OWNER_008-move-www-application_manual-validation-notes.md
@@ -0,0 +1,24 @@
+# PR_26180_OWNER_008 Manual Validation Notes
+
+## Manual Notes
+
+`npm run dev:bootstrap -- --team owner` is a long-running local startup command that launches the Owner web/API runtime and may open a browser. It was documented as manual validation rather than left running during this Codex execution.
+
+Expected manual verification:
+
+1. Run `npm run dev:bootstrap -- --team owner`.
+2. Confirm diagnostics show Owner/default ports:
+   - Web URL: `http://127.0.0.1:5500`
+   - API URL: `http://127.0.0.1:5501/api`
+   - Browser launch: `http://127.0.0.1:5500/index.html`
+3. Open:
+   - `http://127.0.0.1:5500/index.html`
+   - `http://127.0.0.1:5500/toolbox/index.html`
+   - `http://127.0.0.1:5500/account/sign-in.html`
+   - `http://127.0.0.1:5500/admin/system-health.html`
+   - `http://127.0.0.1:5500/games/index.html`
+4. Confirm public URLs remain unchanged while files are served from `www/`.
+
+## Local Artifact Note
+
+An ignored local file, `assets/DemoGame-26168-001.gfsp`, keeps a physical `assets/` folder visible in this checkout. It is not tracked and was not moved or committed.