ToolboxAid · ToolboxAid · Jun 29, 2026
diff --git a/api/API_RUNTIME_BOUNDARY.md b/api/API_RUNTIME_BOUNDARY.md
@@ -11,6 +11,6 @@ It is intentionally not `dev/tests/dev-runtime`:
 Deployment boundary:
 
 - DEV validation may execute `api/` through local server commands.
-- Browser pages, Theme V2 scripts, toolbox pages, and `src/engine` runtime code must use declared API/service contracts instead of importing `api/` directly.
+- Browser pages, Theme V2 scripts, toolbox pages, and `www/src/engine` runtime code must use declared API/service contracts instead of importing `api/` directly.
 - If a dev-only adapter is needed by a browser page, expose it through the Local API contract while keeping the implementation under `api/`.
 - Developer-only local bootstrap/orchestration remains outside `api/` until the scoped `dev/local-runtime/` migration PR.
diff --git a/api/admin/admin-notes-menu.mjs b/api/admin/admin-notes-menu.mjs
@@ -6,7 +6,7 @@ export const ADMIN_NOTES_LOCAL_MENU_LABEL = "Notes";
 export const ADMIN_MY_STUFF_MENU_LABEL = "My Stuff";
 
 const HEADER_PARTIAL_PATH = "www/assets/theme-v2/partials/header-nav.html";
-const LOCAL_HEADER_PARTIAL_PATH = "src/dev-runtime/admin/header-nav.local.html";
+const LOCAL_HEADER_PARTIAL_PATH = "www/src/dev-runtime/admin/header-nav.local.html";
 
 function repoRelativePath(repoRoot, targetPath) {
   return path.relative(repoRoot, targetPath).replaceAll(path.sep, "/");

diff --git a/api/guest-seeds/tool-metadata-inventory.js b/api/guest-seeds/tool-metadata-inventory.js
@@ -1 +1 @@
-export * from "../../src/shared/toolbox/tool-metadata-inventory.js";
+export * from "../../www/src/shared/toolbox/tool-metadata-inventory.js";
diff --git a/api/server/local-api-router.mjs b/api/server/local-api-router.mjs
@@ -133,7 +133,7 @@ import {
 import {
   getAdminNavigationItems,
   getOwnerNavigationItems,
-} from "../../src/api/admin-owner-navigation.js";
+} from "../../www/src/api/admin-owner-navigation.js";
 import { createPaletteSourceMockDbRows } from "../guest-seeds/palette-source-mock-db.js";
 import {
   SUPABASE_AUTH_PROVIDER_ID,
@@ -6929,8 +6929,8 @@ SELECT pg_database_size(current_database()) AS database_size_bytes,
       adminMainItems: getAdminNavigationItems(),
       ownerMenuItems: getOwnerNavigationItems(),
       ownership: {
-        adminMainItems: "src/api/admin-owner-navigation.js",
-        ownerMenuItems: "src/api/admin-owner-navigation.js",
+        adminMainItems: "www/src/api/admin-owner-navigation.js",
+        ownerMenuItems: "www/src/api/admin-owner-navigation.js",
         routeMap: "static shell route resolution",
       },
       source: "server-api",

diff --git a/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS.md b/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS.md
@@ -117,7 +117,7 @@ Rules:
 
 ## Current Version/Date
 
-- Project Instructions Version: 2026.06.28.017
+- Project Instructions Version: 2026.06.28.018
 - Date: 2026-06-28
 - Owner: OWNER
 

diff --git a/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS_VERSION.md b/dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS_VERSION.md
@@ -1,6 +1,6 @@
 # Project Instructions Version
 
-Current Project Instructions Version: 2026.06.28.017
+Current Project Instructions Version: 2026.06.28.018
 
 Last Updated: 2026-06-28
 
@@ -25,6 +25,7 @@ Last Updated: 2026-06-28
 - Added root leftover audit and `src/` transition plan for the final repository layout cleanup stage.
 - Removed safe empty local root directory shells and documented blocked local-only `assets/` cleanup.
 - Removed the local demo `.gfsp` artifact and recorded a file-by-file `src/` destination audit for future scoped migrations.
+- Moved PR017-audited browser/www-owned legacy `src/` files into `www/src/` while preserving public `/src/...` browser route compatibility under the `www` web root.
 - Codex must read this version file and the latest repository copy of `PROJECT_INSTRUCTIONS.md` before performing work.
 - Codex must discard previously remembered Project Instructions and treat the repository copy as authoritative.
 - Codex must validate canonical report and ZIP paths, branching model, and legacy path avoidance before work proceeds.
diff --git a/dev/build/ProjectInstructions/PROJECT_STATE.md b/dev/build/ProjectInstructions/PROJECT_STATE.md
@@ -1,7 +1,7 @@
 # Project State
 
 ```yaml
-project_state_version: "2026.06.28.017"
+project_state_version: "2026.06.28.018"
 last_updated: "2026-06-28"
 current_main_commit: "40de767476d70cadfd1292c916844c2f31b6f185"
 repository_status:
@@ -10,18 +10,18 @@ repository_status:
   runtime_database: "Postgres"
   creator_metadata: "API to Postgres"
   creator_assets: "API to R2"
-project_instructions_version: "2026.06.28.017"
-repository_structure_version: "2026.06.28.017"
-canonical_layout_version: "2026.06.28.017"
+project_instructions_version: "2026.06.28.018"
+repository_structure_version: "2026.06.28.018"
+canonical_layout_version: "2026.06.28.018"
 active_teams:
   - "Owner"
   - "Alfa"
   - "Bravo"
   - "Charlie"
   - "Delta"
   - "Golf"
-latest_owner_pr: "PR_26180_OWNER_017-src-dissection-and-demo-cleanup"
-latest_structure_pr: "PR_26180_OWNER_017-src-dissection-and-demo-cleanup"
+latest_owner_pr: "PR_26180_OWNER_018-move-src-browser-to-www"
+latest_structure_pr: "PR_26180_OWNER_018-move-src-browser-to-www"
 valid_top_level_folders:
   - "api/"
   - "deploy/"
@@ -40,7 +40,8 @@ valid_dev_folders:
   - "dev/tools/"
   - "dev/workspace/"
 known_technical_debt:
-  - "Browser API client modules remain under src/api/ until the final src layer migration moves them into src/web/ or src/runtime/."
-  - "src/dev-runtime/admin/ remains as a legacy Admin Notes browser-viewer compatibility path until a scoped browser admin migration retires it."
+  - "API/server-owned contracts, schemas, and project data store modules remain under src/shared/ until PR_26180_OWNER_019 moves them to api/."
+  - "Developer/source reference files remain under src/ until PR_26180_OWNER_020 moves them to dev/."
+  - "src/dev-runtime/admin/.gitkeep remains as a placeholder until PR_26180_OWNER_021 retires the empty root src folder."
   - "repository_directory_standard.md and codex_project_instructions_startup.md are superseded pointers retained for compatibility."
 ```
diff --git a/dev/build/ProjectInstructions/backlog/BACKLOG_MASTER.md b/dev/build/ProjectInstructions/backlog/BACKLOG_MASTER.md
@@ -40,8 +40,8 @@ The backlog is the authoritative source for determining the next logical PRs.
 - Product Area: Repository Architecture Simplification
 - Status: Active
 - Percent Complete: 99%
-- Active PR: PR_26180_OWNER_017-src-dissection-and-demo-cleanup
-- Next Milestone: Final layout validation and completion report
+- Active PR: PR_26180_OWNER_018-move-src-browser-to-www
+- Next Milestone: Move API/server-owned source to api/
 - Source / Reference: `dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md`; `dev/build/ProjectInstructions/repository/www_migration_map.md`
 
 ## Game Journey MVP

diff --git a/dev/build/ProjectInstructions/repository/canonical_repository_structure.md b/dev/build/ProjectInstructions/repository/canonical_repository_structure.md
@@ -14,7 +14,7 @@ Valid top-level folders:
 - www/
 
 Root product and repo sections:
-- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, and browser assets.
+- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, browser assets, and browser-owned runtime/client modules under `www/src/`.
 - api/ is the Node/API/server application surface for server entry points, API routing, API services, database access, storage access, auth, setup, publishing, and admin server logic.
 - deploy/ contains deployment configuration.
 - dev/ contains the development workspace.
@@ -26,14 +26,14 @@ Deployable application source:
 - src/api-runtime/{feature-name}/
 - src/runtime/{feature-name}/
 
-Final src layer ownership:
-- src/web/ owns browser-facing deployable application modules used by public pages, account/admin surfaces, and Creator tools.
-- src/api-runtime/ owns deployable API/runtime service modules that back the shared Browser -> API -> Postgres/R2 contract.
-- src/runtime/ owns deployable game, tool, engine, and shared runtime capabilities.
-- Existing top-level src/advanced/, src/api/, src/engine/, src/shared/, and src/tools/ directories are legacy transition buckets until explicit migration PRs move them.
+Final source ownership after the repository layout simplification:
+- `www/src/` owns browser-facing deployable application modules used by public pages, account/admin surfaces, Creator tools, game runtime, shared browser utilities, and browser API clients.
+- `api/` owns deployable API/runtime service modules that back the shared Browser -> API -> Postgres/R2 contract.
+- `dev/` owns developer-only source, scripts, tests, reports, local runtime orchestration, and reference material.
+- Existing root `src/shared/contracts/`, `src/shared/schemas/`, `src/shared/projectDataStore/`, and source-reference files are legacy transition buckets until explicit migration PRs move them.
 - Browser API clients remain outside `api/`; browser-served code must use API/service contracts instead of importing top-level `api/` files directly.
-- `src/dev-runtime/admin/` remains only as a legacy Admin Notes browser-viewer compatibility path until a scoped browser admin migration retires it.
-- Do not add new top-level src/ layer names outside src/web/, src/api-runtime/, or src/runtime/ without OWNER approval.
+- `www/src/dev-runtime/admin/` preserves the public `/src/dev-runtime/admin/...` Admin Notes browser-viewer compatibility route under the `www` web root.
+- Do not add new root `src/` layer names or new root `src/` work without OWNER approval.
 - Do not use team names in runtime source filenames.
 
 Valid dev workspace folders:
@@ -60,6 +60,9 @@ Dev workspace ownership:
 - dev/tools/ owns development-only tooling.
 - dev/workspace/ owns generated output: tmp, zips, logs, generated files, and test-results.
 
+Browser-served runtime/client source:
+- www/src/
+
 Browser-served tools:
 - www/toolbox/{tool-name}/index.html
 
@@ -75,14 +78,18 @@ Shared JavaScript:
 - www/assets/js/shared/
 
 Legacy transition buckets:
-- src/advanced/
-- src/api/
-- src/engine/
-- src/shared/
-- src/tools/
-- src/dev-runtime/admin/
-
-These legacy transition buckets may remain until explicit migration PRs move them into `src/web/`, `src/api-runtime/`, or `src/runtime/`.
+- www/src/advanced/
+- www/src/api/
+- www/src/engine/
+- www/src/shared/
+- www/src/tools/
+- www/src/dev-runtime/admin/
+- src/shared/contracts/
+- src/shared/schemas/
+- src/shared/projectDataStore/
+- src/dev-runtime/admin/.gitkeep
+
+The `www/src/` legacy transition buckets preserve public `/src/...` browser import compatibility during source retirement. Remaining root `src/` buckets may remain only until explicit stacked migration PRs move them to `api/` or `dev/`.
 
 ## Rules
 
@@ -102,7 +109,8 @@ These legacy transition buckets may remain until explicit migration PRs move the
 - Do not create new folders unless they fit the documented canonical structure.
 - If a requested or generated path does not clearly fit the canonical structure, Codex must HARD STOP and report the proposed path.
 - New development follows the canonical structure.
-- New deployable `src/` work follows `src/web/`, `src/api-runtime/`, or `src/runtime/`.
+- New browser-owned source belongs under `www/` according to the browser source and asset rules above.
+- New API/server source belongs under `api/`.
 - New non-deployable work belongs under `dev/`.
 - Required reports belong under flat `dev/reports/`.
 - Required ZIPs belong under `dev/workspace/zips/`; generated temporary artifacts belong under `dev/workspace/tmp/`.

diff --git a/dev/build/ProjectInstructions/repository/www_migration_map.md b/dev/build/ProjectInstructions/repository/www_migration_map.md
@@ -1,9 +1,9 @@
 # www Migration Map
 
-Status: Implemented migration map
+Status: Implemented migration map and browser source migration
 Owner: Owner
 Workstream: Repository Architecture Simplification
-PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application
+PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application; PR_26180_OWNER_018-move-src-browser-to-www
 
 ## Purpose
 
@@ -15,9 +15,11 @@ This map began as a no-runtime-change governance artifact. `PR_26180_OWNER_008-m
 
 The browser-served application now lives under `www/`.
 
+PR_26180_OWNER_018 moved the PR017-audited browser/www-owned legacy `src/` files into `www/src/`.
+
 Current local runtime, test helpers, and browser pages keep URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` while resolving browser-served files from `www/`.
 
-The move preserved public route URLs while changing the filesystem lookup root. Repository-root fallback remains available for transition-only compatibility, including browser imports that still reference root-level `src/`.
+The move preserved public route URLs while changing the filesystem lookup root. Browser imports that use `/src/...` or relative paths resolving to `/src/...` now resolve under `www/src/` when `www/` is the served web root.
 
 ## Current Browser-Served Surface
 
@@ -54,7 +56,7 @@ Broad active-reference search across browser roots, `src/`, `dev/scripts/`, and
 | `legal/` | 13 | Footer/navigation route references and page links. |
 | `learn/` | 9 | Learn route links and navigation. |
 | `play/` | 7 | No root folder exists; review references manually before introducing a route. |
-| `src/` | 451 | Browser imports, server imports, tests, validation aliases, and current runtime/source modules. |
+| `src/` | 451 | Browser imports, server imports, tests, validation aliases, and legacy runtime/source modules before the browser-owned subset moved to `www/src/`. |
 
 The high `src/` count means the browser migration cannot be treated as static files only. Several browser-facing pages import modules from root-level `src/`, including account/admin/toolbox flows.
 
@@ -103,7 +105,7 @@ Examples of current references that depend on root-level path relationships:
 - `toolbox/toolRegistry.js` imports from `../src/shared/toolbox/tool-metadata-inventory.js`.
 - `assets/toolbox/*/js/index.js` imports from `../../../../src/` or `../../../../toolbox/` in several tool flows.
 
-These references can be preserved temporarily by serving compatibility paths from the repository root, but the final architecture should move browser-facing runtime modules into `www/` or an approved deployable browser module surface.
+These references are preserved by serving the browser-owned source modules from `www/src/` while keeping public `/src/...` URL compatibility.
 
 ## Current Local Web Server Root Behavior
 

diff --git a/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_branch-validation.md b/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_branch-validation.md
@@ -0,0 +1,9 @@
+# PR_26180_OWNER_018-move-src-browser-to-www Branch Validation
+
+| Check | Status | Evidence |
+| --- | --- | --- |
+| Current branch | PASS | `PR_26180_OWNER_018-move-src-browser-to-www` |
+| Expected stacked base | PASS | Created from `PR_26180_OWNER_017-src-dissection-and-demo-cleanup` workstream branch. |
+| Worktree scope | PASS | Staged changes are source relocation, reference updates, targeted tests, and governance/report artifacts. |
+| Reports path | PASS | `dev/reports/` |
+| ZIP path | PASS | `dev/workspace/zips/PR_26180_OWNER_018-move-src-browser-to-www_delta.zip` generated for this outcome. |
diff --git a/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_manual-validation-notes.md b/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_manual-validation-notes.md
@@ -0,0 +1,6 @@
+# PR_26180_OWNER_018-move-src-browser-to-www Manual Validation Notes
+
+- No manual browser launch was required beyond targeted Playwright route smoke.
+- Public browser route compatibility was manually smoke-checked through `resolveStaticRouteTarget` for representative browser, toolbox, admin, and `/src/...` routes.
+- Product behavior is expected to remain unchanged because public URLs are preserved and moved files keep their relative browser module relationships under `www/src/`.
+- The guard self-test intentionally retains a legacy `src/shared` import string as a violation fixture; it was allowlisted in the path scan and not treated as an active dependency.
diff --git a/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_report.md b/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_report.md
@@ -0,0 +1,39 @@
+# PR_26180_OWNER_018-move-src-browser-to-www Report
+
+## Executive Summary
+
+Moved PR017-audited browser/www-owned legacy `src/` files into `www/src/` so public browser imports such as `/src/...` continue to resolve under the `www` web root. This PR does not move API/server-owned or dev-owned `src` files and does not change product behavior.
+
+## Scope Confirmation
+
+- Branch: `PR_26180_OWNER_018-move-src-browser-to-www`
+- Base workstream: `PR_26180_OWNER_017-src-dissection-and-demo-cleanup`
+- Current HEAD before commit: `f4be737bbfcccd0f04f5298963ac7573362df7ca`
+- Browser/www-owned files moved: 501
+- Modified reference/test/governance files: 231
+- Runtime behavior changes: None intended; public route/import URLs are preserved.
+- API/server-owned files moved: None.
+- Dev-owned files moved: None.
+
+## Implementation Notes
+
+- Moved browser-owned `src/advanced`, `src/api` browser clients, `src/dev-runtime/admin` browser viewer files, `src/engine`, browser/shared helpers, toolbox browser modules, and browser tool helpers into `www/src/` according to the PR017 destination audit.
+- Updated active API/dev/test imports that load these browser-owned modules to point at `www/src/` filesystem paths.
+- Preserved public browser URLs such as `/src/engine/core/Engine.js`, `/src/api/admin-owner-navigation.js`, and `/src/dev-runtime/admin/notes.html` through the existing static web root compatibility layer.
+- Updated Project Instructions, repository structure docs, migration map, Project State, and Backlog to record the PR018 migration state.
+- Updated targeted tests to reflect the current encoded Admin Notes source path and current toolbox registry release-channel counts.
+
+## Files/Folders Moved
+
+- `src/advanced/**` -> `www/src/advanced/**`
+- `src/api/**` browser API clients -> `www/src/api/**`
+- `src/dev-runtime/admin/**` browser viewer files -> `www/src/dev-runtime/admin/**`
+- `src/engine/**` browser/runtime engine modules -> `www/src/engine/**`
+- Browser-owned `src/shared/**` helper/toolbox modules -> `www/src/shared/**`
+- `src/tools/**` browser tool helpers -> `www/src/tools/**`
+
+## Remaining Source Buckets
+
+- `src/shared/contracts/**`, `src/shared/schemas/**`, and `src/shared/projectDataStore/**` remain for PR019 API/server migration.
+- `src/dev-runtime/admin/.gitkeep` and any remaining dev/reference ownership remain for later scoped PRs.
+- `src/` is not retired in this PR.
diff --git a/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_requirement-checklist.md b/dev/reports/PR_26180_OWNER_018-move-src-browser-to-www_requirement-checklist.md
@@ -0,0 +1,16 @@
+# PR_26180_OWNER_018-move-src-browser-to-www Requirement Checklist
+
+| Requirement | Status | Evidence |
+| --- | --- | --- |
+| Use PR017 src destination audit as source of truth | PASS | Moved only audit-classified browser/www-owned source buckets. |
+| Move browser/www-owned src files into www/src | PASS | 501 staged renames into `www/src/`. |
+| Preserve public browser import URLs such as /src/... | PASS | Static route check resolves public `/src/...` URLs into `www/src/...`. |
+| Update references only where required | PASS | Active API/dev/test filesystem imports updated for moved browser modules. |
+| Do not move API/server-owned files | PASS | API/server-owned root `src/shared/contracts`, schemas, and project data store remain for PR019. |
+| Do not move dev-owned files | PASS | Dev-owned source remains for later PR020 scope. |
+| Do not change product behavior | PASS | Migration preserves public URLs and route behavior. |
+| Stop on ambiguous ownership | PASS | No ambiguous files were moved; remaining source buckets are documented for later PRs. |
+| Stop if browser file depends directly on api runtime internals | PASS | No direct browser-to-`api/` import introduced. |
+| Stop if preserving public URLs requires API/server behavior changes | PASS | Existing static web-root compatibility resolved routes without API behavior changes. |
+| Required reports under dev/reports | PASS | Report bundle generated. |
+| Required ZIP under dev/workspace/zips | PASS | `dev/workspace/zips/PR_26180_OWNER_018-move-src-browser-to-www_delta.zip` generated for this outcome. |
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		export * from "../../src/shared/toolbox/tool-metadata-inventory.js";
		export * from "../../www/src/shared/toolbox/tool-metadata-inventory.js";