Move browser-owned src files into www

Author: ToolboxAid

api/API_RUNTIME_BOUNDARY.md

@@ -11,6 +11,6 @@ It is intentionally not `dev/tests/dev-runtime`:
 Deployment boundary:
 
 - DEV validation may execute `api/` through local server commands.
-- Browser pages, Theme V2 scripts, toolbox pages, and `src/engine` runtime code must use declared API/service contracts instead of importing `api/` directly.
+- Browser pages, Theme V2 scripts, toolbox pages, and `www/src/engine` runtime code must use declared API/service contracts instead of importing `api/` directly.
 - If a dev-only adapter is needed by a browser page, expose it through the Local API contract while keeping the implementation under `api/`.
 - Developer-only local bootstrap/orchestration remains outside `api/` until the scoped `dev/local-runtime/` migration PR.

api/admin/admin-notes-menu.mjs

@@ -6,7 +6,7 @@ export const ADMIN_NOTES_LOCAL_MENU_LABEL = "Notes";
 export const ADMIN_MY_STUFF_MENU_LABEL = "My Stuff";
 
 const HEADER_PARTIAL_PATH = "www/assets/theme-v2/partials/header-nav.html";
-const LOCAL_HEADER_PARTIAL_PATH = "src/dev-runtime/admin/header-nav.local.html";
+const LOCAL_HEADER_PARTIAL_PATH = "www/src/dev-runtime/admin/header-nav.local.html";
 
 function repoRelativePath(repoRoot, targetPath) {
   return path.relative(repoRoot, targetPath).replaceAll(path.sep, "/");

api/guest-seeds/tool-metadata-inventory.js

@@ -1 +1 @@
-export * from "../../src/shared/toolbox/tool-metadata-inventory.js";
+export * from "../../www/src/shared/toolbox/tool-metadata-inventory.js";

api/server/local-api-router.mjs

@@ -133,7 +133,7 @@ import {
 import {
   getAdminNavigationItems,
   getOwnerNavigationItems,
-} from "../../src/api/admin-owner-navigation.js";
+} from "../../www/src/api/admin-owner-navigation.js";
 import { createPaletteSourceMockDbRows } from "../guest-seeds/palette-source-mock-db.js";
 import {
   SUPABASE_AUTH_PROVIDER_ID,
@@ -6929,8 +6929,8 @@ SELECT pg_database_size(current_database()) AS database_size_bytes,
       adminMainItems: getAdminNavigationItems(),
       ownerMenuItems: getOwnerNavigationItems(),
       ownership: {
-        adminMainItems: "src/api/admin-owner-navigation.js",
-        ownerMenuItems: "src/api/admin-owner-navigation.js",
+        adminMainItems: "www/src/api/admin-owner-navigation.js",
+        ownerMenuItems: "www/src/api/admin-owner-navigation.js",
         routeMap: "static shell route resolution",
       },
       source: "server-api",

dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS.md

@@ -117,7 +117,7 @@ Rules:
 
 ## Current Version/Date
 
-- Project Instructions Version: 2026.06.28.017
+- Project Instructions Version: 2026.06.28.018
 - Date: 2026-06-28
 - Owner: OWNER
 

dev/build/ProjectInstructions/PROJECT_INSTRUCTIONS_VERSION.md

@@ -1,6 +1,6 @@
 # Project Instructions Version
 
-Current Project Instructions Version: 2026.06.28.017
+Current Project Instructions Version: 2026.06.28.018
 
 Last Updated: 2026-06-28
 
@@ -25,6 +25,7 @@ Last Updated: 2026-06-28
 - Added root leftover audit and `src/` transition plan for the final repository layout cleanup stage.
 - Removed safe empty local root directory shells and documented blocked local-only `assets/` cleanup.
 - Removed the local demo `.gfsp` artifact and recorded a file-by-file `src/` destination audit for future scoped migrations.
+- Moved PR017-audited browser/www-owned legacy `src/` files into `www/src/` while preserving public `/src/...` browser route compatibility under the `www` web root.
 - Codex must read this version file and the latest repository copy of `PROJECT_INSTRUCTIONS.md` before performing work.
 - Codex must discard previously remembered Project Instructions and treat the repository copy as authoritative.
 - Codex must validate canonical report and ZIP paths, branching model, and legacy path avoidance before work proceeds.

dev/build/ProjectInstructions/PROJECT_STATE.md

@@ -1,7 +1,7 @@
 # Project State
 
 ```yaml
-project_state_version: "2026.06.28.017"
+project_state_version: "2026.06.28.018"
 last_updated: "2026-06-28"
 current_main_commit: "40de767476d70cadfd1292c916844c2f31b6f185"
 repository_status:
@@ -10,18 +10,18 @@ repository_status:
   runtime_database: "Postgres"
   creator_metadata: "API to Postgres"
   creator_assets: "API to R2"
-project_instructions_version: "2026.06.28.017"
-repository_structure_version: "2026.06.28.017"
-canonical_layout_version: "2026.06.28.017"
+project_instructions_version: "2026.06.28.018"
+repository_structure_version: "2026.06.28.018"
+canonical_layout_version: "2026.06.28.018"
 active_teams:
   - "Owner"
   - "Alfa"
   - "Bravo"
   - "Charlie"
   - "Delta"
   - "Golf"
-latest_owner_pr: "PR_26180_OWNER_017-src-dissection-and-demo-cleanup"
-latest_structure_pr: "PR_26180_OWNER_017-src-dissection-and-demo-cleanup"
+latest_owner_pr: "PR_26180_OWNER_018-move-src-browser-to-www"
+latest_structure_pr: "PR_26180_OWNER_018-move-src-browser-to-www"
 valid_top_level_folders:
   - "api/"
   - "deploy/"
@@ -40,7 +40,8 @@ valid_dev_folders:
   - "dev/tools/"
   - "dev/workspace/"
 known_technical_debt:
-  - "Browser API client modules remain under src/api/ until the final src layer migration moves them into src/web/ or src/runtime/."
-  - "src/dev-runtime/admin/ remains as a legacy Admin Notes browser-viewer compatibility path until a scoped browser admin migration retires it."
+  - "API/server-owned contracts, schemas, and project data store modules remain under src/shared/ until PR_26180_OWNER_019 moves them to api/."
+  - "Developer/source reference files remain under src/ until PR_26180_OWNER_020 moves them to dev/."
+  - "src/dev-runtime/admin/.gitkeep remains as a placeholder until PR_26180_OWNER_021 retires the empty root src folder."
   - "repository_directory_standard.md and codex_project_instructions_startup.md are superseded pointers retained for compatibility."
 ```

dev/build/ProjectInstructions/backlog/BACKLOG_MASTER.md

@@ -40,8 +40,8 @@ The backlog is the authoritative source for determining the next logical PRs.
 - Product Area: Repository Architecture Simplification
 - Status: Active
 - Percent Complete: 99%
-- Active PR: PR_26180_OWNER_017-src-dissection-and-demo-cleanup
-- Next Milestone: Final layout validation and completion report
+- Active PR: PR_26180_OWNER_018-move-src-browser-to-www
+- Next Milestone: Move API/server-owned source to api/
 - Source / Reference: `dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md`; `dev/build/ProjectInstructions/repository/www_migration_map.md`
 
 ## Game Journey MVP

dev/build/ProjectInstructions/repository/canonical_repository_structure.md

@@ -14,7 +14,7 @@ Valid top-level folders:
 - www/
 
 Root product and repo sections:
-- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, and browser assets.
+- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, browser assets, and browser-owned runtime/client modules under `www/src/`.
 - api/ is the Node/API/server application surface for server entry points, API routing, API services, database access, storage access, auth, setup, publishing, and admin server logic.
 - deploy/ contains deployment configuration.
 - dev/ contains the development workspace.
@@ -26,14 +26,14 @@ Deployable application source:
 - src/api-runtime/{feature-name}/
 - src/runtime/{feature-name}/
 
-Final src layer ownership:
-- src/web/ owns browser-facing deployable application modules used by public pages, account/admin surfaces, and Creator tools.
-- src/api-runtime/ owns deployable API/runtime service modules that back the shared Browser -> API -> Postgres/R2 contract.
-- src/runtime/ owns deployable game, tool, engine, and shared runtime capabilities.
-- Existing top-level src/advanced/, src/api/, src/engine/, src/shared/, and src/tools/ directories are legacy transition buckets until explicit migration PRs move them.
+Final source ownership after the repository layout simplification:
+- `www/src/` owns browser-facing deployable application modules used by public pages, account/admin surfaces, Creator tools, game runtime, shared browser utilities, and browser API clients.
+- `api/` owns deployable API/runtime service modules that back the shared Browser -> API -> Postgres/R2 contract.
+- `dev/` owns developer-only source, scripts, tests, reports, local runtime orchestration, and reference material.
+- Existing root `src/shared/contracts/`, `src/shared/schemas/`, `src/shared/projectDataStore/`, and source-reference files are legacy transition buckets until explicit migration PRs move them.
 - Browser API clients remain outside `api/`; browser-served code must use API/service contracts instead of importing top-level `api/` files directly.
-- `src/dev-runtime/admin/` remains only as a legacy Admin Notes browser-viewer compatibility path until a scoped browser admin migration retires it.
-- Do not add new top-level src/ layer names outside src/web/, src/api-runtime/, or src/runtime/ without OWNER approval.
+- `www/src/dev-runtime/admin/` preserves the public `/src/dev-runtime/admin/...` Admin Notes browser-viewer compatibility route under the `www` web root.
+- Do not add new root `src/` layer names or new root `src/` work without OWNER approval.
 - Do not use team names in runtime source filenames.
 
 Valid dev workspace folders:
@@ -60,6 +60,9 @@ Dev workspace ownership:
 - dev/tools/ owns development-only tooling.
 - dev/workspace/ owns generated output: tmp, zips, logs, generated files, and test-results.
 
+Browser-served runtime/client source:
+- www/src/
+
 Browser-served tools:
 - www/toolbox/{tool-name}/index.html
 
@@ -75,14 +78,18 @@ Shared JavaScript:
 - www/assets/js/shared/
 
 Legacy transition buckets:
-- src/advanced/
-- src/api/
-- src/engine/
-- src/shared/
-- src/tools/
-- src/dev-runtime/admin/
-
-These legacy transition buckets may remain until explicit migration PRs move them into `src/web/`, `src/api-runtime/`, or `src/runtime/`.
+- www/src/advanced/
+- www/src/api/
+- www/src/engine/
+- www/src/shared/
+- www/src/tools/
+- www/src/dev-runtime/admin/
+- src/shared/contracts/
+- src/shared/schemas/
+- src/shared/projectDataStore/
+- src/dev-runtime/admin/.gitkeep
+
+The `www/src/` legacy transition buckets preserve public `/src/...` browser import compatibility during source retirement. Remaining root `src/` buckets may remain only until explicit stacked migration PRs move them to `api/` or `dev/`.
 
 ## Rules
 
@@ -102,7 +109,8 @@ These legacy transition buckets may remain until explicit migration PRs move the
 - Do not create new folders unless they fit the documented canonical structure.
 - If a requested or generated path does not clearly fit the canonical structure, Codex must HARD STOP and report the proposed path.
 - New development follows the canonical structure.
-- New deployable `src/` work follows `src/web/`, `src/api-runtime/`, or `src/runtime/`.
+- New browser-owned source belongs under `www/` according to the browser source and asset rules above.
+- New API/server source belongs under `api/`.
 - New non-deployable work belongs under `dev/`.
 - Required reports belong under flat `dev/reports/`.
 - Required ZIPs belong under `dev/workspace/zips/`; generated temporary artifacts belong under `dev/workspace/tmp/`.

dev/build/ProjectInstructions/repository/www_migration_map.md

@@ -1,9 +1,9 @@
 # www Migration Map
 
-Status: Implemented migration map
+Status: Implemented migration map and browser source migration
 Owner: Owner
 Workstream: Repository Architecture Simplification
-PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application
+PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application; PR_26180_OWNER_018-move-src-browser-to-www
 
 ## Purpose
 
@@ -15,9 +15,11 @@ This map began as a no-runtime-change governance artifact. `PR_26180_OWNER_008-m
 
 The browser-served application now lives under `www/`.
 
+PR_26180_OWNER_018 moved the PR017-audited browser/www-owned legacy `src/` files into `www/src/`.
+
 Current local runtime, test helpers, and browser pages keep URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` while resolving browser-served files from `www/`.
 
-The move preserved public route URLs while changing the filesystem lookup root. Repository-root fallback remains available for transition-only compatibility, including browser imports that still reference root-level `src/`.
+The move preserved public route URLs while changing the filesystem lookup root. Browser imports that use `/src/...` or relative paths resolving to `/src/...` now resolve under `www/src/` when `www/` is the served web root.
 
 ## Current Browser-Served Surface
 
@@ -54,7 +56,7 @@ Broad active-reference search across browser roots, `src/`, `dev/scripts/`, and
 | `legal/` | 13 | Footer/navigation route references and page links. |
 | `learn/` | 9 | Learn route links and navigation. |
 | `play/` | 7 | No root folder exists; review references manually before introducing a route. |
-| `src/` | 451 | Browser imports, server imports, tests, validation aliases, and current runtime/source modules. |
+| `src/` | 451 | Browser imports, server imports, tests, validation aliases, and legacy runtime/source modules before the browser-owned subset moved to `www/src/`. |
 
 The high `src/` count means the browser migration cannot be treated as static files only. Several browser-facing pages import modules from root-level `src/`, including account/admin/toolbox flows.
 
@@ -103,7 +105,7 @@ Examples of current references that depend on root-level path relationships:
 - `toolbox/toolRegistry.js` imports from `../src/shared/toolbox/tool-metadata-inventory.js`.
 - `assets/toolbox/*/js/index.js` imports from `../../../../src/` or `../../../../toolbox/` in several tool flows.
 
-These references can be preserved temporarily by serving compatibility paths from the repository root, but the final architecture should move browser-facing runtime modules into `www/` or an approved deployable browser module surface.
+These references are preserved by serving the browser-owned source modules from `www/src/` while keeping public `/src/...` URL compatibility.
 
 ## Current Local Web Server Root Behavior