@@ -117,7 +117,7 @@ Rules:
 
 ## Current Version/Date
 
-- Project Instructions Version: 2026.06.28.007
+- Project Instructions Version: 2026.06.28.008
 - Date: 2026-06-28
 - Owner: OWNER
 
 
@@ -1,6 +1,6 @@
 # Project Instructions Version
 
-Current Project Instructions Version: 2026.06.28.007
+Current Project Instructions Version: 2026.06.28.008
 
 Last Updated: 2026-06-28
 
@@ -15,6 +15,7 @@ Last Updated: 2026-06-28
 - Added repository layout scaffold governance for `www/`, `api/`, and `dev/local-runtime/`.
 - Added `www/` migration map for safe browser-served application movement planning.
 - Added local route-root compatibility toggle documentation for future `www/` activation.
+- Moved browser-served application files under `www/` and made local static serving prefer `www/` by default.
 - Codex must read this version file and the latest repository copy of `PROJECT_INSTRUCTIONS.md` before performing work.
 - Codex must discard previously remembered Project Instructions and treat the repository copy as authoritative.
 - Codex must validate canonical report and ZIP paths, branching model, and legacy path avoidance before work proceeds.
@@ -1,7 +1,7 @@
 # Project State
 
 ```yaml
-project_state_version: "2026.06.28.007"
+project_state_version: "2026.06.28.008"
 last_updated: "2026-06-28"
 current_main_commit: "40de767476d70cadfd1292c916844c2f31b6f185"
 repository_status:
@@ -10,36 +10,23 @@ repository_status:
   runtime_database: "Postgres"
   creator_metadata: "API to Postgres"
   creator_assets: "API to R2"
-project_instructions_version: "2026.06.28.007"
-repository_structure_version: "2026.06.28.007"
-canonical_layout_version: "2026.06.28.007"
+project_instructions_version: "2026.06.28.008"
+repository_structure_version: "2026.06.28.008"
+canonical_layout_version: "2026.06.28.008"
 active_teams:
   - "Owner"
   - "Alfa"
   - "Bravo"
   - "Charlie"
   - "Delta"
   - "Golf"
-latest_owner_pr: "PR_26180_OWNER_007-www-route-root-compatibility"
-latest_structure_pr: "PR_26180_OWNER_007-www-route-root-compatibility"
+latest_owner_pr: "PR_26180_OWNER_008-move-www-application"
+latest_structure_pr: "PR_26180_OWNER_008-move-www-application"
 valid_top_level_folders:
-  - "account/"
-  - "admin/"
   - "api/"
-  - "assets/"
-  - "community/"
-  - "company/"
   - "deploy/"
   - "dev/"
-  - "docs/"
-  - "games/"
-  - "learn/"
-  - "legal/"
-  - "marketplace/"
-  - "memberships/"
-  - "owner/"
   - "src/"
-  - "toolbox/"
   - "www/"
 valid_dev_folders:
   - "dev/archive/"
 
@@ -39,9 +39,9 @@ The backlog is the authoritative source for determining the next logical PRs.
 - Team: Owner
 - Product Area: Repository Architecture Simplification
 - Status: Active
-- Percent Complete: 20%
-- Active PR: PR_26180_OWNER_007-www-route-root-compatibility
-- Next Milestone: Move browser-served application to `www/`
+- Percent Complete: 30%
+- Active PR: PR_26180_OWNER_008-move-www-application
+- Next Milestone: Move server/API application files into `api/`
 - Source / Reference: `dev/build/ProjectInstructions/repository/repository_layout_architecture_plan.md`; `dev/build/ProjectInstructions/repository/www_migration_map.md`
 
 ## Game Journey MVP
 
@@ -7,36 +7,19 @@ Establish the canonical repository structure for future development and reduce t
 ## Canonical Structure
 
 Valid top-level folders:
-- account/
-- admin/
 - api/
-- assets/
-- community/
-- company/
 - deploy/
 - dev/
-- docs/
-- games/
-- learn/
-- legal/
-- marketplace/
-- memberships/
-- owner/
 - src/
-- toolbox/
 - www/
 
 Root product and repo sections:
-- account/, admin/, community/, company/, learn/, legal/, marketplace/, memberships/, and owner/ are production website sections.
-- assets/ contains production website and tool assets.
+- www/ owns browser-served production website sections, Creator toolbox pages, public game discovery, production Docs & Help, and browser assets.
 - api/ is the target Node/API/server application surface for the repository layout simplification workstream.
-- docs/ is production Docs & Help content.
-- games/ is public game discovery.
-- toolbox/ is the Creator toolbox/workspace.
 - deploy/ contains deployment configuration.
 - dev/ contains the development workspace.
 - src/ contains deployable application/runtime/API source.
-- www/ is the target browser-served application surface for the repository layout simplification workstream.
+- repository root contains standard repository configuration and top-level application shells only.
 
 Deployable application source:
 - src/web/{feature-name}/
@@ -75,19 +58,19 @@ Dev workspace ownership:
 - dev/tools/ owns development-only tooling.
 - dev/workspace/ owns generated output: tmp, zips, logs, generated files, and test-results.
 
-Tools:
-- toolbox/{tool-name}/index.html
+Browser-served tools:
+- www/toolbox/{tool-name}/index.html
 
-Tool assets:
-- assets/toolbox/{tool-name}/js/index.js
-- assets/toolbox/{tool-name}/css/index.css
+Browser-served tool assets:
+- www/assets/toolbox/{tool-name}/js/index.js
+- www/assets/toolbox/{tool-name}/css/index.css
 
 Themes:
-- assets/theme-v1/
-- assets/theme-v2/
+- www/assets/theme-v1/
+- www/assets/theme-v2/
 
 Shared JavaScript:
-- assets/js/shared/
+- www/assets/js/shared/
 
 Legacy transition buckets:
 - src/advanced/
@@ -101,16 +84,16 @@ These legacy transition buckets may remain until explicit migration PRs move the
 
 ## Rules
 
-- Root is production website and standard repository configuration only.
-- www/ is the browser-served application target surface for migration.
+- Root is standard repository configuration and top-level application shells only.
+- www/ is the browser-served application surface.
 - api/ is the Node/API/server application target surface for migration.
 - src/ is deployable application/runtime/API code.
 - dev/ is development workspace only.
 - deploy/ is deployment configuration.
-- docs/ is production Docs & Help content.
+- docs/ routes are served from `www/docs/`.
 - Theme first.
 - Tool CSS second.
-- Shared functionality belongs in assets/js/shared/.
+- Browser-served shared functionality belongs in `www/assets/js/shared/`.
 - No new scattered JS folders.
 - No new scattered CSS folders.
 - Do not create new folders unless they fit the documented canonical structure.
 
@@ -116,37 +116,42 @@ Rules:
    - Document current browser-served root paths, imports, local server behavior, test assumptions, compatibility needs, and validation lanes.
    - Do not move browser files or change package commands.
 
-3. `PR_26180_OWNER_007-move-www-application`
+3. `PR_26180_OWNER_007-www-route-root-compatibility`
+   - Prepare runtime/test route-root compatibility for the future `www/` move.
+   - Preserve public URLs.
+   - Keep repository-root serving as the default until the actual move.
+
+4. `PR_26180_OWNER_008-move-www-application`
    - Move browser-served application files into `www/`.
    - Include root HTML pages, `assets/`, `toolbox/`, `account/`, `legal/`, `learn/`, `play/`, and other browser-served static routes.
    - Update internal static references only as needed.
    - Do not move API/server files.
 
-4. `PR_26180_OWNER_008-move-api-application`
+5. `PR_26180_OWNER_009-move-api-application`
    - Move server/API application files into `api/`.
    - Include Local API server runtime files, API routes, services, database, storage, auth, publishing, and admin server code.
    - Do not move developer-only startup orchestration.
    - Browser code must not import from `api/`.
 
-5. `PR_26180_OWNER_009-move-dev-local-runtime`
+6. `PR_26180_OWNER_010-move-dev-local-runtime`
    - Move developer-only local runtime into `dev/local-runtime/`.
    - Include team-aware bootstrap, port config, local startup orchestration, local diagnostics, and browser launch support.
    - Update `package.json` commands to point to the new local-runtime paths.
 
-6. `PR_26180_OWNER_010-move-tests-and-validation`
+7. `PR_26180_OWNER_011-move-tests-and-validation`
    - Ensure all tests and validation suites live under `dev/tests/` or the current canonical dev test structure.
    - Update test paths after the `www/`, `api/`, and `dev/` migrations.
    - Do not change behavior.
 
-7. `PR_26180_OWNER_011-update-ci-and-scripts`
+8. `PR_26180_OWNER_012-update-ci-and-scripts`
    - Update CI, package scripts, validation scripts, and developer utilities for the new layout.
    - Preserve `npm run dev:bootstrap`, `npm run dev:api`, `npm run dev:web`, and `npm run dev:local-api`.
 
-8. `PR_26180_OWNER_012-remove-legacy-layout`
+9. `PR_26180_OWNER_013-remove-legacy-layout`
    - Remove or retire obsolete legacy paths after all references are updated.
    - Hard stop if any runtime, test, or CI reference still points to old locations.
 
-9. `PR_26180_OWNER_013-final-layout-validation`
+10. `PR_26180_OWNER_014-final-layout-validation`
    - Validate final repository layout.
    - Confirm `www/` owns the browser-served app, `api/` owns the server app, and `dev/` owns the developer workspace.
    - Confirm runtime does not depend on `dev/`, browser code does not import `api/`, and legacy references are removed or documented.
 
@@ -1,27 +1,27 @@
 # www Migration Map
 
-Status: Active planning map
+Status: Implemented migration map
 Owner: Owner
 Workstream: Repository Architecture Simplification
-PR: PR_26180_OWNER_006-www-migration-map
+PR: PR_26180_OWNER_006-www-migration-map; PR_26180_OWNER_008-move-www-application
 
 ## Purpose
 
 Document the current browser-served repository surface and the safe sequence required before moving files into `www/`.
 
-This map is a no-runtime-change governance artifact. It does not move browser files, change package commands, change local server behavior, or update runtime imports.
+This map began as a no-runtime-change governance artifact. `PR_26180_OWNER_008-move-www-application` used it to move browser-served files under `www/` while preserving public URLs.
 
 ## Executive Summary
 
-The browser-served application currently depends on repository-root static serving.
+The browser-served application now lives under `www/`.
 
-Current local runtime, test helpers, and browser pages assume URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` resolve from the repository root.
+Current local runtime, test helpers, and browser pages keep URLs such as `/index.html`, `/toolbox/index.html`, `/assets/theme-v2/css/theme.css`, `/account/sign-in.html`, `/admin/system-health.html`, and `/games/index.html` while resolving browser-served files from `www/`.
 
-Moving browser files into `www/` is feasible, but the move must preserve public route URLs while changing the filesystem lookup root. A direct folder move without route compatibility would break Playwright tests, local API static serving, team-aware bootstrap static serving, Node test root aliases, and browser imports that still reference root-level `src/`, `toolbox/`, and `assets/`.
+The move preserved public route URLs while changing the filesystem lookup root. Repository-root fallback remains available for transition-only compatibility, including browser imports that still reference root-level `src/`.
 
 ## Current Browser-Served Surface
 
-Current root-level browser-served entry points and folders include:
+Current browser-served entry points and folders now live under `www/`:
 
 | Path | Current role | Files | HTML files | Move target |
 | --- | --- | ---: | ---: | --- |
@@ -75,7 +75,7 @@ These URLs should continue working for users and tests during the move:
 - `/marketplace/index.html`
 - `/memberships/index.html`
 
-### Rewrite filesystem lookup paths
+### Rewritten filesystem lookup paths
 
 Static servers and test helpers should map public URLs to `www/` filesystem paths after the move:
 
@@ -172,17 +172,21 @@ Recommended approach for the actual move PR:
 
 ## Route Root Compatibility Toggle
 
-`PR_26180_OWNER_007-www-route-root-compatibility` installs the local compatibility switch without moving browser files.
+`PR_26180_OWNER_007-www-route-root-compatibility` installed the local compatibility switch without moving browser files.
 
-The future activation toggle is:
+`PR_26180_OWNER_008-move-www-application` moves browser-served files into `www/` and makes local static serving prefer `www/` by default.
+
+The local static serving root is now `www/` by default. The explicit activation toggle remains:
 
 ```text
 GAMEFOUNDRY_LOCAL_WEB_ROOT=www
 ```
 
-Default behavior remains current repository-root static serving when `GAMEFOUNDRY_LOCAL_WEB_ROOT` is unset, empty, `.`, `root`, or `repo-root`.
+Default behavior is now `www/` static serving when `GAMEFOUNDRY_LOCAL_WEB_ROOT` is unset or empty.
+
+When `GAMEFOUNDRY_LOCAL_WEB_ROOT=www`, local static serving explicitly prefers `www/` for public browser URLs while retaining repository-root fallback for compatibility during migration.
 
-When `GAMEFOUNDRY_LOCAL_WEB_ROOT=www`, local static serving prefers `www/` for public browser URLs while retaining repository-root fallback for compatibility during migration.
+When local validation needs the prior root behavior, `GAMEFOUNDRY_LOCAL_WEB_ROOT=repo-root` resolves static files from the repository root.
 
 This toggle is for local runtime and test helpers only. It does not change production deployment, public URLs, API routes, or package commands.
 
 
@@ -0,0 +1,26 @@
+# PR_26180_OWNER_008 Branch Validation
+
+## Result
+
+PASS
+
+## Checks
+
+| Check | Result |
+|---|---|
+| Startup validation completed | PASS |
+| Project Instructions version loaded | PASS: `2026.06.28.007` at task start; PR updates docs to `2026.06.28.008` |
+| `PROJECT_BRANCHING_POLICY.md` loaded | PASS |
+| Current branch | PASS: `PR_26180_OWNER_008-move-www-application` |
+| Stacked base branch | PASS: created from `PR_26180_OWNER_007-www-route-root-compatibility` |
+| Worktree before branch creation | PASS: clean |
+| Reports path | PASS: `dev/reports/` |
+| ZIP path | PASS: `dev/workspace/zips/` |
+
+## Dependency Order
+
+1. `PR_26180_OWNER_006-www-migration-map`
+2. `PR_26180_OWNER_007-www-route-root-compatibility`
+3. `PR_26180_OWNER_008-move-www-application`
+
+PR008 must be reviewed and merged after PR007.
@@ -0,0 +1,24 @@
+# PR_26180_OWNER_008 Manual Validation Notes
+
+## Manual Notes
+
+`npm run dev:bootstrap -- --team owner` is a long-running local startup command that launches the Owner web/API runtime and may open a browser. It was documented as manual validation rather than left running during this Codex execution.
+
+Expected manual verification:
+
+1. Run `npm run dev:bootstrap -- --team owner`.
+2. Confirm diagnostics show Owner/default ports:
+   - Web URL: `http://127.0.0.1:5500`
+   - API URL: `http://127.0.0.1:5501/api`
+   - Browser launch: `http://127.0.0.1:5500/index.html`
+3. Open:
+   - `http://127.0.0.1:5500/index.html`
+   - `http://127.0.0.1:5500/toolbox/index.html`
+   - `http://127.0.0.1:5500/account/sign-in.html`
+   - `http://127.0.0.1:5500/admin/system-health.html`
+   - `http://127.0.0.1:5500/games/index.html`
+4. Confirm public URLs remain unchanged while files are served from `www/`.
+
+## Local Artifact Note
+
+An ignored local file, `assets/DemoGame-26168-001.gfsp`, keeps a physical `assets/` folder visible in this checkout. It is not tracked and was not moved or committed.