@@ -4,10 +4,10 @@
 <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>Login - GameFoundryStudio</title>
+    <title>Sign In - GameFoundryStudio</title>
     <meta name="description" content="Choose a local development session for GameFoundryStudio.">
     <link rel="icon" href="/favicon.svg">
-    <link rel="stylesheet" href="assets/theme-v2/css/theme.css">
+    <link rel="stylesheet" href="../assets/theme-v2/css/theme.css">
 </head>
 
 <body>
@@ -16,7 +16,7 @@
         <section class="page-title">
             <div class="container">
                 <div class="kicker">Session</div>
-                <h1>Login</h1>
+                <h1>Sign In</h1>
                 <p class="lede">Use the Local DB-backed development session for project data.</p>
             </div>
         </section>
@@ -25,7 +25,7 @@ <h1>Login</h1>
                 <div class="account-panel">
                     <aside class="side-menu" aria-label="Session mode">
                         <button class="btn btn--compact" type="button" data-login-mode="local-db">Local DB</button>
-                        <p class="status" role="status" data-login-mode-disabled-message hidden>Use the API-backed local server for login. Run npm run dev:local-api and open http://127.0.0.1:5501/login.html. Local DB is disabled until the local API server is running.</p>
+                        <p class="status" role="status" data-login-mode-disabled-message hidden>Use the API-backed local server for sign-in. Run npm run dev:local-api and open http://127.0.0.1:5501/account/sign-in.html. Local DB is disabled until the local API server is running.</p>
                         <hr>
                         <section class="content-stack" aria-labelledby="login-reseed-title">
                             <div>
@@ -76,7 +76,7 @@ <h2 id="login-local-status-title">Local Development Status</h2>
                             <p><strong>Local API availability:</strong> <span data-login-status-api>Checking...</span></p>
                             <p><strong>Disabled reason:</strong> <span data-login-status-disabled-reason>Checking...</span></p>
                             <p><strong>Expected API endpoint:</strong> <span data-login-status-endpoint>/api/session/current</span></p>
-                            <p><strong>Correct local URL:</strong> <span data-login-status-api-url>http://127.0.0.1:5501/login.html</span></p>
+                            <p><strong>Correct local URL:</strong> <span data-login-status-api-url>http://127.0.0.1:5501/account/sign-in.html</span></p>
                             <p><strong>Startup command:</strong> <span data-login-status-command>npm run dev:local-api</span></p>
                         </div>
                     </div>
@@ -85,8 +85,8 @@ <h2 id="login-local-status-title">Local Development Status</h2>
         </section>
     </main>
     <div data-partial="footer"></div>
-    <script src="assets/theme-v2/js/gamefoundry-partials.js" defer></script>
-    <script type="module" src="assets/theme-v2/js/login-session.js"></script>
+    <script src="../assets/theme-v2/js/gamefoundry-partials.js" defer></script>
+    <script type="module" src="../assets/theme-v2/js/login-session.js"></script>
 </body>
 
 </html>
@@ -86,7 +86,7 @@
         publish: "community/publish.html",
         support: "docs/support.html",
         reference: "docs/reference.html",
-        login: "login.html",
+        "sign-in": "account/sign-in.html",
         contact: "company/contact.html",
         vision: "company/vision.html",
         mission: "company/mission.html",
@@ -139,7 +139,7 @@
 
     const currentScript = document.currentScript || document.querySelector("script[src*='gamefoundry-partials.js']");
     const assetRoot = currentScript ? new URL("../", currentScript.src) : null;
-    const apiBackedLoginDiagnostic = "Use the API-backed local server for login. Run npm run dev:local-api and open http://127.0.0.1:5501/login.html.";
+    const apiBackedLoginDiagnostic = "Use the API-backed local server for sign-in. Run npm run dev:local-api and open http://127.0.0.1:5501/account/sign-in.html.";
     let navigationAdminMenuCache = null;
 
     function assetUrl(path) {
@@ -348,7 +348,7 @@
         return {
             authenticated: false,
             diagnostic: diagnostic || "Server session API is unavailable. Start the local server API before using protected pages.",
-            displayName: "Login",
+            displayName: "Sign In",
             mode: "missing-api",
             roleSlugs: []
         };
@@ -384,7 +384,7 @@
             return {
                 authenticated: Boolean(session.authenticated),
                 diagnostic: session.diagnostic || "",
-                displayName: session.authenticated ? session.displayName || session.label || "Account" : "Login",
+                displayName: session.authenticated ? session.displayName || session.label || "Account" : "Sign In",
                 mode: session.mode || "local-db",
                 roleSlugs: Array.isArray(session.roleSlugs) ? session.roleSlugs : []
             };
@@ -413,9 +413,9 @@
         const canUseAdmin = loginState.authenticated && loginState.roleSlugs.includes("admin");
 
         if (accountLink) {
-            accountLink.textContent = canUseAccount ? loginState.displayName + " \u25BE" : "Login";
-            accountLink.setAttribute("aria-label", canUseAccount ? "Account menu for " + loginState.displayName : "Login");
-            accountLink.setAttribute("href", canUseAccount ? routeHref("account") : routeHref("login"));
+            accountLink.textContent = canUseAccount ? loginState.displayName + " \u25BE" : "Sign In";
+            accountLink.setAttribute("aria-label", canUseAccount ? "Account menu for " + loginState.displayName : "Sign In");
+            accountLink.setAttribute("href", canUseAccount ? routeHref("account") : routeHref("sign-in"));
         }
         if (accountMenu) {
             accountMenu.hidden = !canUseAccount;
@@ -432,14 +432,17 @@
             return {
                 role: "admin",
                 title: "Admin role required",
-                message: "Log in as Admin to open this Admin page."
+                message: "Sign in as Admin to open this Admin page."
             };
         }
+        if (pagePath === "account/sign-in.html") {
+            return null;
+        }
         if (pagePath.indexOf("account/") === 0) {
             return {
                 role: "user",
-                title: "Login required",
-                message: "Log in as a local user to open Account pages."
+                title: "Sign-in required",
+                message: "Sign in as a local user to open Account pages."
             };
         }
         return null;
@@ -491,12 +494,12 @@
         status.dataset.sessionAccessStatus = "";
         status.textContent = [
             `Blocked ${pagePath}. Current session: ${loginState.displayName}.`,
-            loginState.diagnostic ? `Login/session diagnostic: ${loginState.diagnostic}` : ""
+            loginState.diagnostic ? `Sign-in/session diagnostic: ${loginState.diagnostic}` : ""
         ].filter(Boolean).join(" ");
         const link = document.createElement("a");
         link.className = "btn primary";
-        link.href = routeHref("login") + "?returnTo=" + encodeURIComponent(pagePath);
-        link.textContent = "Open Login";
+        link.href = routeHref("sign-in") + "?returnTo=" + encodeURIComponent(pagePath);
+        link.textContent = "Open Sign In";
         body.append(status, link);
         card.append(body);
         bodyContainer.append(card);
 
@@ -24,10 +24,10 @@ const reseedFields = {
   target: document.querySelector("[data-login-reseed-target]"),
 };
 const localApiStartCommand = "npm run dev:local-api";
-const localApiLoginUrl = "http://127.0.0.1:5501/login.html";
+const localApiLoginUrl = "http://127.0.0.1:5501/account/sign-in.html";
 const expectedSessionEndpoint = "/api/session/current";
-const apiBackedLoginDiagnostic = `Use the API-backed local server for login. Run ${localApiStartCommand} and open ${localApiLoginUrl}.`;
-const staticModeDisabledMessage = `Use the API-backed local server for login. Run ${localApiStartCommand} and open ${localApiLoginUrl}. Local DB is disabled until the local API server is running.`;
+const apiBackedLoginDiagnostic = `Use the API-backed local server for sign-in. Run ${localApiStartCommand} and open ${localApiLoginUrl}.`;
+const staticModeDisabledMessage = `Use the API-backed local server for sign-in. Run ${localApiStartCommand} and open ${localApiLoginUrl}. Local DB is disabled until the local API server is running.`;
 let reseedConfirmationPending = false;
 let reseedStatusMessage = "";
 const localStatusFields = {
@@ -44,9 +44,22 @@ function currentReturnTo() {
   const params = new URLSearchParams(window.location.search);
   const value = params.get("returnTo") || "";
   if (!value || value.startsWith("/") || value.includes("://") || value.includes("..")) {
-    return "toolbox/index.html";
+    return repoPathHref("toolbox/index.html");
   }
-  return value;
+  return repoPathHref(value);
+}
+
+function repoPathHref(path) {
+  const normalizedPath = String(path || "").replace(/^\/+/, "");
+  return normalizedPath ? rootPrefix() + normalizedPath : "#";
+}
+
+function rootPrefix() {
+  const rootSegments = new Set(["account", "admin", "company", "community", "docs", "games", "learn", "legal", "marketplace", "toolbox"]);
+  const parts = window.location.pathname.split("/").filter(Boolean);
+  const rootIndex = parts.findIndex((part) => rootSegments.has(part));
+  const pageParts = rootIndex >= 0 ? parts.slice(rootIndex) : [parts[parts.length - 1] || "index.html"];
+  return pageParts.length > 1 ? "../".repeat(pageParts.length - 1) : "";
 }
 
 function updateContinueLink() {
@@ -225,7 +238,7 @@ function renderError(error) {
     modeDescription.textContent = "Start the API-backed local server to use Local DB.";
   }
   if (modeStatus) {
-    modeStatus.textContent = `Login/session diagnostic: ${message}`;
+    modeStatus.textContent = `Sign-in/session diagnostic: ${message}`;
   }
   if (modeDisabledMessage) {
     modeDisabledMessage.hidden = message !== apiBackedLoginDiagnostic;
 
@@ -102,7 +102,7 @@
         <div class="sub-menu">
           <a data-nav-link data-route="account" href="account/index.html">Account Home</a>
           <a data-nav-link data-route="account-achievements" href="account/achievements.html">Achievements</a>
-          <a data-account-logout data-route="login" href="login.html">Logout</a>
+          <a data-account-logout data-route="sign-in" href="account/sign-in.html">Logout</a>
           <a data-nav-link data-route="account-preferences" href="account/preferences.html">Preferences</a>
           <a data-nav-link data-route="account-profile" href="account/profile.html">Profile</a>
           <a data-nav-link data-route="account-security" href="account/security.html">Security</a>
 
@@ -0,0 +1,72 @@
+# PR_26164_093-sign-in-route-cleanup
+
+## Branch Validation
+
+PASS: current branch is `main`.
+
+## Scope Summary
+
+PASS: Scoped to sign-in route cleanup, active sign-in/account link updates, targeted tests, and required reports.
+
+## Sign-In Route Reference Audit
+
+PASS: `/login.html` existed before the cleanup and was removed.
+
+PASS: The real active sign-in route is now `account/sign-in.html`.
+
+Updated active route/link references:
+
+- Moved `login.html` to `account/sign-in.html`.
+- Updated shared route map from the old login route to `sign-in`.
+- Updated header logout links to `data-route="sign-in"` and `account/sign-in.html`.
+- Updated local API guidance from `http://127.0.0.1:5501/login.html` to `http://127.0.0.1:5501/account/sign-in.html`.
+- Updated Assets guest prompt Sign In and Account links to resolve from `toolbox/assets/index.html`.
+- Updated targeted Playwright references to the new sign-in path.
+
+PASS: Active source/page/test scan found no `login.html` or `/login.html` references outside historical report/archive folders.
+
+## Requirement Checklist
+
+| Requirement | Status | Evidence |
+| --- | --- | --- |
+| Read `docs_build/dev/PROJECT_INSTRUCTIONS.md` before execution | PASS | Project instructions were read before implementation. |
+| Verify current branch is `main` before changes | PASS | `git branch --show-current` returned `main`. |
+| Confirm `/login.html` no longer exists | PASS | `login.html` was removed; `account/sign-in.html` exists. |
+| Find references to login/sign-in/auth/account entry routes | PASS | Active source/page/test roots were scanned and updated where applicable. |
+| Update sign-in links/routes to current real sign-in page/path | PASS | Active sign-in route is `account/sign-in.html`; updated route map, header partials, local server output, tests, and Assets prompt. |
+| Do not recreate `login.html` | PASS | No root `login.html` file remains. |
+| Do not reintroduce fake login | PASS | No new fake auth mechanism was added; existing Local DB session selection moved to the Sign In route. |
+| Do not reintroduce MEM DB | PASS | Diff audit found no added MEM DB/local-mem references. |
+| Keep scope limited | PASS | Changes are sign-in route cleanup, copy/link alignment, targeted tests, and reports. |
+| Validate updated links resolve | PASS | `account/sign-in.html` and `account/index.html` targets exist. |
+| Validate no inline script/style/event handlers added | PASS | Changed HTML scan passed. |
+
+## Validation Lane Report
+
+Playwright impacted: Yes. Navigation/runtime JS and route tests changed.
+
+Validation commands:
+
+- PASS: `git diff --check`
+- PASS: targeted JS syntax checks with `node --check`
+- PASS: changed HTML inline script/style/event-handler audit
+- PASS: updated sign-in/account link target audit
+- PASS: `login.html` absence audit
+- PASS: active `/login.html` reference audit
+- PASS: MEM DB/local-mem added-line audit
+- PASS: `npx playwright test tests/playwright/tools/LoginSessionMode.spec.mjs tests/playwright/tools/StaticOnlyLoginApiRequired.spec.mjs tests/playwright/tools/ApiStaticRouteRecovery.spec.mjs --reporter=list --workers=1` -> 9 passed
+- PASS: `npx playwright test tests/playwright/tools/RootToolsFutureState.spec.mjs -g "navigation" --reporter=list --workers=1` -> 1 passed
+- PASS: `npx playwright test tests/playwright/tools/AssetToolMockRepository.spec.mjs -g "Assets guest upload action shows account prompt" --reporter=list --workers=1` -> 1 passed
+- PASS: `npx playwright test tests/playwright/tools/ToolboxRoutePages.spec.mjs -g "toolbox index shows wireframe" --reporter=list --workers=1` -> 1 passed
+
+Additional targeted command:
+
+- FAIL: `node --test tests/dev-runtime/AdminNotesBoundary.test.mjs` has unrelated pre-existing failures for missing `docs_build/dev/admin-notes/README.md`, local Admin Notes menu assertions, and Admin menu expectations. The sign-in assertion in that file was updated, but this command is not a reliable route-cleanup validator in the current repo state.
+
+## Manual Validation Notes
+
+- Confirmed root `login.html` was removed.
+- Confirmed `account/sign-in.html` is not blocked by the Account protected-page guard.
+- Confirmed the Sign In page uses external scripts/styles only.
+- Confirmed the Assets guest prompt Sign In target resolves to `../../account/sign-in.html`.
+- Historical reports/archive references were not rewritten because they are immutable validation history, not active routes.