WIP checkpoint: Address review feedback: Fix: navigating Play -> Back logs the user out (should stay logged in)

scripts/main_menu.gd

@@ -65,6 +65,12 @@ func _ready() -> void:
 	_play_button = $CenterContainer/VBoxContainer/PlayButton
 	_quit_button = $CenterContainer/VBoxContainer/QuitButton
 
+	# Default to Play being gated. When a token exists, the async session
+	# check below may take several frames (a real get_me() round-trip);
+	# keeping the button disabled until validation succeeds prevents a fast
+	# click from navigating to world_list with an expired/invalid token.
+	_play_button.disabled = true
+
 	# Check whether a valid session already exists (e.g. user logged in,
 	# navigated to world_list, then clicked Back). If so, restore the
 	# authenticated UI state instead of forcing the login form again.
@@ -85,7 +91,7 @@ func _ready() -> void:
 ## Restore the UI to the authenticated state (Play enabled, welcome label,
 ## auth buttons hidden).
 func _show_authenticated(username: String) -> void:
-	_auth_panel.visible = false
+	_auth_panel.visible = true
 	_status_label.visible = false
 	_welcome_label.text = "Welcome, %s!" % username
 	_welcome_label.visible = true

scripts/smoke_test_main_menu_back.gd

@@ -14,7 +14,7 @@ extends SceneTree
 ##   3. Click Play -> world_list.tscn.
 ##   4. Click Back -> main_menu.tscn.
 ##   5. Assert the menu is STILL authenticated (Play enabled, welcome label
-##      visible, login/register buttons hidden).
+##      actually visible in the tree, login/register buttons hidden).
 ##
 ## Run with:
 ##     godot --headless --path . --script res://scripts/smoke_test_main_menu_back.gd
@@ -118,14 +118,18 @@ func _is_authenticated(menu: Control) -> bool:
 	var auth_panel: PanelContainer = menu.get_node("CenterContainer/VBoxContainer/AuthPanel")
 
 	_check("Play enabled", not play_button.disabled)
-	_check("Welcome label visible", welcome_label.visible)
+	# WelcomeLabel lives inside AuthPanel, so `.visible` alone is a
+	# false-positive: the label can have visible=true while its parent is
+	# hidden and it renders as nothing. `is_visible_in_tree()` is the
+	# check that proves the user can actually see the welcome message.
+	_check("Welcome label visible in tree", welcome_label.is_visible_in_tree())
 	_check("Auth buttons row hidden", not auth_buttons_row.visible)
-	_check("Auth panel hidden", not auth_panel.visible)
+	_check("Auth panel visible (it contains the welcome label)", auth_panel.visible)
 
 	return (not play_button.disabled) \
-		and welcome_label.visible \
+		and welcome_label.is_visible_in_tree() \
 		and not auth_buttons_row.visible \
-		and not auth_panel.visible
+		and auth_panel.visible
 
 
 func _wait_for_scene_change(previous_scene: Node) -> void:

scripts/smoke_test_main_menu_full_flow.gd

@@ -60,7 +60,7 @@ func _run() -> void:
 	await instance._on_auth_button_pressed()
 
 	_check("Play became enabled after real register submission", not play_button.disabled)
-	_check("Welcome label visible", welcome_label.visible)
+	_check("Welcome label visible in tree", welcome_label.is_visible_in_tree())
 	_check("Auth buttons row hid itself after success", not auth_buttons_row.visible)
 
 	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])