Merge remote WIP checkpoint; keep the verified over_18 fix (ModeToggle stays removed per PR #42)

# Conflicts:
#	backend/app/routers/auth.py

backend/app/routers/auth.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
 from jose import JWTError, jwt
 from passlib.context import CryptContext
-from pydantic import BaseModel, EmailStr, field_validator
+from pydantic import BaseModel, EmailStr
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -39,17 +39,7 @@ class RegisterRequest(BaseModel):
     username: str
     email: EmailStr
     password: str
-    date_of_birth: str  # ISO format date string (YYYY-MM-DD)
-
-    @field_validator("date_of_birth")
-    @classmethod
-    def validate_date_of_birth(cls, v: str) -> str:
-        """Validate that the date string is a valid date in YYYY-MM-DD format."""
-        try:
-            datetime.strptime(v, "%Y-%m-%d")
-        except ValueError:
-            raise ValueError("date_of_birth must be in YYYY-MM-DD format")
-        return v
+    over_18: bool  # Simple boolean confirmation instead of date_of_birth
 
 
 class UserResponse(BaseModel):
@@ -118,6 +108,16 @@ def hash_password(password: str) -> str:
 def calculate_age(birth_date: date, today: date | None = None) -> int:
     """Calculate age in years from a birth date.
 
+    Not called by /register anymore (that endpoint now just trusts the
+    client's over_18 boolean, see RegisterRequest) -- kept as a real,
+    tested utility since date-of-birth storage/verification is coming
+    back in a future pass (real age math, not just a client-side claim,
+    the user explicitly wants to revisit this design). Removing it broke
+    backend/tests/test_auth_age_gate.py's collection entirely (ImportError
+    on `from app.routers.auth import calculate_age`) for zero benefit --
+    restoring it is the lower-risk path over rewriting or deleting 17
+    tests for logic this codebase will need again.
+
     Args:
         birth_date: The person's date of birth.
         today: The reference date. Defaults to today's date (UTC).
@@ -155,16 +155,12 @@ def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     """Register a new user and return access + refresh tokens.
 
-    Requires date_of_birth and rejects users under 18.
+    Requires over_18 boolean confirmation; rejects users who are not 18+.
     """
-    # Parse and validate date_of_birth
-    dob = datetime.strptime(req.date_of_birth, "%Y-%m-%d").date()
-    age = calculate_age(dob)
-
-    if age < 18:
+    if not req.over_18:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Must be 18 or older to register (provided date of birth: {req.date_of_birth})",
+            detail="Must be 18 or older to register",
         )
 
     # Check if username already exists
@@ -187,7 +183,7 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
         username=req.username,
         email=req.email,
         hashed_password=hash_password(req.password),
-        date_of_birth=dob,
+        date_of_birth=None,  # No longer collecting DOB
     )
     db.add(user)
     await db.flush()  # flush to get user.id before creating refresh token

backend/tests/test_auth_age_gate.py

@@ -57,38 +57,38 @@ class TestCalculateAge:
         assert calculate_age(dob, today=date(2024, 12, 31)) == 24
 
 
-class TestRegisterRequestDateValidation:
-    """Tests for the RegisterRequest date_of_birth field validator."""
+class TestRegisterRequestOver18Field:
+    """Tests for RegisterRequest's over_18 field.
 
-    @pytest.mark.parametrize(
-        "dob",
-        [
-            "2000-01-01",
-            "1990-12-31",
-            "2004-02-29",  # leap day
-        ],
-    )
-    def test_valid_dates(self, dob):
-        """Valid YYYY-MM-DD dates pass validation."""
+    Replaces TestRegisterRequestDateValidation -- date_of_birth and its
+    field_validator were removed from RegisterRequest 2026-08-20 (interim
+    simplification: a plain client-side over_18 confirmation instead of
+    collecting/validating an actual date of birth; see calculate_age's
+    own docstring in app/routers/auth.py for why that function is still
+    here even though this endpoint no longer calls it). There's no date
+    format left to validate, so the equivalent coverage is just: the
+    field exists, is a real bool, and is required."""
+
+    def test_over_18_true_accepted(self):
         from app.routers.auth import RegisterRequest
 
-        req = RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
-        assert req.date_of_birth == dob
+        req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=True)
+        assert req.over_18 is True
 
-    @pytest.mark.parametrize(
-        "dob",
-        [
-            "01-01-2000",
-            "2000/01/01",
-            "2000-13-01",
-            "2000-00-10",
-            "not-a-date",
-            "",
-        ],
-    )
-    def test_invalid_dates_rejected(self, dob):
-        """Invalid dates are rejected by the validator."""
+    def test_over_18_false_accepted(self):
+        """False is a valid value at the schema level -- the endpoint,
+        not the schema, is what rejects it (see
+        TestRegister::test_register_rejects_not_over_18 in
+        test_auth_endpoints.py)."""
         from app.routers.auth import RegisterRequest
 
-        with pytest.raises(ValueError):
-            RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
+        req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=False)
+        assert req.over_18 is False
+
+    def test_over_18_missing_rejected(self):
+        """over_18 has no default -- omitting it entirely is a validation error."""
+        from app.routers.auth import RegisterRequest
+        from pydantic import ValidationError
+
+        with pytest.raises(ValidationError):
+            RegisterRequest(username="u", email="u@example.com", password="p")

backend/tests/test_auth_endpoints.py

@@ -73,7 +73,7 @@ class TestRegister:
                 "username": "newuser",
                 "email": "new@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201
@@ -81,8 +81,14 @@ class TestRegister:
         assert "access_token" in data
         assert data["token_type"] == "bearer"
 
-    def test_register_rejects_underage(self):
-        """Users under 18 get a 400 with a detail message."""
+    def test_register_rejects_not_over_18(self):
+        """over_18=false gets a 400 with a detail message.
+
+        The interim design (2026-08-20) trusts a client-side boolean
+        confirmation instead of collecting/validating an actual date of
+        birth -- this only checks that the flag is respected, not real
+        age math (there's no date to verify against anymore). Real DOB
+        collection/verification may come back in a future pass."""
         client = TestClient(app)
         resp = client.post(
             "/api/auth/register",
@@ -90,7 +96,7 @@ class TestRegister:
                 "username": "kid",
                 "email": "kid@example.com",
                 "password": "secret123",
-                "date_of_birth": "2010-06-15",  # ~15 years old
+                "over_18": False,
             },
         )
         assert resp.status_code == 400
@@ -106,7 +112,7 @@ class TestRegister:
                 "username": "duplicate",
                 "email": "dup1@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         # Second registration with same username, different email
@@ -116,7 +122,7 @@ class TestRegister:
                 "username": "duplicate",
                 "email": "dup2@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 409
@@ -131,7 +137,7 @@ class TestRegister:
                 "username": "user1",
                 "email": "same@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         resp = client.post(
@@ -140,14 +146,19 @@ class TestRegister:
                 "username": "user2",
                 "email": "same@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 409
         assert "Email already registered" in resp.json()["detail"]
 
-    def test_register_invalid_date_format(self):
-        """Invalid date format returns 422 validation error."""
+    def test_register_missing_over_18(self):
+        """Missing the required over_18 field returns 422.
+
+        Replaces the old test_register_invalid_date_format -- there's no
+        date format to get wrong anymore (no date field at all), so the
+        closest equivalent "malformed request" case is the required
+        over_18 boolean being absent entirely."""
         client = TestClient(app)
         resp = client.post(
             "/api/auth/register",
@@ -155,25 +166,10 @@ class TestRegister:
                 "username": "user",
                 "email": "user@example.com",
                 "password": "secret123",
-                "date_of_birth": "01-01-2000",  # wrong format
             },
         )
         assert resp.status_code == 422
 
-    def test_register_exactly_18(self):
-        """A user who just turned 18 can register."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "just18",
-                "email": "just18@example.com",
-                "password": "secret123",
-                "date_of_birth": "2007-06-15",
-            },
-        )
-        assert resp.status_code == 201
-
 
 # ---------------------------------------------------------------------------
 # Login endpoint
@@ -193,7 +189,7 @@ class TestLogin:
                 "username": username,
                 "email": email,
                 "password": password,
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201

backend/tests/test_auth_expired_token.py

@@ -93,7 +93,7 @@ def _register_user(client: TestClient, username: str) -> str:
             "username": username,
             "email": f"{username}@example.com",
             "password": "secret123",
-            "date_of_birth": "2000-01-01",
+            "over_18": True,
         },
     )
     assert resp.status_code == 201

backend/tests/test_refresh_endpoint.py

@@ -59,7 +59,7 @@ class TestRefresh:
                 "username": username,
                 "email": email,
                 "password": password,
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201
@@ -143,7 +143,7 @@ class TestRefresh:
                 "username": "refep_loginrefuser",
                 "email": "loginref@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         # Login to get a refresh token

docs/checkpoints/PC1.md

@@ -0,0 +1,72 @@
+# Package Checkpoint 1 (PC1)
+
+Validated 2026-08-20 against `main` commit `927f9bd`, from a genuinely fresh
+clone (not a reused agent workspace).
+
+## Automated validation
+
+Run with `scripts/run_checkpoint_tests.py` — see
+`docs/testing/test_inventory.md` for exactly what each suite covers.
+
+| Check | Result |
+|---|---|
+| Alembic migrations, fresh DB | PASS |
+| Backend pytest | 68/68 PASS |
+| Godot smoke tests (4 files) | ALL PASS |
+| Linux export (`agp-game.x86_64`) | Builds, verified as a real ELF64 binary |
+| Windows export (`agp-game.exe`) | Builds, verified as a real PE32+ binary |
+
+## Problems found during this checkpoint (fixed, tracked as tasks)
+
+- Roadmap showed the Godot Engine Scaffold feature amber despite 6/6 tasks
+  done — a historical data gap (a review-feedback follow-up task's
+  supersession link was never recorded, predating when that field started
+  being tracked). Backfilled in the PM database; confirmed green.
+- `docs/testing/test_inventory.md` was stale (said 38 backend tests,
+  actually 68; said no integration tests existed, 4 real ones had landed).
+  Fixed via task `398bf1a22a2d` / PR #40.
+
+## What's actually testable right now
+
+Login/register/browse-worlds only — there's no joinable gameplay yet. That's
+the real scope of PC1; don't expect more when playtesting.
+
+- Register a new account (18+ only, rejected otherwise)
+- Log out, log back in with the same credentials
+- Play → Browse Worlds — loads a (currently empty) world list with no errors
+
+## Manual playtest: backend on cloudbison, client on pinkbison
+
+As of 2026-08-20 this is dashboard-controlled — no terminal commands, no
+env vars, no editing files. Foolproof enough to hand to someone else.
+
+### 1. On cloudbison — the AGP dashboard
+
+Open the dashboard (`http://cloudbison:7070`, or its Tailscale address) and
+go to **PC1** in the nav bar (`/checkpoint/PC1`). Click **Start Backend** —
+it pulls the latest `main`, stands up Postgres, runs migrations, and starts
+the API server, all in one step. The page shows the LAN address it's
+reachable at once it's up (under a minute).
+
+When you're done playtesting, click **Stop & Clean Up** on the same page —
+it tears down everything that step started (API server, Postgres
+container, its volume and network). Nothing is left running or lying
+around afterward, even if the dashboard itself gets restarted in between.
+
+### 2. On pinkbison — download and run the .exe
+
+Same dashboard page: click **Build .exe** the first time (or **Rebuild** to
+pick up newer changes) — this pulls the latest `main` and exports a Windows
+binary with cloudbison's backend address already baked in. Click
+**Download agp-game.exe**, copy it to pinkbison, and just run it. No
+environment variable, no config file, no build step on pinkbison at all.
+
+### 3. Tear down when done
+
+**Stop & Clean Up** on the dashboard page. That's it.
+
+## Status
+
+`config/checkpoint_focus_feature_ids` in the AGP framework (`~/agp`) still
+restricts agent claiming to the 5 PC1-scope features. Agents will not move
+on to post-PC1 work until that's widened.

docs/testing/test_inventory.md

@@ -7,22 +7,26 @@ to know what "run the tests" actually checked.
 
 Run everything below in one shot with `scripts/run_checkpoint_tests.py`.
 
-Last verified against `main`: 2026-08-20 (commit `927f9bd`) — full PC1
-checkpoint run, fresh clone, migrations + pytest + all 4 Godot smoke tests +
-both platform exports, all clean.
+Last verified against `main`: 2026-08-20 — full PC1 checkpoint run,
+migrations + pytest + all 6 Godot smoke tests + both platform exports, all
+clean. Two real bugs found and fixed via real playtesting this same day
+(not caught by the checkpoint suite as it stood before today): the main
+menu had no way to actually open the login/register form, and the world
+list's cards rendered at ~1px wide once real data existed. Both are now
+covered by the smoke tests below so they can't silently regress.
 
 ## Backend — `backend/tests/` (pytest)
 
 Run: `cd backend && python -m pytest -v` (needs `DATABASE_URL` pointed at a
 reachable Postgres — see the runner script).
 
-**Current total: 68 tests, all passing on a clean `main` checkout.**
+**Current total: 61 tests, all passing on a clean `main` checkout.**
 
 | File | Tests | What it covers |
 |---|---|---|
-| `test_auth_age_gate.py` | 17 | `calculate_age()` date-math correctness (exact boundary, leap years, birthday-not-yet-this-year) + `RegisterRequest` date-of-birth validation (parametrized valid/invalid date rejection). Backs the 18+ registration gate (PR #23). |
+| `test_auth_age_gate.py` | 11 | `calculate_age()` date-math correctness (exact boundary, leap years, birthday-not-yet-this-year — kept as a tested utility for a future real-DOB pass even though `/register` no longer calls it) + `RegisterRequest.over_18` field tests (true accepted, false accepted, missing rejected). 2026-08-20: the register flow was simplified from collecting/validating a date of birth to a plain client-side "I am 18 or older" confirmation, so the old date-validation parametrized cases were replaced. Backs the 18+ registration gate (PR #23, revised PC1). |
 | `test_gltf_metadata.py` | 21 | glTF/GLB binary + JSON parsing: magic-byte detection, chunk-padding handling, mesh/animation/texture-reference metadata extraction, malformed-input rejection. Backs the asset-import pipeline (PR #27). |
-| `test_auth_endpoints.py` | 11 | **Integration tests** for `POST /api/auth/register` and `POST /api/auth/login` against the real FastAPI app + real Postgres. Covers: successful register (201), duplicate username (409), duplicate email (409), underage rejection (400), invalid date format (422), exact-18 registration, successful login with correct credentials (200), wrong password (401), nonexistent user (401), form-encoded login (OAuth2), and JWT validity of returned tokens. |
+| `test_auth_endpoints.py` | 10 | **Integration tests** for `POST /api/auth/register` and `POST /api/auth/login` against the real FastAPI app + real Postgres. Covers: successful register (201), duplicate username (409), duplicate email (409), `over_18=false` rejection (400), missing `over_18` field (422), successful login with correct credentials (200), wrong password (401), nonexistent user (401), form-encoded login (OAuth2), and JWT validity of returned tokens. |
 | `test_refresh_endpoint.py` | 8 | **Integration tests** for `POST /api/auth/refresh`. Covers: successful refresh (200, new access token, same refresh token returned), refresh produces different access tokens on repeated calls, invalid refresh token (401), empty body (422), missing field (422), refresh token from login also works, returned access token is valid JWT decodable with public key, `access_token_expires_minutes` in response. |
 | `test_refresh_token_jti.py` | 6 | Unit tests for refresh token uniqueness (jti claim) and model column length. Covers: two calls with same sub produce different tokens (jti uniqueness), jti is valid UUID, rapid repeated calls all produce unique jtis, jti survives decode, `RefreshToken.token` column is `String(512)`, column type is `String`. |
 | `test_auth_expired_token.py` | 5 | **Integration tests** for expired-token rejection across auth endpoints. Covers: expired access JWT rejected by `GET /api/auth/me` (401), garbage access token rejected by `/me` (401), missing bearer token returns 401, expired refresh token (DB `expires_at` in past) rejected by `/refresh` (401), expired refresh JWT (past `exp` claim) rejected before DB lookup (401). |
@@ -48,7 +52,7 @@ these yet):
 
 ## Godot client — `scripts/smoke_test_*.gd`
 
-**4 smoke tests merged into `main`.** Each needs a live backend —
+**6 smoke tests merged into `main`.** Each needs a live backend —
 `AGP_API_BASE_URL` env var, falling back to the
 `application/agp/api_base_url` project setting (default
 `http://127.0.0.1:8000`) if unset.
@@ -56,9 +60,11 @@ these yet):
 | File | What it covers |
 |---|---|
 | `smoke_test_api.gd` | Exercises `ApiClient.health_check()` against a live backend. Verifies the real HTTP request path (`HTTPRequest` node lifecycle, JSON parse, result-dictionary contract). Exits 1 on failure. |
-| `smoke_test_auth.gd` | Tests the full auth flow via `ApiClient` autoload: register unique user (201), duplicate username (409), under-18 registration (400), correct login (200), wrong password (401), nonexistent user (401). |
+| `smoke_test_auth.gd` | Tests the full auth flow via `ApiClient` autoload: register unique user (201), duplicate username (409), `over_18=false` registration (400), correct login (200), wrong password (401), nonexistent user (401). |
 | `smoke_test_e2e.gd` | End-to-end flow: health check → register → login → worlds list. Verifies the full request chain with a fresh user, including token storage and `get_worlds()` with auth header. |
-| `smoke_test_world_list.gd` | Instantiates `world_list.tscn` as a real scene, adds to tree (catches `@onready` node-path bugs), waits for `_refresh_worlds()` to complete, confirms the screen reaches a real end state (world cards, empty-list message, or error label — not stuck loading). |
+| `smoke_test_world_list.gd` | Registers a user, **seeds a real world via `POST /api/worlds/`** (without this, `run_checkpoint_tests.py`'s always-fresh DB means the populated-card render path never actually runs in CI, only the empty-list path would), instantiates `world_list.tscn` as a real scene, waits for `_refresh_worlds()` to complete, confirms it reached the populated (not empty) state, and asserts **each rendered card's real computed width is >= 200px**. That last check is the one that matters: 2026-08-20, a real bug shipped where every card existed in the tree with a non-zero child count and no crash, but rendered at 1.0px wide (`ScrollContainer`'s `size_flags_horizontal`/`vertical` used the raw integer `4` = `Control.SIZE_SHRINK_CENTER` instead of `3` = `SIZE_EXPAND_FILL`) — invisible on screen, and a child-count-only check would never have caught it. Confirmed by deliberately reintroducing the bug: card width check correctly fails at 25px. |
+| `smoke_test_main_menu_ui.gd` | Instantiates `main_menu.tscn`, confirms the auth panel starts hidden, and confirms a **real signal emission** on LoginButton/RegisterButton (not calling the handler method directly) actually opens it. This is the check that would have caught 2026-08-20's real bug: the auth panel and its logic were fully correct, but nothing in the scene was ever wired to open it, so Login/Register were completely unreachable from the UI. |
+| `smoke_test_main_menu_full_flow.gd` | Full click-through: open the register form, fill it exactly as a user would, submit, confirm Play actually becomes enabled, the welcome message shows, and the auth buttons hide themselves. Calls the submit handler directly (awaited) rather than via `auth_button.pressed.emit()` — see the note at the top of the file: a synthetic `.emit()` on an `await`-using handler doesn't get driven forward reliably in `--script`/SceneTree headless mode the way real GUI input event dispatch does, confirmed by comparing direct-call vs `.emit()` behavior. Not a bug in the actual click-driven flow, just a headless-test-harness quirk to route around when writing tests. |
 
 Run (once, to build the class cache): `godot --headless --path . --import`,
 then for each smoke test: `godot --headless --path . --script
@@ -66,14 +72,18 @@ res://scripts/smoke_test_<name>.gd` — **no `--quit`**, it kills these before
 their awaited HTTP calls finish.
 
 **Known gaps:**
-- No smoke tests for the main menu scene (`main_menu.tscn`).
 - No smoke tests for chunk loading/streaming (`chunk.gd`, `chunk_scene.gd`).
 - No smoke tests for dynamic/static object nodes.
 - All smoke tests require a live backend; no offline/unit smoke tests exist.
-- `smoke_test_world_list.gd` is the only one that exercises a real `.tscn`
-  scene instantiation — others only test the `ApiClient` autoload.
+- `smoke_test_world_list.gd` and `smoke_test_main_menu_*.gd` are the only
+  ones that exercise a real `.tscn` scene instantiation — others only test
+  the `ApiClient` autoload directly.
 - `get_me()` (`GET /auth/me`) is implemented in `scripts/api_client.gd` but
   has no smoke coverage yet.
+- The Login path (as opposed to Register) through `main_menu.gd` isn't
+  separately smoke-tested — it shares the same `_on_auth_button_pressed()`/
+  `_on_auth_complete()` code path already exercised for Register, but that's
+  inference, not a direct check.
 
 ## Client export
 

export_presets.cfg

@@ -21,7 +21,7 @@ script_export_mode=2
 custom_template/debug=""
 custom_template/release=""
 debug/export_console_wrapper=1
-binary_format/embed_pck=false
+binary_format/embed_pck=true
 texture_format/bptc=true
 texture_format/s3tc=true
 texture_format/etc=false
@@ -52,7 +52,7 @@ script_export_mode=2
 custom_template/debug=""
 custom_template/release=""
 debug/export_console_wrapper=1
-binary_format/embed_pck=false
+binary_format/embed_pck=true
 texture_format/bptc=true
 texture_format/s3tc=true
 texture_format/etc=false

scenes/main_menu.tscn

@@ -29,6 +29,21 @@ text = "AGP Game"
 horizontal_alignment = 1
 theme_override_font_sizes/font_size = 72
 
+[node name="AuthButtonsRow" type="HBoxContainer" parent="CenterContainer/VBoxContainer"]
+layout_mode = 1
+theme_override_constants/separation = 16
+alignment = 1
+
+[node name="LoginButton" type="Button" parent="CenterContainer/VBoxContainer/AuthButtonsRow"]
+layout_mode = 1
+text = "Login"
+size_flags_horizontal = 3
+
+[node name="RegisterButton" type="Button" parent="CenterContainer/VBoxContainer/AuthButtonsRow"]
+layout_mode = 1
+text = "Register"
+size_flags_horizontal = 3
+
 [node name="AuthPanel" type="PanelContainer" parent="CenterContainer/VBoxContainer"]
 layout_mode = 1
 visible = false
@@ -68,16 +83,12 @@ visible = false
 placeholder_text = "Email"
 size_flags_horizontal = 3
 
-[node name="DOBEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
+[node name="Over18Check" type="CheckBox" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
 layout_mode = 1
 visible = false
-placeholder_text = "Date of Birth (YYYY-MM-DD)"
+text = "I am 18 or older"
 size_flags_horizontal = 3
 
-[node name="ModeToggle" type="CheckButton" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-text = "Register"
-
 [node name="AuthButton" type="Button" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
 layout_mode = 1
 text = "Login"
@@ -106,9 +117,10 @@ layout_mode = 1
 text = "Quit"
 size_flags_horizontal = 4
 
+[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthButtonsRow/LoginButton" to="." method="_on_login_button_pressed"]
+[connection signal="pressed" from="CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton" to="." method="_on_register_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/PlayButton" to="." method="_on_play_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/QuitButton" to="." method="_on_quit_button_pressed"]
-[connection signal="toggled" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle" to="." method="_on_mode_toggle_toggled"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton" to="." method="_on_auth_button_pressed"]
 [connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit" to="." method="_on_auth_button_pressed"]
 [connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit" to="." method="_on_auth_button_pressed"]

scenes/world_list.tscn

@@ -11,14 +11,17 @@ grow_vertical = 2
 script = ExtResource("1_wl")
 
 [node name="VBoxContainer" type="VBoxContainer" parent="."]
-layout_mode = 3
+layout_mode = 1
+anchors_preset = 15
+anchor_right = 1.0
+anchor_bottom = 1.0
+grow_horizontal = 2
+grow_vertical = 2
 theme_override_constants/separation = 8
-size_flags_horizontal = 4
-size_flags_vertical = 4
 
 [node name="HeaderHBox" type="HBoxContainer" parent="VBoxContainer"]
 layout_mode = 3
-size_flags_horizontal = 4
+size_flags_horizontal = 3
 theme_override_constants/separation = 16
 
 [node name="BackButton" type="Button" parent="VBoxContainer/HeaderHBox"]
@@ -30,7 +33,7 @@ size_flags_horizontal = 0
 layout_mode = 3
 text = "Browse Worlds"
 horizontal_alignment = 1
-size_flags_horizontal = 4
+size_flags_horizontal = 3
 theme_override_font_sizes/font_size = 28
 
 [node name="RefreshButton" type="Button" parent="VBoxContainer/HeaderHBox"]
@@ -40,15 +43,14 @@ size_flags_horizontal = 0
 
 [node name="ScrollContainer" type="ScrollContainer" parent="VBoxContainer"]
 layout_mode = 3
-size_flags_horizontal = 4
-size_flags_vertical = 4
+size_flags_horizontal = 3
+size_flags_vertical = 3
 horizontal_mode = 2
 vertical_mode = 2
 
 [node name="WorldList" type="VBoxContainer" parent="VBoxContainer/ScrollContainer"]
 layout_mode = 3
-size_flags_horizontal = 4
-size_flags_vertical = 4
+size_flags_horizontal = 3
 theme_override_constants/separation = 8
 
 [node name="LoadingLabel" type="Label" parent="VBoxContainer"]

scripts/api_client.gd

@@ -178,18 +178,18 @@ func login(username: String, password: String) -> Dictionary:
 
 
 ## Register a new user. On success stores the returned access token.
-## @param date_of_birth ISO date string "YYYY-MM-DD".
+## @param over_18 Must be true; the backend rejects registration otherwise.
 func register(
 	username: String,
 	email: String,
 	password: String,
-	date_of_birth: String
+	over_18: bool
 ) -> Dictionary:
 	var payload := {
 		"username": username,
 		"email": email,
 		"password": password,
-		"date_of_birth": date_of_birth,
+		"over_18": over_18,
 	}
 	var result := await request(
 		HTTPClient.METHOD_POST,

scripts/main_menu.gd

@@ -1,24 +1,23 @@
 extends Control
 ## Main menu with login/register UI wired to the backend auth API.
 ##
-## The AuthPanel is hidden by default. When the user clicks "Login" or "Register"
-## (the existing Play/Quit buttons), the auth panel slides in. The ModeToggle
-## switches between Login and Register modes, showing/hiding the email and DOB
-## fields accordingly.
-##
-## On successful auth the token is stored via ApiClient, the welcome label
-## shows the username, and the Play button becomes enabled.
+## The AuthPanel is hidden by default. When the user clicks the LoginButton or
+## RegisterButton (AuthButtonsRow, above the panel), the auth panel slides in.
+## The Login and Register buttons on the AuthButtonsRow directly set the panel's
+## mode, so the user can switch between Login and Register at any time while
+## the panel is open.
 
+# ─── UI references ────────────────────────────────────────────────────────────
 
-# ── UI references ────────────────────────────────────────────────────────────
-
+var _auth_buttons_row: HBoxContainer
+var _login_button: Button
+var _register_button: Button
 var _auth_panel: PanelContainer
 var _auth_mode_label: Label
 var _username_edit: LineEdit
 var _password_edit: LineEdit
 var _email_edit: LineEdit
-var _dob_edit: LineEdit
-var _mode_toggle: CheckButton
+var _over_18_check: CheckBox
 var _auth_button: Button
 var _status_label: Label
 var _welcome_label: Label
@@ -29,17 +28,19 @@ var _is_register_mode: bool = false
 var _is_authenticating: bool = false
 
 
-# ── Lifecycle ────────────────────────────────────────────────────────────────
+# ─── Lifecycle ────────────────────────────────────────────────────────────────
 
 func _ready() -> void:
 	# Cache node references.
+	_auth_buttons_row = $CenterContainer/VBoxContainer/AuthButtonsRow
+	_login_button = $CenterContainer/VBoxContainer/AuthButtonsRow/LoginButton
+	_register_button = $CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton
 	_auth_panel = $CenterContainer/VBoxContainer/AuthPanel
 	_auth_mode_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel
 	_username_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit
 	_password_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit
 	_email_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit
-	_dob_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DOBEdit
-	_mode_toggle = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle
+	_over_18_check = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check
 	_auth_button = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton
 	_status_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthStatusLabel
 	_welcome_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel
@@ -51,12 +52,13 @@ func _ready() -> void:
 	_status_label.visible = false
 	_welcome_label.visible = false
 	_email_edit.visible = false
-	_dob_edit.visible = false
+	_over_18_check.visible = false
+	_over_18_check.button_pressed = false
 	_play_button.disabled = true  # Gate play behind successful auth.
 	_update_auth_mode_ui()
 
 
-# ── Play / Quit ──────────────────────────────────────────────────────────────
+# ─── Play / Quit ──────────────────────────────────────────────────────────────
 
 func _on_play_button_pressed() -> void:
 	if _play_button.disabled:
@@ -70,29 +72,24 @@ func _on_quit_button_pressed() -> void:
 	get_tree().quit()
 
 
-# ── Auth panel toggle ────────────────────────────────────────────────────────
+# ─── Auth panel toggle ────────────────────────────────────────────────────────
 
 func _on_login_button_pressed() -> void:
-	"""Show the auth panel (called from a future Login button on the main menu)."""
+	"""Show the auth panel in login mode, called from AuthButtonsRow/LoginButton."""
 	_auth_panel.visible = true
-	_auth_panel.grab_focus()
+	_is_register_mode = false
+	_update_auth_mode_ui()
+	_clear_status()
+	_username_edit.grab_focus()
 
 
 func _on_register_button_pressed() -> void:
-	"""Show the auth panel in register mode."""
+	"""Show the auth panel in register mode, called from AuthButtonsRow/RegisterButton."""
 	_auth_panel.visible = true
 	_is_register_mode = true
-	_mode_toggle.button_pressed = true
-	_update_auth_mode_ui()
-	_clear_status()
-
-
-# ── Mode toggle (Login / Register) ───────────────────────────────────────────
-
-func _on_mode_toggle_toggled(button_pressed: bool) -> void:
-	_is_register_mode = button_pressed
 	_update_auth_mode_ui()
 	_clear_status()
+	_username_edit.grab_focus()
 
 
 func _update_auth_mode_ui() -> void:
@@ -101,15 +98,15 @@ func _update_auth_mode_ui() -> void:
 		_auth_mode_label.text = "Register"
 		_auth_button.text = "Register"
 		_email_edit.visible = true
-		_dob_edit.visible = true
+		_over_18_check.visible = true
 	else:
 		_auth_mode_label.text = "Login"
 		_auth_button.text = "Login"
 		_email_edit.visible = false
-		_dob_edit.visible = false
+		_over_18_check.visible = false
 
 
-# ── Auth submission ──────────────────────────────────────────────────────────
+# ─── Auth submission ──────────────────────────────────────────────────────────
 
 func _on_auth_button_pressed() -> void:
 	"""Handle login or register button press."""
@@ -129,17 +126,12 @@ func _on_auth_button_pressed() -> void:
 
 	if _is_register_mode:
 		var email := _email_edit.text.strip_edges()
-		var dob := _dob_edit.text.strip_edges()
 
 		if email == "":
 			_show_status("Email is required.")
 			return
-		if dob == "":
-			_show_status("Date of birth is required.")
-			return
-		# Basic YYYY-MM-DD format check.
-		if not _is_valid_date(dob):
-			_show_status("Date of birth must be in YYYY-MM-DD format.")
+		if not _over_18_check.button_pressed:
+			_show_status("You must confirm you are 18 or older to register.")
 			return
 
 		_auth_button.disabled = true
@@ -147,7 +139,7 @@ func _on_auth_button_pressed() -> void:
 		_is_authenticating = true
 		_clear_status()
 
-		var result := await ApiClient.register(username, email, password, dob)
+		var result := await ApiClient.register(username, email, password, true)
 		_on_auth_complete(result)
 	else:
 		_auth_button.disabled = true
@@ -166,18 +158,21 @@ func _on_auth_complete(result: Dictionary) -> void:
 	_is_authenticating = false
 
 	if result.ok:
-		# Success — show welcome, enable Play.
+		# Success — show welcome, enable Play, hide the now-redundant
+		# Login/Register entry points (the auth panel itself stays open,
+		# showing the welcome message in place of the form).
 		_welcome_label.text = "Welcome, %s!" % _username_edit.text.strip_edges()
 		_welcome_label.visible = true
 		_status_label.visible = false
 		_play_button.disabled = false
+		_auth_buttons_row.visible = false
 		print("Auth successful. Token stored.")
 	else:
 		# Failure — show backend error detail.
 		_show_status(result.detail)
 
 
-# ── Status helpers ───────────────────────────────────────────────────────────
+# ─── Status helpers ───────────────────────────────────────────────────────────
 
 func _show_status(message: String) -> void:
 	_status_label.text = message
@@ -187,26 +182,3 @@ func _show_status(message: String) -> void:
 func _clear_status() -> void:
 	_status_label.text = ""
 	_status_label.visible = false
-
-
-# ── Validation ───────────────────────────────────────────────────────────────
-
-func _is_valid_date(date_str: String) -> bool:
-	"""Check if a string looks like a valid YYYY-MM-DD date."""
-	if date_str.length() != 10:
-		return false
-	var parts := date_str.split("-")
-	if parts.size() != 3:
-		return false
-	var year := parts[0].to_int()
-	var month := parts[1].to_int()
-	var day := parts[2].to_int()
-	if month < 1 or month > 12:
-		return false
-	if day < 1 or day > 31:
-		return false
-	# Rough month-day validation.
-	var days_in_month := [0, 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]
-	if day > days_in_month[month]:
-		return false
-	return true

scripts/smoke_test_auth.gd

@@ -10,7 +10,7 @@ extends SceneTree
 ## Tests:
 ##   1. Register a unique user → 201 + token stored.
 ##   2. Register the same user again → 409 "Username already registered".
-##   3. Register an under-18 user → 400 "Must be 18 or older".
+##   3. Register with over_18=false → 400 "Must be 18 or older".
 ##   4. Login with correct credentials → 200 + token stored.
 ##   5. Login with wrong password → 401 "Incorrect username or password".
 ##   6. Login with non-existent user → 401 "Incorrect username or password".
@@ -21,8 +21,6 @@ const API_BASE := "http://127.0.0.1:8000"
 const TEST_USERNAME := "smoke_test_user_%d"
 const TEST_EMAIL := "smoke_%d@test.example.com"
 const TEST_PASSWORD := "SmokeTest123!"
-const TEST_DOB_ADULT := "2000-01-01"
-const TEST_DOB_CHILD := "2020-01-01"  # ~5 years old
 
 
 func _initialize() -> void:
@@ -40,12 +38,13 @@ func _run() -> void:
 	var failed: int = 0
 
 	# --- Test 1: Register a unique user ---
-	var unique_id := Time.get_ticks_msec()
+	randomize()
+	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
 	var username := "smoke_%d" % unique_id
 	var email := "smoke_%d@test.example.com" % unique_id
 
 	print("\n=== Test 1: Register unique user ===")
-	var result := await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
+	var result := await api.register(username, email, TEST_PASSWORD, true)
 	if _check("register returns ok", result.ok) \
 			and _check("register status is 201", result.status == 201) \
 			and _check("register stores token", api.has_token()):
@@ -56,7 +55,7 @@ func _run() -> void:
 
 	# --- Test 2: Register same user again (duplicate) ---
 	print("\n=== Test 2: Duplicate username ===")
-	result = await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
+	result = await api.register(username, email, TEST_PASSWORD, true)
 	if _check("duplicate register not ok", not result.ok) \
 			and _check("duplicate status is 409", result.status == 409) \
 			and _check("duplicate detail mentions username",
@@ -66,14 +65,14 @@ func _run() -> void:
 		failed += 1
 		print("  detail: ", result.detail)
 
-	# --- Test 3: Register under-18 user ---
-	print("\n=== Test 3: Under-18 registration ===")
+	# --- Test 3: Register with over_18=false ---
+	print("\n=== Test 3: over_18=false registration ===")
 	var child_username := "child_%d" % unique_id
 	var child_email := "child_%d@test.example.com" % unique_id
-	result = await api.register(child_username, child_email, TEST_PASSWORD, TEST_DOB_CHILD)
-	if _check("under-18 register not ok", not result.ok) \
-			and _check("under-18 status is 400", result.status == 400) \
-			and _check("under-18 detail mentions age",
+	result = await api.register(child_username, child_email, TEST_PASSWORD, false)
+	if _check("over_18=false register not ok", not result.ok) \
+			and _check("over_18=false status is 400", result.status == 400) \
+			and _check("over_18=false detail mentions age",
 					"18" in result.detail):
 		passed += 1
 	else:

scripts/smoke_test_e2e.gd

@@ -23,7 +23,6 @@ extends SceneTree
 const TEST_USERNAME_BASE := "smoke_test_user"
 const TEST_EMAIL := "smoke@test.com"
 const TEST_PASSWORD := "TestPass123"
-const TEST_DOB := "2000-01-01"
 
 
 func _initialize() -> void:
@@ -70,7 +69,7 @@ func _run() -> void:
 
 	# --- Step 2: Register -----------------------------------------------------
 	print("\n=== Step 2: Register (POST /api/auth/register) ===")
-	var reg: Dictionary = await api.register(username, email, TEST_PASSWORD, TEST_DOB)
+	var reg: Dictionary = await api.register(username, email, TEST_PASSWORD, true)
 	var reg_token := _extract_token(reg)
 	var reg_ok: bool = (
 		reg.ok

scripts/smoke_test_main_menu_full_flow.gd

@@ -0,0 +1,76 @@
+extends SceneTree
+## Full click-through simulation of the real user flow: press Register,
+## fill the form exactly as a human would, submit, confirm Play actually
+## becomes clickable. This is the check that would have caught the
+## original bug (no way to even open the form) and would catch a repeat
+## of it.
+
+var passed := 0
+var failed := 0
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+
+	var packed: PackedScene = load("res://scenes/main_menu.tscn")
+	var instance: Control = packed.instantiate()
+	root.add_child(instance)
+	await process_frame
+
+	var register_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton")
+	var auth_buttons_row: HBoxContainer = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow")
+	var username_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit")
+	var password_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit")
+	var email_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit")
+	var over_18_check: CheckBox = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check")
+	var auth_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton")
+	var welcome_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel")
+	var play_button: Button = instance.get_node("CenterContainer/VBoxContainer/PlayButton")
+
+	_check("Play starts disabled", play_button.disabled)
+
+	# Click Register -- a real signal emission is fine here since
+	# _on_register_button_pressed() is synchronous (no await), same as a
+	# real click's GUI event dispatch would drive it.
+	register_button.pressed.emit()
+	await process_frame
+
+	_check("auth panel opened in register mode", instance.get_node("CenterContainer/VBoxContainer/AuthPanel").visible)
+
+	# Fill the form exactly as a user would type into it.
+	var unique_id := int(Time.get_unix_time_from_system() * 1000)
+	username_edit.text = "mainmenu_e2e_%d" % unique_id
+	password_edit.text = "TestPass123!"
+	email_edit.text = "mainmenu_e2e_%d@test.example.com" % unique_id
+	over_18_check.button_pressed = true
+
+	# Call the submit handler directly (awaited) rather than via
+	# auth_button.pressed.emit() -- a synthetic .emit() in --script/
+	# SceneTree headless mode doesn't drive an await-using handler's
+	# coroutine forward the same way real GUI input event dispatch does
+	# (confirmed via a direct-call vs emit() comparison: the direct call
+	# always resolves, the synthetic emit sometimes doesn't advance past
+	# its own await point even after 50 real process_frame waits). This
+	# is a headless-mode test-harness limitation, not a bug in the actual
+	# click-driven flow.
+	await instance._on_auth_button_pressed()
+
+	_check("Play became enabled after real register submission", not play_button.disabled)
+	_check("Welcome label visible", welcome_label.visible)
+	_check("Auth buttons row hid itself after success", not auth_buttons_row.visible)
+
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
+	quit(0 if failed == 0 else 1)
+
+
+func _check(description: String, condition: bool) -> void:
+	if condition:
+		print("  PASS: ", description)
+		passed += 1
+	else:
+		printerr("  FAIL: ", description)
+		failed += 1

scripts/smoke_test_main_menu_ui.gd

@@ -0,0 +1,126 @@
+extends SceneTree
+## Verifies the main menu's Login/Register buttons correctly open the auth
+## panel and toggle between Login and Register modes via signal emission.
+##
+## Key tests:
+##  - AuthPanel starts hidden.
+##  - LoginButton press opens the panel in Login mode.
+##  - RegisterButton press opens the panel in Register mode.
+##  - Clicking Login while in Register mode switches back to Login mode.
+##  - Clicking Register while in Login mode switches to Register mode.
+##  - The ModeToggle CheckButton no longer exists in the scene.
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+
+	var passed := 0
+	var failed := 0
+
+	var packed: PackedScene = load("res://scenes/main_menu.tscn")
+	var instance: Control = packed.instantiate()
+	root.add_child(instance)
+	await process_frame
+
+	var login_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/LoginButton")
+	var register_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton")
+	var auth_panel: PanelContainer = instance.get_node("CenterContainer/VBoxContainer/AuthPanel")
+	var auth_mode_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel")
+	var email_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit")
+	var over_18_check: CheckBox = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check")
+
+	# --- Test 1: auth panel starts hidden ---
+	if _check("auth panel starts hidden", not auth_panel.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 2: LoginButton press opens panel in Login mode ---
+	login_button.pressed.emit()
+	await process_frame
+
+	if _check("auth panel visible after LoginButton press", auth_panel.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Login mode label after LoginButton press", auth_mode_label.text == "Login"):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field hidden in Login mode", not email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox hidden in Login mode", not over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 3: RegisterButton press switches to Register mode ---
+	register_button.pressed.emit()
+	await process_frame
+
+	if _check("auth panel still visible after RegisterButton press", auth_panel.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Register mode label after RegisterButton press", auth_mode_label.text == "Register"):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field visible in Register mode", email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox visible in Register mode", over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 4: LoginButton press switches back to Login mode ---
+	login_button.pressed.emit()
+	await process_frame
+
+	if _check("Login mode label after second LoginButton press", auth_mode_label.text == "Login"):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field hidden after switching back to Login", not email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox hidden after switching back to Login", not over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 5: ModeToggle CheckButton no longer exists ---
+	var mode_toggle_path = "CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle"
+	var has_mode_toggle = instance.has_node(mode_toggle_path)
+	if _check("ModeToggle CheckButton removed from scene", not has_mode_toggle):
+		passed += 1
+	else:
+		failed += 1
+
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
+	quit(0 if failed == 0 else 1)
+
+
+func _check(description: String, condition: bool) -> bool:
+	if condition:
+		print("  PASS: ", description)
+	else:
+		printerr("  FAIL: ", description)
+	return condition

scripts/smoke_test_world_list.gd

@@ -16,15 +16,27 @@ extends SceneTree
 ##
 ## Tests:
 ##   1. Register + log in a fresh user (so get_worlds() has a valid token).
-##   2. Instantiate world_list.tscn, add to tree -- @onready resolution
+##   2. POST a real world via the API so the populated-card path actually
+##      gets exercised -- run_checkpoint_tests.py always starts from a
+##      genuinely empty DB, so without this the card-rendering code below
+##      would never run in CI at all, only the empty-list path would.
+##   3. Instantiate world_list.tscn, add to tree -- @onready resolution
 ##      must not error.
-##   3. Wait for _refresh_worlds()'s awaited request to complete.
-##   4. Confirm the screen reached a real end state (world cards, or the
-##      empty-list message -- either is fine, a crash/stuck-loading isn't).
+##   4. Wait for _refresh_worlds()'s awaited request to complete.
+##   5. Confirm it actually reached the populated (not empty) state, and
+##      that the rendered card has a real width -- not just non-zero
+##      child_count. 2026-08-20: a real bug shipped where every card
+##      technically existed in the tree (child_count > 0, no error, no
+##      crash) but rendered at 1.0px wide because size_flags_horizontal/
+##      vertical used the raw integer 4 (Control.SIZE_SHRINK_CENTER)
+##      instead of 3 (Control.SIZE_EXPAND_FILL) on ScrollContainer -- a
+##      child-count check alone would never catch that, only a real size
+##      assertion does.
 ##
 ## Exits 0 on full pass, 1 on any failure.
 
 const WORLD_LIST_SCENE := "res://scenes/world_list.tscn"
+const MIN_SANE_CARD_WIDTH := 200.0  # a real screen is at minimum a few hundred px wide
 
 
 func _initialize() -> void:
@@ -46,12 +58,25 @@ func _run() -> void:
 	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
 	var username := "worldlist_smoke_%d" % unique_id
 	var email := "worldlist_smoke_%d@test.example.com" % unique_id
-	var reg_result: Dictionary = await api.register(username, email, "SmokeTest123!", "2000-01-01")
+	var reg_result: Dictionary = await api.register(username, email, "SmokeTest123!", true)
 	if not _check("setup: register succeeded", reg_result.ok):
 		print("  detail: ", reg_result.detail)
 		quit(1)
 		return
 
+	# --- Seed a real world so the populated-card path is actually exercised ---
+	print("\n=== Setup: seed a real world ===")
+	var world_body := JSON.stringify({
+		"name": "Smoke Test World %d" % unique_id,
+		"description": "Seeded by smoke_test_world_list.gd to exercise the populated-card render path.",
+		"visibility": "public",
+	})
+	var create_result: Dictionary = await api.request(HTTPClient.METHOD_POST, "/api/worlds/", world_body, "application/json", true)
+	if not _check("setup: world created", create_result.ok):
+		print("  detail: ", create_result.detail)
+		quit(1)
+		return
+
 	# --- Test 1: Instantiate the real scene ---
 	print("\n=== Test 1: Instantiate world_list.tscn ===")
 	var packed_scene: PackedScene = load(WORLD_LIST_SCENE)
@@ -99,10 +124,31 @@ func _run() -> void:
 
 	if error_label.visible:
 		printerr("  Note: ended in error state: ", error_label.text)
-	elif world_list_node.visible:
-		print("  Note: rendered %d world card(s)" % world_list_node.get_child_count())
 	elif empty_label.visible:
-		print("  Note: ended in empty-list state")
+		# We just seeded a world -- ending up empty means GET /api/worlds
+		# isn't actually seeing what POST /api/worlds/ just created.
+		_check("ended in populated state, not empty (a world was just seeded)", false)
+		failed += 1
+	elif world_list_node.visible:
+		var card_count := world_list_node.get_child_count()
+		print("  Note: rendered %d world card(s)" % card_count)
+
+		if _check("at least one card rendered", card_count > 0):
+			passed += 1
+		else:
+			failed += 1
+
+		# The actual bug this test exists to catch: a card can be present
+		# in the tree, not crash, and still be visually nothing because
+		# it rendered at ~1px wide. Check every card's real computed size,
+		# not just that it exists.
+		for i in range(card_count):
+			var card: Control = world_list_node.get_child(i)
+			var wide_enough := card.size.x >= MIN_SANE_CARD_WIDTH
+			if _check("card %d has a real width (%.0fpx >= %.0fpx)" % [i, card.size.x, MIN_SANE_CARD_WIDTH], wide_enough):
+				passed += 1
+			else:
+				failed += 1
 
 	# --- Summary ---
 	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])

scripts/world_list.gd

@@ -88,10 +88,26 @@ func _refresh_worlds() -> void:
 
 ## Create a visual card for a single world entry.
 func _create_world_card(world_dict: Dictionary) -> Control:
+	# PanelContainer for the background, not a ColorRect moved to child index
+	# 0 of a VBoxContainer -- a VBoxContainer lays out ALL its children in a
+	# vertical sequence, it has no concept of "float this one child behind
+	# the others as an overlay". That version rendered as an empty dark bar
+	# sitting above the text, not a background behind it.
+	var panel := PanelContainer.new()
+	panel.size_flags_horizontal = Control.SIZE_EXPAND_FILL
+	panel.custom_minimum_size = Vector2(0, 80)
+	var style := StyleBoxFlat.new()
+	style.bg_color = Color(0.15, 0.15, 0.15, 1.0)
+	style.content_margin_left = 12
+	style.content_margin_right = 12
+	style.content_margin_top = 8
+	style.content_margin_bottom = 8
+	panel.add_theme_stylebox_override("panel", style)
+
 	var card := VBoxContainer.new()
-	card.size_flags_horizontal = Control.SIZE_FILL
-	card.custom_minimum_size = Vector2(0, 80)
+	card.size_flags_horizontal = Control.SIZE_EXPAND_FILL
 	card.add_theme_constant_override("separation", 4)
+	panel.add_child(card)
 
 	var name_label := Label.new()
 	name_label.text = world_dict.get("name", "Unnamed World")
@@ -123,13 +139,4 @@ func _create_world_card(world_dict: Dictionary) -> Control:
 	card.add_child(desc_label)
 	card.add_child(meta_label)
 
-	# Subtle background for the card
-	var bg := ColorRect.new()
-	bg.color = Color(0.15, 0.15, 0.15, 1.0)
-	bg.size_flags_horizontal = Control.SIZE_FILL
-	bg.size_flags_vertical = Control.SIZE_FILL
-	bg.custom_minimum_size = Vector2(0, 80)
-	card.add_child(bg)
-	card.move_child(bg, 0)
-
-	return card
+	return panel