WIP checkpoint: Address review feedback: Implement Godot dedicated server scene + player spawning

Two genuine bugs, found by reproducing rather than trusting the branch's
own state:

1. scenes/player.tscn collided with PC2's client-side player scene at the
   exact same path (server-authoritative PlayerNode vs. the local
   single-player character) -- whichever merged last would silently
   overwrite the other. The branch's own last commit had literally
   committed unresolved <<<<<<< conflict markers into the file instead of
   resolving them. Renamed the server's version to
   scenes/server_player.tscn, restored scenes/player.tscn to match main's
   real client scene exactly, repointed scripts/server.gd's preload.

2. scenes/server.tscn's root Node had no script attached at all -- it only
   ever worked before because project.godot had `Server` registered as a
   project-wide autoload (the exact wholesale-overwrite this task was
   already asked to fix). Once that autoload was correctly removed,
   nothing attached server.gd to the scene tree anymore and the dedicated
   server silently did nothing. Attached scripts/server.gd directly to
   scenes/server.tscn's root node instead.

Verified: godot --headless --import/--quit both clean, full 10-suite
client smoke test all passing, and the dedicated server actually listens
on UDP port 7777 when launched explicitly (`godot --path . scenes/server.tscn`)
-- confirmed with `ss -ulnp`, not just trusting the startup print (first
checked with `ss -tlnp`, which only shows TCP and falsely suggested it
wasn't listening at all; ENet is UDP).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6rUEynmv2QmweocAQYARN

.godot/.gdignore

@@ -0,0 +1 @@
+

.godot/editor/filesystem_cache10

@@ -0,0 +1,73 @@
+63f7b34db8d8cdea90c76aacccf841ec
+::res://::1787274990
+export_presets.cfg::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+README.md::TextFile::-1::1787268304::0::1::::<><><>0<>0<><>::
+::res://addons/::1787268526
+::res://assets/::1787268526
+::res://backend/::1787268526
+alembic.ini::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+docker-compose.yml::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+pytest.ini::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+requirements.txt::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+::res://backend/alembic/::1787268526
+::res://backend/alembic/versions/::1787268526
+::res://backend/app/::1787268526
+::res://backend/app/models/::1787268526
+::res://backend/app/routers/::1787268526
+::res://backend/app/services/::1787268526
+::res://backend/tests/::1787268526
+::res://docs/::1787268526
+::res://docs/architecture/::1787268526
+avatar.md::TextFile::-1::1787268304::0::1::::<><><>0<>0<><>::
+content_moderation.md::TextFile::-1::1787268304::0::1::::<><><>0<>0<><>::
+editor.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+networking.md::TextFile::-1::1787268304::0::1::::<><><>0<>0<><>::
+pc2_test_level.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+scripting_sandbox.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+world.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+::res://docs/checkpoints/::1787268526
+PC1.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+::res://docs/planning/::1787268526
+client-server-wiring.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+economy.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+social.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+::res://docs/testing/::1787274066
+README.md::TextFile::-1::1787268526::0::1::::<><><>0<>0<><>::
+test_inventory.md::TextFile::-1::1787274066::0::1::::<><><>0<>0<><>::
+::res://scenes/::1787274066
+game.tscn::PackedScene::-1::1787273072::0::1::::<><><>0<>0<><>::res://scenes/worlds/test_level.tscn<>res://scenes/player.tscn
+main.tscn::PackedScene::-1::1787268526::0::1::::<><><>0<>0<><>::res://scripts/chunk_stream_manager.gd
+main_menu.tscn::PackedScene::-1::1787268526::0::1::::<><><>0<>0<><>::res://scripts/main_menu.gd
+player.tscn::PackedScene::-1::1787274066::0::1::::<><><>0<>0<><>::res://scripts/player.gd
+server.tscn::PackedScene::-1::1787274066::0::1::::<><><>0<>0<><>::res://scripts/server.gd
+server_player.tscn::PackedScene::-1::1787274066::0::1::::<><><>0<>0<><>::res://scripts/player_spawner.gd
+world_list.tscn::PackedScene::-1::1787268526::0::1::::<><><>0<>0<><>::res://scripts/world_list.gd
+::res://scenes/worlds/::1787270633
+test_level.tscn::PackedScene::-1::1787270633::0::1::::<><><>0<>0<><>::
+::res://scripts/::1787274066
+api_client.gd::GDScript::5412288119287126975::1787268526::0::1::::<>Node<><>0<>0<><>::
+chunk.gd::GDScript::7364239597441807588::1787268526::0::1::::Chunk<>Node3D<><>0<>0<><>::
+chunk_data_decoder.gd::GDScript::3922068956043581888::1787268526::0::1::::ChunkDataDecoder<>RefCounted<><>0<>0<><>::
+chunk_scene.gd::GDScript::9207602004456600331::1787268526::0::1::::ChunkScene<>Node3D<><>0<>0<><>::
+chunk_stream_manager.gd::GDScript::2366645676568508746::1787268526::0::1::::ChunkStreamManager<>Node<><>0<>0<><>::
+dynamic_object_node.gd::GDScript::8863349716576659118::1787268526::0::1::::DynamicObjectNode<>Node3D<><>0<>0<><>::
+main_menu.gd::GDScript::2834562513277893052::1787268526::0::1::::<>Control<><>0<>0<><>::
+player.gd::GDScript::4510795778937304264::1787274066::0::1::::Player<>CharacterBody3D<><>0<>0<><>::
+player_spawner.gd::GDScript::3637338339553764865::1787274066::0::1::::PlayerNode<>CharacterBody3D<><>0<>0<><>::
+server.gd::GDScript::6336910781803684784::1787274066::0::1::::<>Node<><>0<>0<><>::
+smoke_test_api.gd::GDScript::1760923834350699002::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_auth.gd::GDScript::3027816090663230577::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_e2e.gd::GDScript::9086409960595132737::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_enter_world.gd::GDScript::4171815758762850910::1787274066::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_main_menu_back.gd::GDScript::4436937414562273157::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_main_menu_full_flow.gd::GDScript::1948803640558784862::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_main_menu_ui.gd::GDScript::396938597300585484::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_player.gd::GDScript::3497042634752676337::1787273072::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_test_level.gd::GDScript::2607555612829866949::1787270633::0::1::::<>SceneTree<><>0<>0<><>::
+smoke_test_world_list.gd::GDScript::4300757286283894147::1787268526::0::1::::<>SceneTree<><>0<>0<><>::
+static_object_node.gd::GDScript::5276389741929225897::1787268526::0::1::::StaticObjectNode<>Node3D<><>0<>0<><>::
+tile_def.gd::GDScript::2430528079284085109::1787268526::0::1::::TileDef<>RefCounted<><>0<>0<><>::
+tile_layer.gd::GDScript::4797906255131447844::1787268526::0::1::::TileLayer<>RefCounted<><>0<>0<><>::
+tile_layer_node.gd::GDScript::9033225196818247616::1787268526::0::1::::TileLayerNode<>Node3D<><>0<>0<><>::
+world_list.gd::GDScript::6119591848847211153::1787274066::0::1::::<>Control<><>0<>0<><>::
+world_object.gd::GDScript::6429674491464200335::1787268526::0::1::::WorldObject<>RefCounted<><>0<>0<><>::

.godot/editor/project_metadata.cfg

@@ -0,0 +1,11 @@
+[game_view]
+
+select_mode=0
+
+[editor_metadata]
+
+executable_path="/home/daddy/godot/godot"
+
+[recent_files]
+
+scenes=["res://scenes/main_menu.tscn", "res://scenes/server.tscn"]

.godot/editor/server.tscn-folding-73010d7d11a63b36042ee0ee3baaed9c.cfg

@@ -0,0 +1,5 @@
+[folding]
+
+node_unfolds=[]
+resource_unfolds=[]
+nodes_folded=[]

.godot/global_script_class_cache.cfg

@@ -0,0 +1,97 @@
+list=[{
+"base": &"Node3D",
+"class": &"Chunk",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/chunk.gd"
+}, {
+"base": &"RefCounted",
+"class": &"ChunkDataDecoder",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/chunk_data_decoder.gd"
+}, {
+"base": &"Node3D",
+"class": &"ChunkScene",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/chunk_scene.gd"
+}, {
+"base": &"Node",
+"class": &"ChunkStreamManager",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/chunk_stream_manager.gd"
+}, {
+"base": &"Node3D",
+"class": &"DynamicObjectNode",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/dynamic_object_node.gd"
+}, {
+"base": &"CharacterBody3D",
+"class": &"Player",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/player.gd"
+}, {
+"base": &"CharacterBody3D",
+"class": &"PlayerNode",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/player_spawner.gd"
+}, {
+"base": &"Node3D",
+"class": &"StaticObjectNode",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/static_object_node.gd"
+}, {
+"base": &"RefCounted",
+"class": &"TileDef",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/tile_def.gd"
+}, {
+"base": &"RefCounted",
+"class": &"TileLayer",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/tile_layer.gd"
+}, {
+"base": &"Node3D",
+"class": &"TileLayerNode",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/tile_layer_node.gd"
+}, {
+"base": &"RefCounted",
+"class": &"WorldObject",
+"icon": "",
+"is_abstract": false,
+"is_tool": false,
+"language": &"GDScript",
+"path": "res://scripts/world_object.gd"
+}]

backend/app/routers/auth.py

@@ -7,7 +7,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from fastapi.security import OAuth2PasswordRequestForm
 from jose import JWTError, jwt
 from passlib.context import CryptContext
-from pydantic import BaseModel, EmailStr, field_validator
+from pydantic import BaseModel, EmailStr
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -39,17 +39,7 @@ class RegisterRequest(BaseModel):
     username: str
     email: EmailStr
     password: str
-    date_of_birth: str  # ISO format date string (YYYY-MM-DD)
+    over_18: bool  # Simple boolean confirmation instead of date_of_birth
-
-    @field_validator("date_of_birth")
-    @classmethod
-    def validate_date_of_birth(cls, v: str) -> str:
-        """Validate that the date string is a valid date in YYYY-MM-DD format."""
-        try:
-            datetime.strptime(v, "%Y-%m-%d")
-        except ValueError:
-            raise ValueError("date_of_birth must be in YYYY-MM-DD format")
-        return v
 
 
 class UserResponse(BaseModel):
@@ -118,6 +108,16 @@ def hash_password(password: str) -> str:
 def calculate_age(birth_date: date, today: date | None = None) -> int:
     """Calculate age in years from a birth date.
 
+    Not called by /register anymore (that endpoint now just trusts the
+    client's over_18 boolean, see RegisterRequest) -- kept as a real,
+    tested utility since date-of-birth storage/verification is coming
+    back in a future pass (real age math, not just a client-side claim,
+    the user explicitly wants to revisit this design). Removing it broke
+    backend/tests/test_auth_age_gate.py's collection entirely (ImportError
+    on `from app.routers.auth import calculate_age`) for zero benefit --
+    restoring it is the lower-risk path over rewriting or deleting 17
+    tests for logic this codebase will need again.
+
     Args:
         birth_date: The person's date of birth.
         today: The reference date. Defaults to today's date (UTC).
@@ -155,16 +155,12 @@ def _issue_refresh_token(user_id: int, db: AsyncSession) -> str:
 async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
     """Register a new user and return access + refresh tokens.
 
-    Requires date_of_birth and rejects users under 18.
+    Requires over_18 boolean confirmation; rejects users who are not 18+.
     """
-    # Parse and validate date_of_birth
+    if not req.over_18:
-    dob = datetime.strptime(req.date_of_birth, "%Y-%m-%d").date()
-    age = calculate_age(dob)
-
-    if age < 18:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Must be 18 or older to register (provided date of birth: {req.date_of_birth})",
+            detail="Must be 18 or older to register",
         )
 
     # Check if username already exists
@@ -187,7 +183,7 @@ async def register(req: RegisterRequest, db: AsyncSession = Depends(get_db)):
         username=req.username,
         email=req.email,
         hashed_password=hash_password(req.password),
-        date_of_birth=dob,
+        date_of_birth=None,  # No longer collecting DOB
     )
     db.add(user)
     await db.flush()  # flush to get user.id before creating refresh token

backend/tests/test_auth_age_gate.py

@@ -57,38 +57,38 @@ class TestCalculateAge:
         assert calculate_age(dob, today=date(2024, 12, 31)) == 24
 
 
-class TestRegisterRequestDateValidation:
+class TestRegisterRequestOver18Field:
-    """Tests for the RegisterRequest date_of_birth field validator."""
+    """Tests for RegisterRequest's over_18 field.
 
-    @pytest.mark.parametrize(
+    Replaces TestRegisterRequestDateValidation -- date_of_birth and its
-        "dob",
+    field_validator were removed from RegisterRequest 2026-08-20 (interim
-        [
+    simplification: a plain client-side over_18 confirmation instead of
-            "2000-01-01",
+    collecting/validating an actual date of birth; see calculate_age's
-            "1990-12-31",
+    own docstring in app/routers/auth.py for why that function is still
-            "2004-02-29",  # leap day
+    here even though this endpoint no longer calls it). There's no date
-        ],
+    format left to validate, so the equivalent coverage is just: the
-    )
+    field exists, is a real bool, and is required."""
-    def test_valid_dates(self, dob):
+
-        """Valid YYYY-MM-DD dates pass validation."""
+    def test_over_18_true_accepted(self):
         from app.routers.auth import RegisterRequest
 
-        req = RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
+        req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=True)
-        assert req.date_of_birth == dob
+        assert req.over_18 is True
 
-    @pytest.mark.parametrize(
+    def test_over_18_false_accepted(self):
-        "dob",
+        """False is a valid value at the schema level -- the endpoint,
-        [
+        not the schema, is what rejects it (see
-            "01-01-2000",
+        TestRegister::test_register_rejects_not_over_18 in
-            "2000/01/01",
+        test_auth_endpoints.py)."""
-            "2000-13-01",
-            "2000-00-10",
-            "not-a-date",
-            "",
-        ],
-    )
-    def test_invalid_dates_rejected(self, dob):
-        """Invalid dates are rejected by the validator."""
         from app.routers.auth import RegisterRequest
 
-        with pytest.raises(ValueError):
+        req = RegisterRequest(username="u", email="u@example.com", password="p", over_18=False)
-            RegisterRequest(username="u", email="u@example.com", password="p", date_of_birth=dob)
+        assert req.over_18 is False
+
+    def test_over_18_missing_rejected(self):
+        """over_18 has no default -- omitting it entirely is a validation error."""
+        from app.routers.auth import RegisterRequest
+        from pydantic import ValidationError
+
+        with pytest.raises(ValidationError):
+            RegisterRequest(username="u", email="u@example.com", password="p")

backend/tests/test_auth_endpoints.py

@@ -73,7 +73,7 @@ class TestRegister:
                 "username": "newuser",
                 "email": "new@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201
@@ -81,8 +81,14 @@ class TestRegister:
         assert "access_token" in data
         assert data["token_type"] == "bearer"
 
-    def test_register_rejects_underage(self):
+    def test_register_rejects_not_over_18(self):
-        """Users under 18 get a 400 with a detail message."""
+        """over_18=false gets a 400 with a detail message.
+
+        The interim design (2026-08-20) trusts a client-side boolean
+        confirmation instead of collecting/validating an actual date of
+        birth -- this only checks that the flag is respected, not real
+        age math (there's no date to verify against anymore). Real DOB
+        collection/verification may come back in a future pass."""
         client = TestClient(app)
         resp = client.post(
             "/api/auth/register",
@@ -90,7 +96,7 @@ class TestRegister:
                 "username": "kid",
                 "email": "kid@example.com",
                 "password": "secret123",
-                "date_of_birth": "2010-06-15",  # ~15 years old
+                "over_18": False,
             },
         )
         assert resp.status_code == 400
@@ -106,7 +112,7 @@ class TestRegister:
                 "username": "duplicate",
                 "email": "dup1@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         # Second registration with same username, different email
@@ -116,7 +122,7 @@ class TestRegister:
                 "username": "duplicate",
                 "email": "dup2@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 409
@@ -131,7 +137,7 @@ class TestRegister:
                 "username": "user1",
                 "email": "same@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         resp = client.post(
@@ -140,14 +146,19 @@ class TestRegister:
                 "username": "user2",
                 "email": "same@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 409
         assert "Email already registered" in resp.json()["detail"]
 
-    def test_register_invalid_date_format(self):
+    def test_register_missing_over_18(self):
-        """Invalid date format returns 422 validation error."""
+        """Missing the required over_18 field returns 422.
+
+        Replaces the old test_register_invalid_date_format -- there's no
+        date format to get wrong anymore (no date field at all), so the
+        closest equivalent "malformed request" case is the required
+        over_18 boolean being absent entirely."""
         client = TestClient(app)
         resp = client.post(
             "/api/auth/register",
@@ -155,25 +166,10 @@ class TestRegister:
                 "username": "user",
                 "email": "user@example.com",
                 "password": "secret123",
-                "date_of_birth": "01-01-2000",  # wrong format
             },
         )
         assert resp.status_code == 422
 
-    def test_register_exactly_18(self):
-        """A user who just turned 18 can register."""
-        client = TestClient(app)
-        resp = client.post(
-            "/api/auth/register",
-            json={
-                "username": "just18",
-                "email": "just18@example.com",
-                "password": "secret123",
-                "date_of_birth": "2007-06-15",
-            },
-        )
-        assert resp.status_code == 201
-
 
 # ---------------------------------------------------------------------------
 # Login endpoint
@@ -193,7 +189,7 @@ class TestLogin:
                 "username": username,
                 "email": email,
                 "password": password,
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201

backend/tests/test_auth_expired_token.py

@@ -93,7 +93,7 @@ def _register_user(client: TestClient, username: str) -> str:
             "username": username,
             "email": f"{username}@example.com",
             "password": "secret123",
-            "date_of_birth": "2000-01-01",
+            "over_18": True,
         },
     )
     assert resp.status_code == 201

backend/tests/test_refresh_endpoint.py

@@ -59,7 +59,7 @@ class TestRefresh:
                 "username": username,
                 "email": email,
                 "password": password,
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         assert resp.status_code == 201
@@ -143,7 +143,7 @@ class TestRefresh:
                 "username": "refep_loginrefuser",
                 "email": "loginref@example.com",
                 "password": "secret123",
-                "date_of_birth": "2000-01-01",
+                "over_18": True,
             },
         )
         # Login to get a refresh token

docs/architecture/pc2_test_level.md

@@ -0,0 +1,194 @@
+# PC2 Test Level & Player Spawn — Design Note
+
+> **Status:** Decided (PC2)
+> **Owner:** Architecture
+> **Consumers:** the two PC2 implementation tasks — (1) build the test level,
+> (2) build the player & spawn it. Both must be able to follow this note
+> without further design decisions.
+
+## 1. Decision: static scene, not chunk streaming
+
+**The PC2 playable test level is a single, hand-authored, static Godot 3D
+scene.** It is **not** built through the chunk streaming system
+(`scripts/chunk_stream_manager.gd`, `chunk_scene.gd`, `chunk.gd`,
+`chunk_data_decoder.gd`).
+
+This is a deliberate decision, not a default:
+
+- **The streaming system has never been exercised with real content.** It is a
+  faithful port of the `docs/architecture/world.md` format spec, but nothing in
+  the project produces or serves chunk payloads for it to consume. `scenes/main.tscn`
+  wires `chunk_stream_manager.gd` onto a bare `Node3D` with no `player` reference
+  and no `_server_rpc`, so at runtime it does nothing. There is no server-side
+  chunk authoring/streaming endpoint to integrate against.
+- **PC2 scope is single-player, local-only, no networking.** The value of chunk
+  streaming is server-authoritative streaming around a moving player across a
+  network boundary. None of those preconditions exist in PC2, so exercising the
+  pipeline here would mean building a chunk *authoring + serving* path first —
+  clearly out of checkpoint scope.
+- **A static scene is the lowest-risk way to get "spawn a player in a real 3D
+  level and walk around" working**, which is the actual PC2 outcome being tested.
+
+Chunk streaming is **not removed and not broken by this decision** — it stays as
+an optional, later milestone. The static level is the PC2 proof of the *player*
+and *camera/physics* half of the problem; chunk streaming remains the later proof
+of the *world data* half.
+
+## 2. Where things live
+
+| Artifact | Path | Owned by |
+|---|---|---|
+| Test level scene | `scenes/worlds/test_level.tscn` | level task |
+| Player scene | `scenes/player.tscn` | player task |
+| Player controller script | `scripts/player.gd` | player task |
+| Game composition scene | `scenes/game.tscn` | player task |
+
+- **`scenes/worlds/`** is the convention for all level scenes (it does not exist
+  yet; the level task creates it). Future levels follow `scenes/worlds/<name>.tscn`.
+- `scenes/player.tscn` is **reusable** across levels — it must not hard-code any
+  reference to `test_level`; it discovers the spawn point at runtime (see §3).
+
+## 3. Player spawn convention
+
+The level scene **must** contain a `Marker3D` named exactly **`PlayerSpawn`**.
+That node's world transform is the spawn point.
+
+- `Marker3D` is a plain `Node3D` that shows a cross gizmo in the editor and
+  carries no gameplay behavior — it is the established Godot idiom for "position
+  hint." (Confirmed present in Godot 4.6.2.)
+- The marker's **position** is authoritative; its rotation is ignored by the
+  player (spawn yaw is the player's concern, default forward is fine).
+- Coordinate system: **Y-up, units = meters, 1 unit = 1 m.** The marker must sit
+  at least **1.0 m above the ground's top surface** (recommended `y = 1.0` where
+  the ground top is `y = 0`) so the player capsule does not spawn intersecting
+  the floor and get popped out by the physics solver.
+- There is exactly **one** `PlayerSpawn` per level. (If a level ever needs
+  multiple spawns, that is a later convention — not PC2.)
+
+**Lookup rule (implemented by `player.gd`, not by the level):**
+
+```
+# in player.gd _ready()
+var spawn := get_tree().current_scene.find_child("PlayerSpawn", true, false)
+if spawn is Node3D:
+    global_position = spawn.global_position
+else:
+    push_warning("player.gd: no PlayerSpawn marker found; spawning at origin")
+    global_position = Vector3(0, 1.0, 0)   # fallback, do not crash
+```
+
+The lookup runs from the current scene root so it finds the marker whether it is
+a direct child of the level instance or nested under a `Level` wrapper. The
+fallback keeps the player runnable in a scene that forgot its marker, but a
+**missing `PlayerSpawn` is a level bug** and the level task's smoke test must fail
+on it (see §6).
+
+## 4. Composition (who puts level + player together)
+
+`scenes/game.tscn` is the PC2 playable entry point:
+
+```
+Game (Node3D)
+├── Level      (instance of res://scenes/worlds/test_level.tscn)
+└── Player     (instance of res://scenes/player.tscn)
+```
+
+- `Game` is a plain `Node3D` with **no script** — composition is done by scene
+  instantiation, not code, so there is nothing to keep in sync.
+- The **level scene is self-contained and has zero dependency on the player** —
+  it loads and is smoke-testable on its own. The level task does not instance or
+  reference `player.tscn`.
+- The **player scene is self-contained and has zero dependency on any specific
+  level** — it only requires that the *current scene* contains a `PlayerSpawn`.
+- Ownership of `game.tscn` goes to the **player task**, which depends on the
+  level task having landed `test_level.tscn` first (chain with `depends_on`).
+
+## 5. Level content requirements (level task)
+
+`scenes/worlds/test_level.tscn`, root node `TestLevel` (`Node3D`). Required
+children:
+
+| Node | Type | Notes |
+|---|---|---|
+| `Ground` | `StaticBody3D` | `BoxShape3D` (e.g. `40 × 1 × 40`) centered at `(0, -0.5, 0)` so the **top face is `y = 0`**; matching `MeshInstance3D` (`BoxMesh`) so it is visible and collidable. Use a `StaticBody3D` rather than a bare `PlaneMesh` so collision is explicit and reliable. |
+| `Props` | `Node3D` | 3–5 simple props as `StaticBody3D` + `MeshInstance3D` using built-in primitives only (`BoxMesh`, `CylinderMesh`, `SphereMesh`). `assets/` is empty and PC2 must not require imported content. Positioned on the ground surface; scale freely. |
+| `Sun` | `DirectionalLight3D` | Pitch it downward (~ -45°), enable shadows if the compatibility renderer allows; shadows are optional. |
+| `WorldEnvironment` | `WorldEnvironment` | Ambient light and/or a simple background color. Keep it plain — the project uses `gl_compatibility`. |
+| `PlayerSpawn` | `Marker3D` | Per §3. Recommended `(0, 1.0, 0)`. |
+
+Notes:
+
+- **Do not** add any `script` to the level. It is pure content. Any per-level
+  behavior belongs to the player (or a future game-mode script), not the level.
+- Keep the whole level on the XZ plane around the origin; nothing off at extreme
+  coordinates, no thin walls the capsule can tunnel through.
+
+## 6. Player contract (player task)
+
+`scenes/player.tscn`, root `Player` (`CharacterBody3D`) + `scripts/player.gd`.
+
+Minimum for PC2:
+
+- **Body:** `CharacterBody3D` with a `CollisionShape3D` using `CapsuleShape3D`
+  (~`radius 0.3`, ~`height 1.8`) and a matching `CapsuleMesh` for visibility.
+- **Camera:** a `Camera3D` child. First-person (camera at capsule head height) is
+  the lowest-risk choice; third-person is fine too but is more work.
+- **Spawn:** per §3 — read `PlayerSpawn` from the current scene, fall back
+  gracefully.
+- **Movement:** gravity + `move_and_slide()` so the player stands on `Ground`.
+  WASD/arrow locomotion is the hard requirement. Mouse-look is recommended but
+  may be split into its own task if the controller grows.
+- **No networking, no avatar UI, no chunk code** — PC2 is local-only. Do not add
+  `MultiplayerAPI`, `ChunkStreamManager`, or any avatar customization here.
+
+The player must work when instanced under `Game` alongside a level; it must not
+assume it is the only node in the scene.
+
+## 7. Entry point / how a human plays it
+
+- `scenes/game.tscn` is the PC2 playable scene. For playtesting, load it directly
+  (e.g. `godot --path . scenes/game.tscn`), or temporarily set
+  `application/run/main_scene` to it.
+- **Wiring "Play → Join a world" in the existing `world_list` UI is out of scope
+  for this note** and out of scope for the level/player tasks. The current menu
+  flow ends at browse-worlds (PC1). If a checkpoint wants a clickable path into
+  the test level, that navigation wiring is its own small task — do not fold it
+  into level or player.
+
+## 8. Validation (both tasks must run this before "done")
+
+```sh
+# one-time, first checkout only — builds the class/import cache
+godot --headless --path . --import
+
+# then, to catch parse/load errors:
+godot --headless --path . --quit
+```
+
+- **Level task:** additionally load `test_level.tscn` headlessly and assert it
+  (a) loads without error and (b) contains a `Marker3D` named `PlayerSpawn`
+  positioned ≥ 1.0 m above the ground top. A smoke script following the existing
+  `scripts/smoke_test_*.gd` pattern is the right vehicle.
+- **Player task:** a smoke test that instantiates `game.tscn`, waits a frame,
+  and asserts the player's global position equals the `PlayerSpawn` position
+  (within a small epsilon). This is the check that proves the spawn convention
+  actually wired through — not just "the scene loads."
+
+## 9. Explicitly out of scope for PC2
+
+- Networking / multiplayer / prediction (single-player, local-only).
+- Chunk streaming integration and server-side chunk authoring/serving.
+- Avatar customization UI and glTF avatar loading.
+- Join-a-world navigation from the world list.
+- Any content moderation / age-gating logic in the level.
+
+## 10. Summary
+
+| Concern | Decision |
+|---|---|
+| Level construction | Static hand-authored Godot 3D scene (chunk streaming deferred, not removed) |
+| Level location | `scenes/worlds/test_level.tscn` |
+| Spawn convention | `Marker3D` named `PlayerSpawn`, ≥ 1.0 m above ground, looked up by the player |
+| Player | `scenes/player.tscn` (`CharacterBody3D`) + `scripts/player.gd`, reusable across levels |
+| Composition | `scenes/game.tscn` instances `Level` + `Player`; no script |
+| Entry point | Load `scenes/game.tscn` directly; UI join-wiring deferred |

docs/testing/test_inventory.md

@@ -7,26 +7,27 @@ to know what "run the tests" actually checked.
 
 Run everything below in one shot with `scripts/run_checkpoint_tests.py`.
 
-Last verified against `main`: 2026-08-20 — full PC1 checkpoint run,
+Last verified against `main`: 2026-08-21 — migrations + pytest + all 10
-migrations + pytest + all 6 Godot smoke tests + both platform exports, all
+Godot smoke tests, all clean. PC1's real playtest-found bugs (login form
-clean. Two real bugs found and fixed via real playtesting this same day
+unreachable, 1px world cards, Play → Back losing the session) are covered
-(not caught by the checkpoint suite as it stood before today): the main
+by the smoke tests below so they can't silently regress. PC2 (basic
-menu had no way to actually open the login/register form, and the world
+playable world + character + movement) landed 2026-08-20/21 — see
-list's cards rendered at ~1px wide once real data existed. Both are now
+`docs/checkpoints/` once a PC2 record exists, and the three new smoke
-covered by the smoke tests below so they can't silently regress.
+tests below (`smoke_test_test_level.gd`, `smoke_test_player.gd`,
+`smoke_test_enter_world.gd`) for what's actually verified.
 
 ## Backend — `backend/tests/` (pytest)
 
 Run: `cd backend && python -m pytest -v` (needs `DATABASE_URL` pointed at a
 reachable Postgres — see the runner script).
 
-**Current total: 68 tests, all passing on a clean `main` checkout.**
+**Current total: 61 tests, all passing on a clean `main` checkout.**
 
 | File | Tests | What it covers |
 |---|---|---|
-| `test_auth_age_gate.py` | 17 | `calculate_age()` date-math correctness (exact boundary, leap years, birthday-not-yet-this-year) + `RegisterRequest` date-of-birth validation (parametrized valid/invalid date rejection). Backs the 18+ registration gate (PR #23). |
+| `test_auth_age_gate.py` | 11 | `calculate_age()` date-math correctness (exact boundary, leap years, birthday-not-yet-this-year — kept as a tested utility for a future real-DOB pass even though `/register` no longer calls it) + `RegisterRequest.over_18` field tests (true accepted, false accepted, missing rejected). 2026-08-20: the register flow was simplified from collecting/validating a date of birth to a plain client-side "I am 18 or older" confirmation, so the old date-validation parametrized cases were replaced. Backs the 18+ registration gate (PR #23, revised PC1). |
 | `test_gltf_metadata.py` | 21 | glTF/GLB binary + JSON parsing: magic-byte detection, chunk-padding handling, mesh/animation/texture-reference metadata extraction, malformed-input rejection. Backs the asset-import pipeline (PR #27). |
-| `test_auth_endpoints.py` | 11 | **Integration tests** for `POST /api/auth/register` and `POST /api/auth/login` against the real FastAPI app + real Postgres. Covers: successful register (201), duplicate username (409), duplicate email (409), underage rejection (400), invalid date format (422), exact-18 registration, successful login with correct credentials (200), wrong password (401), nonexistent user (401), form-encoded login (OAuth2), and JWT validity of returned tokens. |
+| `test_auth_endpoints.py` | 10 | **Integration tests** for `POST /api/auth/register` and `POST /api/auth/login` against the real FastAPI app + real Postgres. Covers: successful register (201), duplicate username (409), duplicate email (409), `over_18=false` rejection (400), missing `over_18` field (422), successful login with correct credentials (200), wrong password (401), nonexistent user (401), form-encoded login (OAuth2), and JWT validity of returned tokens. |
 | `test_refresh_endpoint.py` | 8 | **Integration tests** for `POST /api/auth/refresh`. Covers: successful refresh (200, new access token, same refresh token returned), refresh produces different access tokens on repeated calls, invalid refresh token (401), empty body (422), missing field (422), refresh token from login also works, returned access token is valid JWT decodable with public key, `access_token_expires_minutes` in response. |
 | `test_refresh_token_jti.py` | 6 | Unit tests for refresh token uniqueness (jti claim) and model column length. Covers: two calls with same sub produce different tokens (jti uniqueness), jti is valid UUID, rapid repeated calls all produce unique jtis, jti survives decode, `RefreshToken.token` column is `String(512)`, column type is `String`. |
 | `test_auth_expired_token.py` | 5 | **Integration tests** for expired-token rejection across auth endpoints. Covers: expired access JWT rejected by `GET /api/auth/me` (401), garbage access token rejected by `/me` (401), missing bearer token returns 401, expired refresh token (DB `expires_at` in past) rejected by `/refresh` (401), expired refresh JWT (past `exp` claim) rejected before DB lookup (401). |
@@ -52,7 +53,7 @@ these yet):
 
 ## Godot client — `scripts/smoke_test_*.gd`
 
-**6 smoke tests merged into `main`.** Each needs a live backend —
+**10 smoke tests merged into `main`.** Each needs a live backend —
 `AGP_API_BASE_URL` env var, falling back to the
 `application/agp/api_base_url` project setting (default
 `http://127.0.0.1:8000`) if unset.
@@ -60,11 +61,15 @@ these yet):
 | File | What it covers |
 |---|---|
 | `smoke_test_api.gd` | Exercises `ApiClient.health_check()` against a live backend. Verifies the real HTTP request path (`HTTPRequest` node lifecycle, JSON parse, result-dictionary contract). Exits 1 on failure. |
-| `smoke_test_auth.gd` | Tests the full auth flow via `ApiClient` autoload: register unique user (201), duplicate username (409), under-18 registration (400), correct login (200), wrong password (401), nonexistent user (401). |
+| `smoke_test_auth.gd` | Tests the full auth flow via `ApiClient` autoload: register unique user (201), duplicate username (409), `over_18=false` registration (400), correct login (200), wrong password (401), nonexistent user (401). |
 | `smoke_test_e2e.gd` | End-to-end flow: health check → register → login → worlds list. Verifies the full request chain with a fresh user, including token storage and `get_worlds()` with auth header. |
 | `smoke_test_world_list.gd` | Registers a user, **seeds a real world via `POST /api/worlds/`** (without this, `run_checkpoint_tests.py`'s always-fresh DB means the populated-card render path never actually runs in CI, only the empty-list path would), instantiates `world_list.tscn` as a real scene, waits for `_refresh_worlds()` to complete, confirms it reached the populated (not empty) state, and asserts **each rendered card's real computed width is >= 200px**. That last check is the one that matters: 2026-08-20, a real bug shipped where every card existed in the tree with a non-zero child count and no crash, but rendered at 1.0px wide (`ScrollContainer`'s `size_flags_horizontal`/`vertical` used the raw integer `4` = `Control.SIZE_SHRINK_CENTER` instead of `3` = `SIZE_EXPAND_FILL`) — invisible on screen, and a child-count-only check would never have caught it. Confirmed by deliberately reintroducing the bug: card width check correctly fails at 25px. |
 | `smoke_test_main_menu_ui.gd` | Instantiates `main_menu.tscn`, confirms the auth panel starts hidden, and confirms a **real signal emission** on LoginButton/RegisterButton (not calling the handler method directly) actually opens it. This is the check that would have caught 2026-08-20's real bug: the auth panel and its logic were fully correct, but nothing in the scene was ever wired to open it, so Login/Register were completely unreachable from the UI. |
 | `smoke_test_main_menu_full_flow.gd` | Full click-through: open the register form, fill it exactly as a user would, submit, confirm Play actually becomes enabled, the welcome message shows, and the auth buttons hide themselves. Calls the submit handler directly (awaited) rather than via `auth_button.pressed.emit()` — see the note at the top of the file: a synthetic `.emit()` on an `await`-using handler doesn't get driven forward reliably in `--script`/SceneTree headless mode the way real GUI input event dispatch does, confirmed by comparing direct-call vs `.emit()` behavior. Not a bug in the actual click-driven flow, just a headless-test-harness quirk to route around when writing tests. |
+| `smoke_test_main_menu_back.gd` | Regression test for Play → Back logging the user out even with a valid token still held. Registers a user, loads `main_menu.tscn` (asserts it restores the authenticated state via a real `auth_state_ready` signal wait, not a frame-count guess), clicks Play → `world_list.tscn`, clicks Back → `main_menu.tscn`, and asserts the menu is still authenticated. Checks `WelcomeLabel.is_visible_in_tree()`, not just `.visible` — the label lives inside AuthPanel, so `.visible` alone is a false positive if the panel itself is hidden (a real bug briefly present: `_show_authenticated()` hid AuthPanel while claiming the welcome label was visible, which rendered nothing). |
+| `smoke_test_test_level.gd` | Loads `scenes/worlds/test_level.tscn` directly (the level is player-agnostic and self-contained per `docs/architecture/pc2_test_level.md` §4) and confirms it has real content: 5 props, a `DirectionalLight3D` ("Sun"), and a `WorldEnvironment` — not an empty void. |
+| `smoke_test_player.gd` | Loads `scenes/game.tscn` and confirms the player exists as a real `CharacterBody3D` with a `CollisionShape3D`+shape, a `CapsuleMesh`, and spawns at the level's `PlayerSpawn` marker position. Also asserts `JUMP_VELOCITY` is positive and a `Camera3D` exists and is `current` — both were real bugs found 2026-08-20/21 (jump velocity was negative, pushing the player down instead of up; no camera existed at all, so the game was unplayable even though the character could technically move). Structural checks only — real movement/jump *direction* correctness was verified separately via a throwaway headless physics simulation during development, not by an automated test that's part of this suite. |
+| `smoke_test_enter_world.gd` | The full PC2 path end to end: register → seed a real world → load `world_list.tscn` → click the real "Enter World" button on a real card (found by walking the card's children, not by index, so it doesn't silently pass if the card layout changes) → confirms `scenes/game.tscn` actually becomes `current_scene` with the player spawned at the level's `PlayerSpawn` marker → sends a real `KEY_ESCAPE` input event (not a direct method call) and confirms it returns to `world_list.tscn`. This is the test that proves "browse → enter → walk around → leave" actually works as one continuous flow, not just that each piece works in isolation. |
 
 Run (once, to build the class cache): `godot --headless --path . --import`,
 then for each smoke test: `godot --headless --path . --script

project.godot

@@ -21,6 +21,29 @@ window/size/viewport_width=1920
 window/size/viewport_height=1080
 window/stretch/mode="canvas_items"
 
+[input]
+
+move_forward={
+"deadzone": 0.5,
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":87,"key_label":0,"unicode":119,"location":0,"echo":false,"script":null)
+]
+}
+move_left={
+"deadzone": 0.5,
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":65,"key_label":0,"unicode":97,"location":0,"echo":false,"script":null)
+]
+}
+move_right={
+"deadzone": 0.5,
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":68,"key_label":0,"unicode":100,"location":0,"echo":false,"script":null)
+]
+}
+move_down={
+"deadzone": 0.5,
+"events": [Object(InputEventKey,"resource_local_to_scene":false,"resource_name":"","device":-1,"window_id":0,"alt_pressed":false,"shift_pressed":false,"ctrl_pressed":false,"meta_pressed":false,"pressed":false,"keycode":0,"physical_keycode":83,"key_label":0,"unicode":115,"location":0,"echo":false,"script":null)
+]
+}
+
 [rendering]
 
 renderer/rendering_method="gl_compatibility"

scenes/game.tscn

@@ -0,0 +1,10 @@
+[gd_scene load_steps=3 format=3 uid="uid://game_scene_pc2"]
+
+[ext_resource type="PackedScene" uid="uid://c49a36fc7db_test_level" path="res://scenes/worlds/test_level.tscn" id="1_level"]
+[ext_resource type="PackedScene" uid="uid://player_scene_001" path="res://scenes/player.tscn" id="2_player"]
+
+[node name="Game" type="Node3D"]
+
+[node name="Level" parent="." instance=ExtResource("1_level")]
+
+[node name="Player" parent="." instance=ExtResource("2_player")]

scenes/main_menu.tscn

@@ -83,16 +83,12 @@ visible = false
 placeholder_text = "Email"
 size_flags_horizontal = 3
 
-[node name="DOBEdit" type="LineEdit" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
+[node name="Over18Check" type="CheckBox" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
 layout_mode = 1
 visible = false
-placeholder_text = "Date of Birth (YYYY-MM-DD)"
+text = "I am 18 or older"
 size_flags_horizontal = 3
 
-[node name="ModeToggle" type="CheckButton" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
-layout_mode = 1
-text = "Register"
-
 [node name="AuthButton" type="Button" parent="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox"]
 layout_mode = 1
 text = "Login"
@@ -125,7 +121,6 @@ size_flags_horizontal = 4
 [connection signal="pressed" from="CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton" to="." method="_on_register_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/PlayButton" to="." method="_on_play_button_pressed"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/QuitButton" to="." method="_on_quit_button_pressed"]
-[connection signal="toggled" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle" to="." method="_on_mode_toggle_toggled"]
 [connection signal="pressed" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton" to="." method="_on_auth_button_pressed"]
 [connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit" to="." method="_on_auth_button_pressed"]
 [connection signal="text_submitted" from="CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit" to="." method="_on_auth_button_pressed"]

scenes/player.tscn

@@ -0,0 +1,24 @@
+[gd_scene load_steps=3 format=3 uid="uid://player_scene_001"]
+
+[ext_resource type="Script" path="res://scripts/player.gd" id="1_player"]
+
+[sub_resource type="CapsuleMesh" id="CapsuleMesh1"]
+radius = 0.35
+height = 1.6
+
+[sub_resource type="CapsuleShape3D" id="CapsuleShape1"]
+radius = 0.35
+height = 1.6
+
+[node name="Player" type="CharacterBody3D"]
+script = ExtResource("1_player")
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="."]
+shape = SubResource("CapsuleShape1")
+
+[node name="CapsuleMesh" type="MeshInstance3D" parent="."]
+mesh = SubResource("CapsuleMesh1")
+
+[node name="Camera3D" type="Camera3D" parent="."]
+transform = Transform3D(1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0.6, 0)
+current = true

scenes/server.tscn

@@ -0,0 +1,6 @@
+[gd_scene load_steps=2 format=3]
+
+[ext_resource type="Script" path="res://scripts/server.gd" id="1_server"]
+
+[node name="Server" type="Node"]
+script = ExtResource("1_server")

scenes/server_player.tscn

@@ -0,0 +1,6 @@
+[gd_scene load_steps=2 format=3]
+
+[ext_resource type="Script" path="res://scripts/player_spawner.gd" id="1"]
+
+[node name="Player" type="CharacterBody3D"]
+script = ExtResource("1")

scenes/worlds/test_level.tscn

@@ -0,0 +1,120 @@
+[gd_scene load_steps=1 format=3 uid="uid://c49a36fc7db_test_level"]
+
+[sub_resource type="BoxShape3D" id="BoxShape3D_ground"]
+size = Vector3(40, 1, 40)
+
+[sub_resource type="BoxMesh" id="BoxMesh_ground"]
+size = Vector3(40, 1, 40)
+
+[sub_resource type="BoxShape3D" id="BoxShape3D_prop1"]
+size = Vector3(2, 3, 2)
+
+[sub_resource type="BoxMesh" id="BoxMesh_prop1"]
+size = Vector3(2, 3, 2)
+
+[sub_resource type="BoxShape3D" id="BoxShape3D_prop2"]
+size = Vector3(3, 1, 3)
+
+[sub_resource type="BoxMesh" id="BoxMesh_prop2"]
+size = Vector3(3, 1, 3)
+
+[sub_resource type="CylinderShape3D" id="CylinderShape3D_prop3"]
+top_radius = 1.0
+height = 4.0
+
+[sub_resource type="CylinderMesh" id="CylinderMesh_prop3"]
+top_radius = 1.0
+bottom_radius = 1.0
+height = 4.0
+subdivisions_top_radius = 8
+
+[sub_resource type="SphereShape3D" id="SphereShape3D_prop4"]
+radius = 1.0
+
+[sub_resource type="SphereMesh" id="SphereMesh_prop4"]
+radius = 1.0
+subdivisions_ring = 12
+subdivisions_height = 12
+
+[sub_resource type="SphereShape3D" id="SphereShape3D_prop5"]
+radius = 0.5
+
+[sub_resource type="SphereMesh" id="SphereMesh_prop5"]
+radius = 0.5
+subdivisions_ring = 8
+subdivisions_height = 8
+
+[sub_resource type="Environment" id="WorldEnvironment_env"]
+background_mode = 1
+background_color = Color(0.4, 0.6, 0.8, 1)
+ambient_light_source = 1
+ambient_light_energy = 0.4
+ambient_light_sky_energy = 1.0
+
+[node name="TestLevel" type="Node3D"]
+
+[node name="Ground" type="StaticBody3D" parent="."]
+position = Vector3(0, -0.5, 0)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Ground"]
+shape = SubResource("BoxShape3D_ground")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Ground"]
+mesh = SubResource("BoxMesh_ground")
+
+[node name="Props" type="Node3D" parent="."]
+
+[node name="Prop1_Box" type="StaticBody3D" parent="Props"]
+position = Vector3(8, 1.5, 8)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop1_Box"]
+shape = SubResource("BoxShape3D_prop1")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop1_Box"]
+mesh = SubResource("BoxMesh_prop1")
+
+[node name="Prop2_Pedestal" type="StaticBody3D" parent="Props"]
+position = Vector3(-8, 0.5, 6)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop2_Pedestal"]
+shape = SubResource("BoxShape3D_prop2")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop2_Pedestal"]
+mesh = SubResource("BoxMesh_prop2")
+
+[node name="Prop3_Column" type="StaticBody3D" parent="Props"]
+position = Vector3(6, 2.0, -8)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop3_Column"]
+shape = SubResource("CylinderShape3D_prop3")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop3_Column"]
+mesh = SubResource("CylinderMesh_prop3")
+
+[node name="Prop4_Sphere" type="StaticBody3D" parent="Props"]
+position = Vector3(-6, 1.0, -6)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop4_Sphere"]
+shape = SubResource("SphereShape3D_prop4")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop4_Sphere"]
+mesh = SubResource("SphereMesh_prop4")
+
+[node name="Prop5_SmallSphere" type="StaticBody3D" parent="Props"]
+position = Vector3(0, 0.5, 12)
+
+[node name="CollisionShape3D" type="CollisionShape3D" parent="Props/Prop5_SmallSphere"]
+shape = SubResource("SphereShape3D_prop5")
+
+[node name="MeshInstance3D" type="MeshInstance3D" parent="Props/Prop5_SmallSphere"]
+mesh = SubResource("SphereMesh_prop5")
+
+[node name="Sun" type="DirectionalLight3D" parent="."]
+rotation = Vector3(-0.785398, 0, 0)
+shadow_enabled = true
+
+[node name="WorldEnvironment" type="WorldEnvironment" parent="."]
+environment = SubResource("WorldEnvironment_env")
+
+[node name="PlayerSpawn" type="Marker3D" parent="."]
+position = Vector3(0, 1.5, 0)

scripts/api_client.gd

@@ -178,18 +178,18 @@ func login(username: String, password: String) -> Dictionary:
 
 
 ## Register a new user. On success stores the returned access token.
-## @param date_of_birth ISO date string "YYYY-MM-DD".
+## @param over_18 Must be true; the backend rejects registration otherwise.
 func register(
 	username: String,
 	email: String,
 	password: String,
-	date_of_birth: String
+	over_18: bool
 ) -> Dictionary:
 	var payload := {
 		"username": username,
 		"email": email,
 		"password": password,
-		"date_of_birth": date_of_birth,
+		"over_18": over_18,
 	}
 	var result := await request(
 		HTTPClient.METHOD_POST,

scripts/main_menu.gd

@@ -3,14 +3,29 @@ extends Control
 ##
 ## The AuthPanel is hidden by default. When the user clicks the LoginButton or
 ## RegisterButton (AuthButtonsRow, above the panel), the auth panel slides in.
-## The ModeToggle switches between Login and Register modes, showing/hiding
+## The Login and Register buttons on the AuthButtonsRow directly set the panel's
-## the email and DOB fields accordingly.
+## mode, so the user can switch between Login and Register at any time while
+## the panel is open.
 ##
 ## On successful auth the token is stored via ApiClient, AuthButtonsRow hides,
 ## the welcome label shows the username, and the Play button becomes enabled.
+## The auth form fields are hidden, leaving only the welcome message visible.
+##
+## When returning from another scene (e.g. world_list), _ready() checks whether
+## ApiClient already holds a valid token. If so, it restores the authenticated
+## UI state (Play enabled, welcome message visible) instead of forcing the user
+## back to the login form.
 
 
-# ── UI references ────────────────────────────────────────────────────────────
+## Emitted once _ready()'s session check (has_token() + the awaited
+## get_me() call) has actually resolved, whichever way -- lets a test (or
+## anything else) know the UI state is trustworthy now, rather than
+## guessing from a frame count or from UI properties that are ambiguous
+## mid-await (e.g. AuthButtonsRow.visible is true both before the check
+## resolves AND in a genuine logged-out end state).
+signal auth_state_ready
+
+# ─── UI references ────────────────────────────────────────────────────────────
 
 var _auth_buttons_row: HBoxContainer
 var _login_button: Button
@@ -20,8 +35,7 @@ var _auth_mode_label: Label
 var _username_edit: LineEdit
 var _password_edit: LineEdit
 var _email_edit: LineEdit
-var _dob_edit: LineEdit
+var _over_18_check: CheckBox
-var _mode_toggle: CheckButton
 var _auth_button: Button
 var _status_label: Label
 var _welcome_label: Label
@@ -32,7 +46,7 @@ var _is_register_mode: bool = false
 var _is_authenticating: bool = false
 
 
-# ── Lifecycle ────────────────────────────────────────────────────────────────
+# ─── Lifecycle ────────────────────────────────────────────────────────────────
 
 func _ready() -> void:
 	# Cache node references.
@@ -44,25 +58,81 @@ func _ready() -> void:
 	_username_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit
 	_password_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit
 	_email_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit
-	_dob_edit = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DOBEdit
+	_over_18_check = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check
-	_mode_toggle = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle
 	_auth_button = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton
 	_status_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthStatusLabel
 	_welcome_label = $CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel
 	_play_button = $CenterContainer/VBoxContainer/PlayButton
 	_quit_button = $CenterContainer/VBoxContainer/QuitButton
 
-	# Initial state.
+	# Default to Play being gated. When a token exists, the async session
+	# check below may take several frames (a real get_me() round-trip);
+	# keeping the button disabled until validation succeeds prevents a fast
+	# click from navigating to world_list with an expired/invalid token.
+	_play_button.disabled = true
+
+	# Check whether a valid session already exists (e.g. user logged in,
+	# navigated to world_list, then clicked Back). If so, restore the
+	# authenticated UI state instead of forcing the login form again.
+	if ApiClient.has_token():
+		var me_result: Dictionary = await ApiClient.get_me()
+		if me_result.ok and me_result.data is Dictionary:
+			var username: String = str((me_result.data as Dictionary).get("username", ""))
+			if username != "":
+				_show_authenticated(username)
+				auth_state_ready.emit()
+				return
+
+	# Token missing or invalid — fall through to logged-out state.
+	_reset_to_logged_out()
+	auth_state_ready.emit()
+
+
+## Restore the UI to the authenticated state (Play enabled, welcome message
+## visible, auth buttons hidden). AuthPanel itself stays visible -- the
+## welcome label lives inside it, so hiding the panel hides the label too
+## even when the label's own `visible` is true (real bug, 2026-08-20: a
+## review caught the panel being hidden here while the label claimed to be
+## visible, which is a no-op UI-wise since Control.visible doesn't override
+## an ancestor's hidden state).
+func _show_authenticated(username: String) -> void:
+	_auth_panel.visible = true
+	_status_label.visible = false
+	_welcome_label.text = "Welcome, %s!" % username
+	_welcome_label.visible = true
+	# Hide the same full set of form fields _on_auth_complete() hides right
+	# after a fresh login/register -- this path (session restore on scene
+	# reload, e.g. after Play -> Back) used to only hide EmailEdit/
+	# Over18Check, leaving UsernameEdit/PasswordEdit/AuthButton/
+	# AuthModeLabel visible on top of the welcome message. Real bug: Play
+	# was enabled and the welcome label was correct, so it wasn't caught by
+	# checks for those alone -- the login fields being back on screen is
+	# what a user actually sees as "it's making me log in again."
+	_username_edit.visible = false
+	_password_edit.visible = false
+	_email_edit.visible = false
+	_over_18_check.visible = false
+	_auth_button.visible = false
+	_auth_mode_label.visible = false
+	_play_button.disabled = false
+	_auth_buttons_row.visible = false
+	print("Restored authenticated session for: ", username)
+
+
+## Reset the UI to the logged-out state (Play disabled, auth panel hidden,
+## login/register buttons visible).
+func _reset_to_logged_out() -> void:
 	_auth_panel.visible = false
 	_status_label.visible = false
 	_welcome_label.visible = false
 	_email_edit.visible = false
-	_dob_edit.visible = false
+	_over_18_check.visible = false
+	_over_18_check.button_pressed = false
 	_play_button.disabled = true  # Gate play behind successful auth.
 	_update_auth_mode_ui()
 
 
-# ── Play / Quit ──────────────────────────────────────────────────────────────
+# ─── Play / Quit ──────────────────────────────────────────────────────────────
 
 func _on_play_button_pressed() -> void:
 	if _play_button.disabled:
@@ -76,11 +146,14 @@ func _on_quit_button_pressed() -> void:
 	get_tree().quit()
 
 
-# ── Auth panel toggle ────────────────────────────────────────────────────────
+# ─── Auth panel toggle ────────────────────────────────────────────────────────
 
 func _on_login_button_pressed() -> void:
-	"""Show the auth panel, called from AuthButtonsRow/LoginButton."""
+	"""Show the auth panel in login mode, called from AuthButtonsRow/LoginButton."""
 	_auth_panel.visible = true
+	_is_register_mode = false
+	_update_auth_mode_ui()
+	_clear_status()
 	_username_edit.grab_focus()
 
 
@@ -88,35 +161,26 @@ func _on_register_button_pressed() -> void:
 	"""Show the auth panel in register mode, called from AuthButtonsRow/RegisterButton."""
 	_auth_panel.visible = true
 	_is_register_mode = true
-	_mode_toggle.button_pressed = true
 	_update_auth_mode_ui()
 	_clear_status()
 	_username_edit.grab_focus()
 
 
-# ── Mode toggle (Login / Register) ───────────────────────────────────────────
-
-func _on_mode_toggle_toggled(button_pressed: bool) -> void:
-	_is_register_mode = button_pressed
-	_update_auth_mode_ui()
-	_clear_status()
-
-
 func _update_auth_mode_ui() -> void:
 	"""Update labels and field visibility based on login vs register mode."""
 	if _is_register_mode:
 		_auth_mode_label.text = "Register"
 		_auth_button.text = "Register"
 		_email_edit.visible = true
-		_dob_edit.visible = true
+		_over_18_check.visible = true
 	else:
 		_auth_mode_label.text = "Login"
 		_auth_button.text = "Login"
 		_email_edit.visible = false
-		_dob_edit.visible = false
+		_over_18_check.visible = false
 
 
-# ── Auth submission ──────────────────────────────────────────────────────────
+# ─── Auth submission ──────────────────────────────────────────────────────────
 
 func _on_auth_button_pressed() -> void:
 	"""Handle login or register button press."""
@@ -136,17 +200,12 @@ func _on_auth_button_pressed() -> void:
 
 	if _is_register_mode:
 		var email := _email_edit.text.strip_edges()
-		var dob := _dob_edit.text.strip_edges()
 
 		if email == "":
 			_show_status("Email is required.")
 			return
-		if dob == "":
+		if not _over_18_check.button_pressed:
-			_show_status("Date of birth is required.")
+			_show_status("You must confirm you are 18 or older to register.")
-			return
-		# Basic YYYY-MM-DD format check.
-		if not _is_valid_date(dob):
-			_show_status("Date of birth must be in YYYY-MM-DD format.")
 			return
 
 		_auth_button.disabled = true
@@ -154,7 +213,7 @@ func _on_auth_button_pressed() -> void:
 		_is_authenticating = true
 		_clear_status()
 
-		var result := await ApiClient.register(username, email, password, dob)
+		var result := await ApiClient.register(username, email, password, true)
 		_on_auth_complete(result)
 	else:
 		_auth_button.disabled = true
@@ -173,12 +232,16 @@ func _on_auth_complete(result: Dictionary) -> void:
 	_is_authenticating = false
 
 	if result.ok:
-		# Success — show welcome, enable Play, hide the now-redundant
+		# Success — hide the auth form fields, show only the welcome label.
-		# Login/Register entry points (the auth panel itself stays open,
+		_username_edit.visible = false
-		# showing the welcome message in place of the form).
+		_password_edit.visible = false
+		_email_edit.visible = false
+		_over_18_check.visible = false
+		_auth_button.visible = false
+		_auth_mode_label.visible = false
+		_status_label.visible = false
 		_welcome_label.text = "Welcome, %s!" % _username_edit.text.strip_edges()
 		_welcome_label.visible = true
-		_status_label.visible = false
 		_play_button.disabled = false
 		_auth_buttons_row.visible = false
 		print("Auth successful. Token stored.")
@@ -187,7 +250,7 @@ func _on_auth_complete(result: Dictionary) -> void:
 		_show_status(result.detail)
 
 
-# ── Status helpers ───────────────────────────────────────────────────────────
+# ─── Status helpers ───────────────────────────────────────────────────────────
 
 func _show_status(message: String) -> void:
 	_status_label.text = message
@@ -197,26 +260,3 @@ func _show_status(message: String) -> void:
 func _clear_status() -> void:
 	_status_label.text = ""
 	_status_label.visible = false
-
-
-# ── Validation ───────────────────────────────────────────────────────────────
-
-func _is_valid_date(date_str: String) -> bool:
-	"""Check if a string looks like a valid YYYY-MM-DD date."""
-	if date_str.length() != 10:
-		return false
-	var parts := date_str.split("-")
-	if parts.size() != 3:
-		return false
-	var year := parts[0].to_int()
-	var month := parts[1].to_int()
-	var day := parts[2].to_int()
-	if month < 1 or month > 12:
-		return false
-	if day < 1 or day > 31:
-		return false
-	# Rough month-day validation.
-	var days_in_month := [0, 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31]
-	if day > days_in_month[month]:
-		return false
-	return true

scripts/player.gd

@@ -0,0 +1,146 @@
+class_name Player
+extends CharacterBody3D
+## The player character controller.
+##
+## A simple CharacterBody3D with WASD/arrow locomotion, gravity, jump, and a
+## first-person Camera3D with mouse-look.  Reads the spawn point from the
+## current scene's `PlayerSpawn` Marker3D (see docs/architecture/pc2_test_level.md §3).
+##
+## No networking, no chunk code, no avatar UI — PC2 is local-only.
+
+
+# ---------------------------------------------------------------------------
+# Movement constants
+# ---------------------------------------------------------------------------
+
+const WALK_SPEED: float = 5.0
+const JUMP_VELOCITY: float = 4.5
+const GRAVITY: float = 9.8
+
+## Mouse-look sensitivity (radians per pixel of relative motion).
+const MOUSE_SENSITIVITY: float = 0.003
+
+## Camera pitch is clamped so the player can't flip past looking straight
+## up/down (which would otherwise let mouse-look invert on itself).
+const PITCH_LIMIT: float = deg_to_rad(89.0)
+
+
+# ---------------------------------------------------------------------------
+# Input state
+# ---------------------------------------------------------------------------
+
+var _input_direction := Vector2.ZERO
+var _camera_pitch: float = 0.0
+
+@onready var _camera: Camera3D = $Camera3D
+
+
+# ---------------------------------------------------------------------------
+# _ready — spawn at PlayerSpawn marker, capture the mouse for look
+# ---------------------------------------------------------------------------
+
+func _ready() -> void:
+	# Per §3 of pc2_test_level.md: look up PlayerSpawn from the current
+	# scene root.  The lookup walks the full subtree (recursive=true) so
+	# it finds the marker whether it is a direct child of the level or
+	# nested deeper.
+	#
+	# current_scene is null in headless --script mode and in any scene
+	# before the main scene is fully swapped in, so guard it rather than
+	# blindly dereferencing.
+	var current_scene: Node = get_tree().current_scene
+	var spawn: Node = null
+	if current_scene != null:
+		spawn = current_scene.find_child("PlayerSpawn", true, false)
+
+	if spawn is Node3D:
+		global_position = (spawn as Node3D).global_position
+		# Align player forward with spawn yaw (optional polish).
+		var spawn_yaw := (spawn as Node3D).rotation.y
+		rotation.y = spawn_yaw
+	else:
+		push_warning("player.gd: no PlayerSpawn marker found; spawning at origin")
+		global_position = Vector3(0, 1.0, 0)
+
+	# Capture the mouse for FPS-style look. Headless/test runs have no real
+	# window to capture input for, so guard against that rather than error.
+	if DisplayServer.get_name() != "headless":
+		Input.mouse_mode = Input.MOUSE_MODE_CAPTURED
+
+
+# ---------------------------------------------------------------------------
+# _unhandled_input — capture keyboard / mouse for movement
+# ---------------------------------------------------------------------------
+
+func _unhandled_input(event: InputEvent) -> void:
+	if event is InputEventKey:
+		var key := event as InputEventKey
+		if key.pressed and not key.echo:
+			_update_input_direction(key)
+		elif not key.pressed:
+			_clear_input_direction(key)
+		# Escape exits the level back to the world browse list, mirroring
+		# the Back button pattern already used in world_list.gd/main_menu.gd.
+		if key.pressed and key.keycode == KEY_ESCAPE:
+			Input.mouse_mode = Input.MOUSE_MODE_VISIBLE
+			get_tree().change_scene_to_file("res://scenes/world_list.tscn")
+	elif event is InputEventMouseMotion and Input.mouse_mode == Input.MOUSE_MODE_CAPTURED:
+		_handle_mouse_look(event as InputEventMouseMotion)
+
+
+func _update_input_direction(key: InputEventKey) -> void:
+	match key.keycode:
+		KEY_W, KEY_UP:
+			_input_direction.y += 1.0
+		KEY_S, KEY_DOWN:
+			_input_direction.y -= 1.0
+		KEY_A, KEY_LEFT:
+			_input_direction.x -= 1.0
+		KEY_D, KEY_RIGHT:
+			_input_direction.x += 1.0
+
+
+func _clear_input_direction(key: InputEventKey) -> void:
+	match key.keycode:
+		KEY_W, KEY_UP:
+			_input_direction.y -= 1.0
+		KEY_S, KEY_DOWN:
+			_input_direction.y += 1.0
+		KEY_A, KEY_LEFT:
+			_input_direction.x += 1.0
+		KEY_D, KEY_RIGHT:
+			_input_direction.x -= 1.0
+
+
+func _handle_mouse_look(event: InputEventMouseMotion) -> void:
+	# Yaw rotates the whole body (so movement direction turns with the
+	# look direction); pitch only tilts the camera, so the capsule itself
+	# never tips over.
+	rotation.y -= event.relative.x * MOUSE_SENSITIVITY
+	_camera_pitch = clampf(_camera_pitch - event.relative.y * MOUSE_SENSITIVITY, -PITCH_LIMIT, PITCH_LIMIT)
+	_camera.rotation.x = _camera_pitch
+
+
+# ---------------------------------------------------------------------------
+# Physics — gravity, jump, move_and_slide
+# ---------------------------------------------------------------------------
+
+func _physics_process(delta: float) -> void:
+	# Apply gravity.
+	if not is_on_floor():
+		velocity.y -= GRAVITY * delta
+
+	# Jump.
+	if is_on_floor() and Input.is_action_just_pressed("ui_accept"):
+		velocity.y = JUMP_VELOCITY
+
+	# Build movement direction from input. Godot's local "forward" is -Z, not
+	# +Z, so W (input.y = +1) must use -basis.z -- using +basis.z here would
+	# move the player backward when pressing forward (confirmed by reading
+	# Camera3D/Node3D's own convention: a node looks down its local -Z).
+	var direction := (_input_direction.x * transform.basis.x -
+		_input_direction.y * transform.basis.z).normalized()
+	velocity.x = direction.x * WALK_SPEED
+	velocity.z = direction.z * WALK_SPEED
+
+	move_and_slide()

scripts/player_spawner.gd

@@ -0,0 +1,232 @@
+class_name PlayerNode
+extends CharacterBody3D
+## PlayerNode - Server-side player entity.
+##
+## Represents a connected player on the server. Handles movement,
+## input processing, and state synchronization.
+
+# --- Signals ---
+signal health_changed(new_health: int)
+signal player_died(player_node: PlayerNode)
+
+
+# --- Constants ---
+const WALK_SPEED := 5.0
+const SPRINT_MULTIPLIER := 1.6
+const JUMP_VELOCITY := 4.5
+const GRAVITY := 9.8
+const MAX_FALL_SPEED := 20.0
+const FRICTION := 8.0
+const AIR_CONTROL := 0.3
+
+# --- Configurable ---
+@export var walk_speed: float = WALK_SPEED
+@export var sprint_multiplier: float = SPRINT_MULTIPLIER
+@export var jump_velocity: float = JUMP_VELOCITY
+@export var max_fall_speed: float = MAX_FALL_SPEED
+
+# --- State ---
+@export var max_health: int = 100
+var current_health: int = 0
+var is_alive: bool = true
+var is_sprinting: bool = false
+var peer_id: int = -1
+var player_name: String = ""
+var entity_id: int = 0
+
+# --- Input buffer ---
+var _input_queue: Array[Dictionary] = []
+var _last_processed_seq: int = -1
+
+# --- Movement ---
+var _velocity: Vector3 = Vector3.ZERO
+
+
+func _ready() -> void:
+	current_health = max_health
+	velocity = _velocity
+	# Start alive
+	is_alive = true
+
+
+func _physics_process(delta: float) -> void:
+	if not is_alive:
+		return
+	
+	# Process input from queue
+	_process_input(delta)
+	
+	# Apply gravity
+	if not is_on_floor():
+		velocity.y -= GRAVITY * delta
+		velocity.y = clampf(velocity.y, -max_fall_speed, max_fall_speed)
+	
+	# Apply friction on ground
+	if is_on_floor():
+		var move_dir := Vector2(velocity.x, velocity.z)
+		if move_dir.length() > 0.01:
+			var friction_factor := clampf(FRICTION * delta, 0.0, 1.0)
+			velocity.x = move_dir.normalized().x * move_dir.length() * (1.0 - friction_factor)
+			velocity.z = move_dir.normalized().y * move_dir.length() * (1.0 - friction_factor)
+		else:
+			velocity.x = 0.0
+			velocity.z = 0.0
+	
+	# Move and slide
+	velocity.y = clampf(velocity.y, -max_fall_speed, max_fall_speed)
+	move_and_slide()
+	
+	# Update visual position (for remote clients via RPC)
+	_update_visual_state()
+
+
+func _process_input(delta: float) -> void:
+	"""Process buffered input from the server's input queue."""
+	if _input_queue.is_empty():
+		return
+	
+	var input_data: Dictionary = _input_queue.pop_front()
+	var input_state: Dictionary = input_data.get("input_state", {})
+	
+	# Calculate movement direction
+	var direction := Vector3.ZERO
+	direction.x = input_state.get("move_x", 0.0)
+	direction.z = input_state.get("move_z", 0.0)
+	
+	# Sprint check
+	is_sprinting = input_state.get("sprint", false)
+	
+	if direction.length() > 0.01:
+		direction = direction.normalized()
+		var speed = walk_speed * sprint_multiplier if is_sprinting else walk_speed
+		velocity.x = direction.x * speed
+		velocity.z = direction.z * speed
+	else:
+		# On ground, apply friction (handled in physics_process)
+		if not is_on_floor():
+			velocity.x *= (1.0 - AIR_CONTROL * delta * 5.0)
+			velocity.z *= (1.0 - AIR_CONTROL * delta * 5.0)
+	
+	# Jump
+	if input_state.get("jump", false) and is_on_floor():
+		velocity.y = jump_velocity
+
+
+func take_damage(amount: int, source_id: int) -> Dictionary:
+	"""Take damage and return result dict."""
+	if not is_alive:
+		return {"success": false, "reason": "already_dead"}
+	
+	current_health = max(0, current_health - amount)
+	health_changed.emit(current_health)
+	
+	if current_health <= 0:
+		die()
+		return {"success": true, "health": 0, "dead": true}
+	
+	return {"success": true, "health": current_health}
+
+
+func die() -> void:
+	"""Handle player death."""
+	is_alive = false
+	velocity = Vector3.ZERO
+	player_died.emit(self)
+	
+	# Respawn after delay
+	await get_tree().create_timer(3.0).timeout
+	respawn()
+
+
+func respawn() -> void:
+	"""Respawn the player at spawn point."""
+	current_health = max_health
+	is_alive = true
+	velocity = Vector3.ZERO
+	health_changed.emit(current_health)
+	
+	# Move to spawn point (default: origin)
+	position = Vector3.ZERO
+
+
+func set_input_queue(inputs: Array[Dictionary]) -> void:
+	"""Set the input queue from the server."""
+	_input_queue = inputs
+
+
+func get_state() -> Dictionary:
+	"""Get current player state for replication."""
+	return {
+		"entity_id": entity_id,
+		"peer_id": peer_id,
+		"position": position,
+		"rotation": rotation,
+		"health": current_health,
+		"max_health": max_health,
+		"is_alive": is_alive,
+		"is_sprinting": is_sprinting,
+	}
+
+
+func get_server_state() -> Dictionary:
+	"""Get current player state for server snapshot broadcast."""
+	return get_state()
+
+
+func process_server_input(tick: int) -> void:
+	"""Called by server tick to process buffered input."""
+	# This is called from the server's _tick loop.
+	# The input queue is populated by RPCs from clients.
+	pass
+
+
+func _update_visual_state() -> void:
+	"""Update visual state (for remote interpolation)."""
+	# In a full implementation, this would update a remote player's
+	# visual representation. For now, the node itself is the authority.
+	pass
+
+
+# --- RPCs ---
+
+@rpc("any_peer", "call_remote", "reliable")
+func rpc_request_input(input_state: Dictionary, seq: int) -> void:
+	"""Receive input from client."""
+	if not is_alive:
+		return
+	# Store for processing in _physics_process
+	_input_queue.append({
+		"input_state": input_state,
+		"seq": seq,
+		"timestamp": Time.get_ticks_msec(),
+	})
+
+
+@rpc("any_peer", "call_remote", "reliable")
+func rpc_request_interact(target_id: int) -> void:
+	"""Handle interaction request from client."""
+	if not is_alive:
+		return
+	# TODO: Implement interaction logic
+	print("Player %d interacted with entity %d" % [peer_id, target_id])
+
+
+@rpc("any_peer", "call_remote", "reliable")
+func rpc_request_attack(target_id: int, aim_dir: Vector3) -> void:
+	"""Handle attack request from client."""
+	if not is_alive:
+		return
+	# TODO: Implement attack logic
+	print("Player %d attacked entity %d with aim %s" % [peer_id, target_id, aim_dir])
+
+
+@rpc("authority", "call_remote", "reliable")
+func rpc_set_position(pos: Vector3) -> void:
+	"""Server authoritative position update."""
+	position = pos
+
+
+@rpc("authority", "call_remote", "reliable")
+func rpc_set_rotation(rot: Vector3) -> void:
+	"""Server authoritative rotation update."""
+	rotation = rot

scripts/player_spawner.gd.uid

@@ -0,0 +1 @@
+uid://br27owjh2f5xd

scripts/server.gd

@@ -0,0 +1,174 @@
+## ServerMain - Dedicated server root node.
+## Accepts ENet connections, spawns Player nodes for each peer,
+## and runs the simulation tick loop at 20 Hz.
+extends Node
+
+
+## Maximum number of concurrent players.
+const MAX_PLAYERS := 16
+
+## Server tick rate (Hz).
+const TICK_RATE := 20
+
+## Tick duration in seconds.
+const TICK_DURATION := 1.0 / TICK_RATE
+
+## ENet server port.
+const SERVER_PORT := 7777
+
+## Network peer used for ENet communication.
+var network_peer: ENetMultiplayerPeer
+
+## Map of peer_id -> Player node.
+var players: Dictionary = {}
+
+## Current tick counter (server-authoritative).
+var tick: int = 0
+
+## Whether the server is running.
+var is_running: bool = false
+
+## Accumulated real time for fixed timestep simulation.
+var accumulator: float = 0.0
+
+## Player scene resource (loaded once).
+var _player_scene: PackedScene
+
+
+func _ready() -> void:
+	# Preload the player scene once.
+	_player_scene = preload("res://scenes/server_player.tscn")
+
+	# Create and assign the ENet server peer.
+	network_peer = _create_server_peer()
+	if network_peer:
+		multiplayer.multiplayer_peer = network_peer
+		is_running = true
+		print("[Server] Started on port %d" % SERVER_PORT)
+	else:
+		printerr("[Server] Failed to create ENet peer.")
+		get_tree().quit(1)
+
+
+# ---------------------------------------------------------------------------
+# Server creation
+# ---------------------------------------------------------------------------
+
+func _create_server_peer() -> ENetMultiplayerPeer:
+	var peer := ENetMultiplayerPeer.new()
+	var error := peer.create_server(SERVER_PORT, MAX_PLAYERS)
+	if error != OK:
+		printerr("[Server] create_server error: %d" % error)
+		return null
+	return peer
+
+
+# ---------------------------------------------------------------------------
+# Fixed-timestep simulation loop
+# ---------------------------------------------------------------------------
+
+func _process(delta: float) -> void:
+	if not is_running:
+		return
+
+	# Fixed timestep accumulator.
+	accumulator += delta
+	while accumulator >= TICK_DURATION:
+		accumulator -= TICK_DURATION
+		_tick()
+
+
+func _tick() -> void:
+	"""Main server simulation tick (called at TICK_RATE)."""
+	tick += 1
+
+	# Process player inputs and update state.
+	for peer_id in players:
+		var player: Node3D = players[peer_id]
+		if player and player.has_method("process_server_input"):
+			player.process_server_input(tick)
+
+	# Broadcast snapshot to all clients.
+	_broadcast_snapshot()
+
+
+func _broadcast_snapshot() -> void:
+	"""Broadcast the current authoritative state to all connected clients."""
+	var snapshot_data := {
+		"tick": tick,
+		"players": {},
+	}
+
+	for peer_id in players:
+		var player: Node3D = players[peer_id]
+		if player and player.has_method("get_server_state"):
+			snapshot_data.players[peer_id] = player.get_server_state()
+
+	# Send snapshot to all peers except the server itself (peer_id == 1).
+	var peer_ids: Array = multiplayer.get_peers()
+	for pid in peer_ids:
+		if pid == 1:  # 1 is the server itself
+			continue
+		rpc_id(pid, "_receive_snapshot", snapshot_data)
+
+
+# Remote: clients receive snapshots.
+@rpc("any_peer", "call_remote", "reliable")
+func _receive_snapshot(snapshot_data: Dictionary) -> void:
+	pass  # Handled by client scene.
+
+
+# ---------------------------------------------------------------------------
+# Connection lifecycle
+# ---------------------------------------------------------------------------
+
+func _on_peer_connected(peer_id: int) -> void:
+	print("[Server] Peer %d connected." % peer_id)
+
+	if players.size() >= MAX_PLAYERS:
+		print("[Server] Max players reached. Disconnecting peer %d." % peer_id)
+		rpc_id(peer_id, "_kick", "Server is full.")
+		return
+
+	# Spawn a Player node for this peer.
+	var player: Node3D = _player_scene.instantiate()
+	player.name = "Player_%d" % peer_id
+	player.peer_id = peer_id
+	add_child(player)
+	players[peer_id] = player
+
+	print("[Server] Spawned player node for peer %d." % peer_id)
+
+
+func _on_peer_disconnected(peer_id: int) -> void:
+	print("[Server] Peer %d disconnected." % peer_id)
+	if players.has(peer_id):
+		var player: Node3D = players[peer_id]
+		if player.is_inside_tree():
+			player.queue_free()
+		players.erase(peer_id)
+
+
+# ---------------------------------------------------------------------------
+# RPCs
+# ---------------------------------------------------------------------------
+
+@rpc("any_peer", "call_remote", "reliable")
+func _kick(reason: String) -> void:
+	print("[Server] Kicking caller: %s" % reason)
+	rpc_id(multiplayer.get_remote_sender_id(), "_disconnect", reason)
+
+
+@rpc("call_remote", "reliable")
+func _disconnect(reason: String) -> void:
+	print("[Server] Disconnecting: %s" % reason)
+	get_tree().quit(0)
+
+
+# ---------------------------------------------------------------------------
+# Signal connections
+# ---------------------------------------------------------------------------
+
+func _enter_tree() -> void:
+	multiplayer.peer_connected.connect(_on_peer_connected)
+	multiplayer.peer_disconnected.connect(_on_peer_disconnected)

scripts/server.gd.uid

@@ -0,0 +1 @@
+uid://cwjv826lva2gi

scripts/smoke_test_auth.gd

@@ -10,7 +10,7 @@ extends SceneTree
 ## Tests:
 ##   1. Register a unique user → 201 + token stored.
 ##   2. Register the same user again → 409 "Username already registered".
-##   3. Register an under-18 user → 400 "Must be 18 or older".
+##   3. Register with over_18=false → 400 "Must be 18 or older".
 ##   4. Login with correct credentials → 200 + token stored.
 ##   5. Login with wrong password → 401 "Incorrect username or password".
 ##   6. Login with non-existent user → 401 "Incorrect username or password".
@@ -21,8 +21,6 @@ const API_BASE := "http://127.0.0.1:8000"
 const TEST_USERNAME := "smoke_test_user_%d"
 const TEST_EMAIL := "smoke_%d@test.example.com"
 const TEST_PASSWORD := "SmokeTest123!"
-const TEST_DOB_ADULT := "2000-01-01"
-const TEST_DOB_CHILD := "2020-01-01"  # ~5 years old
 
 
 func _initialize() -> void:
@@ -40,12 +38,13 @@ func _run() -> void:
 	var failed: int = 0
 
 	# --- Test 1: Register a unique user ---
-	var unique_id := Time.get_ticks_msec()
+	randomize()
+	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
 	var username := "smoke_%d" % unique_id
 	var email := "smoke_%d@test.example.com" % unique_id
 
 	print("\n=== Test 1: Register unique user ===")
-	var result := await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
+	var result := await api.register(username, email, TEST_PASSWORD, true)
 	if _check("register returns ok", result.ok) \
 			and _check("register status is 201", result.status == 201) \
 			and _check("register stores token", api.has_token()):
@@ -56,7 +55,7 @@ func _run() -> void:
 
 	# --- Test 2: Register same user again (duplicate) ---
 	print("\n=== Test 2: Duplicate username ===")
-	result = await api.register(username, email, TEST_PASSWORD, TEST_DOB_ADULT)
+	result = await api.register(username, email, TEST_PASSWORD, true)
 	if _check("duplicate register not ok", not result.ok) \
 			and _check("duplicate status is 409", result.status == 409) \
 			and _check("duplicate detail mentions username",
@@ -66,14 +65,14 @@ func _run() -> void:
 		failed += 1
 		print("  detail: ", result.detail)
 
-	# --- Test 3: Register under-18 user ---
+	# --- Test 3: Register with over_18=false ---
-	print("\n=== Test 3: Under-18 registration ===")
+	print("\n=== Test 3: over_18=false registration ===")
 	var child_username := "child_%d" % unique_id
 	var child_email := "child_%d@test.example.com" % unique_id
-	result = await api.register(child_username, child_email, TEST_PASSWORD, TEST_DOB_CHILD)
+	result = await api.register(child_username, child_email, TEST_PASSWORD, false)
-	if _check("under-18 register not ok", not result.ok) \
+	if _check("over_18=false register not ok", not result.ok) \
-			and _check("under-18 status is 400", result.status == 400) \
+			and _check("over_18=false status is 400", result.status == 400) \
-			and _check("under-18 detail mentions age",
+			and _check("over_18=false detail mentions age",
 					"18" in result.detail):
 		passed += 1
 	else:

scripts/smoke_test_e2e.gd

@@ -23,7 +23,6 @@ extends SceneTree
 const TEST_USERNAME_BASE := "smoke_test_user"
 const TEST_EMAIL := "smoke@test.com"
 const TEST_PASSWORD := "TestPass123"
-const TEST_DOB := "2000-01-01"
 
 
 func _initialize() -> void:
@@ -70,7 +69,7 @@ func _run() -> void:
 
 	# --- Step 2: Register -----------------------------------------------------
 	print("\n=== Step 2: Register (POST /api/auth/register) ===")
-	var reg: Dictionary = await api.register(username, email, TEST_PASSWORD, TEST_DOB)
+	var reg: Dictionary = await api.register(username, email, TEST_PASSWORD, true)
 	var reg_token := _extract_token(reg)
 	var reg_ok: bool = (
 		reg.ok

scripts/smoke_test_enter_world.gd

@@ -0,0 +1,146 @@
+extends SceneTree
+## Regression/smoke test for the PC2 "Enter World" flow end to end.
+##
+## Real user path: register -> land on world_list.tscn -> click "Enter World"
+## on a real card -> the playable level (scenes/game.tscn) actually loads
+## with the player spawned in it -> pressing Escape returns to world_list.
+##
+## Run with:
+##     godot --headless --path . --script res://scripts/smoke_test_enter_world.gd
+##
+## Requires the backend to be running (default base URL
+## `application/agp/api_base_url` -> http://127.0.0.1:8000, overridable via
+## AGP_API_BASE_URL) and at least one real world to already exist.
+
+var passed := 0
+var failed := 0
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+
+	var api := root.get_node("ApiClient")
+	if api == null:
+		printerr("FAIL: ApiClient autoload not found")
+		quit(1)
+		return
+
+	# 1. Register a real user and seed a world so the browse list has a
+	# real card to click, same pattern as smoke_test_world_list.gd.
+	randomize()
+	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
+	var username := "enterworld_%d" % unique_id
+	var email := "enterworld_%d@test.example.com" % unique_id
+	var reg_result: Dictionary = await api.register(username, email, "SmokeTest123!", true)
+	if not _check("setup: register succeeded", reg_result.ok):
+		print("  detail: ", reg_result.detail)
+		_finish()
+		return
+
+	var world_body := JSON.stringify({
+		"name": "EnterWorld Smoke Test World %d" % unique_id,
+		"description": "Seeded by smoke_test_enter_world.gd",
+		"visibility": "public",
+	})
+	var world_result: Dictionary = await api.request(
+		HTTPClient.METHOD_POST, "/api/worlds/", world_body, "application/json", true
+	)
+	if not _check("setup: world created", world_result.ok):
+		print("  detail: ", world_result.detail)
+		_finish()
+		return
+
+	# 2. Load world_list.tscn as a real scene and let it fetch worlds.
+	var packed: PackedScene = load("res://scenes/world_list.tscn")
+	var instance: Control = packed.instantiate()
+	root.add_child(instance)
+	# _ready() kicks off an async _refresh_worlds() -- wait real frames for
+	# the HTTP round trip rather than guessing a fixed count.
+	var world_list_node: VBoxContainer = instance.get_node("VBoxContainer/ScrollContainer/WorldList")
+	var settled := false
+	for i in 120:
+		await process_frame
+		if world_list_node.get_child_count() > 0:
+			settled = true
+			break
+	if not _check("world list populated with at least one card", settled):
+		_finish()
+		return
+
+	# 3. Click "Enter World" on the first real card -- find the button by
+	# walking the card's children rather than assuming an index, so this
+	# doesn't silently pass if _create_world_card's structure changes.
+	var card: Control = world_list_node.get_child(0)
+	var enter_button: Button = _find_button(card, "Enter World")
+	if not _check("Enter World button exists on the card", enter_button != null):
+		_finish()
+		return
+
+	enter_button.pressed.emit()
+	await _wait_for_scene_change(instance, 60)
+
+	var game_scene := current_scene
+	if not _check("game.tscn became current_scene after Enter World", game_scene != null and game_scene != instance):
+		_finish()
+		return
+
+	# 4. Verify the player actually exists and spawned at the level's
+	# PlayerSpawn marker -- not just that *some* scene loaded.
+	var player: Node = game_scene.get_node_or_null("Player")
+	_check("Player node exists in the loaded game scene", player is CharacterBody3D)
+
+	var spawn_marker: Node = game_scene.get_node_or_null("Level/PlayerSpawn")
+	_check("PlayerSpawn marker exists in the loaded level", spawn_marker is Marker3D)
+
+	if player is CharacterBody3D and spawn_marker is Marker3D:
+		var dist := (player as CharacterBody3D).global_position.distance_to((spawn_marker as Marker3D).global_position)
+		_check("player spawned at (or very near) the PlayerSpawn marker", dist < 0.5)
+
+	# 5. Escape should return to world_list.tscn (real key event, not a
+	# direct method call -- proves the actual input binding works).
+	var esc_event := InputEventKey.new()
+	esc_event.keycode = KEY_ESCAPE
+	esc_event.pressed = true
+	Input.parse_input_event(esc_event)
+	await _wait_for_scene_change(game_scene, 60)
+
+	var back_to_menu := current_scene
+	_check("Escape returned to world_list.tscn", back_to_menu != null and back_to_menu.scene_file_path == "res://scenes/world_list.tscn")
+
+	_finish()
+
+
+func _find_button(node: Node, text: String) -> Button:
+	if node is Button and (node as Button).text == text:
+		return node
+	for child in node.get_children():
+		var found := _find_button(child, text)
+		if found:
+			return found
+	return null
+
+
+func _wait_for_scene_change(previous_scene: Node, max_frames: int) -> void:
+	for i in max_frames:
+		await process_frame
+		if current_scene != previous_scene and current_scene != null:
+			return
+
+
+func _check(description: String, condition: bool) -> bool:
+	if condition:
+		print("  PASS: ", description)
+		passed += 1
+	else:
+		printerr("  FAIL: ", description)
+		failed += 1
+	return condition
+
+
+func _finish() -> void:
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
+	quit(0 if failed == 0 else 1)

scripts/smoke_test_main_menu_back.gd

@@ -0,0 +1,170 @@
+extends SceneTree
+## Regression test for the Play -> Back navigation bug.
+##
+## The reported bug: after logging in and clicking Play, the user lands on
+## world_list.tscn; clicking Back returns to main_menu.tscn, but the menu
+## reset to a fully logged-out state (Play disabled, login form showing)
+## even though ApiClient still held a valid token. main_menu.gd's _ready()
+## used to unconditionally reset the UI on every scene load.
+##
+## This test drives the real navigation flow (change_scene_to_file) against
+## a live backend:
+##   1. Register a unique user so ApiClient holds a valid token.
+##   2. Load main_menu.tscn and assert it restores the authenticated state.
+##   3. Click Play -> world_list.tscn.
+##   4. Click Back -> main_menu.tscn.
+##   5. Assert the menu is STILL authenticated (Play enabled, welcome label
+##      actually visible in the tree, login/register buttons hidden).
+##
+## Run with:
+##     godot --headless --path . --script res://scripts/smoke_test_main_menu_back.gd
+##
+## Requires the backend to be running (default base URL
+## `application/agp/api_base_url` -> http://127.0.0.1:8000).
+
+const USERNAME := "backnav_%d"
+const EMAIL := "backnav_%d@test.example.com"
+const PASSWORD := "BackNav123!"
+
+var passed := 0
+var failed := 0
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+
+	var api := root.get_node("ApiClient")
+	if api == null:
+		printerr("FAIL: ApiClient autoload not found")
+		quit(1)
+		return
+
+	# 1. Establish a real, valid session exactly the way a user would.
+	randomize()
+	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
+	var username := USERNAME % unique_id
+	var email := EMAIL % unique_id
+	print("\n=== Setup: register ", username, " ===")
+	var register_result: Dictionary = await api.register(username, email, PASSWORD, true)
+	if not _check("register succeeds", register_result.ok):
+		print("  detail: ", register_result.detail)
+		_finish()
+		return
+	_check("ApiClient stores token after register", api.has_token())
+
+	# 2. First visit to the main menu: should already show the authenticated
+	#    state (no login form, Play enabled).
+	change_scene_to_file("res://scenes/main_menu.tscn")
+	# change_scene_to_file defers the actual swap -- a couple frames is
+	# plenty for the scene object itself to exist (unlike the real
+	# get_me() network round-trip afterward, which is what auth_state_ready
+	# actually waits for below).
+	for i in 5:
+		await process_frame
+		if current_scene is Control:
+			break
+
+	var menu: Control = current_scene
+	if menu == null or not menu is Control:
+		printerr("FAIL: main_menu.tscn did not become current_scene")
+		_finish()
+		return
+	await menu.auth_state_ready
+	_check("first main menu visit restores authenticated state", _is_authenticated(menu))
+
+	# 3. Play -> world_list.tscn (real button press).
+	var play_button: Button = menu.get_node("CenterContainer/VBoxContainer/PlayButton")
+	play_button.pressed.emit()
+	await _wait_for_scene_change(menu)
+
+	var world_list_scene := current_scene
+	if world_list_scene == null or world_list_scene == menu:
+		printerr("FAIL: world_list.tscn did not become current_scene after Play")
+		_finish()
+		return
+
+	# 4. Back -> main_menu.tscn (real button press).
+	var back_button: Button = world_list_scene.get_node("VBoxContainer/HeaderHBox/BackButton")
+	back_button.pressed.emit()
+	await _wait_for_scene_change(world_list_scene)
+
+	menu = current_scene
+	if menu == null or not menu is Control:
+		printerr("FAIL: main_menu.tscn did not become current_scene after Back")
+		_finish()
+		return
+
+	# The new main_menu instance's own _ready() is *also* awaiting a real
+	# get_me() call -- _wait_for_scene_change only confirms the scene
+	# object exists, not that its authenticated-state fields have been
+	# set yet. Wait for the real signal, not a guess.
+	await menu.auth_state_ready
+
+	# 5. THE regression assertion: still logged in after returning.
+	_check("main menu stays authenticated after Play -> Back", _is_authenticated(menu))
+
+	_finish()
+
+
+func _is_authenticated(menu: Control) -> bool:
+	var play_button: Button = menu.get_node("CenterContainer/VBoxContainer/PlayButton")
+	var welcome_label: Label = menu.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel")
+	var auth_buttons_row: HBoxContainer = menu.get_node("CenterContainer/VBoxContainer/AuthButtonsRow")
+	var auth_panel: PanelContainer = menu.get_node("CenterContainer/VBoxContainer/AuthPanel")
+	var username_edit: LineEdit = menu.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit")
+	var password_edit: LineEdit = menu.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit")
+	var auth_button: Button = menu.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton")
+	var auth_mode_label: Label = menu.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel")
+
+	_check("Play enabled", not play_button.disabled)
+	# WelcomeLabel lives inside AuthPanel, so `.visible` alone is a
+	# false-positive: the label can have visible=true while its parent is
+	# hidden and it renders as nothing. `is_visible_in_tree()` is the
+	# check that proves the user can actually see the welcome message.
+	_check("Welcome label visible in tree", welcome_label.is_visible_in_tree())
+	_check("Auth buttons row hidden", not auth_buttons_row.visible)
+	_check("Auth panel visible (it contains the welcome label)", auth_panel.visible)
+	# Real bug, 2026-08-20: the session-restore path (this one, after
+	# Play -> Back) hid EmailEdit/Over18Check but never the rest of the
+	# login form -- Play enabled + welcome label visible were both still
+	# true, so a check that stopped there passed while the user was
+	# looking at the login fields again on top of the welcome message.
+	_check("Username field hidden", not username_edit.visible)
+	_check("Password field hidden", not password_edit.visible)
+	_check("Auth button hidden", not auth_button.visible)
+	_check("Auth mode label hidden", not auth_mode_label.visible)
+
+	return (not play_button.disabled) \
+		and welcome_label.is_visible_in_tree() \
+		and not auth_buttons_row.visible \
+		and auth_panel.visible \
+		and not username_edit.visible \
+		and not password_edit.visible \
+		and not auth_button.visible \
+		and not auth_mode_label.visible
+
+
+func _wait_for_scene_change(previous_scene: Node) -> void:
+	for i in 20:
+		await process_frame
+		if current_scene != previous_scene and current_scene != null:
+			return
+
+
+func _check(description: String, condition: bool) -> bool:
+	if condition:
+		print("  PASS: ", description)
+		passed += 1
+	else:
+		printerr("  FAIL: ", description)
+		failed += 1
+	return condition
+
+
+func _finish() -> void:
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
+	quit(0 if failed == 0 else 1)

scripts/smoke_test_main_menu_full_flow.gd

@@ -1,9 +1,8 @@
 extends SceneTree
 ## Full click-through simulation of the real user flow: press Register,
 ## fill the form exactly as a human would, submit, confirm Play actually
-## becomes clickable. This is the check that would have caught the
+## becomes clickable. Also verifies that after successful auth the auth
-## original bug (no way to even open the form) and would catch a repeat
+## form fields are hidden, leaving only the welcome message visible.
-## of it.
 
 var passed := 0
 var failed := 0
@@ -26,8 +25,9 @@ func _run() -> void:
 	var username_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/UsernameEdit")
 	var password_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/PasswordEdit")
 	var email_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit")
-	var dob_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/DOBEdit")
+	var over_18_check: CheckBox = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check")
 	var auth_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthButton")
+	var auth_mode_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel")
 	var welcome_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/WelcomeLabel")
 	var play_button: Button = instance.get_node("CenterContainer/VBoxContainer/PlayButton")
 
@@ -46,7 +46,7 @@ func _run() -> void:
 	username_edit.text = "mainmenu_e2e_%d" % unique_id
 	password_edit.text = "TestPass123!"
 	email_edit.text = "mainmenu_e2e_%d@test.example.com" % unique_id
-	dob_edit.text = "2000-01-01"
+	over_18_check.button_pressed = true
 
 	# Call the submit handler directly (awaited) rather than via
 	# auth_button.pressed.emit() -- a synthetic .emit() in --script/
@@ -60,9 +60,19 @@ func _run() -> void:
 	await instance._on_auth_button_pressed()
 
 	_check("Play became enabled after real register submission", not play_button.disabled)
-	_check("Welcome label visible", welcome_label.visible)
+	_check("Welcome label visible in tree", welcome_label.is_visible_in_tree())
 	_check("Auth buttons row hid itself after success", not auth_buttons_row.visible)
 
+	# Verify the auth form fields are hidden after successful auth,
+	# leaving only the welcome message visible within the panel.
+	_check("Username edit hidden after auth", not username_edit.visible)
+	_check("Password edit hidden after auth", not password_edit.visible)
+	_check("Email edit hidden after auth", not email_edit.visible)
+	_check("Over18 checkbox hidden after auth", not over_18_check.visible)
+	_check("Auth button hidden after auth", not auth_button.visible)
+	_check("Auth mode label hidden after auth", not auth_mode_label.visible)
+	_check("Welcome label contains username", welcome_label.text.begins_with("Welcome, mainmenu_e2e_"))
+
 	print("\n=== SMOKE RESULT: %d/%d passed ===" % [passed, passed + failed])
 	quit(0 if failed == 0 else 1)
 

scripts/smoke_test_main_menu_ui.gd

@@ -1,9 +1,14 @@
 extends SceneTree
-## Verifies the main menu's Login/Register buttons actually open the auth
+## Verifies the main menu's Login/Register buttons correctly open the auth
-## panel via a real signal emission (not calling the handler method
+## panel and toggle between Login and Register modes via signal emission.
-## directly) -- that's the exact gap that shipped without ever being
+##
-## caught: the AuthPanel and its logic were all correct, but nothing in
+## Key tests:
-## the scene was ever wired to open it.
+##  - AuthPanel starts hidden.
+##  - LoginButton press opens the panel in Login mode.
+##  - RegisterButton press opens the panel in Register mode.
+##  - Clicking Login while in Register mode switches back to Login mode.
+##  - Clicking Register while in Login mode switches to Register mode.
+##  - The ModeToggle CheckButton no longer exists in the scene.
 
 
 func _initialize() -> void:
@@ -24,26 +29,87 @@ func _run() -> void:
 	var login_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/LoginButton")
 	var register_button: Button = instance.get_node("CenterContainer/VBoxContainer/AuthButtonsRow/RegisterButton")
 	var auth_panel: PanelContainer = instance.get_node("CenterContainer/VBoxContainer/AuthPanel")
+	var auth_mode_label: Label = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/AuthModeLabel")
+	var email_edit: LineEdit = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/EmailEdit")
+	var over_18_check: CheckBox = instance.get_node("CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/Over18Check")
 
+	# --- Test 1: auth panel starts hidden ---
 	if _check("auth panel starts hidden", not auth_panel.visible):
 		passed += 1
 	else:
 		failed += 1
 
+	# --- Test 2: LoginButton press opens panel in Login mode ---
 	login_button.pressed.emit()
 	await process_frame
 
-	if _check("auth panel visible after a real LoginButton press signal", auth_panel.visible):
+	if _check("auth panel visible after LoginButton press", auth_panel.visible):
 		passed += 1
 	else:
 		failed += 1
 
-	# Reset and check RegisterButton independently too.
+	if _check("Login mode label after LoginButton press", auth_mode_label.text == "Login"):
-	auth_panel.visible = false
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field hidden in Login mode", not email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox hidden in Login mode", not over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 3: RegisterButton press switches to Register mode ---
 	register_button.pressed.emit()
 	await process_frame
 
-	if _check("auth panel visible after a real RegisterButton press signal", auth_panel.visible):
+	if _check("auth panel still visible after RegisterButton press", auth_panel.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Register mode label after RegisterButton press", auth_mode_label.text == "Register"):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field visible in Register mode", email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox visible in Register mode", over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 4: LoginButton press switches back to Login mode ---
+	login_button.pressed.emit()
+	await process_frame
+
+	if _check("Login mode label after second LoginButton press", auth_mode_label.text == "Login"):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Email field hidden after switching back to Login", not email_edit.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	if _check("Over18 checkbox hidden after switching back to Login", not over_18_check.visible):
+		passed += 1
+	else:
+		failed += 1
+
+	# --- Test 5: ModeToggle CheckButton no longer exists ---
+	var mode_toggle_path = "CenterContainer/VBoxContainer/AuthPanel/MarginContainer/AuthVBox/ModeToggle"
+	var has_mode_toggle = instance.has_node(mode_toggle_path)
+	if _check("ModeToggle CheckButton removed from scene", not has_mode_toggle):
 		passed += 1
 	else:
 		failed += 1

scripts/smoke_test_player.gd

@@ -0,0 +1,93 @@
+extends SceneTree
+## Smoke test for the player character scene and its spawn behavior.
+##
+## Run with:
+##     godot --headless --path . --script res://scripts/smoke_test_player.gd
+##
+## Loads the test level, verifies the player is present, spawned at the
+## PlayerSpawn marker, and has the expected CharacterBody3D structure.
+
+var _passed := 0
+var _failed := 0
+
+
+func _initialize() -> void:
+	print("SMOKE: starting player smoke test")
+	_run()
+
+
+func _run() -> void:
+	await process_frame
+	print("SMOKE: loading game scene")
+
+	# Load scenes/game.tscn -- the real PC2 composition point (Level + Player
+	# as siblings, per docs/architecture/pc2_test_level.md §4), not the level
+	# scene directly. Use the same SceneTree API as the real game so
+	# `current_scene` is populated before the scene is added and its
+	# _ready() callbacks fire. That ordering is what the player's spawn
+	# lookup (get_tree().current_scene) depends on.
+	var packed: PackedScene = load("res://scenes/game.tscn")
+	var result := change_scene_to_packed(packed)
+	if result != OK:
+		printerr("SMOKE: failed to change scene, error ", result)
+		quit(1)
+		return
+
+	await scene_changed
+	var game: Node3D = current_scene as Node3D
+	print("SMOKE: game scene ready")
+
+	# 1. Verify the player node exists in the scene tree.
+	var player: Node = game.get_node("Player")
+	_check("Player node exists in test level", player != null)
+	_check("Player is a CharacterBody3D", player is CharacterBody3D)
+
+	# 2. Verify the player has the expected child structure.
+	var collision: Node = player.get_node("CollisionShape3D")
+	_check("Player has CollisionShape3D", collision != null)
+	_check("CollisionShape3D has a shape",
+		   collision is CollisionShape3D and (collision as CollisionShape3D).shape != null)
+
+	var mesh: Node = player.get_node("CapsuleMesh")
+	_check("Player has CapsuleMesh", mesh != null)
+	_check("CapsuleMesh has a mesh",
+		   mesh is MeshInstance3D and (mesh as MeshInstance3D).mesh != null)
+
+	# 3. Verify the player spawned at the PlayerSpawn marker position.
+	var spawn_marker: Marker3D = game.get_node("Level/PlayerSpawn")
+	_check("PlayerSpawn marker exists", spawn_marker != null)
+
+	# The player's _ready() should have moved it to the spawn marker's
+	# global position. Compare global positions directly (not local) since
+	# Player and Level sit at different depths under Game.
+	var expected_pos: Vector3 = spawn_marker.global_position
+	_check("Player spawned at PlayerSpawn position",
+		   player.global_position == expected_pos)
+
+	# 4. Verify the player script class_name is correct and has the
+	# movement constants defined.
+	var script: GDScript = player.get_script() as GDScript
+	_check("Player has a script attached", script != null)
+	var constants: Dictionary = script.get_script_constant_map()
+	_check("Player has WALK_SPEED constant", constants.has("WALK_SPEED"))
+	_check("Player has GRAVITY constant", constants.has("GRAVITY"))
+	_check("Player has JUMP_VELOCITY constant", constants.has("JUMP_VELOCITY"))
+	_check("JUMP_VELOCITY is positive (upward)", float(constants.get("JUMP_VELOCITY", -1.0)) > 0.0)
+
+	# 5. Verify the player has a Camera3D so the game is actually viewable
+	# from the player's perspective, not just a walking capsule with no view.
+	var camera: Node = player.get_node_or_null("Camera3D")
+	_check("Player has a Camera3D", camera is Camera3D)
+	_check("Camera3D is current", camera is Camera3D and (camera as Camera3D).current)
+
+	print("\n=== SMOKE RESULT: %d/%d passed ===" % [_passed, _passed + _failed])
+	quit(0 if _failed == 0 else 1)
+
+
+func _check(description: String, condition: bool) -> void:
+	if condition:
+		print("  PASS: ", description)
+		_passed += 1
+	else:
+		printerr("  FAIL: ", description)
+		_failed += 1

scripts/smoke_test_test_level.gd

@@ -0,0 +1,125 @@
+extends SceneTree
+## Headless smoke test for the PC2 test level scene.
+##
+## Run with:
+##     godot --headless --path . --script res://scripts/smoke_test_test_level.gd
+##
+## Loads the test level scene, asserts:
+##   (a) it loads without error,
+##   (b) it contains a Marker3D named "PlayerSpawn",
+##   (c) PlayerSpawn is positioned >= 1.0 m above the ground top surface.
+## Exits 0 on success, 1 on failure.
+
+
+func _initialize() -> void:
+	_run()
+
+
+func _run() -> void:
+	var level_path: String = "res://scenes/worlds/test_level.tscn"
+
+	# Load the scene file
+	var level_resource: PackedScene = load(level_path)
+	if level_resource == null:
+		printerr("SMOKE RESULT: FAIL \u2014 could not load ", level_path)
+		quit(1)
+		return
+
+	print("SMOKE: test_level.tscn loaded successfully")
+
+	# Change the running scene to our test level
+	var err: int = change_scene_to_packed(level_resource)
+	if err != OK:
+		printerr("SMOKE RESULT: FAIL \u2014 change_scene_to_packed returned ", err)
+		quit(1)
+		return
+
+	# Wait for the scene_changed signal so current_scene is set
+	await scene_changed
+
+	var level_instance: Node3D = current_scene as Node3D
+	if level_instance == null:
+		printerr("SMOKE RESULT: FAIL \u2014 current_scene is not Node3D")
+		quit(1)
+		return
+
+	# Give the tree one frame to fully initialize
+	await process_frame
+
+	# (b) Find the PlayerSpawn marker
+	var spawn_marker: Node3D = level_instance.find_child("PlayerSpawn", true, false) as Node3D
+	if spawn_marker == null:
+		printerr("SMOKE RESULT: FAIL \u2014 no Node3D named 'PlayerSpawn' found in test level")
+		quit(1)
+		return
+
+	print("SMOKE: found PlayerSpawn at ", spawn_marker.global_position)
+
+	# (c) Verify PlayerSpawn is >= 1.0 m above ground top
+	# The ground top surface is at y = 0 (Ground StaticBody3D centered at y = -0.5
+	# with height 1.0, so top face is at y = 0).
+	var spawn_y: float = spawn_marker.global_position.y
+	if spawn_y < 1.0:
+		printerr("SMOKE RESULT: FAIL \u2014 PlayerSpawn y = ", spawn_y,
+				 " is below the required minimum of 1.0 m above ground top (y=0)")
+		quit(1)
+		return
+
+	print("SMOKE: PlayerSpawn y = ", spawn_y, " >= 1.0 m \u2014 PASS")
+
+	# Additional check: verify Ground StaticBody3D exists
+	var ground: StaticBody3D = level_instance.find_child("Ground", true, false) as StaticBody3D
+	if ground == null:
+		printerr("SMOKE RESULT: FAIL \u2014 no StaticBody3D named 'Ground' found")
+		quit(1)
+		return
+
+	print("SMOKE: found Ground StaticBody3D")
+
+	# Verify Ground top face is at y = 0
+	var ground_shape: CollisionShape3D = ground.find_child("CollisionShape3D", true, false) as CollisionShape3D
+	if ground_shape != null and ground_shape.shape is BoxShape3D:
+		var box_shape: BoxShape3D = ground_shape.shape as BoxShape3D
+		var ground_top: float = ground.global_position.y + box_shape.size.y / 2.0
+		if abs(ground_top - 0.0) > 0.01:
+			printerr("SMOKE RESULT: FAIL \u2014 Ground top face at y = ", ground_top, " expected ~0.0")
+			quit(1)
+			return
+		print("SMOKE: Ground top face at y = ", ground_top, " \u2014 PASS")
+
+	# Verify props exist (3-5 StaticBody3D children under Props node)
+	var props_node: Node3D = level_instance.find_child("Props", true, false) as Node3D
+	if props_node != null:
+		var prop_count: int = 0
+		for child in props_node.get_children():
+			if child is StaticBody3D:
+				prop_count += 1
+		if prop_count < 3:
+			printerr("SMOKE RESULT: FAIL \u2014 only ", prop_count, " props found, need >= 3")
+			quit(1)
+			return
+		print("SMOKE: found ", prop_count, " props \u2014 PASS")
+	else:
+		printerr("SMOKE RESULT: FAIL \u2014 no 'Props' Node3D found")
+		quit(1)
+		return
+
+	# Verify lighting exists
+	var sun: DirectionalLight3D = level_instance.find_child("Sun", true, false) as DirectionalLight3D
+	if sun == null:
+		printerr("SMOKE RESULT: FAIL \u2014 no DirectionalLight3D named 'Sun' found")
+		quit(1)
+		return
+	print("SMOKE: found Sun DirectionalLight3D")
+
+	# Verify WorldEnvironment exists
+	var env: WorldEnvironment = level_instance.find_child("WorldEnvironment", true, false) as WorldEnvironment
+	if env == null:
+		printerr("SMOKE RESULT: FAIL \u2014 no WorldEnvironment named 'WorldEnvironment' found")
+		quit(1)
+		return
+	print("SMOKE: found WorldEnvironment")
+
+	# All checks passed
+	print("SMOKE RESULT: PASS")
+	quit(0)

scripts/smoke_test_world_list.gd

@@ -58,7 +58,7 @@ func _run() -> void:
 	var unique_id: int = int(Time.get_unix_time_from_system() * 1000) + randi() % 100000
 	var username := "worldlist_smoke_%d" % unique_id
 	var email := "worldlist_smoke_%d@test.example.com" % unique_id
-	var reg_result: Dictionary = await api.register(username, email, "SmokeTest123!", "2000-01-01")
+	var reg_result: Dictionary = await api.register(username, email, "SmokeTest123!", true)
 	if not _check("setup: register succeeded", reg_result.ok):
 		print("  detail: ", reg_result.detail)
 		quit(1)

scripts/world_list.gd

@@ -135,8 +135,23 @@ func _create_world_card(world_dict: Dictionary) -> Control:
 	meta_label.add_theme_font_size_override("font_size", 12)
 	meta_label.add_theme_color_override("font_color", Color(0.5, 0.5, 0.5, 1.0))
 
+	# PC2: the only thing a world actually loads into right now is the one
+	# shared playable test level (scenes/game.tscn) -- there's no per-world
+	# content yet, so "Enter" doesn't need the world's id for anything.
+	# Real per-world level loading is a later concern once worlds actually
+	# have their own content to load.
+	var enter_button := Button.new()
+	enter_button.text = "Enter World"
+	enter_button.size_flags_horizontal = Control.SIZE_SHRINK_BEGIN
+	enter_button.pressed.connect(_on_enter_world_pressed)
+
 	card.add_child(name_label)
 	card.add_child(desc_label)
 	card.add_child(meta_label)
+	card.add_child(enter_button)
 
 	return panel
+
+
+func _on_enter_world_pressed() -> void:
+	get_tree().change_scene_to_file("res://scenes/game.tscn")