Sync from kink_cli (Docker Space)

api.py

@@ -31,6 +31,15 @@ _MEDIA_CACHE = "public, max-age=86400, immutable"
 _MEDIA_FALLBACK_CACHE = "public, max-age=3600"
 
 
+def _frontend_static_cache_control(target: Path) -> str:
+    """Browser e2e and local iteration can set ``KINK_FRONTEND_NO_CACHE=1`` so module graphs always match disk."""
+    if os.environ.get("KINK_FRONTEND_NO_CACHE") == "1":
+        return "no-store"
+    if target.suffix in {".js", ".css"}:
+        return "public, max-age=300, stale-while-revalidate=60"
+    return "no-store"
+
+
 def _hf_space_published_image() -> bool:
     """True in the Hugging Face Space Docker image (``Dockerfile`` sets ``KINK_HF_SPACE_IMAGE=1``).
 
@@ -194,6 +203,9 @@ async def add_security_headers(request: Request, call_next):
     response.headers["Cross-Origin-Embedder-Policy"] = "credentialless"
     response.headers.setdefault("Cross-Origin-Opener-Policy", "same-origin")
     response.headers.setdefault("Cross-Origin-Resource-Policy", "same-origin")
+    # Personalized GETs must not be cached by intermediaries or the browser (Playwright e2e saw stale ``/users/…`` payloads).
+    if request.method == "GET" and request.url.path.startswith("/users/"):
+        response.headers["Cache-Control"] = "private, no-store"
     return response
 
 
@@ -359,7 +371,7 @@ def frontend_static(filepath: str) -> FileResponse:
         raise HTTPException(status_code=404, detail="Not found")
     if not target.exists() or not target.is_file():
         raise HTTPException(status_code=404, detail="Not found")
-    cache_control = "public, max-age=300, stale-while-revalidate=60" if target.suffix in {".js", ".css"} else "no-store"
+    cache_control = _frontend_static_cache_control(target)
     return FileResponse(target, headers={"Cache-Control": cache_control})
 
 

frontend/app.js

@@ -15,7 +15,7 @@ import {
   useGroupsQuery,
   useRolesQuery,
   useRoleSearchQuery,
-} from "./queries.js?v=38";
+} from "./queries.js?v=40";
 import {
   useLoginMutation,
   useCreateMutation,
@@ -28,9 +28,9 @@ import {
   useRemoveGroupMemberMutation,
   useShareToggleMutation,
   usePartnerRequestMutations,
-} from "./mutations.js?v=38";
-import { optimisticBoard, removeKinkFromItemsPayload, playCommitKey } from "./board-utils.js?v=32";
-import { DiscoverView } from "./discover.js?v=47";
+} from "./mutations.js?v=52";
+import { optimisticBoard, removeKinkFromItemsPayload, playCommitKey } from "./board-utils.js?v=33";
+import { DiscoverView } from "./discover.js?v=64";
 import { normalizeDiscoverSheetDirections } from "./discover-flow.js?v=1";
 import { ScenariosView } from "./scenarios.js?v=1";
 import { MyPlaysView } from "./my-plays.js?v=37";
@@ -191,8 +191,11 @@ function AppInner() {
     starterCompleted,
   });
   const needsStarterFlow = starterState === "starter" || starterState === "finalizing";
+  /** Starter Discover always queries recs with group id ""; keep save/recs cache in sync if partner groups load mid-flow. */
+  const recsCacheGroupId = needsStarterFlow ? "" : activeGroupId;
 
   useEffect(() => {
+    if (createResult) return;
     if (!auth.userId || !auth.token) return;
     if (!userQuery.isError || userQuery.isFetching) return;
     const statusCode = userQuery.error?.status;
@@ -200,9 +203,10 @@ function AppInner() {
       setStatus("That profile is gone. Create a new one or log in again.");
       logout();
     }
-  }, [auth.userId, auth.token, userQuery.isError, userQuery.isFetching, userQuery.error, logout]);
+  }, [createResult, auth.userId, auth.token, userQuery.isError, userQuery.isFetching, userQuery.error, logout]);
 
   useEffect(() => {
+    if (createResult) return;
     if (!auth.userId || !auth.token) return;
     const bad = (q) => q.isError && !q.isFetching && (q.error?.status === 401 || q.error?.status === 404);
     if (bad(groupsQuery) || bad(rolesQuery)) {
@@ -210,6 +214,7 @@ function AppInner() {
       logout();
     }
   }, [
+    createResult,
     auth.userId,
     auth.token,
     groupsQuery.isError,
@@ -274,7 +279,7 @@ function AppInner() {
   function syncPostSaveCaches(userPayload, kinkId, interestState, directions) {
     qc.setQueryData(["user", auth.userId], userPayload);
     qc.setQueryData(["board", auth.userId], (old) => optimisticBoard(old || EMPTY_BOARD, kinkId, interestState, directions, qc, auth));
-    qc.setQueryData(["recs", auth.userId, activeGroupId], (old) => removeKinkFromItemsPayload(old, kinkId));
+    qc.setQueryData(["recs", auth.userId, recsCacheGroupId], (old) => removeKinkFromItemsPayload(old, kinkId));
     qc.invalidateQueries({ queryKey: ["scenario-parents", auth.userId] });
     if (activeGroupId) qc.invalidateQueries({ queryKey: ["group-overlap", auth.userId, activeGroupId] });
   }
@@ -283,7 +288,7 @@ function AppInner() {
   const createMutation = useCreateMutation({ setAuth, setCreateResult, setLoginForm, setStatus });
   const savePlayMutation = useSavePlayMutation({
     auth,
-    activeGroupId,
+    activeGroupId: recsCacheGroupId,
     selectedKinkId: "",
     setSelectedKinkId: () => {},
     setStatus,
@@ -351,16 +356,23 @@ function AppInner() {
   }, []);
 
   const handleRate = useCallback((kinkId, interestState, directions = null) => {
-    const prevState = currentPlays[kinkId] || null;
-    const nextDirections = normalizeDirectionsForSave(interestState, directions ?? currentDirectionsFor(currentPlays, kinkId));
+    const kid = String(kinkId);
+    const prevState = currentPlays[kid] || null;
+    const nextDirections = normalizeDirectionsForSave(interestState, directions ?? currentDirectionsFor(currentPlays, kid));
     const normalized = [...nextDirections].sort();
     const existing = [...(prevState?.directions || [])].sort();
-    if (prevState?.interest_state === interestState && JSON.stringify(existing) === JSON.stringify(normalized)) return Promise.resolve(null);
-    const commitKey = playCommitKey(kinkId, interestState, normalized);
-    if (pendingPlayCommitRef.current === commitKey) return Promise.resolve(null);
+    if (
+      !needsStarterFlow
+      && prevState?.interest_state === interestState
+      && JSON.stringify(existing) === JSON.stringify(normalized)
+    ) {
+      return Promise.resolve(null);
+    }
+    const commitKey = playCommitKey(kid, interestState, normalized);
+    if (!needsStarterFlow && pendingPlayCommitRef.current === commitKey) return Promise.resolve(null);
     pendingPlayCommitRef.current = commitKey;
-    return savePlayMutation.mutateAsync({ kinkId, interestState, directions: normalized });
-  }, [currentPlays, discoverPositiveDirections, savePlayMutation]);
+    return savePlayMutation.mutateAsync({ kinkId: kid, interestState, directions: normalized });
+  }, [currentPlays, discoverPositiveDirections, needsStarterFlow, savePlayMutation]);
 
   const handleDirectionToggle = useCallback((kinkId, direction) => {
     const play = currentPlays[kinkId];
@@ -446,8 +458,14 @@ function AppInner() {
         selectedRoles=${selectedRoles}
         pendingPartnerId=${pendingPartnerId}
         onFinish=${() => {
+          const uid = auth.userId;
           setCreateResult(null);
           setAuthStep(null);
+          if (uid) {
+            qc.invalidateQueries({ queryKey: ["user", uid] });
+            qc.invalidateQueries({ queryKey: ["partner-groups", uid] });
+            qc.invalidateQueries({ queryKey: ["roles", uid] });
+          }
         }}
       />
     `;
@@ -746,7 +764,15 @@ function Onboarding({
       <p className="sub">Discover what you like. See what you share. Keep private things private by default.</p>
       <div className="card stack">
         ${pendingPartnerId ? html`<div className="tiny">You were invited by <code>${pendingPartnerId}</code>. Create or open a profile and we’ll stage the connection for you.</div>` : null}
-        <button data-testid="onboarding-create-profile" onClick=${() => createMutation.mutate()}>Create profile</button>
+        <button
+          data-testid="onboarding-create-profile"
+          disabled=${createMutation.isPending}
+          onClick=${() => {
+            if (!createMutation.isPending) createMutation.mutate();
+          }}
+        >
+          ${createMutation.isPending ? "Creating profile…" : "Create profile"}
+        </button>
         <button className="ghost" data-testid="onboarding-have-profile" onClick=${() => setStep("login")}>I have a profile</button>
       </div>
       <${StatusText} text=${status} />

frontend/board-utils.js

@@ -7,17 +7,18 @@ export function sortedBoardItems(items) {
 }
 
 export function optimisticBoard(previousBoard, kinkId, interestState, directions, qc, auth) {
+  const kid = String(kinkId);
   const nextBoard = Object.fromEntries(
     Object.entries(previousBoard || EMPTY_BOARD).map(([key, items]) => [
       key,
-      (items || []).filter((item) => item.id !== kinkId),
+      (items || []).filter((item) => String(item.id) !== kid),
     ]),
   );
 
   const sourceItem =
-    findBoardItemInData(previousBoard, kinkId) || (qc ? findBoardItemFromQuery(qc, auth, kinkId) : null);
+    findBoardItemInData(previousBoard, kid) || (qc ? findBoardItemFromQuery(qc, auth, kid) : null);
   /** If play-board has not loaded yet (or kink not in recs cache), still place a stub so we never strip a row and return empty buckets. */
-  const itemBase = sourceItem || { id: kinkId, name: kinkId, summary: "", popularity: 0 };
+  const itemBase = sourceItem || { id: kid, name: kid, summary: "", popularity: 0 };
   const item = { ...itemBase, interest_state: interestState, directions };
   if (interestState === "hard_no") {
     nextBoard.no_go.push(item);
@@ -34,8 +35,9 @@ export function optimisticBoard(previousBoard, kinkId, interestState, directions
 }
 
 export function findBoardItemInData(board, kinkId) {
+  const kid = String(kinkId);
   for (const items of Object.values(board || EMPTY_BOARD)) {
-    const match = (items || []).find((item) => item.id === kinkId);
+    const match = (items || []).find((item) => String(item.id) === kid);
     if (match) return match;
   }
   return null;
@@ -52,7 +54,8 @@ function normalizeKinkItem(raw) {
 }
 
 function findInItemsPayload(payload, kinkId) {
-  const match = payload?.items?.find((item) => item?.kink?.id === kinkId);
+  const kid = String(kinkId);
+  const match = payload?.items?.find((item) => String(item?.kink?.id) === kid);
   return normalizeKinkItem(match?.kink || null);
 }
 
@@ -95,9 +98,10 @@ function findBoardItemFromQuery(qc, auth, kinkId) {
 
 export function removeKinkFromItemsPayload(payload, kinkId) {
   if (!payload?.items) return payload;
+  const kid = String(kinkId);
   return {
     ...payload,
-    items: payload.items.filter((item) => item?.kink?.id !== kinkId),
+    items: payload.items.filter((item) => String(item?.kink?.id) !== kid),
   };
 }
 

frontend/discover-state.js

@@ -4,8 +4,10 @@ export function visibleDiscoveryItems(rawItems, currentPlays) {
   const out = [];
   for (const row of rawItems || []) {
     const id = row?.kink?.id;
-    if (!id || played[id] || seen.has(id)) continue;
-    seen.add(id);
+    if (id == null || id === "") continue;
+    const sid = String(id);
+    if (played[sid] || seen.has(sid)) continue;
+    seen.add(sid);
     out.push(row);
   }
   return out;

frontend/discover-state.test.mjs

@@ -3,6 +3,15 @@ import test from "node:test";
 
 import { shouldRefetchEmptyDeck, visibleDiscoveryItems } from "./discover-state.js";
 
+test("visibleDiscoveryItems treats numeric kink ids and string play keys as the same id", () => {
+  const rawItems = [{ kink: { id: 12, name: "one" } }, { kink: { id: 34, name: "two" } }];
+  const currentPlays = { "12": { interest_state: "like", directions: ["together"] } };
+  assert.deepEqual(
+    visibleDiscoveryItems(rawItems, currentPlays).map((row) => row.kink.id),
+    [34],
+  );
+});
+
 test("visibleDiscoveryItems drops already-rated raw recommendation rows", () => {
   const rawItems = [
     { kink: { id: "a" } },

frontend/discover.js

@@ -3,8 +3,8 @@ import { useQueryClient } from "https://esm.sh/@tanstack/react-query@5.59.20?dep
 import { html, partnerGroupChipLabel, partnerGroupPartnerIdsTitle, DIRECTION_PILLS } from "./constants.js?v=33";
 import { KinkCard, ActionBar, SearchOverlay } from "./components.js?v=41";
 import { normalizeDiscoverSheetDirections, applyDiscoverDirectionChoice } from "./discover-flow.js?v=1";
-import { useRecsQuery, useSearchQuery, useDetailQuery } from "./queries.js?v=38";
-import { shouldRefetchEmptyDeck, visibleDiscoveryItems } from "./discover-state.js?v=32";
+import { useRecsQuery, useSearchQuery, useDetailQuery } from "./queries.js?v=40";
+import { shouldRefetchEmptyDeck, visibleDiscoveryItems } from "./discover-state.js?v=33";
 import { api } from "./api.js?v=33";
 import { sendTelemetry } from "./telemetry.js?v=33";
 
@@ -110,12 +110,13 @@ export function DiscoverView({
 
   const safeIndex = items.length ? Math.min(cardIndex, items.length - 1) : 0;
   const currentItem = items[safeIndex] || null;
-  const kinkId = currentItem?.kink?.id || "";
+  const rawKinkId = currentItem?.kink?.id;
+  const kinkId = rawKinkId == null || rawKinkId === "" ? "" : String(rawKinkId);
   const detailQuery = useDetailQuery(kinkId);
   const kink = useMemo(() => {
     const listKink = currentItem?.kink;
     const detail = detailQuery.data;
-    const detailOk = detail && detail.id === kinkId ? detail : null;
+    const detailOk = detail && String(detail.id) === kinkId ? detail : null;
     if (!listKink && !detailOk) return null;
     if (detailOk && listKink && listKink.id === detailOk.id) return { ...listKink, ...detailOk };
     return listKink || detailOk;

frontend/index.html

@@ -11,6 +11,6 @@
   </head>
   <body>
     <div id="root"></div>
-    <script type="module" src="/frontend/app.js?v=49"></script>
+    <script type="module" src="/frontend/app.js?v=78"></script>
   </body>
 </html>

frontend/mutations.js

@@ -1,6 +1,6 @@
 import { useMutation, useQueryClient } from "https://esm.sh/@tanstack/react-query@5.59.20?deps=react@18.3.1";
 import { api, authHeaders } from "./api.js?v=33";
-import { optimisticBoard, removeKinkFromItemsPayload } from "./board-utils.js?v=32";
+import { optimisticBoard, removeKinkFromItemsPayload } from "./board-utils.js?v=33";
 
 const EMPTY_BOARD = { to_me: [], by_me: [], together: [], hidden: [], no_go: [] };
 
@@ -32,6 +32,11 @@ export function useCreateMutation({ setAuth, setCreateResult, setLoginForm, setS
         headers: { "Content-Type": "application/json" },
         body: "{}",
       }),
+    onMutate: () => {
+      setStatus(
+        "Creating profile… If this sits here a while, the Space is still loading the catalog (first boot can take several minutes).",
+      );
+    },
     onSuccess: (payload) => {
       setAuth({ userId: payload.id, token: payload.private_token });
       setCreateResult(payload);
@@ -66,38 +71,42 @@ export function useSavePlayMutation({
     onMutate: async (vars) => {
       onSaveStart();
       const directions = vars.directions || [];
-      await qc.cancelQueries({ queryKey: ["user", auth.userId] });
+      /** Do not cancel/refetch the user query here: refetchInterval can still deliver a stale GET that
+       *  replaces the cache after this onMutate runs but before onSuccess, wiping the optimistic play
+       *  and leaving the same top card so the next tap dedupes to “no new save” while the counter stays flat. */
       const recsKey = ["recs", auth.userId, activeGroupId];
       const previousUser = qc.getQueryData(["user", auth.userId]);
       const previousBoard = qc.getQueryData(["board", auth.userId]);
       const previousRecs = qc.getQueryData(recsKey);
+      const playKey = String(vars.kinkId);
+      qc.setQueryData(["user", auth.userId], (old) => {
+        const base = old && typeof old === "object" ? old : { id: auth.userId, plays: {} };
+        return {
+          ...base,
+          plays: {
+            ...(base.plays || {}),
+            [playKey]: { interest_state: vars.interestState, directions },
+          },
+        };
+      });
       if (previousRecs?.items) {
-        qc.setQueryData(recsKey, (old) => removeKinkFromItemsPayload(old, vars.kinkId));
+        qc.setQueryData(recsKey, (old) => removeKinkFromItemsPayload(old, playKey));
       }
-      qc.setQueryData(["user", auth.userId], (old) =>
-        old
-          ? {
-              ...old,
-              plays: {
-                ...(old.plays || {}),
-                [vars.kinkId]: { interest_state: vars.interestState, directions },
-              },
-            }
-          : old,
+      qc.setQueryData(["board", auth.userId], (old) =>
+        optimisticBoard(old || previousBoard || EMPTY_BOARD, playKey, vars.interestState, directions, qc, auth),
       );
-      qc.setQueryData(["board", auth.userId], (old) => optimisticBoard(old || previousBoard || EMPTY_BOARD, vars.kinkId, vars.interestState, directions, qc, auth));
-      if (!selectedKinkId) setSelectedKinkId(vars.kinkId);
+      if (!selectedKinkId) setSelectedKinkId(playKey);
       setStatus("Saving...");
       return {
         previousUser,
         previousBoard,
         previousRecs,
         recsKey,
-        commitKey: playCommitKey(vars.kinkId, vars.interestState, directions),
+        commitKey: playCommitKey(playKey, vars.interestState, directions),
       };
     },
     onSuccess: (payload, vars, context) => {
-      syncPostSaveCaches(payload, vars.kinkId, vars.interestState, vars.directions || []);
+      syncPostSaveCaches(payload, String(vars.kinkId), vars.interestState, vars.directions || []);
       /** Refetch play-board from server so My Plays never stays on a partial optimistic board (e.g. board cache was empty when save ran). */
       qc.invalidateQueries({ queryKey: ["board", auth.userId] });
       /** Avoid immediate recs/prompts refetch: it re-randomized the deck and made the next card “flash” away. Server still updates user/board via payload + optimistic cache. */

scripts/playwright_product_flow.py

@@ -2,17 +2,24 @@ from __future__ import annotations
 
 import json
 import os
+import threading
 import time
 import urllib.parse
 import urllib.request
 from dataclasses import asdict, dataclass
 from typing import Callable
 
-from playwright.sync_api import Browser, BrowserContext, Page, expect, sync_playwright
+from playwright.sync_api import Browser, Page, expect, sync_playwright
 
 
 BASE_URL = os.environ.get("KINK_AUDIT_BASE_URL", "http://127.0.0.1:8012").rstrip("/")
-DEFAULT_SCENARIOS = ["starter", "settings", "couple"]
+DEFAULT_SCENARIOS = ["onboarding", "starter", "settings", "couple"]
+_POLL_WAIT = threading.Event()
+
+
+def _e2e_onboarding_timeout_ms() -> int:
+    """HF cold start + first ``POST /users`` can block on catalog init; allow long UI waits."""
+    return int(os.environ.get("KINK_E2E_ONBOARDING_TIMEOUT_MS", "120000") or "120000")
 
 
 @dataclass
@@ -29,7 +36,9 @@ class StageResult:
 
 
 def _json_request(path: str, *, method: str = "GET", payload: dict | None = None, headers: dict[str, str] | None = None, timeout: int = 60) -> dict:
-    request_headers = {"Content-Type": "text/plain;charset=UTF-8"}
+    request_headers: dict[str, str] = {}
+    if payload is not None:
+        request_headers["Content-Type"] = "application/json; charset=utf-8"
     if headers:
         request_headers.update(headers)
     request = urllib.request.Request(
@@ -184,13 +193,29 @@ def ensure_play_absent(creds: Credentials, kink_id: str) -> None:
 
 
 def open_app(page: Page, *, path: str = "") -> None:
-    page.goto(f"{BASE_URL}{path}", wait_until="domcontentloaded")
+    page.goto(f"{BASE_URL}{path}", wait_until="load", timeout=120_000)
+
+
+def _run_in_fresh_context(browser: Browser, fn: Callable[[Page], dict[str, object]]) -> dict[str, object]:
+    """Each scenario gets an isolated storage / cache origin (Playwright default context is shared)."""
+    context = browser.new_context(
+        viewport={"width": 1280, "height": 720},
+        extra_http_headers={"Cache-Control": "no-cache"},
+    )
+    page = context.new_page()
+    try:
+        return fn(page)
+    finally:
+        context.close()
 
 
 def create_profile_in_browser(page: Page, *, path: str = "") -> Credentials:
     open_app(page, path=path)
-    page.get_by_test_id("onboarding-create-profile").click()
-    expect(page.get_by_test_id("onboarding-setup")).to_be_visible(timeout=15000)
+    t_onboard = _e2e_onboarding_timeout_ms()
+    create_btn = page.get_by_test_id("onboarding-create-profile")
+    expect(create_btn).to_be_visible(timeout=min(30000, t_onboard))
+    create_btn.click()
+    expect(page.get_by_test_id("onboarding-setup")).to_be_visible(timeout=t_onboard)
     creds = Credentials(
         user_id=page.get_by_test_id("onboarding-created-user-id").inner_text().strip(),
         private_token=page.get_by_test_id("onboarding-created-private-token").inner_text().strip(),
@@ -210,13 +235,48 @@ def login_existing_user(page: Page, creds: Credentials) -> None:
     page.get_by_test_id("onboarding-open-profile").click()
 
 
-def finish_starter_gate(page: Page, *, positive_action: str = "like", total_actions: int = 12) -> None:
-    expect(page.get_by_test_id("starter-gate")).to_be_visible(timeout=15000)
-    page.get_by_test_id(f"discover-rate-{positive_action}").click()
-    for _ in range(total_actions - 1):
-        page.get_by_test_id("discover-rate-not_interested").click()
-    expect(page.get_by_test_id("nav-tab-discover")).to_be_visible(timeout=15000)
-    expect(page.get_by_test_id("discover-view")).to_be_visible(timeout=15000)
+def finish_starter_gate(page: Page, *, total_actions: int = 12) -> None:
+    # Single long wait here (avoid duplicating a long ``starter-gate`` expect before this helper — that pairing
+    # caused Chromium headless ``locator.click`` to hang on the first ``Like`` in practice).
+    expect(page.get_by_test_id("starter-gate")).to_be_visible(timeout=120_000)
+    if page.get_by_text("Could not load recommendations").count():
+        snippet = page.locator("body").inner_text()[:800]
+        raise AssertionError(f"Discover recommendations error in browser. Body snippet:\n{snippet}")
+    starter = page.locator('[data-testid="starter-discover-view"]')
+    expect(starter).to_be_visible(timeout=120_000)
+    expect(starter.get_by_test_id("discover-saved-count")).to_have_text("0 saved", timeout=120_000)
+    expect(starter.locator('[data-testid="discover-direction-strip"]')).to_be_visible(timeout=120_000)
+    bar = page.locator('[data-testid="discover-action-bar"]')
+    expect(bar).to_be_visible(timeout=120_000)
+    expect(bar.locator("button")).to_have_count(5, timeout=30_000)
+    expect(bar.locator("button").nth(0)).to_have_attribute("data-testid", "discover-rate-love", timeout=10_000)
+    expect(bar.locator("button").nth(1)).to_have_attribute("data-testid", "discover-rate-like", timeout=10_000)
+    # Always tap Like on the current top card (re-mounts each advance). Mixing Skip was flaky under headless transitions.
+    _expect_saved = (
+        "1 saved",
+        "2 saved",
+        "3 saved",
+        "4 saved",
+        "5 saved",
+        "6 saved",
+        "7 saved",
+        "8 saved",
+        "9 saved",
+        "10 saved",
+        "11 saved",
+        "12 saved",
+    )
+    if total_actions != 12:
+        raise AssertionError("finish_starter_gate only supports total_actions=12 (starter gate contract)")
+    for saved_label in _expect_saved:
+        starter = page.locator('[data-testid="starter-discover-view"]')
+        like_btn = page.get_by_test_id("discover-rate-like")
+        expect(like_btn).to_be_attached(timeout=30_000)
+        like_btn.click(force=True, timeout=120_000)
+        expect(starter.get_by_test_id("discover-saved-count")).to_have_text(saved_label, timeout=60_000)
+    # Leaving the starter gate swaps ``starter-discover-view`` for main ``discover-view`` (nav mounts at 1024px+).
+    expect(page.get_by_test_id("discover-view")).to_be_visible(timeout=90_000)
+    expect(page.get_by_test_id("nav-tab-discover")).to_be_visible(timeout=30_000)
 
 
 def open_together(page: Page) -> None:
@@ -248,7 +308,7 @@ def wait_for(predicate: Callable[[], bool], *, timeout_s: float = 20.0, step_s:
     while time.time() < deadline:
         if predicate():
             return
-        time.sleep(step_s)
+        _POLL_WAIT.wait(timeout=step_s)
     raise AssertionError(f"Timed out waiting for {label}")
 
 
@@ -271,18 +331,74 @@ def _run_stage(name: str, fn: Callable[[], dict[str, object]]) -> StageResult:
         return StageResult(name=name, ok=False, details={"error": str(exc)})
 
 
+def _seed_browser_session(page: Page, creds: Credentials) -> None:
+    """Open the app with an existing profile (same as returning visitor with saved localStorage)."""
+    open_app(page)
+    page.evaluate(
+        """([uid, tok]) => {
+            localStorage.clear();
+            try { sessionStorage.clear(); } catch (e) {}
+            localStorage.setItem("kink_auth", JSON.stringify({ userId: uid, token: tok }));
+        }""",
+        [creds.user_id, creds.private_token],
+    )
+    page.reload(wait_until="load", timeout=120_000)
+
+
+def scenario_onboarding_create_button(page: Page) -> dict[str, object]:
+    """Minimal UX: welcome → Create profile → credential setup (covers POST /users + DOM)."""
+    open_app(page)
+    page.get_by_test_id("onboarding-create-profile").click()
+    expect(page.get_by_test_id("onboarding-setup")).to_be_visible(timeout=_e2e_onboarding_timeout_ms())
+    expect(page.get_by_test_id("onboarding-created-user-id")).to_be_visible(timeout=30_000)
+    return {"summary": "Create profile reaches credential + role setup screen"}
+
+
 def scenario_starter_gate(page: Page) -> dict[str, object]:
-    creds = create_profile_in_browser(page)
-    finish_starter_gate(page)
+    # Server-side user avoids fragile cold-start timing on POST /users vs first deck paint; starter + relogin is still all-UI.
+    creds = create_user()
+    fresh = get_user(creds)
+    if len(fresh.get("plays") or {}):
+        raise AssertionError(f"Expected new user with no plays before browser session, got {len(fresh['plays'])}")
+    rec_items = get_json(f"/users/{creds.user_id}/recommendations?limit=8", headers=auth_headers(creds)).get("items", [])
+    if len(rec_items) < 1:
+        raise AssertionError("New user has no recommendations before browser session (seed/API contract)")
+    _seed_browser_session(page, creds)
+    play_posts: list[str] = []
+    page.on(
+        "request",
+        lambda req: play_posts.append(req.url) if req.method == "POST" and "/plays" in req.url else None,
+    )
+    try:
+        finish_starter_gate(page)
+    except Exception as exc:
+        u_dbg = get_user(creds)
+        n_dbg = len(u_dbg.get("plays") or {})
+        keys_dbg = list((u_dbg.get("plays") or {}).keys())
+        raise AssertionError(
+            f"{exc}; after failure server play_count={n_dbg} play_keys={keys_dbg!r} "
+            f"browser_post_plays_count={len(play_posts)}"
+        ) from exc
     user = get_user(creds)
     saved_count = len(user.get("plays", {}))
     if saved_count < 12:
         raise AssertionError(f"starter gate unlocked before starter picks were durably saved (saved_count={saved_count})")
     discover_source = get_json(f"/users/{creds.user_id}/recommendations?limit=8", headers=auth_headers(creds)).get("items", [])[0]["discovery_source"]
+    # Full auth UX: leave app and log back in with the same credentials (guards logout/login + localStorage).
+    expect(page.get_by_test_id("discover-view")).to_be_visible(timeout=15000)
+    page.get_by_test_id("app-logout").click()
+    expect(page.get_by_test_id("onboarding-welcome")).to_be_visible(timeout=15000)
+    login_existing_user(page, creds)
+    expect(page.get_by_test_id("discover-view")).to_be_visible(timeout=15000)
+    user_after = get_user(creds)
+    saved_after = len(user_after.get("plays", {}))
+    if saved_after < 12:
+        raise AssertionError(f"plays missing after re-login (saved_after={saved_after})")
     return {
-        "summary": "starter onboarding reaches full Discover with one-tap saves",
+        "summary": "create → starter → discover → logout → login → discover with durable plays",
         "user_id": creds.user_id,
         "saved_count": saved_count,
+        "saved_after_relogin": saved_after,
         "first_play_directions": next(iter(user.get("plays", {}).values()))["directions"],
         "first_discovery_source": discover_source,
     }
@@ -314,8 +430,14 @@ def scenario_couple_audit(browser: Browser) -> dict[str, object]:
         }
     ]
 
-    left_context = browser.new_context()
-    right_context = browser.new_context()
+    left_context = browser.new_context(
+        viewport={"width": 1280, "height": 720},
+        extra_http_headers={"Cache-Control": "no-cache"},
+    )
+    right_context = browser.new_context(
+        viewport={"width": 1280, "height": 720},
+        extra_http_headers={"Cache-Control": "no-cache"},
+    )
     left_page = left_context.new_page()
     right_page = right_context.new_page()
 
@@ -599,8 +721,9 @@ def scenario_couple_audit(browser: Browser) -> dict[str, object]:
 
 
 SCENARIOS: dict[str, Callable[[Browser], dict[str, object]]] = {
-    "starter": lambda browser: scenario_starter_gate(browser.new_page()),
-    "settings": lambda browser: scenario_settings_controls(browser.new_page()),
+    "onboarding": lambda browser: _run_in_fresh_context(browser, scenario_onboarding_create_button),
+    "starter": lambda browser: _run_in_fresh_context(browser, scenario_starter_gate),
+    "settings": lambda browser: _run_in_fresh_context(browser, scenario_settings_controls),
     "couple": scenario_couple_audit,
 }
 
@@ -623,7 +746,15 @@ def normalize_scenarios(names: list[str]) -> list[str]:
 def run_selected_scenarios(selected: list[str], *, headless: bool = True) -> list[StageResult]:
     results: list[StageResult] = []
     with sync_playwright() as playwright:
-        browser = playwright.chromium.launch(channel="chrome", headless=headless, args=["--no-sandbox"])
+        launch_kwargs: dict[str, object] = {
+            "headless": headless,
+            # Shared HTTP cache across fresh contexts caused empty starter decks while urllib saw recs (Chromium).
+            "args": ["--no-sandbox", "--disable-http-cache"],
+        }
+        channel = os.environ.get("KINK_PLAYWRIGHT_CHANNEL", "").strip()
+        if channel:
+            launch_kwargs["channel"] = channel
+        browser = playwright.chromium.launch(**launch_kwargs)
         try:
             for name in normalize_scenarios(selected):
                 results.append(_run_stage(name, lambda scenario_name=name: SCENARIOS[scenario_name](browser)))

tests/test_auth_login.py

@@ -64,6 +64,30 @@ def test_login_unknown_user_404_not_wrong_password(api_client) -> None:
     assert "ephemeral" in detail.lower()
 
 
+def test_new_user_has_recommendations_on_hf_seed(api_client) -> None:
+    """Playwright e2e depends on a non-empty starter deck from ``/recommendations``."""
+    client = TestClient(api_client.app)
+    u = client.post("/users", json={}).json()
+    r = client.get(
+        f"/users/{u['id']}/recommendations?limit=8",
+        headers={"x-private-token": u["private_token"]},
+    )
+    assert r.status_code == 200
+    assert len(r.json().get("items", [])) >= 1
+
+
+def test_create_profile_then_get_user_immediately(api_client) -> None:
+    """UI: POST /users then GET /users/:id with token — must not 404/401 (HF create-profile flow)."""
+    client = TestClient(api_client.app)
+    u = client.post("/users", json={}).json()
+    uid = u["id"]
+    tok = u["private_token"]
+    r = client.get(f"/users/{uid}", headers={"x-private-token": tok})
+    assert r.status_code == 200
+    body = r.json()
+    assert body["id"] == uid
+
+
 def test_login_strips_whitespace_on_body_fields(api_client) -> None:
     client = TestClient(api_client.app)
     u = client.post("/users", json={}).json()

tests/test_e2e_playwright_product_flow.py

@@ -0,0 +1,125 @@
+"""Browser e2e: local uvicorn + Playwright starter flow (create, starter gate, relogin).
+
+Requires ``curl`` on PATH and Playwright browsers: ``python -m playwright install chromium``
+(optional ``KINK_PLAYWRIGHT_CHANNEL=chrome`` for system Chrome.)
+
+Run: ``pytest tests/test_e2e_playwright_product_flow.py``
+"""
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import socket
+import subprocess
+import sys
+import threading
+import time
+from importlib.util import module_from_spec, spec_from_file_location
+from pathlib import Path
+
+import pytest
+
+_REPO = Path(__file__).resolve().parent.parent
+_SEED = _REPO / "deploy/hf/seed/hf_bundled_store.db"
+_POLL = threading.Event()
+
+
+def _wait_s(seconds: float) -> None:
+    _POLL.wait(timeout=seconds)
+
+
+def _free_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.bind(("127.0.0.1", 0))
+        return int(sock.getsockname()[1])
+
+
+def _load_playwright_flow():
+    path = _REPO / "scripts" / "playwright_product_flow.py"
+    spec = spec_from_file_location("playwright_product_flow", path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"Cannot load {path}")
+    mod = module_from_spec(spec)
+    sys.modules[spec.name] = mod
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _terminate_process(proc: subprocess.Popen[str]) -> None:
+    proc.terminate()
+    deadline = time.monotonic() + 15.0
+    while proc.poll() is None and time.monotonic() < deadline:
+        _wait_s(0.1)
+    if proc.poll() is None:
+        proc.kill()
+    if proc.stderr:
+        err = proc.stderr.read()
+        code = proc.returncode
+        if code not in (0, -15, -9) and err:
+            print(err, file=sys.stderr)
+
+
+def _start_uvicorn_with_seed(tmp_path: Path) -> tuple[str, subprocess.Popen[str]]:
+    assert _SEED.is_file(), f"Missing seed DB: {_SEED}"
+    db = tmp_path / "e2e_playwright_store.db"
+    shutil.copyfile(_SEED, db)
+    port = _free_port()
+    base = f"http://127.0.0.1:{port}"
+    env = os.environ.copy()
+    env["KINK_STORE_PATH"] = str(db)
+    env["KINK_SKIP_HEAVY_WARM"] = "1"
+    env["KINK_HF_REQUIRE_FULL_CATALOG"] = "0"
+    env["KINK_FRONTEND_NO_CACHE"] = "1"
+    proc = subprocess.Popen(
+        [sys.executable, "-m", "uvicorn", "api:app", "--host", "127.0.0.1", f"--port={port}"],
+        cwd=str(_REPO),
+        env=env,
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+    url = f"{base}/health"
+    deadline = time.monotonic() + 120.0
+    while time.monotonic() < deadline:
+        completed = subprocess.run(
+            ["curl", "-sS", "-f", "-m", "5", url],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if completed.returncode == 0 and completed.stdout.strip():
+            data = json.loads(completed.stdout)
+            if data.get("ok") is True:
+                return base, proc
+        _wait_s(0.4)
+    _terminate_process(proc)
+    raise AssertionError("/health did not become ok within 120s (uvicorn stderr may have clues)")
+
+
+@pytest.fixture(scope="module")
+def _playwright_chromium_launchable() -> None:
+    from playwright.sync_api import sync_playwright
+
+    with sync_playwright() as p:
+        browser = p.chromium.launch(headless=True, args=["--no-sandbox", "--disable-http-cache"])
+        browser.close()
+
+
+@pytest.fixture
+def e2e_app_base_url(tmp_path: Path) -> str:
+    base, proc = _start_uvicorn_with_seed(tmp_path)
+    yield base
+    _terminate_process(proc)
+
+
+def test_playwright_starter_create_relogin_e2e(
+    e2e_app_base_url: str,
+    _playwright_chromium_launchable: None,
+) -> None:
+    flow = _load_playwright_flow()
+    flow.BASE_URL = e2e_app_base_url
+    results = flow.run_selected_scenarios(["onboarding", "starter"], headless=True)
+    payload = flow.results_to_json(results)
+    if not payload["ok"]:
+        raise AssertionError(str(payload.get("summary", payload)))

tests/test_starter_deck_saves_api.py

@@ -0,0 +1,68 @@
+"""Sequential play saves on a fresh user (guards starter deck API + play keys)."""
+from __future__ import annotations
+
+import shutil
+import sys
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+_SEED = Path(__file__).resolve().parent.parent / "deploy/hf/seed/hf_bundled_store.db"
+
+
+@pytest.fixture()
+def api_client(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
+    assert _SEED.is_file(), f"Missing seed DB: {_SEED}"
+    dest = tmp_path / "starter_saves_store.db"
+    shutil.copyfile(_SEED, dest)
+    monkeypatch.setenv("KINK_STORE_PATH", str(dest))
+    monkeypatch.setenv("KINK_SKIP_HEAVY_WARM", "1")
+    monkeypatch.setenv("KINK_HF_REQUIRE_FULL_CATALOG", "0")
+    sys.modules.pop("api", None)
+    import api as api_mod
+
+    api_mod._backend_impl = None
+    api_mod._get_backend()
+    return api_mod
+
+
+def test_two_distinct_likes_increment_play_count(api_client) -> None:
+    client = TestClient(api_client.app)
+    u = client.post("/users", json={}).json()
+    uid, tok = u["id"], u["private_token"]
+    h = {"x-private-token": tok}
+    rec = client.get(f"/users/{uid}/recommendations?limit=8", headers=h).json()
+    items = rec.get("items") or []
+    assert len(items) >= 2, items
+    a = items[0]["kink"]["id"]
+    b = items[1]["kink"]["id"]
+    assert a != b
+    body = {"kink_id": a, "interest_state": "like", "directions": ["together"]}
+    r1 = client.post(f"/users/{uid}/plays", json=body, headers=h)
+    assert r1.status_code == 200, r1.text
+    r2 = client.post(
+        f"/users/{uid}/plays",
+        json={"kink_id": b, "interest_state": "like", "directions": ["together"]},
+        headers=h,
+    )
+    assert r2.status_code == 200, r2.text
+    plays = r2.json().get("plays") or {}
+    assert len(plays) == 2, plays
+
+
+def test_recommendations_after_first_save_exclude_that_kink(api_client) -> None:
+    client = TestClient(api_client.app)
+    u = client.post("/users", json={}).json()
+    uid, tok = u["id"], u["private_token"]
+    h = {"x-private-token": tok}
+    rec0 = client.get(f"/users/{uid}/recommendations?limit=8", headers=h).json()
+    top = (rec0.get("items") or [])[0]["kink"]["id"]
+    client.post(
+        f"/users/{uid}/plays",
+        json={"kink_id": top, "interest_state": "like", "directions": ["together"]},
+        headers=h,
+    )
+    rec1 = client.get(f"/users/{uid}/recommendations?limit=8", headers=h).json()
+    ids = [row["kink"]["id"] for row in (rec1.get("items") or [])]
+    assert top not in ids, (top, ids[:5])