Merge branch 'dev' into bugfix/org

2026-05-27 13:11:29 +09:00
parent 35e51910c6 0e7ab2a22f
commit dda1df9c48
18 changed files with 439 additions and 138 deletions
--- a/.playwright-mcp/page-2026-05-26T09-02-03-101Z.yml
+++ b/.playwright-mcp/page-2026-05-26T09-02-03-101Z.yml
@@ -0,0 +1 @@
+- generic [ref=e2]: Bad Gateway
--- a/locales/en.toml
+++ b/locales/en.toml
--- a/test/frontend_dev_bind_mount_policy_test.sh
+++ b/test/frontend_dev_bind_mount_policy_test.sh
@@ -45,12 +45,22 @@ grep -Fq -- "--dart-define=CLIENT_LOG_DEBUG=" "$USERFRONT_DEV_SERVER" || fail "u
 grep -Fq -- "--dart-define=APP_ENV=" "$USERFRONT_DEV_SERVER" || fail "userfront dev server must pass app env through dart-define"
 grep -Fq -- "--dart-define=USERFRONT_URL=" "$USERFRONT_DEV_SERVER" || fail "userfront dev server must pass userfront URL through dart-define"
 grep -Fq -- 'USERFRONT_FLUTTER_RUN_FLAGS' "$USERFRONT_DEV_SERVER" || fail "userfront dev server must accept optional Flutter run flags"
+grep -Fq -- 'USERFRONT_FLUTTER_RUN_FLAGS="${USERFRONT_FLUTTER_RUN_FLAGS:---debug}"' "$USERFRONT_DEV_SERVER" || fail "userfront dev server must keep Flutter debug mode as the default"
+grep -Fq -- 'warm_userfront_once' "$USERFRONT_DEV_SERVER" || fail "userfront dev server must run a one-shot boot warmup"
+grep -Fq -- 'USERFRONT_BOOT_WARMUP_LOCALES' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must declare the language matrix"
+grep -Fq -- 'USERFRONT_BOOT_WARMUP_VIEWPORTS' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must declare the viewport matrix"
+grep -Fq -- 'Accept-Language:' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must GET each route with the locale header"
+grep -Fq -- 'Viewport-Width:' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must GET each route with viewport width metadata"
+grep -Fq -- '/signin' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must cover signin routes"
+grep -Fq -- '/flutter_bootstrap.js' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must load the Flutter bootstrap entrypoint"
+grep -Fq -- '/main.dart.mjs' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must load the wasm JS module entrypoint"
+grep -Fq -- '/main.dart.wasm' "$USERFRONT_DEV_SERVER" || fail "userfront boot warmup must load the wasm module"
 assert_contains 'CLIENT_LOG_DEBUG=${CLIENT_LOG_DEBUG:-false}'
 assert_contains 'BACKEND_URL=${BACKEND_URL:-}'
 assert_contains 'USERFRONT_URL=${USERFRONT_URL}'
 assert_contains 'USERFRONT_FLUTTER_RUN_FLAGS=${USERFRONT_FLUTTER_RUN_FLAGS:-}'
-if grep -Fq -- "--debug" "$USERFRONT_DEV_SERVER"; then
-  fail "make dev must not hard-code Flutter debug mode in the userfront dev server"
+if grep -Fq -- "while true" "$USERFRONT_DEV_SERVER"; then
+  fail "userfront boot warmup must not run as a periodic health check"
 fi
 if grep -Fq -- "--release" "$USERFRONT_DEV_SERVER"; then
  fail "userfront dev server must not run Flutter in release mode"
--- a/userfront-e2e/fixtures/fonts/NotoSansKR-TestSubset.woff2
+++ b/userfront-e2e/fixtures/fonts/NotoSansKR-TestSubset.woff2
--- a/userfront-e2e/playwright.config.ts
+++ b/userfront-e2e/playwright.config.ts
@@ -13,7 +13,7 @@ export default defineConfig({
  fullyParallel: false,
  forbidOnly: !!process.env.CI,
  retries: process.env.CI ? 2 : 0,
-  workers: configuredWorkers ?? (process.env.CI ? 1 : undefined),
+  workers: configuredWorkers ?? 1,
  reporter: process.env.CI ? [['html', { open: 'never' }], ['list']] : 'html',
  use: {
    baseURL,
@@ -23,6 +23,20 @@ export default defineConfig({
    locale: process.env.LOCALE ?? 'ko-KR',
  },
  projects: [
+    {
+      name: 'webkit-desktop',
+      use: {
+        ...devices['Desktop Safari'],
+        serviceWorkers: 'block',
+      },
+    },
+    {
+      name: 'webkit-mobile-webapp',
+      use: {
+        ...devices['iPhone 13'],
+        serviceWorkers: 'block',
+      },
+    },
    {
      name: 'chromium-desktop',
      use: {
@@ -30,11 +44,18 @@ export default defineConfig({
        serviceWorkers: 'block',
      },
    },
+    {
+      name: 'firefox-desktop',
+      use: {
+        ...devices['Desktop Firefox'],
+        serviceWorkers: 'block',
+      },
+    },
    {
      name: 'chromium-mobile-webapp',
      use: {
        ...devices['Pixel 7'],
-        serviceWorkers: 'allow',
+        serviceWorkers: 'block',
      },
    },
  ],
--- a/userfront-e2e/tests/login-performance-budget.spec.ts
+++ b/userfront-e2e/tests/login-performance-budget.spec.ts
@@ -101,9 +101,7 @@ function expectNoDuplicateStaticRequests(metrics: LoadMetrics): void {
        !path.endsWith('/main.dart.wasm') &&
        !path.endsWith('/main.dart.mjs') &&
        !path.endsWith('/skwasm.js') &&
-        !path.endsWith('/skwasm.wasm') &&
-        !path.endsWith('/assets/assets/fonts/NotoSansKR-Regular.ttf') &&
-        !path.endsWith('/assets/assets/fonts/NotoSansKR-Bold.ttf')
+        !path.endsWith('/skwasm.wasm')
      );
    },
  );
--- a/userfront-e2e/tests/runtime-env-mobile.spec.ts
+++ b/userfront-e2e/tests/runtime-env-mobile.spec.ts
@@ -1,6 +1,17 @@
-import { expect, test, type Page } from '@playwright/test';
+import {
+  expect,
+  test,
+  type BrowserContext,
+  type Page,
+  type TestInfo,
+} from '@playwright/test';
+import { readFileSync } from 'node:fs';
 import { inflateSync } from 'node:zlib';

+const lightweightTestFont = readFileSync(
+  new URL('../fixtures/fonts/NotoSansKR-TestSubset.woff2', import.meta.url),
+);
+
 type SigninCase = {
  path: '/ko/signin' | '/en/signin';
  theme: 'light' | 'dark';
@@ -13,8 +24,8 @@ const signinCases: SigninCase[] = [
  { path: '/en/signin', theme: 'dark' },
 ];

-async function mockPublicApis(page: Page): Promise<void> {
-  await page.route('**/api/v1/**', async (route) => {
+async function mockPublicApis(context: BrowserContext): Promise<void> {
+  await context.route(/\/api\/v1\//, async (route) => {
    const requestUrl = new URL(route.request().url());
    if (requestUrl.pathname.endsWith('/api/v1/user/me')) {
      await route.fulfill({
@@ -42,10 +53,27 @@ async function mockPublicApis(page: Page): Promise<void> {
  });
 }

+async function routeLightweightTestFonts(context: BrowserContext): Promise<void> {
+  await context.route('https://fonts.gstatic.com/**', async (route) => {
+    await route.fulfill({
+      status: 200,
+      contentType: 'font/woff2',
+      body: lightweightTestFont,
+      headers: {
+        'access-control-allow-origin': '*',
+        'cache-control': 'public, max-age=31536000, immutable',
+      },
+    });
+  });
+}
+
 async function expectFlutterCanvasRendered(
  page: Page,
  timeoutMs = 5_000,
 ): Promise<void> {
+  await expect(page.locator('#baron-bootstrap-shell')).toBeHidden({
+    timeout: timeoutMs,
+  });
  await expect
    .poll(() => page.screenshot().then(screenshotHasSigninPaint), {
      timeout: timeoutMs,
@@ -59,6 +87,36 @@ async function expectBootstrapShellVisible(page: Page): Promise<void> {
  await expect(shell).toContainText(/Baron SW Portal/);
 }

+async function expectSigninSurfaceWithinBudget(
+  page: Page,
+  testInfo: TestInfo,
+  entry: SigninCase,
+): Promise<void> {
+  await seedAuthState(page, entry);
+  await page.goto(entry.path, { waitUntil: 'domcontentloaded' });
+
+  const slug = `${entry.path.slice(1).replace('/', '-')}-${entry.theme}`;
+  let paintedAtMs: number | null = null;
+  let previousElapsedMs = 0;
+  for (const elapsedMs of [500, 1000]) {
+    await page.waitForTimeout(elapsedMs - previousElapsedMs);
+    previousElapsedMs = elapsedMs;
+    const screenshot = await page.screenshot({
+      path: testInfo.outputPath(`${testInfo.project.name}-${slug}-${elapsedMs}ms.png`),
+      fullPage: true,
+    });
+    if (paintedAtMs === null && screenshotHasSigninPaint(screenshot)) {
+      paintedAtMs = elapsedMs;
+    }
+  }
+
+  expect(paintedAtMs).not.toBeNull();
+  expect(paintedAtMs ?? Number.POSITIVE_INFINITY).toBeLessThanOrEqual(1_000);
+  console.log(
+    `[userfront-e2e] ${testInfo.project.name} ${entry.path} ${entry.theme} signin surface painted at ${paintedAtMs}ms`,
+  );
+}
+
 function screenshotHasSigninPaint(buffer: Buffer): boolean {
  const image = decodePng(buffer);
  let sampled = 0;
@@ -204,16 +262,22 @@ function paeth(left: number, up: number, upLeft: number): number {
  return upLeft;
 }

-async function seedAuthTheme(page: Page, theme: SigninCase['theme']): Promise<void> {
-  await page.addInitScript((themeValue) => {
+async function seedAuthState(page: Page, entry: SigninCase): Promise<void> {
+  const localeCode = entry.path.slice(1, 3);
+  await page.addInitScript(({ themeValue, localeValue }) => {
    window.localStorage.setItem('userfront_auth_theme', themeValue);
    window.localStorage.setItem('flutter.userfront_auth_theme', themeValue);
-  }, theme);
+    window.localStorage.setItem('locale', localeValue);
+    window.localStorage.setItem('flutter.locale', localeValue);
+  }, { themeValue: entry.theme, localeValue: localeCode });
 }

 test.describe('UserFront signin runtime matrix', () => {
-  test.beforeEach(async ({ page }) => {
-    await mockPublicApis(page);
+  test.beforeEach(async ({ context }, testInfo) => {
+    await mockPublicApis(context);
+    if (testInfo.project.name !== 'webkit-desktop') {
+      await routeLightweightTestFonts(context);
+    }
  });

  test('first paint exposes bootstrap shell before Flutter renders', async ({
@@ -227,39 +291,17 @@ test.describe('UserFront signin runtime matrix', () => {
    });
  });

-  test('mobile signin paints final UI within 2 seconds with 0.5s captures', async ({
-    page,
-  }, testInfo) => {
-    test.skip(
-      !testInfo.project.name.includes('mobile'),
-      'mobile loading budget is verified on the mobile project',
-    );
-
-    await seedAuthTheme(page, 'light');
-    await page.goto('/ko/signin', { waitUntil: 'domcontentloaded' });
-
-    let paintedAtMs: number | null = null;
-    let previousElapsedMs = 0;
-    for (const elapsedMs of [500, 1000, 1500, 2000]) {
-      await page.waitForTimeout(elapsedMs - previousElapsedMs);
-      previousElapsedMs = elapsedMs;
-      const screenshot = await page.screenshot({
-        path: testInfo.outputPath(`mobile-ko-signin-${elapsedMs}ms.png`),
-        fullPage: true,
-      });
-      if (paintedAtMs === null && screenshotHasSigninPaint(screenshot)) {
-        paintedAtMs = elapsedMs;
-      }
-    }
-
-    expect(paintedAtMs).not.toBeNull();
-    expect(paintedAtMs ?? Number.POSITIVE_INFINITY).toBeLessThanOrEqual(2_000);
-    console.log(`[userfront-e2e] mobile signin painted at ${paintedAtMs}ms`);
-  });
+  for (const entry of signinCases) {
+    test(`${entry.path} ${entry.theme} paints sign-in surface within 1 second with 0.5s captures`, async ({
+      page,
+    }, testInfo) => {
+      await expectSigninSurfaceWithinBudget(page, testInfo, entry);
+    });
+  }

  for (const entry of signinCases) {
    test(`${entry.path} renders in ${entry.theme} theme`, async ({ page }) => {
-      await seedAuthTheme(page, entry.theme);
+      await seedAuthState(page, entry);
      await page.goto(entry.path);
      await expect(page).toHaveURL(new RegExp(`${entry.path}(?:\\?.*)?$`));
      await expectFlutterCanvasRendered(page);
@@ -281,7 +323,7 @@ test.describe('UserFront signin runtime matrix', () => {
    });

    for (const entry of signinCases) {
-      await seedAuthTheme(page, entry.theme);
+      await seedAuthState(page, entry);
      await page.goto(entry.path);
      await expectFlutterCanvasRendered(page);
      await expect
@@ -290,4 +332,32 @@ test.describe('UserFront signin runtime matrix', () => {
      expect(requestedApiOrigins).not.toContain('https://sso.example.test');
    }
  });
+
+  test('Korean signin renders with test-only lightweight web font', async ({
+    context,
+    page,
+  }, testInfo) => {
+    if (testInfo.project.name === 'webkit-desktop') {
+      await routeLightweightTestFonts(context);
+    }
+    const requestedUrls: string[] = [];
+    page.on('request', (request) => {
+      requestedUrls.push(request.url());
+    });
+
+    await seedAuthState(page, { path: '/ko/signin', theme: 'light' });
+    await page.goto('/ko/signin', { waitUntil: 'domcontentloaded' });
+    await expectFlutterCanvasRendered(page, 10_000);
+    await page.screenshot({
+      path: testInfo.outputPath(`${testInfo.project.name}-ko-signin-korean-font.png`),
+      fullPage: true,
+    });
+
+    expect(requestedUrls).toContainEqual(
+      expect.stringContaining('https://fonts.gstatic.com/'),
+    );
+    expect(requestedUrls).not.toContainEqual(
+      expect.stringContaining('/assets/assets/fonts/NotoSansKR-Regular.ttf'),
+    );
+  });
 });
--- a/userfront/assets/translations/en.toml
+++ b/userfront/assets/translations/en.toml
--- a/userfront/lib/core/i18n/toml_asset_loader.dart
+++ b/userfront/lib/core/i18n/toml_asset_loader.dart
@@ -10,45 +10,37 @@ class TomlAssetLoader extends AssetLoader {
  @override
  Future<Map<String, dynamic>> load(String path, Locale locale) async {
    final languageCode = locale.languageCode.toLowerCase();
-    final source = switch (languageCode) {
-      'ko' => koStrings,
-      'en' => enStrings,
-      _ => enStrings,
+    return switch (languageCode) {
+      'ko' => _normalizedKoStrings,
+      'en' => _normalizedEnStrings,
+      _ => _normalizedEnStrings,
    };
-    return _expandFlatTranslations(source);
  }
 }

-Map<String, dynamic> _expandFlatTranslations(Map<String, String> flatMap) {
-  final nested = <String, dynamic>{};
-  for (final entry in flatMap.entries) {
-    final key = entry.key;
-    if (key.isEmpty) {
-      continue;
-    }
-    final segments = key.split('.');
-    Map<String, dynamic> cursor = nested;
-    for (var index = 0; index < segments.length; index++) {
-      final segment = segments[index];
-      if (segment.isEmpty) {
-        continue;
-      }
-      final isLeaf = index == segments.length - 1;
-      if (isLeaf) {
-        cursor[segment] = _normalizeLocalizationValue(entry.value);
-        continue;
-      }
-      final next = cursor.putIfAbsent(segment, () => <String, dynamic>{});
-      if (next is Map<String, dynamic>) {
-        cursor = next;
-        continue;
-      }
-      final replacement = <String, dynamic>{};
-      cursor[segment] = replacement;
-      cursor = replacement;
-    }
-  }
-  return nested;
+final Map<String, dynamic> _normalizedKoStrings = _normalizeFlatTranslations(
+  koStrings,
+);
+final Map<String, dynamic> _normalizedEnStrings = _normalizeFlatTranslations(
+  enStrings,
+);
+
+Map<String, dynamic> _normalizeFlatTranslations(Map<String, String> flatMap) =>
+    Map.fromEntries(
+      flatMap.entries
+          .where((entry) => _isUserfrontTranslationKey(entry.key))
+          .map(
+            (entry) =>
+                MapEntry(entry.key, _normalizeLocalizationValue(entry.value)),
+          ),
+    );
+
+bool _isUserfrontTranslationKey(String key) {
+  return key.startsWith('domain.') ||
+      key.startsWith('err.userfront.') ||
+      key.startsWith('msg.userfront.') ||
+      key.startsWith('ui.userfront.') ||
+      key.startsWith('ui.common.');
 }

 String _normalizeLocalizationValue(String value) {
--- a/userfront/lib/core/services/log_policy.dart
+++ b/userfront/lib/core/services/log_policy.dart
@@ -52,14 +52,11 @@ class LogPolicy {
    required String? appEnv,
    required String? productionDebugFlag,
  }) {
-    final flag = parseOptionalBoolFlag(productionDebugFlag);
-    if (flag.specified) {
-      return flag.enabled;
-    }
    if (!isProductionEnv(appEnv)) {
      return true;
    }
-    return false;
+    final flag = parseOptionalBoolFlag(productionDebugFlag);
+    return flag.specified && flag.enabled;
  }

  static bool shouldRelayClientLog({
@@ -67,10 +64,12 @@ class LogPolicy {
    required String? appEnv,
    required String? productionDebugFlag,
  }) {
-    if (debugEnabled(
-      appEnv: appEnv,
-      productionDebugFlag: productionDebugFlag,
-    )) {
+    final flag = parseOptionalBoolFlag(productionDebugFlag);
+    final debugRelayEnabled = isProductionEnv(appEnv)
+        ? flag.specified && flag.enabled
+        : !(flag.specified && !flag.enabled);
+
+    if (debugRelayEnabled) {
      return true;
    }
    final normalized = level.trim().toUpperCase();
--- a/userfront/lib/features/auth/presentation/login_screen.dart
+++ b/userfront/lib/features/auth/presentation/login_screen.dart
@@ -1781,7 +1781,7 @@ class _LoginScreenState extends ConsumerState<LoginScreen>
                          style: theme.textTheme.headlineMedium?.copyWith(
                            fontSize: 34,
                            fontWeight: FontWeight.w800,
-                            letterSpacing: -0.7,
+                            letterSpacing: 0,
                          ),
                          textAlign: TextAlign.center,
                        ),
--- a/userfront/lib/i18n_data.dart
+++ b/userfront/lib/i18n_data.dart
--- a/userfront/pubspec.lock
+++ b/userfront/pubspec.lock
@@ -45,10 +45,10 @@ packages:
    dependency: transitive
    description:
      name: characters
-      sha256: f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803
+      sha256: faf38497bda5ead2a8c7615f4f7939df04333478bf32e4173fcb06d428b5716b
      url: "https://pub.dev"
    source: hosted
-    version: "1.4.0"
+    version: "1.4.1"
  cli_config:
    dependency: transitive
    description:
@@ -320,18 +320,18 @@ packages:
    dependency: transitive
    description:
      name: matcher
-      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
+      sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
      url: "https://pub.dev"
    source: hosted
-    version: "0.12.17"
+    version: "0.12.19"
  material_color_utilities:
    dependency: transitive
    description:
      name: material_color_utilities
-      sha256: f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec
+      sha256: "9c337007e82b1889149c82ed242ed1cb24a66044e30979c44912381e9be4c48b"
      url: "https://pub.dev"
    source: hosted
-    version: "0.11.1"
+    version: "0.13.0"
  meta:
    dependency: transitive
    description:
@@ -653,26 +653,26 @@ packages:
    dependency: transitive
    description:
      name: test
-      sha256: "75906bf273541b676716d1ca7627a17e4c4070a3a16272b7a3dc7da3b9f3f6b7"
+      sha256: "280d6d890011ca966ad08df7e8a4ddfab0fb3aa49f96ed6de56e3521347a9ae7"
      url: "https://pub.dev"
    source: hosted
-    version: "1.26.3"
+    version: "1.30.0"
  test_api:
    dependency: transitive
    description:
      name: test_api
-      sha256: ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55
+      sha256: "8161c84903fd860b26bfdefb7963b3f0b68fee7adea0f59ef805ecca346f0c7a"
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.7"
+    version: "0.7.10"
  test_core:
    dependency: transitive
    description:
      name: test_core
-      sha256: "0cc24b5ff94b38d2ae73e1eb43cc302b77964fbf67abad1e296025b78deb53d0"
+      sha256: "0381bd1585d1a924763c308100f2138205252fb90c9d4eeaf28489ee65ccde51"
      url: "https://pub.dev"
    source: hosted
-    version: "0.6.12"
+    version: "0.6.16"
  toml:
    dependency: "direct main"
    description:
--- a/userfront/scripts/dev-server.sh
+++ b/userfront/scripts/dev-server.sh
@@ -5,16 +5,98 @@ cd /workspace
 /bin/sh ./scripts/sync_userfront_locales.sh

 cd /workspace/userfront
+USERFRONT_INTERNAL_PORT="${USERFRONT_INTERNAL_PORT:-5000}"
+USERFRONT_FLUTTER_RUN_FLAGS="${USERFRONT_FLUTTER_RUN_FLAGS:---debug}"
+USERFRONT_BOOT_WARMUP_ATTEMPTS="${USERFRONT_BOOT_WARMUP_ATTEMPTS:-120}"
+USERFRONT_BOOT_WARMUP_INTERVAL_SECONDS="${USERFRONT_BOOT_WARMUP_INTERVAL_SECONDS:-0.5}"
+USERFRONT_BOOT_WARMUP_LOCALES="${USERFRONT_BOOT_WARMUP_LOCALES:-ko en}"
+USERFRONT_BOOT_WARMUP_VIEWPORTS="${USERFRONT_BOOT_WARMUP_VIEWPORTS:-mobile:390 desktop:1440}"
+
+warm_get() {
+  path="$1"
+  locale="$2"
+  viewport="$3"
+  width="${viewport#*:}"
+  if [ "$width" = "$viewport" ]; then
+    width=""
+  fi
+
+  wget -qO- \
+    --header="Accept-Language: $locale" \
+    --header="Viewport-Width: $width" \
+    "http://127.0.0.1:${USERFRONT_INTERNAL_PORT}${path}" >/dev/null 2>&1
+}
+
+warm_userfront_once() {
+  flutter_pid="$1"
+  attempt=1
+  started_at="$(date +%s)"
+
+  while [ "$attempt" -le "$USERFRONT_BOOT_WARMUP_ATTEMPTS" ]; do
+    if wget -qO- "http://127.0.0.1:${USERFRONT_INTERNAL_PORT}/flutter_bootstrap.js" >/dev/null 2>&1; then
+      break
+    fi
+    if ! kill -0 "$flutter_pid" 2>/dev/null; then
+      echo "[userfront-boot] warmup skipped because flutter exited before readiness" >&2
+      return 0
+    fi
+    attempt=$((attempt + 1))
+    sleep "$USERFRONT_BOOT_WARMUP_INTERVAL_SECONDS"
+  done
+
+  if [ "$attempt" -gt "$USERFRONT_BOOT_WARMUP_ATTEMPTS" ]; then
+    echo "[userfront-boot] warmup skipped after ${USERFRONT_BOOT_WARMUP_ATTEMPTS} readiness attempts" >&2
+    return 0
+  fi
+
+  echo "[userfront-boot] one-shot warmup starting locales=\"${USERFRONT_BOOT_WARMUP_LOCALES}\" viewports=\"${USERFRONT_BOOT_WARMUP_VIEWPORTS}\"" >&2
+
+  for locale in $USERFRONT_BOOT_WARMUP_LOCALES; do
+    for viewport in $USERFRONT_BOOT_WARMUP_VIEWPORTS; do
+      warm_get "/${locale}/signin" "$locale" "$viewport" || true
+    done
+  done
+
+  for asset in \
+    / \
+    /flutter_bootstrap.js \
+    /main.dart.mjs \
+    /main.dart.wasm \
+    /canvaskit/skwasm.js \
+    /canvaskit/skwasm.wasm \
+    /canvaskit/skwasm_heavy.js \
+    /canvaskit/skwasm_heavy.wasm \
+    /assets/AssetManifest.bin.json \
+    /assets/FontManifest.json
+  do
+    wget -qO- "http://127.0.0.1:${USERFRONT_INTERNAL_PORT}${asset}" >/dev/null 2>&1 || true
+  done
+
+  finished_at="$(date +%s)"
+  elapsed_seconds=$((finished_at - started_at))
+  echo "[userfront-boot] one-shot warmup completed in ${elapsed_seconds}s" >&2
+}
+
 set -- flutter run \
  -d web-server \
  --web-hostname 0.0.0.0 \
-  --web-port "${USERFRONT_INTERNAL_PORT:-5000}" \
+  --web-port "${USERFRONT_INTERNAL_PORT}" \
  --wasm \
  --dart-define=BACKEND_URL="${BACKEND_URL:-}" \
  --dart-define=CLIENT_LOG_DEBUG="${CLIENT_LOG_DEBUG:-false}" \
  --dart-define=APP_ENV="${APP_ENV:-dev}" \
  --dart-define=USERFRONT_URL="${USERFRONT_URL:-}" \
-  ${USERFRONT_FLUTTER_RUN_FLAGS:-} \
+  ${USERFRONT_FLUTTER_RUN_FLAGS} \
  --no-web-resources-cdn

-exec "$@"
+"$@" &
+flutter_pid="$!"
+
+terminate() {
+  kill "$flutter_pid" 2>/dev/null || true
+  wait "$flutter_pid" 2>/dev/null || true
+}
+
+trap terminate INT TERM
+warm_userfront_once "$flutter_pid"
+wait "$flutter_pid"
--- a/userfront/scripts/optimize-web-build.mjs
+++ b/userfront/scripts/optimize-web-build.mjs
@@ -18,17 +18,6 @@ const buildDir = process.argv[2] ?? join(__dirname, '..', 'build', 'web');
 const bootstrapPath = join(buildDir, 'flutter_bootstrap.js');
 const indexPath = join(buildDir, 'index.html');
 const hashableEntrypoints = ['main.dart.js', 'main.dart.mjs', 'main.dart.wasm'];
-const loginFontFallbackPreloads = [
-  'https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Me4GZLCzYlKw.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.110.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.113.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.114.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.115.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.116.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.117.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.118.woff2',
-  'https://fonts.gstatic.com/s/notosanskr/v36/PbyxFmXiEBPT4ITbgNA5Cgms3VYcOA-vvnIzzuoyeLGC5nwuDo-KBTUm6CryotyJROlrnQ.119.woff2',
-];
 const compressibleExtensions = new Set([
  '.css',
  '.html',
@@ -116,6 +105,9 @@ if (existsSync(indexPath)) {
  let index = readFileSync(indexPath, 'utf8');
  const preloadLinks = [
    '<link rel="preload" href="flutter_bootstrap.js" as="script" />',
+    hashedEntrypoints.has('main.dart.js')
+      ? `<link rel="preload" href="${hashedEntrypoints.get('main.dart.js')}" as="script" />`
+      : '',
    hashedEntrypoints.has('main.dart.mjs')
      ? `<link rel="modulepreload" href="${hashedEntrypoints.get('main.dart.mjs')}" />`
      : '',
@@ -124,22 +116,22 @@ if (existsSync(indexPath)) {
      : '',
    '<link rel="modulepreload" href="canvaskit/skwasm.js" />',
    '<link rel="preload" href="canvaskit/skwasm.wasm" as="fetch" type="application/wasm" crossorigin />',
-    '<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />',
-    ...loginFontFallbackPreloads.map(
-      (href) =>
-        `<link rel="preload" href="${href}" as="fetch" type="font/woff2" crossorigin />`,
-    ),
  ]
    .filter(Boolean)
    .join('\n    ');

  index = index
    .replace(/\n\s*<link rel="preload" href="flutter_bootstrap\.js" as="script" \/>/g, '')
+    .replace(/\n\s*<link rel="preload" href="main\.dart\.[^"]+\.js" as="script" \/>/g, '')
    .replace(/\n\s*<link rel="modulepreload" href="main\.dart\.[^"]+\.mjs" \/>/g, '')
    .replace(
      /\n\s*<link rel="preload" href="main\.dart\.[^"]+\.wasm" as="fetch" type="application\/wasm" crossorigin \/>/g,
      '',
    )
+    .replace(
+      /\n\s*<link rel="preload" href="assets\/assets\/translations\/(?:en|ko)\.toml" as="fetch" crossorigin \/>/g,
+      '',
+    )
    .replace(/\n\s*<link rel="modulepreload" href="canvaskit\/skwasm\.js" \/>/g, '')
    .replace(
      /\n\s*<link rel="preload" href="canvaskit\/skwasm\.wasm" as="fetch" type="application\/wasm" crossorigin \/>/g,
--- a/userfront/test/log_policy_test.dart
+++ b/userfront/test/log_policy_test.dart
@@ -14,7 +14,7 @@ void main() {
      );
    });

-    test('explicit debug flag applies in development-like environment', () {
+    test('explicit true enables debug in development-like environment', () {
      expect(
        LogPolicy.debugEnabled(appEnv: 'dev', productionDebugFlag: 'true'),
        isTrue,
@@ -23,13 +23,16 @@ void main() {
        LogPolicy.debugEnabled(appEnv: 'development', productionDebugFlag: '1'),
        isTrue,
      );
+    });
+
+    test('explicit false does not suppress local debug in development', () {
      expect(
        LogPolicy.debugEnabled(appEnv: 'dev', productionDebugFlag: 'false'),
-        isFalse,
+        isTrue,
      );
      expect(
        LogPolicy.debugEnabled(appEnv: 'development', productionDebugFlag: '0'),
-        isFalse,
+        isTrue,
      );
    });

--- a/userfront/test/toml_asset_loader_test.dart
+++ b/userfront/test/toml_asset_loader_test.dart
@@ -0,0 +1,54 @@
+import 'dart:ui';
+
+import 'package:flutter_test/flutter_test.dart';
+import 'package:userfront/core/i18n/toml_asset_loader.dart';
+import 'package:userfront/i18n_data.dart';
+
+void main() {
+  test('TomlAssetLoader keeps flat keys for fast startup lookup', () async {
+    const loader = TomlAssetLoader();
+
+    final translations = await loader.load(
+      'assets/translations',
+      const Locale('en'),
+    );
+
+    expect(translations['domain.company.baron'], 'Baron');
+    expect(translations['domain'], isNull);
+  });
+
+  test('English signup policy copy stays small enough for first render', () {
+    const sensitiveKeys = [
+      'msg.userfront.signup.privacy_full',
+      'msg.userfront.signup.tos_full',
+    ];
+
+    for (final key in sensitiveKeys) {
+      final value = enStrings[key];
+      expect(value, isNotNull, reason: key);
+      expect(value!.length, lessThan(1024), reason: key);
+      expect(value.contains(r'\\\\'), isFalse, reason: key);
+    }
+  });
+
+  test(
+    'TomlAssetLoader excludes non-userfront dictionaries at startup',
+    () async {
+      const loader = TomlAssetLoader();
+
+      final translations = await loader.load(
+        'assets/translations',
+        const Locale('en'),
+      );
+
+      expect(translations['ui.admin.nav.api_keys'], isNull);
+      expect(translations['ui.dev.console_title'], isNull);
+      expect(
+        translations['err.userfront.auth_proxy.login_failed'],
+        'Login failed.',
+      );
+      expect(translations['ui.userfront.login.action.submit'], 'Sign in');
+      expect(translations['ui.common.theme_light'], 'Light');
+    },
+  );
+}
--- a/userfront/web/index.html
+++ b/userfront/web/index.html
@@ -53,7 +53,7 @@
        box-sizing: border-box;
        display: flex;
        flex-direction: column;
-        gap: 24px;
+        gap: 18px;
        inset: 0;
        justify-content: center;
        min-height: 100%;
@@ -83,6 +83,20 @@
        margin: 0;
      }

+      #baron-bootstrap-shell .signin-preview {
+        align-items: center;
+        background: #1d4ed8;
+        border-radius: 8px;
+        color: #ffffff;
+        display: flex;
+        font-size: clamp(15px, 3vw, 18px);
+        font-weight: 700;
+        justify-content: center;
+        min-height: 48px;
+        min-width: min(280px, 80vw);
+        padding: 0 24px;
+      }
+
      #baron-bootstrap-shell .loader {
        animation: baron-spin 880ms linear infinite;
        border: 5px solid #cbd5e1;
@@ -104,15 +118,81 @@
      <h1>Baron SW Portal</h1>
      <div class="loader" aria-hidden="true"></div>
      <p>Loading sign-in</p>
+      <div class="signin-preview" aria-hidden="true">Sign in</div>
    </main>
    <script>
+      var baronBootstrapStartedAt = performance.now();
+      var baronMinimumShellMs = 0;
      window.addEventListener("flutter-first-frame", function () {
-        document.body.classList.add("flutter-ready");
-        window.setTimeout(function () {
-          document.getElementById("baron-bootstrap-shell")?.remove();
-        }, 220);
+        var elapsedMs = performance.now() - baronBootstrapStartedAt;
+        window.setTimeout(
+          function () {
+            document.body.classList.add("flutter-ready");
+            window.setTimeout(function () {
+              document.getElementById("baron-bootstrap-shell")?.remove();
+            }, 220);
+          },
+          Math.max(0, baronMinimumShellMs - elapsedMs),
+        );
      });
    </script>
-    <script src="flutter_bootstrap.js" async></script>
+    <script>
+      (function () {
+        function loadFlutter() {
+          var script = document.createElement("script");
+          script.src = "flutter_bootstrap.js";
+          script.async = true;
+          document.body.appendChild(script);
+        }
+
+        var hostname = window.location.hostname;
+        var isLocalhost =
+          hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+        if (!isLocalhost || !("serviceWorker" in navigator)) {
+          loadFlutter();
+          return;
+        }
+
+        navigator.serviceWorker
+          .getRegistrations()
+          .then(function (registrations) {
+            return Promise.all(
+              registrations.map(function (registration) {
+                return registration.unregister();
+              }),
+            );
+          })
+          .then(function () {
+            if (!window.caches) {
+              return;
+            }
+            return caches.keys().then(function (keys) {
+              return Promise.all(
+                keys
+                  .filter(function (key) {
+                    return (
+                      key.indexOf("baron-userfront-") === 0 ||
+                      key.indexOf("flutter-app-cache") === 0
+                    );
+                  })
+                  .map(function (key) {
+                    return caches.delete(key);
+                  }),
+              );
+            });
+          })
+          .then(function () {
+            if (navigator.serviceWorker.controller) {
+              window.location.reload();
+              return;
+            }
+            loadFlutter();
+          })
+          .catch(function (error) {
+            console.warn("[baron] failed to clear local service worker", error);
+            loadFlutter();
+          });
+      })();
+    </script>
  </body>
 </html>