diff --git a/.env.example b/.env.example
index 522e2ba05..2346067bd 100755
--- a/.env.example
+++ b/.env.example
@@ -51,6 +51,10 @@ GA_MEASUREMENT_ID='example'
 SMOKE_BASE_URL=http://localhost:3000
 
 # Credentials for a dedicated smoke-test account. Keep real values in
-# .env.development, which is gitignored - never commit them here.
+# .env.development
 SMOKE_USER_EMAIL=
-SMOKE_USER_PASSWORD=
\ No newline at end of file
+SMOKE_USER_PASSWORD=
+
+# Content the specs navigate to. Ids only - /grant/<id> and /proposal/<id>
+SMOKE_GRANT_ID=33
+SMOKE_PROPOSAL_ID=5
diff --git a/components/Auth/screens/ForgotPassword.tsx b/components/Auth/screens/ForgotPassword.tsx
index ef40bf126..11b649523 100644
--- a/components/Auth/screens/ForgotPassword.tsx
+++ b/components/Auth/screens/ForgotPassword.tsx
@@ -117,10 +117,16 @@ export default function ForgotPassword({
             autoComplete="email"
             className="w-full p-3 border rounded"
             ref={emailInputRef}
+            data-testid="auth-forgot-email-input"
           />
         </div>
 
-        <Button type="submit" disabled={isLoading} className="w-full mb-4">
+        <Button
+          type="submit"
+          disabled={isLoading}
+          className="w-full mb-4"
+          data-testid="auth-forgot-submit"
+        >
           {isLoading ? 'Sending...' : 'Send reset link'}
         </Button>
       </form>
diff --git a/components/Auth/screens/Login.tsx b/components/Auth/screens/Login.tsx
index 9db617cf0..fbe934a0d 100644
--- a/components/Auth/screens/Login.tsx
+++ b/components/Auth/screens/Login.tsx
@@ -240,6 +240,7 @@ export default function Login({
             onClick={onForgotPassword}
             disabled={isLoading}
             className="text-rhBlue-500 hover:text-rhBlue-600 text-sm"
+            data-testid="auth-forgot-password"
           >
             Forgot your password?
           </Button>
diff --git a/components/Auth/screens/Signup.tsx b/components/Auth/screens/Signup.tsx
index 869a789e0..48db9b947 100644
--- a/components/Auth/screens/Signup.tsx
+++ b/components/Auth/screens/Signup.tsx
@@ -92,6 +92,7 @@ export default function Signup({
           placeholder="Full name (e.g. John Smith)"
           className="w-full p-3 border rounded mb-4"
           ref={fullNameInputRef}
+          data-testid="auth-signup-name-input"
         />
 
         <div className="relative mb-4">
@@ -101,6 +102,7 @@ export default function Signup({
             onChange={(e) => setPassword(e.target.value)}
             placeholder="Password"
             className="w-full p-3 border rounded pr-12"
+            data-testid="auth-signup-password-input"
           />
           <button
             type="button"
@@ -115,6 +117,7 @@ export default function Signup({
           type="submit"
           disabled={isLoading}
           className="w-full bg-indigo-600 text-white p-3 rounded mb-4 hover:bg-indigo-700 disabled:opacity-50"
+          data-testid="auth-signup-submit"
         >
           {isLoading ? 'Creating account...' : 'Create account'}
         </button>
diff --git a/components/Feed/items/FeedItemGrantWithApplicants.tsx b/components/Feed/items/FeedItemGrantWithApplicants.tsx
index 96b79d9bf..c54b18586 100644
--- a/components/Feed/items/FeedItemGrantWithApplicants.tsx
+++ b/components/Feed/items/FeedItemGrantWithApplicants.tsx
@@ -171,6 +171,7 @@ export const FeedItemGrantWithApplicants: FC<FeedItemGrantWithApplicantsProps> =
         'bg-white rounded-[14px] overflow-hidden border border-gray-200 shadow-[0_1px_3px_rgba(0,0,0,0.04)]',
         className
       )}
+      data-testid="grant-card"
     >
       {/* Frosted header */}
       <Link href={href} className="group block relative h-[160px] overflow-hidden bg-gray-900">
diff --git a/components/Funding/GrantSortAndFilters.tsx b/components/Funding/GrantSortAndFilters.tsx
index 854f7b483..4475f29a6 100644
--- a/components/Funding/GrantSortAndFilters.tsx
+++ b/components/Funding/GrantSortAndFilters.tsx
@@ -38,6 +38,7 @@ function SortDropdown({
         aria-haspopup="listbox"
         aria-expanded={isOpen}
         className="inline-flex items-center gap-1.5 -mr-2 min-h-[44px] px-2 rounded-lg text-sm text-gray-500 hover:text-gray-700 hover:bg-gray-50 active:bg-gray-100 transition-colors cursor-pointer touch-manipulation"
+        data-testid="feed-sort-trigger"
       >
         <span className="font-medium text-gray-700">{selectedLabel}</span>
         {isOpen ? <ChevronUp size={16} /> : <ChevronDown size={16} />}
diff --git a/components/Funding/ProposalSortAndFilters.tsx b/components/Funding/ProposalSortAndFilters.tsx
index b91a74115..2cab9dfd1 100644
--- a/components/Funding/ProposalSortAndFilters.tsx
+++ b/components/Funding/ProposalSortAndFilters.tsx
@@ -34,6 +34,7 @@ function SortDropdown() {
         aria-haspopup="listbox"
         aria-expanded={isOpen}
         className="inline-flex items-center gap-1.5 -mr-2 min-h-[44px] px-2 rounded-lg text-sm text-gray-500 hover:text-gray-700 hover:bg-gray-50 active:bg-gray-100 transition-colors cursor-pointer touch-manipulation"
+        data-testid="feed-sort-trigger"
       >
         <span className="font-medium text-gray-700">{selectedLabel}</span>
         {isOpen ? <ChevronUp size={16} /> : <ChevronDown size={16} />}
diff --git a/components/Funding/ProposalWorkCard.tsx b/components/Funding/ProposalWorkCard.tsx
index 2fcf39f43..a3b5e5317 100644
--- a/components/Funding/ProposalWorkCard.tsx
+++ b/components/Funding/ProposalWorkCard.tsx
@@ -91,7 +91,7 @@ export const ProposalWorkCard: FC<ProposalWorkCardProps> = ({ entry, onNavigate
   };
 
   return (
-    <article data-entry-id={entryId}>
+    <article data-entry-id={entryId} data-testid="proposal-card">
       <WorkPreviewCard work={work} brand={presentation.brand} onNavigate={handleNavigate}>
         <WorkPreviewCard.Overlay position="top-left">
           <FeedItemFundingBadges
diff --git a/components/Notebook/NoteEditorLayout.tsx b/components/Notebook/NoteEditorLayout.tsx
index fad9b7625..2e407969b 100644
--- a/components/Notebook/NoteEditorLayout.tsx
+++ b/components/Notebook/NoteEditorLayout.tsx
@@ -334,6 +334,7 @@ export function NoteEditorLayout({ onAgentChatDockedChange }: NoteEditorLayoutPr
               <div className="flex items-center gap-2">
                 {activeTab === 'document' && (
                   <Button
+                    data-testid="notebook-add-details"
                     variant="outlined"
                     size="sm"
                     onClick={() => setActiveTab('details')}
diff --git a/components/Notebook/PublishingForm/components/FundingSection.tsx b/components/Notebook/PublishingForm/components/FundingSection.tsx
index ee05d50ab..2b3f16f98 100644
--- a/components/Notebook/PublishingForm/components/FundingSection.tsx
+++ b/components/Notebook/PublishingForm/components/FundingSection.tsx
@@ -223,6 +223,7 @@ export function FundingSection({ note }: Readonly<FundingSectionProps>) {
         <>
           <div>
             <Input
+              data-testid="funding-goal-input"
               {...register('budget')}
               label="Funding Goal"
               required
diff --git a/components/Notebook/PublishingForm/components/TopicsSection.tsx b/components/Notebook/PublishingForm/components/TopicsSection.tsx
index 434e7093a..56ae72cda 100644
--- a/components/Notebook/PublishingForm/components/TopicsSection.tsx
+++ b/components/Notebook/PublishingForm/components/TopicsSection.tsx
@@ -24,7 +24,7 @@ export function TopicsSection() {
   }, []);
 
   return (
-    <div className="py-3 px-6">
+    <div className="py-3 px-6" data-testid="topics-section">
       <SectionHeader icon={Tag}>Topics</SectionHeader>
       <SearchableMultiSelect
         value={topics}
diff --git a/components/Notebook/PublishingForm/components/WorkImageSection.tsx b/components/Notebook/PublishingForm/components/WorkImageSection.tsx
index bf2fa6f3a..34db6d9e1 100644
--- a/components/Notebook/PublishingForm/components/WorkImageSection.tsx
+++ b/components/Notebook/PublishingForm/components/WorkImageSection.tsx
@@ -136,6 +136,7 @@ function CoverImageControl({
       )}
 
       <input
+        data-testid="cover-image-input"
         ref={inputRef}
         type="file"
         accept={ACCEPT.join(',')}
diff --git a/components/Notebook/PublishingForm/index.tsx b/components/Notebook/PublishingForm/index.tsx
index 2ed430b15..3cea3c4f1 100644
--- a/components/Notebook/PublishingForm/index.tsx
+++ b/components/Notebook/PublishingForm/index.tsx
@@ -766,6 +766,7 @@ export function PublishingForm({
               <p className="text-sm text-red-600">{CHANGELOG_PUBLISH_ERROR_MESSAGE}</p>
             )}
             <Button
+              data-testid="publishing-form-submit"
               variant="default"
               onClick={handlePublishClick}
               className="w-full disabled:opacity-50 disabled:cursor-not-allowed"
diff --git a/components/menus/UserMenu.tsx b/components/menus/UserMenu.tsx
index d74f95dfe..74a977b1f 100644
--- a/components/menus/UserMenu.tsx
+++ b/components/menus/UserMenu.tsx
@@ -285,6 +285,7 @@ export default function UserMenu({
           tabIndex={0}
           role="button"
           aria-label="Sign Out"
+          data-testid="user-menu-signout"
         >
           <div className="flex items-center">
             <LogOut className="h-5 w-5 mr-3 text-gray-500" />
@@ -446,6 +447,7 @@ export default function UserMenu({
             <BaseMenuItem
               onClick={() => AuthSharingService.signOutFromBothApps()}
               className="w-full px-4 py-2"
+              data-testid="user-menu-signout"
             >
               <div className="flex items-center">
                 <LogOut className="h-5 w-5 mr-3 text-gray-500" />
diff --git a/components/modals/ApplyToGrantModal.tsx b/components/modals/ApplyToGrantModal.tsx
index 886e58ef9..2e7a14355 100644
--- a/components/modals/ApplyToGrantModal.tsx
+++ b/components/modals/ApplyToGrantModal.tsx
@@ -327,6 +327,7 @@ export const ApplyToGrantModal: React.FC<ApplyToGrantModalProps> = ({
             )}
           >
             <div
+              data-testid="apply-draft-new"
               onClick={handleSelectDraftNew}
               className={cn(
                 'px-3 py-2 rounded-lg border cursor-pointer transition-all duration-200',
@@ -383,6 +384,7 @@ export const ApplyToGrantModal: React.FC<ApplyToGrantModalProps> = ({
               </div>
             )}
             <Button
+              data-testid="apply-continue"
               variant={draftNewSelected ? 'dark' : 'default'}
               onClick={handleFooterAction}
               disabled={!hasSelection || isSavingSelection}
diff --git a/components/modals/ConfirmPublishModal.tsx b/components/modals/ConfirmPublishModal.tsx
index 172948808..7fb40fdce 100644
--- a/components/modals/ConfirmPublishModal.tsx
+++ b/components/modals/ConfirmPublishModal.tsx
@@ -123,6 +123,7 @@ export function ConfirmPublishModal({
                     {resolvedDocumentLabel}:
                   </p>
                   <input
+                    data-testid="confirm-publish-title"
                     type="text"
                     value={title}
                     onChange={handleTitleChange}
@@ -168,6 +169,7 @@ export function ConfirmPublishModal({
                       Cancel
                     </Button>
                     <Button
+                      data-testid="confirm-publish-submit"
                       variant="default"
                       onClick={() => onConfirm(title)}
                       disabled={!isPublishEnabled || isPublishing}
diff --git a/components/work/WorkHeader/WorkHeaderGrant.tsx b/components/work/WorkHeader/WorkHeaderGrant.tsx
index ae09bafb9..382b013b8 100644
--- a/components/work/WorkHeader/WorkHeaderGrant.tsx
+++ b/components/work/WorkHeader/WorkHeaderGrant.tsx
@@ -70,6 +70,7 @@ export function WorkHeaderGrant({
       <>
         <SubmitProposalTooltip isPrivate={requiresPrivateApplications}>
           <Button
+            data-testid="grant-submit-proposal"
             variant="default"
             size="lg"
             onClick={() => setIsApplyModalOpen(true)}
diff --git a/smoke/auth.spec.ts b/smoke/auth.spec.ts
index 1aaa6d23e..447de8808 100644
--- a/smoke/auth.spec.ts
+++ b/smoke/auth.spec.ts
@@ -1,5 +1,6 @@
 import { expect, test } from '@playwright/test';
-import { submitCredentials } from './helpers/auth';
+import { mockApiPost } from './helpers/api';
+import { logIn, smokeCredentials, submitCredentials, uniqueEmail } from './helpers/auth';
 
 test('a user can log in from the sign-in page', async ({ page }) => {
   await page.goto('/auth/signin');
@@ -36,3 +37,84 @@ test('a user can log in through the auth modal', async ({ page }) => {
   await expect(page.getByTestId('user-menu-button').first()).toBeVisible();
   await expect(loginButton).toHaveCount(0);
 });
+
+test('a user can request a password reset from the auth modal', async ({ page }) => {
+  // Mocked so that a run cannot mail a real inbox or trip rate limiting on the
+  // endpoint. The request is still asserted below, so what the form sends stays
+  // covered; only Django's own handling of it is out of scope.
+  const resetRequests = await mockApiPost(page, '/api/auth/password-reset/');
+
+  await page.goto('/');
+  await page.getByTestId('topbar-login-button').click();
+
+  // The reset link lives on the password step, which check_account only opens
+  // for an account that exists and is verified, so this has to be driven as the
+  // smoke user rather than an arbitrary address.
+  const { email } = smokeCredentials();
+  await page.getByTestId('auth-email-input').fill(email);
+  await page.getByTestId('auth-email-continue').click();
+  await page.getByTestId('auth-forgot-password').click();
+
+  // The screen carries the address over from the email step, so a user who got
+  // here through the modal never retypes it.
+  await expect(page.getByTestId('auth-forgot-email-input')).toHaveValue(email);
+  await page.getByTestId('auth-forgot-submit').click();
+
+  await expect(page.getByRole('heading', { name: 'Request submitted' })).toBeVisible();
+  await expect(page.getByText(`password reset link to ${email}`)).toBeVisible();
+  expect(resetRequests).toEqual([{ body: { email } }]);
+});
+
+test('a user can register a new account with an email address', async ({ page }) => {
+  // Mocked: a real registration would leave an account behind on every pull
+  // request that no one can ever verify, since CI has no inbox to confirm from.
+  const registrations = await mockApiPost(page, '/api/auth/register/', {
+    status: 201,
+    body: { id: 1 },
+  });
+
+  const email = uniqueEmail();
+  await page.goto('/');
+  await page.getByTestId('topbar-login-button').click();
+
+  // check_account is deliberately left unmocked. A freshly generated address
+  // genuinely has no account, and it is that real response which decides
+  // between the login and signup screens.
+  await page.getByTestId('auth-email-input').fill(email);
+  await page.getByTestId('auth-email-continue').click();
+  await expect(page.getByRole('heading', { name: 'Create your account' })).toBeVisible();
+
+  await page.getByTestId('auth-signup-name-input').fill('Smoke Tester');
+  await page.getByTestId('auth-signup-password-input').fill('SmokeTest!2468');
+  await page.getByTestId('auth-signup-submit').click();
+
+  await expect(page.getByRole('heading', { name: 'Check your email' })).toBeVisible();
+  await expect(page.getByText(`verification link to ${email}`)).toBeVisible();
+
+  // With the response faked, the request is the only real evidence the form
+  // works: in particular that the single name field was split into the two
+  // Django expects.
+  expect(registrations).toHaveLength(1);
+  expect(registrations[0].body).toMatchObject({
+    email,
+    password1: 'SmokeTest!2468',
+    password2: 'SmokeTest!2468',
+    first_name: 'Smoke',
+    last_name: 'Tester',
+  });
+});
+
+test('a user can log out from the user menu', async ({ page }) => {
+  await logIn(page);
+  await page.goto('/');
+
+  await page.getByTestId('user-menu-button').first().click();
+  await page.getByTestId('user-menu-signout').click();
+
+  // Signing out also clears the token shared with the other app and redirects
+  // home, but the observable result is the top bar reverting to its
+  // logged-out controls. Asserting that rather than the URL keeps this
+  // independent of the redirect flakiness noted above.
+  await expect(page.getByTestId('topbar-login-button')).toBeVisible();
+  await expect(page.getByTestId('user-menu-button')).toHaveCount(0);
+});
diff --git a/smoke/fund.spec.ts b/smoke/fund.spec.ts
new file mode 100644
index 000000000..efc92b8ed
--- /dev/null
+++ b/smoke/fund.spec.ts
@@ -0,0 +1,86 @@
+import { expect, test, type Page, type Request } from '@playwright/test';
+
+const GRANT_FEED = '/api/grant_feed/';
+const FUNDING_FEED = '/api/funding_feed/';
+
+/**
+ * A sort change refetches immediately, unlike a first page load, so these waits
+ * are capped well below the test timeout. A broken control then reports in
+ * seconds instead of consuming the whole budget, twice over once CI retries.
+ */
+const SORT_CHANGE_TIMEOUT = 15_000;
+
+/**
+ * Neither feed writes its sort to the URL, and neither card renders a date in
+ * any machine-readable form, so the request the frontend builds is the only
+ * place the chosen order is observable. Matching on pathname keeps this working
+ * whichever origin NEXT_PUBLIC_API_URL points at.
+ */
+function feedRequest(pathname: string, ordering: string) {
+  return (request: Request) => {
+    const url = new URL(request.url());
+    return url.pathname === pathname && url.searchParams.get('ordering') === ordering;
+  };
+}
+
+/** Opens a feed's sort dropdown and picks an option by its visible label. */
+async function selectSort(page: Page, label: string) {
+  await page.getByTestId('feed-sort-trigger').click();
+  await page.getByRole('option', { name: label }).click();
+}
+
+test('the RFP feed renders results from the API', async ({ page }) => {
+  await page.goto('/fund');
+
+  // As with the activity feed, a failed fetch is swallowed in favour of the
+  // empty state rather than an error page, so assert that state is absent too.
+  await expect(page.getByTestId('grant-card').first()).toBeVisible();
+  await expect(page.getByText('No open awards right now')).toHaveCount(0);
+});
+
+test('the RFP feed can be sorted by newest', async ({ page }) => {
+  const initialNewest = page.waitForRequest(feedRequest(GRANT_FEED, 'newest'));
+  await page.goto('/fund');
+  await initialNewest;
+  await expect(page.getByTestId('grant-card').first()).toBeVisible();
+
+  // This feed already defaults to newest, so selecting it on a fresh page would
+  // pass even with the dropdown wired to nothing. Sorting away and back is what
+  // makes the assertion depend on the control actually driving the query.
+  const byAmount = page.waitForRequest(feedRequest(GRANT_FEED, 'amount_raised'), {
+    timeout: SORT_CHANGE_TIMEOUT,
+  });
+  await selectSort(page, 'Highest amount');
+  await byAmount;
+
+  const backToNewest = page.waitForRequest(feedRequest(GRANT_FEED, 'newest'), {
+    timeout: SORT_CHANGE_TIMEOUT,
+  });
+  await selectSort(page, 'Newest');
+  await backToNewest;
+
+  await expect(page.getByTestId('grant-card').first()).toBeVisible();
+});
+
+test('the proposals feed renders results from the API', async ({ page }) => {
+  await page.goto('/fund/proposals');
+
+  await expect(page.getByTestId('proposal-card').first()).toBeVisible();
+  await expect(page.getByText('No proposals submitted yet')).toHaveCount(0);
+});
+
+test('the proposals feed can be sorted by newest', async ({ page }) => {
+  // Unlike the RFP feed this one defaults to 'best', so choosing Newest is
+  // already a real change of order and needs no round trip to mean something.
+  const initialBest = page.waitForRequest(feedRequest(FUNDING_FEED, 'best'));
+  await page.goto('/fund/proposals');
+  await initialBest;
+
+  const byNewest = page.waitForRequest(feedRequest(FUNDING_FEED, 'newest'), {
+    timeout: SORT_CHANGE_TIMEOUT,
+  });
+  await selectSort(page, 'Newest');
+  await byNewest;
+
+  await expect(page.getByTestId('proposal-card').first()).toBeVisible();
+});
diff --git a/smoke/helpers/api.ts b/smoke/helpers/api.ts
new file mode 100644
index 000000000..3dfe25cf9
--- /dev/null
+++ b/smoke/helpers/api.ts
@@ -0,0 +1,58 @@
+import type { Page } from '@playwright/test';
+
+/**
+ * The Django API is on a different origin to the app, and ApiClient sends
+ * `Content-Type: application/json`, which is not CORS-safelisted. That means
+ * every POST is preceded by a preflight the browser will not skip, and a
+ * fulfilled response is discarded unless it authorises the app's origin.
+ */
+const CORS_HEADERS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-headers': '*',
+  'access-control-allow-methods': '*',
+};
+
+/** A request captured by {@link mockApiPost}, for asserting what was sent. */
+export interface CapturedRequest {
+  body: Record<string, unknown>;
+}
+
+/**
+ * Intercepts POSTs to an API path and answers them without reaching Django.
+ *
+ * For endpoints whose side effects are unacceptable in a suite that runs
+ * against a shared environment on every pull request: registering would leave
+ * behind an account nothing can verify, and a password reset would mail a real
+ * inbox and risk tripping rate limits. The outgoing request is still recorded,
+ * so the payload the frontend builds stays covered even though the response is
+ * fabricated.
+ *
+ * Matches on pathname alone, so it holds wherever NEXT_PUBLIC_API_URL points.
+ * The returned array is appended to as requests arrive.
+ */
+export async function mockApiPost(
+  page: Page,
+  pathname: string,
+  response: { status?: number; body?: unknown } = {}
+): Promise<CapturedRequest[]> {
+  const captured: CapturedRequest[] = [];
+
+  await page.route(
+    (url) => url.pathname === pathname,
+    async (route) => {
+      if (route.request().method() === 'OPTIONS') {
+        await route.fulfill({ status: 204, headers: CORS_HEADERS });
+        return;
+      }
+
+      captured.push({ body: route.request().postDataJSON() });
+      await route.fulfill({
+        status: response.status ?? 200,
+        headers: { ...CORS_HEADERS, 'content-type': 'application/json' },
+        body: JSON.stringify(response.body ?? {}),
+      });
+    }
+  );
+
+  return captured;
+}
diff --git a/smoke/helpers/auth.ts b/smoke/helpers/auth.ts
index 4ee4b5e29..3afd22336 100644
--- a/smoke/helpers/auth.ts
+++ b/smoke/helpers/auth.ts
@@ -1,15 +1,6 @@
+import { randomUUID } from 'node:crypto';
 import { expect, type Page } from '@playwright/test';
-
-function requiredEnv(name: string): string {
-  const value = process.env[name];
-  if (!value) {
-    throw new Error(
-      `${name} is required to run the smoke tests. ` +
-        'Set it in .env.development, or pass it inline on the command line.'
-    );
-  }
-  return value;
-}
+import { requiredEnv } from './env';
 
 /** Credentials for the dedicated smoke-test account, from the environment. */
 export function smokeCredentials() {
@@ -19,6 +10,20 @@ export function smokeCredentials() {
   };
 }
 
+/**
+ * An address for the registration spec that no account can already own.
+ *
+ * example.com is reserved by RFC 2606 and can never receive mail, so nothing
+ * reaches a real person even if a request escapes the mock. Randomised per
+ * call rather than per run because a retry that reused an address would find
+ * the account from the previous attempt: check_account would report it as
+ * existing and route the modal into the login flow, and the test would pass
+ * while exercising the wrong screen.
+ */
+export function uniqueEmail(): string {
+  return `rh-smoke-${randomUUID()}@example.com`;
+}
+
 /**
  * Drives the two-step credential form, which is shared by the /auth/signin
  * route and the auth modal. The caller is responsible for opening it, so this
diff --git a/smoke/helpers/env.ts b/smoke/helpers/env.ts
new file mode 100644
index 000000000..5bd5d9e03
--- /dev/null
+++ b/smoke/helpers/env.ts
@@ -0,0 +1,17 @@
+/**
+ * Reads a variable the suite cannot run without.
+ *
+ * Every smoke setting is required rather than defaulted: a default would let a
+ * misconfigured run silently point at the wrong environment or the wrong
+ * content, and fail later as an assertion that looks like a product bug.
+ */
+export function requiredEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(
+      `${name} is required to run the smoke tests. ` +
+        'Set it in .env.development, or pass it inline on the command line.'
+    );
+  }
+  return value;
+}
diff --git a/smoke/helpers/fixtures.ts b/smoke/helpers/fixtures.ts
new file mode 100644
index 000000000..74b565223
--- /dev/null
+++ b/smoke/helpers/fixtures.ts
@@ -0,0 +1,19 @@
+import { requiredEnv } from './env';
+
+/**
+ * Content the suite navigates to, addressed by id.
+ *
+ * Ids rather than full URLs because `/grant/<id>` and `/proposal/<id>` both
+ * redirect to the canonical slug, so a renamed title cannot break a spec. Note
+ * that the grant redirect is a 307 while the proposal's is performed in the
+ * browser — the proposal layout streams, so Next inlines the redirect instead
+ * of sending a status. Both are transparent to Playwright; only a bare
+ * request-level check would notice.
+ */
+export function grantId(): string {
+  return requiredEnv('SMOKE_GRANT_ID');
+}
+
+export function proposalId(): string {
+  return requiredEnv('SMOKE_PROPOSAL_ID');
+}
diff --git a/smoke/proposal.spec.ts b/smoke/proposal.spec.ts
new file mode 100644
index 000000000..246161953
--- /dev/null
+++ b/smoke/proposal.spec.ts
@@ -0,0 +1,152 @@
+import { randomUUID } from 'node:crypto';
+import { expect, test } from '@playwright/test';
+import { logIn } from './helpers/auth';
+import { grantId } from './helpers/fixtures';
+
+/**
+ * A 64x64 PNG, inline rather than a committed binary. A cover image is required
+ * to publish a proposal and there is no default, so something has to be
+ * uploaded; nothing about the flow cares what it depicts.
+ */
+const COVER_IMAGE = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAIAAAAlC+aJAAAAUElEQVR42u3PQQkAAAgEsOufzLchzGEE' +
+    '38JgBZbqeS0CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICApcF3mo' +
+    'CWVPTG70AAAAASUVORK5CYII=',
+  'base64'
+);
+
+/**
+ * Randomised so that a leftover from a failed run is identifiable, and so two
+ * runs never argue over the same title. Kept over 20 characters because both
+ * the confirm dialog and Django (MIN_POST_TITLE_LENGTH) reject anything
+ * shorter — the proposal template's own heading, "Proposal Template", is 17,
+ * so a title has to be supplied regardless.
+ */
+const proposalTitle = () => `Smoke test proposal, please ignore ${randomUUID().slice(0, 8)}`;
+
+/**
+ * Note that this leaves its proposal behind: publishing is not reversible from
+ * the outside. The author-facing removal endpoint
+ * (`DELETE /api/researchhubpost/<id>/censor/`) is broken — it builds its
+ * response through a serializer that rejects the arguments the shared mixin
+ * passes, and the 500 rolls the removal back inside its own transaction — and
+ * the plain destroy route fails the same way on an unimplemented permission
+ * check. So every run adds one proposal to whichever environment it ran
+ * against, titled to be recognisable and skippable.
+ */
+test('a new proposal can be drafted from an RFP and published', async ({ page }) => {
+  // The longest flow in the suite: a login, a grant page, a note created from
+  // a template, an image upload and a publish, each a round trip through
+  // Next.js and Django. The generous budget is mostly for a local run, where
+  // the notebook route is compiled on first visit and that alone can take the
+  // best part of a minute; a deployed environment serves it prebuilt.
+  test.setTimeout(300_000);
+
+  const title = proposalTitle();
+
+  await logIn(page);
+  await page.goto(`/grant/${grantId()}`);
+
+  // The entry point only exists while the RFP is open for applications, so a
+  // closed or expired fixture fails here rather than somewhere confusing.
+  // HeroHeader renders its call to action twice — a desktop copy and a mobile
+  // one, with the other hidden — so this has to select on visibility rather
+  // than position to stay correct at any viewport.
+  const submitProposal = page.getByTestId('grant-submit-proposal').filter({ visible: true });
+  await expect(submitProposal).toBeVisible();
+  await submitProposal.click();
+
+  // Two ways to apply: continue an existing draft, or start a new one. Only
+  // the second creates a note from the proposal template.
+  await page.getByTestId('apply-draft-new').click();
+  await page.getByTestId('apply-continue').click();
+
+  // /notebook resolves the user's organisation, the org page creates the note
+  // from the proposal template, and only then does the URL carry a note id.
+  // Waiting for that id is what confirms the draft exists — and it is the
+  // point from which this test has something to clean up. Given its own
+  // timeout because it is by far the slowest step, so a hang here reports as
+  // itself rather than as the whole test running out of budget.
+  await page.waitForURL(/\/notebook\/[^/]+\/\d+/, { timeout: 120_000 });
+
+  await page.getByTestId('notebook-add-details').click();
+
+  // Topics, funding goal and cover image are all required by the form's
+  // schema. Authors are not filled here: the form adds the current user on
+  // its own for a new proposal.
+  //
+  // The topic lookup is scoped to its own section on purpose. Unscoped,
+  // `option` also matches the currency <select> in the sidebar, whose RSC and
+  // USD entries carry the same role and can win the race for `.first()`.
+  const topics = page.getByTestId('topics-section');
+  await topics.getByPlaceholder('Search topics...').fill('bio');
+  const firstTopic = topics.getByRole('option').first();
+  await expect(firstTopic).toBeVisible();
+  const topicName = (await firstTopic.innerText()).trim();
+  await firstTopic.click();
+
+  // The list stays open on select, so it is dismissed first: the remaining
+  // copy of the label is then the chip for the chosen topic, which is what
+  // shows the selection actually registered rather than silently missing.
+  await page.keyboard.press('Escape');
+  await expect(topics.getByText(topicName, { exact: true })).toBeVisible();
+
+  await page.getByTestId('funding-goal-input').fill('1000');
+
+  await page.getByTestId('cover-image-input').setInputFiles({
+    name: 'smoke-cover.png',
+    mimeType: 'image/png',
+    buffer: COVER_IMAGE,
+  });
+  await expect(page.getByRole('button', { name: 'Remove cover image' })).toBeVisible();
+
+  await page.getByTestId('publishing-form-submit').click();
+
+  // The dialog opens carrying the template's heading, which is too short to
+  // publish. Asserting the blocked state first means the title field is
+  // covered as a requirement rather than just as a step.
+  const titleField = page.getByTestId('confirm-publish-title');
+  await expect(titleField).toBeVisible();
+  await expect(page.getByText('Title must be at least 20 characters long')).toBeVisible();
+  await expect(page.getByTestId('confirm-publish-submit')).toBeDisabled();
+
+  await titleField.fill(title);
+  await page.getByLabel('I have adhered to the ResearchHub posting guidelines').check();
+
+  const published = page.waitForResponse(
+    (response) =>
+      new URL(response.url()).pathname === '/api/researchhubpost/' &&
+      response.request().method() === 'POST'
+  );
+  await page.getByTestId('confirm-publish-submit').click();
+  const response = await published;
+
+  expect(response.status()).toBe(200);
+
+  // The RFP link is the whole point of this flow and is invisible in the UI at
+  // this stage, so the request is where it has to be asserted. Only that a
+  // grant was attached, not which one: SMOKE_GRANT_ID is the post id the URL
+  // uses, while the payload carries the id of the grant record hanging off it,
+  // and the two are different numbers.
+  const payload = response.request().postDataJSON();
+  expect(payload).toMatchObject({ title });
+  expect(payload.grant_id).toBeTruthy();
+
+  // Publishing redirects to the proposal itself, which is the user-visible
+  // confirmation that it exists and is readable.
+  await page.waitForURL(/\/proposal\/\d+\//);
+
+  // That redirect carries `?new=true`, which opens a celebration dialog over
+  // the page and takes the document out of the accessibility tree with it.
+  // Dropping the parameter makes the assertion about the published proposal
+  // rather than the modal sitting on top of it.
+  const proposalUrl = new URL(page.url());
+  proposalUrl.searchParams.delete('new');
+  await page.goto(proposalUrl.toString());
+
+  // The title lands on the page twice as an h1: once in the header, from the
+  // post record the API returned, and once in the document body, from the
+  // editor content. Either proves the publish, but the body one mounts a beat
+  // later — matching both is a race that only shows up on a slower run.
+  await expect(page.getByRole('heading', { name: title }).first()).toBeVisible();
+});