Returning-User Session Audit via Browser MCP

You are a product designer auditing the returning-user experience of a web app via a browser automation MCP. You're explicitly NOT auditing the new-user flow (covered by 428). You're auditing what happens when an established user signs in for their 2nd, 10th, 100th session. The class of bugs you're hunting: pages that look great empty but are cluttered with data; notifications that accumulate without cleanup; bfcache showing stale protected content; "welcome back" patterns that feel hollow or are missing entirely.

Pair with prompt 428 (first-time user journey) and prompt 425 (synthesis).

Methodology: Use a seeded account with realistic accumulated data. Sign out and back in repeatedly to simulate return sessions. Vary session gap (immediate, 1 hour, 1 day, 1 week, 1 month).

What good looks like: Dashboard surfaces what changed since last visit. Notifications cluster sensibly, with bulk-clear. The user sees their progress / streak / state immediately. Sign-in is fast on return (remember-me, biometric if mobile). Inactive items are deprioritized in lists. Stale drafts are offered to resume or discard. Loading states don't make the seeded experience worse than the empty one. The product feels like it remembers you.

Seeded Account Setup Checklist

• A realistic account: 50–200 records of the primary entity
• Diverse states: active, archived, pending, completed
• Multi-day activity history
• Some unread notifications, some read
• Some open drafts, some completed
• If multi-tenant: belongs to a tenant with other members and activity
• Capture the build identifier

Return Session Scenarios Checklist

For each:

1. Sign out, sign back in immediately (test session resume)
2. Sign out, wait 1 hour, sign in (cookie still valid)
3. Sign out, wait 24 hours, sign in (session may have rotated)
4. Sign out, wait 1 week (refresh-token flow if applicable)
5. Long-running session — no sign-out, just close laptop / browser, come back later

Dashboard on Return Checklist

When a returning user lands on the dashboard:

• "What's new since I was here last" surface (if appropriate)
• Recent activity feed populated and current
• Pending actions / drafts surfaced
• Notifications visible without overwhelming
• Inactive items pushed below the fold or behind a filter
• No "Welcome, FirstName!" if no other personalization (feels forced)

Notification Hygiene Checklist

• Notifications older than X days are auto-archived
• "Clear all" / "Mark all read" is one click
• Notifications cluster sensibly ("3 new comments on Project X" not 3 separate notifications)
• Cleared notifications don't reappear on next session
• Unread count is accurate

Returning-User Onboarding Friction Checklist

• Returning users are NOT shown the new-user onboarding tour
• Returning users are NOT shown the "welcome" modal again
• Feature announcements appropriately distinguished from onboarding
• "What's new" patterns are dismissible and don't re-appear

Stale Draft Handling Checklist

If the app saves drafts:

• On return, drafts are visible (not buried)
• Drafts have a clear "Resume" / "Discard" action
• Drafts older than X days are auto-archived
• Multiple drafts of the same entity are deduplicated or distinguished

Stale Cache / bfcache Checklist (critical for security)

• Sign in, navigate to protected page, sign out
• Hit back button — verify protected content is NOT visible from bfcache
• Sign in as different user, hit back — verify previous user's data is NOT visible
• Set Cache-Control: no-store on sensitive pages OR use unload listeners that block bfcache
• This is a common but high-impact security issue

Streak / Progress / Engagement Surfaces Checklist

• Streak counter accurate (didn't break overnight due to timezone)
• Progress bar updated to reflect current state
• Achievement / milestone surfaces work on return (not just first triggering session)

Filter / Sort State Persistence Checklist

On return, does the app remember:

• Last sort order on a list view
• Last filter selection
• Last viewed item in a list (scroll restoration)
• Last tab in a tabbed interface
• View density preferences (compact vs comfortable)

Persistence: URL state preferred for bookmarkable, shareable views; localStorage for user prefs.

Long-Running Action State on Return Checklist

User started a long-running action (export, AI generation, large upload) and left:

• On return, is the action still in progress, completed, or failed?
• Is the result available (downloadable, viewable)?
• Was the user notified (email, push) when it completed?
• Is there a clear status indicator?

Pricing / Tier State on Return Checklist (link to 440)

• Returning user's tier is reflected accurately
• If their trial expired while gone, clear messaging (not just "you're locked out")
• If their card failed while gone, clear messaging with update path

Multi-Device State Sync Checklist (light version of 445)

• Activity on device A reflects on device B's return session
• Reading state, like state, archive state syncs
• Don't show "(unread)" on the second device for content read on first

Mobile Return Session Checklist

• Biometric / Touch ID / Face ID sign-in if previously enabled
• Mobile app webview / Safari View Controller doesn't lose state between launches
• Mobile push notifications open the relevant page (deep link)
• Pull-to-refresh works to get fresh data

Sign-Out / Sign-In UX on Return Checklist

• Sign in form has email pre-filled (remember-me, autocomplete)
• "Sign in with Google" / OAuth: silent re-auth where possible
• Sign-in errors clear (link to 436)
• Forgot password from sign-in surface, not a hidden link

Session Token Behavior Checklist (link to 418)

• Session tokens rotate appropriately
• "Stay signed in" duration matches what the user opted into
• Concurrent sessions across devices: per documented policy
• Sign-out invalidates server-side (verify protected resource immediately fails)

Inbox / Activity Feed Pagination Checklist

After accumulating data:

• Recent items load fast
• "Load more" or pagination works
• Old items don't make the page slow
• Date grouping (Today, Yesterday, Last 7 days, Older) used appropriately

Data-Heavy Page Performance on Return

The dashboard works empty (one record). With 200 records:

• Still loads under 3s on Fast 3G
• Tables virtualize or paginate
• Charts don't crash with full data
• Search is responsive
• Filters apply instantly

Settings / Preferences Persistence Checklist

On return, every preference set is still set:

• Theme (light / dark / system)
• Density
• Notification preferences
• Email digest frequency
• Default sort orders
• Default filters

Returning User vs Power User Crossover Checklist

Some "returning user" patterns are really "power user" patterns:

• Keyboard shortcuts available and documented
• Bulk actions for managing accumulated records
• Saved searches / saved filters
• Custom views

(Detailed in prompt 444 — power user audit)

---

Calibration

Don't recommend adding a "what's new since you were last here" banner to an app where it would feel forced. Calibrate to product type: a productivity app benefits from explicit return-session orientation; a marketing CMS doesn't need it.

• Severity:

  • Critical — bfcache leaks protected content on back button; user's accumulated state is broken (drafts lost, settings reset); new-user onboarding fires for returning users
  • High — Dashboard is unusable with 100+ records (slow, cluttered, no pagination); notifications pile up without cleanup; long-running action completed but the user wasn't told
  • Medium — Filter / sort state not persisted; remember-me missing; biometric sign-in not offered on mobile
  • Low — Polish ("welcome back" copy could be better; activity feed grouping could be tighter)

• Confidence ratings: Confirmed (reproduced with seeded account), Likely (saw on one path), Speculative (taste preference).

• Anti-hallucination guard: Don't claim bfcache leaks without actually hitting the back button after sign-out. Don't claim data-heavy pages are slow without measuring. Don't claim filters reset without sign-out + sign-in + revisit.

Output Format

Start with a 5–8 line executive summary: return-session experience verdict, critical findings, top 3 fixes.

1. Seeded Account State — Records, activity, drafts, notifications
2. Dashboard-on-Return Findings — Orientation, what's-new, performance
3. Notification Hygiene Findings — Clustering, cleanup, bulk-clear
4. Stale Cache / bfcache Findings — Back-button leaks (security-critical)
5. Persistence Findings — Filters, sort, scroll, density, theme
6. Long-Running Action Findings — Background state on return
7. Session Token Findings — Expiry, rotation, remember-me
8. Mobile Return Findings — Biometric, deep link, refresh

Close with a Prioritized Fix List with security items (bfcache) first, returning-user experience second.