diff --git a/apps/web/e2e/permission-matrix.spec.ts b/apps/web/e2e/permission-matrix.spec.ts
index dea7c1e..b27f063 100644
--- a/apps/web/e2e/permission-matrix.spec.ts
+++ b/apps/web/e2e/permission-matrix.spec.ts
@@ -173,10 +173,14 @@ test('page read & edit — the 404-vs-403 policy holds per subject', async () =>
 });
 
 test('sidebar list is filtered to each subject’s visible pages', async () => {
-  expect(await listCount(f.admin.request, f.pondId)).toBe(3);
-  expect(await listCount(f.owner.request, f.pondId)).toBe(3);
-  expect(await listCount(f.reader.request, f.pondId)).toBe(3);
-  expect(await listCount(f.editor.request, f.pondId)).toBe(2); // secret hidden
+  // Three fixture pages plus the pond's own start page (issue #302), which
+  // every pond created through the api now carries. It is an ordinary page
+  // with no grant of its own, so it follows the pond-wide permissions: the
+  // outsider, who reaches only the explicitly public page, still sees one.
+  expect(await listCount(f.admin.request, f.pondId)).toBe(4);
+  expect(await listCount(f.owner.request, f.pondId)).toBe(4);
+  expect(await listCount(f.reader.request, f.pondId)).toBe(4);
+  expect(await listCount(f.editor.request, f.pondId)).toBe(3); // secret hidden
   expect(await listCount(f.outsider.request, f.pondId)).toBe(1); // only the public page
   // Anonymous cannot hit the authenticated list endpoint at all.
   expect(await listCount(f.anon, f.pondId)).toBe(401);