The Obsidian fixture vault contains a note called "Startseite", and the
pond now creates one too — the seeded fixtures use locale `de`. Two
consequences, and the second is the one that mattered:
- the unscoped title locator matched two sidebar entries;
- `/p/<pond>/startseite` no longer belongs to the imported note. The
pond's own start page took that slug, so the import landed on a
suffixed one and the test was about to assert against the wrong page.
Both are fixed by scoping to the mount page and navigating through the
sidebar instead of guessing a slug. The test stays meaningful: it then
clicks a wikilink inside the page content, which the empty auto-created
start page would not have.
CI caught this; the local run passed it. Worth remembering that a
title-based locator can go green by luck.
Every pond created through the api now carries one, and the matrix pond
is created that way. The start page is an ordinary page with no grant of
its own, so it follows the pond-wide permissions: the three member
subjects each see one more, the label-restricted editor too, and the
outsider — who reaches only the explicitly public page — still sees one.
The 429 in the same run was the login rate limit, reached through the
retries of this failure rather than on its own.
Opening a pond landed on whatever sorted first in the sidebar — stable,
but a rule nobody could see, and one whose target moved as soon as
someone added a page ahead of it. New ponds landed on the empty-pond hint
instead of anything useful.
- `startPageId` joins the pond settings. No migration: `Pond.settings` is
already jsonb. It stores an id, not a slug, so renaming or moving the
page keeps it working.
- `PondHomePage` prefers it, but only when the page is in this user's
page list. That list already holds just what they may see, so a start
page hidden by a page-scoped grant — or trashed — falls back silently
instead of landing them on a 404, and it costs no extra request.
- Both creation paths give the pond a start page, titled from the
creator's stored locale. It happens after the creating transaction
commits: the owner's grant is written inside it and permissions cache
per pond, so creating the page any earlier would ask about rights the
grant has not published yet. A failure is logged, not fatal — a pond
without a start page still works.
`PagesModule` imported `PondsModule` without using it. Removing that
vestigial edge let PondsModule depend on PagesModule in the honest
direction instead of tying the two together with forwardRef.
Every pond created through the api now owns a page, which broke eight
suites whose teardown deleted ponds directly — `Page.pond` deliberately
has no cascade, because a real purge removes contents explicitly and
audits it. A shared `deletePondsWhere` helper deletes pages first. Two
tests that counted pages now account for the start page rather than
pretending the pond began empty.
