Opening a pond landed on whatever sorted first in the sidebar — stable,
but a rule nobody could see, and one whose target moved as soon as
someone added a page ahead of it. New ponds landed on the empty-pond hint
instead of anything useful.
- `startPageId` joins the pond settings. No migration: `Pond.settings` is
already jsonb. It stores an id, not a slug, so renaming or moving the
page keeps it working.
- `PondHomePage` prefers it, but only when the page is in this user's
page list. That list already holds just what they may see, so a start
page hidden by a page-scoped grant — or trashed — falls back silently
instead of landing them on a 404, and it costs no extra request.
- Both creation paths give the pond a start page, titled from the
creator's stored locale. It happens after the creating transaction
commits: the owner's grant is written inside it and permissions cache
per pond, so creating the page any earlier would ask about rights the
grant has not published yet. A failure is logged, not fatal — a pond
without a start page still works.
`PagesModule` imported `PondsModule` without using it. Removing that
vestigial edge let PondsModule depend on PagesModule in the honest
direction instead of tying the two together with forwardRef.
Every pond created through the api now owns a page, which broke eight
suites whose teardown deleted ponds directly — `Page.pond` deliberately
has no cascade, because a real purge removes contents explicitly and
audits it. A shared `deletePondsWhere` helper deletes pages first. Two
tests that counted pages now account for the start page rather than
pretending the pond began empty.
Claude Opus 5
45f1925917