test(e2e): a plain member's shell is held end to end, and a page it cannot open lands on the feed

The suite ran only as an admin, so nothing end to end held what a member sees. A second seeded
account, a member with its own session, now walks every rail page (no admin entry, no admin call,
no error state) and follows links to the admin pages.

It found one: a member's link to an admin page showed the feed with no rail row current, and the
address bar kept naming the admin page — only the content fell back. The navigation state now
derives the page on screen through each module's gate (reachablePage), so the rail, the content,
the tab title and the address bar agree, on a link, a Back, and a role taken away mid-session.

frontend/src/components/BootGate.dom.test.tsx

@@ -47,7 +47,10 @@ function mount() {
   );
   return qc;
 }
-const account = (over: Partial<Me> = {}) => ({ id: 5, preferences: {}, ...over }) as Me;
+// On a Plex-enabled instance: the remembered page these cases restore is the Plex module, which only
+// an instance with Plex lets an account open.
+const account = (over: Partial<Me> = {}) =>
+  ({ id: 5, preferences: {}, plex_enabled: true, ...over }) as Me;
 let savePrefs: MockInstance<typeof api.savePrefs>;
 const retryButton = () => screen.findByRole("button", { name: i18n.t("common.retry") });
 

frontend/src/components/NavigationProvider.dom.test.tsx

@@ -79,7 +79,8 @@ async function openOverlay() {
 
 beforeEach(() => {
   qc = new QueryClient();
-  qc.setQueryData(qk.me(), { id: 1 });
+  // An admin on a Plex-enabled instance: every module is open to it, so no gate moves a page here.
+  qc.setQueryData(qk.me(), { id: 1, role: "admin", plex_enabled: true });
   localStorage.clear();
   sessionStorage.setItem("siftlode.activeAccount", "1"); // account-scoped page memory
   window.history.replaceState({ sfPage: "feed" }, "", "/");
@@ -295,6 +296,43 @@ describe("NavigationProvider · Back", () => {
   });
 });
 
+describe("NavigationProvider · a page the account cannot open", () => {
+  const member = { id: 1, role: "user", plex_enabled: true };
+
+  // A member following a link to an admin page saw the feed with no rail row current: the page
+  // stayed "scheduler" while only the content fell back.
+  it("lands on the feed, and the address bar says so", () => {
+    qc.setQueryData(qk.me(), member);
+    window.history.replaceState(null, "", "/?page=scheduler&keep=1");
+    const { result } = render();
+    expect(result.current.page).toBe("feed");
+    expect(window.location.search).toBe("?keep=1");
+    expect(window.history.state).toMatchObject({ sfPage: "feed" });
+  });
+
+  it("lands on the feed when Back reaches an entry naming one", () => {
+    qc.setQueryData(qk.me(), member);
+    const { result } = render();
+    act(() => result.current.setPage("files"));
+    act(() => {
+      window.history.replaceState({ sfPage: "config" }, "", "/?page=config");
+      window.dispatchEvent(new PopStateEvent("popstate", { state: { sfPage: "config" } }));
+    });
+    expect(result.current.page).toBe("feed");
+  });
+
+  it("leaves the page it is on once the account loses it", async () => {
+    window.history.replaceState(null, "", "/?page=users");
+    const { result } = render();
+    expect(result.current.page).toBe("users");
+    act(() => {
+      qc.setQueryData(qk.me(), member);
+    });
+    await settle();
+    expect(result.current.page).toBe("feed");
+  });
+});
+
 describe("NavigationProvider · leaving a sub-view whose entry is the oldest of this document", () => {
   // A full tab can have dropped the entry under the one the channel page or the search pushed (see
   // lib/history's backStaysInDocument): leaving clears it in place instead of stepping out.

frontend/src/components/NavigationProvider.tsx

@@ -14,6 +14,7 @@ import {
   notifyNav,
   rememberNavPosition,
 } from "../lib/history";
+import { reachablePage } from "../lib/modules";
 import { channelViewFrom, loadInitialPage, PAGE_KEY, type ChannelView } from "./navigationInit";
 import {
   NavigationActionsContext,
@@ -31,7 +32,12 @@ import {
 
 export function NavigationProvider({ children }: { children: ReactNode }) {
   const { t, i18n } = useTranslation();
-  const [page, setPageState] = useState<Page>(loadInitialPage);
+  const [chosenPage, setPageState] = useState<Page>(loadInitialPage);
+  // The page on screen: the chosen one when this account may open it, else the feed — derived, so a
+  // link, a Back and a role taken away mid-session all land the same way, and the rail, the content
+  // and the address bar (stamped from it below) agree.
+  const me = useMe();
+  const page = reachablePage(chosenPage, me);
   // Ephemeral: not persisted and not in the URL, so a reload returns to the normal feed (a search
   // spends quota, so we never auto-replay it) — UNLESS it was zero-quota scrape-sourced, which rides
   // in history.state and is free to re-fetch. The popstate handler derives it from history.state so
@@ -171,7 +177,7 @@ export function NavigationProvider({ children }: { children: ReactNode }) {
   // title, a playlist — `PageHeading` reports it), so a channel opened from a link is named the same
   // as one opened in the app. Signed out, the page on screen is the public landing whatever `page`
   // says — the tab read "What should I watch?" over the sign-in form (prod UAT 2026-09-19).
-  const signedIn = useMe() != null;
+  const signedIn = me != null;
   const objectTitle = useDocumentObjectTitle();
   useEffect(() => {
     const parts = signedIn ? [objectTitle, t(pageTitleKey(page))] : [];