@fuzdev/fuz_app 0.148.0 → 0.150.0

package/dist/testing/cross_backend/audit_cross_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CASd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}
+{"version":3,"file":"audit_cross_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/audit_cross_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsB9B,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAIvE,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,cAAc,CAAC;IAC5F,2FAA2F;IAC3F,QAAQ,CAAC,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5F,QAAQ,CAAC,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjG,8FAA8F;IAC9F,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;CACtD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,SAAS,gBAAgB,EACzB,WAAU,MAAuB,KAC/B,OAAO,CAAC,IAAI,CAmBd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,IAAI,CAAC,gBAAgB,EAAE,oCAAoC,CAAC,EACrE,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAQ,aAAa,CAAC,MAAM,CAAM,KAChC,IASF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,gBAAgB,EACzB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAU,MAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAe/C,CAAC"}

package/dist/testing/cross_backend/audit_cross_helpers.js

@@ -26,12 +26,23 @@ import { SPINE_RPC_PATH } from './spine_surface_constants.js';
  * backend must mount the action — every spine test binary does; in-process
  * suites mount `create_testing_drain_effects_action`.
  *
+ * Refuses an answer without `tracked: true`. A binary whose audit emitter was
+ * built without in-flight tracking answers the drain at once, waiting on
+ * nothing, and its audit reads race the writes — an absent row then reads as
+ * a pass. Every audit read runs through here, so each one checks the barrier
+ * is live.
+ *
  * @param fixture - the per-test fixture, whose daemon token authorizes the drain
  * @param rpc_path - the RPC endpoint the drain action is mounted on
  */
 export const cross_drain_effects = async (fixture, rpc_path = SPINE_RPC_PATH) => {
     const drained = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, '_testing_drain_effects', undefined, fixture.create_daemon_token_headers());
     assert.ok(drained.ok, `_testing_drain_effects failed: ${JSON.stringify(drained.error)}`);
+    const tracked = typeof drained.result === 'object' && drained.result !== null
+        ? drained.result.tracked
+        : undefined;
+    assert.strictEqual(tracked, true, "_testing_drain_effects must answer tracked: true — the backend's audit emitter does not " +
+        `track in-flight writes, so the drain waits on nothing (got ${JSON.stringify(drained.result)})`);
 };
 /**
  * Assert an audit row's `metadata` carries `expected` — each field compared

package/dist/testing/cross_backend/capabilities.d.ts

@@ -1,4 +1,5 @@
 import '../assert_dev_env.js';
+import type { TestingBackdoorMethod } from './spine_surface_constants.js';
 /**
  * Optional behaviors a backend may support. Each flag's TSDoc names the
  * tests that gate on it; add a new flag here before referencing it from
@@ -61,10 +62,12 @@ export interface BackendCapabilities {
     /**
      * The cell-gated fact-serving route (`GET /api/cells/:cell_id/facts/:hash`)
      * is live-mounted on the backend, its DB carries the `fuz_facts` migration
-     * namespace, and it registers the `_testing_put_fact` seeder. Gates
+     * namespace, and it mounts the `_testing_put_fact` seeder — declared in
+     * `testing_backdoors`, which `describe_spine_cross_suites` requires. Gates
      * `describe_fact_serving_cross_tests`' per-reference read model (cell-scoped
      * admit via a viewable cell, cross-owner-dedup-no-leak, 404-mask),
-     * `describe_cell_ref_admission_cross_tests`, and the fact cases of the
+     * `describe_cell_ref_admission_cross_tests` (its grant, item, and clone
+     * cases with `cell_relations`), and the fact cases of the
      * moderation suite. Like cells, the serve route stays off the standard
      * declared surface. The admin bare-hash route is its own flag,
      * `fact_serving_admin_hash`.
@@ -191,6 +194,25 @@ export interface BackendCapabilities {
      * Deno, Bun, and the Rust spine, which send the response as built.
      */
     readonly ws_refusal_body: boolean;
+    /**
+     * The `_testing_*` backdoors the backend mounts on its RPC endpoint, from
+     * `TESTING_BACKDOOR_METHODS` (a consumer's own seams stay off it). Not a
+     * flag, but declared like a `MountFlag`: no family default, so every config
+     * states it. `describe_testing_backdoor_cross_tests` checks the declaration
+     * against the backend — a declared method must be mounted, an undeclared one
+     * must answer `method_not_found` — and runs its credential-gate rows over
+     * the declared ones; `describe_spine_cross_suites` requires `_testing_reset`
+     * and `_testing_drain_effects` (the per-test reset and the audit barrier),
+     * skips a suite whose backdoor is undeclared, naming it — `credential_deadline`
+     * (`_testing_shorten_credential_expiry`), `origin_conformance`
+     * (`_testing_origin_check`), `ws_outbound_overflow`
+     * (`_testing_flood_notifications`) — and requires `_testing_put_fact` of a
+     * backend declaring `fact_serving`.
+     *
+     * fuz_app's spine presets declare every one; the in-process transport none
+     * (the backdoor suites are cross-process only).
+     */
+    readonly testing_backdoors: ReadonlyArray<TestingBackdoorMethod>;
 }
 /**
  * The capabilities that describe a backend's own mounts, never a runtime
@@ -203,8 +225,9 @@ export interface BackendCapabilities {
  */
 export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_crud' | 'cell_relations' | 'cell_gated_create' | 'fact_serving' | 'fact_serving_admin_hash' | 'ready' | 'peer_request' | 'ws_account_actions' | 'ws_role_gated'>;
 /**
- * A family's default capabilities: every flag but the `MountFlag`s, which
- * each backend config states itself. Spread one and add every mount flag:
+ * A family's default capabilities: every flag but the `MountFlag`s and the
+ * `testing_backdoors` list, which each backend config states itself. Spread
+ * one and add every mount flag and the backdoor list:
  *
  * ```ts
  * capabilities: {
@@ -213,10 +236,11 @@ export type MountFlag = keyof Pick<BackendCapabilities, 'ws' | 'sse' | 'cell_cru
  *   cell_crud: false, cell_relations: false, cell_gated_create: false,
  *   fact_serving: false, fact_serving_admin_hash: false,
  *   ws_account_actions: false, ws_role_gated: false,
+ *   testing_backdoors: ['_testing_reset', '_testing_drain_effects'],
  * }
  * ```
  */
-export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag>;
+export type FamilyDefaultCapabilities = Omit<BackendCapabilities, MountFlag | 'testing_backdoors'>;
 /**
  * Capability declarations for the in-process Hono transport. Nearly every
  * flag is `true` because in-process testing exercises the full backend

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiD9B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAyBpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,mBAAmB,CAAC,CAAC;AAEnG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA4BpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -28,9 +28,9 @@ import '../assert_dev_env.js';
  *   `rust_spine_stub_backend_config.ts` (the rust family default plus every mount flag).
  *
  * **Mount flags have no default.** A flag naming something a backend mounts
- * (a `MountFlag`) is never inherited: the family defaults are
- * `FamilyDefaultCapabilities`, which omits them, so every backend config states
- * each one. The family defaults carry only what the family guarantees — the
+ * (a `MountFlag`) is never inherited, nor is the `testing_backdoors` list: the
+ * family defaults are `FamilyDefaultCapabilities`, which omits them, so every
+ * backend config states each one. The family defaults carry only what the family guarantees — the
  * declared spine surface's mounts (`account_lifecycle`, `account_status`) and
  * the runtime behavior of its reference runtime (`ws_handshake_pipelining`,
  * `ws_refusal_body`: Node for TS, hyper for Rust), which a backend on another
@@ -38,8 +38,9 @@ import '../assert_dev_env.js';
  *
  * **Gating flags only.** `BackendCapabilities` holds only flags a suite
  * actually gates on (each has a `test_if(capabilities.X, ...)` reader, or —
- * `ws_refusal_body` — picks how a case reads a refusal). A wiring fact no suite
- * reads is not a capability.
+ * `ws_refusal_body` — picks how a case reads a refusal), plus the
+ * `testing_backdoors` list the backdoor suite and `describe_spine_cross_suites`
+ * read. A wiring fact no suite reads is not a capability.
  *
  * @module
  */
@@ -81,7 +82,10 @@ export const in_process_capabilities = Object.freeze({
     ws_role_gated: false,
     // Read only by the front-door table's WS rows, which skip in-process (no
     // socket to upgrade); Hono's own refusals carry their bodies.
-    ws_refusal_body: true
+    ws_refusal_body: true,
+    // The in-process app mounts no `_testing_*` action; the suites reading this
+    // are cross-process only.
+    testing_backdoors: Object.freeze([])
 });
 /**
  * Conditional `test()` wrapper — registers a vitest case only when

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAG1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA6lBF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA0E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAgE1E,eAAO,MAAM,8BAA8B,GAC1C,SAAS,uCAAuC,KAC9C,IA4uBF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -38,7 +38,13 @@ import '../assert_dev_env.js';
  *   accepted as a list filter that matches nothing;
  * - a `kind` of exactly `CELL_KIND_LENGTH_MAX` UTF-16 code units is stored
  *   whole, and one unit past it is `invalid_params` on create and as a list
- *   filter.
+ *   filter;
+ * - a `data` that is no `CellData` — not an object, or a `label` / `summary`
+ *   that is no string — is 400 `invalid_params` with the generic message and
+ *   no reason on `cell_create`, `cell_update` and (with
+ *   `capabilities.cell_relations`) `cell_clone`'s `with_data_patch`, ahead of
+ *   every cell check (a missing or hidden cell refuses it the same way, never
+ *   with the 404 mask), and writes no cell.
  *
  * The visibility-manage-tier 403 (`cell_visibility_manage_only`) needs a
  * non-owner editor, which only a `cell_grant` can produce, so it lives in
@@ -48,11 +54,64 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CELL_KIND_LENGTH_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { jsonrpc_error_messages } from '../../http/jsonrpc_errors.js';
+import { CELL_KIND_LENGTH_MAX, CELL_LIST_LIMIT_MAX, CellCreateOutput, CellDeleteOutput, CellGetOutput, CellListOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { assert_iso8601_seconds, assert_iso8601_seconds_nullable } from './wire_shapes.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/**
+ * `data` values that are no `CellData` — not an object, or an object whose
+ * `label` / `summary` is no string. Twin of the Rust spine's mistyped-data
+ * table in its cell authz tests.
+ */
+const MISTYPED_CELL_DATA = [
+    'not_an_object',
+    42,
+    true,
+    [1],
+    { label: 123 },
+    { label: null },
+    { summary: {} },
+    { summary: false }
+];
+/** The message every schema refusal answers, naming no field. */
+const INVALID_PARAMS_MESSAGE = jsonrpc_error_messages.invalid_params().message;
+/**
+ * Assert `r` is a schema refusal: 400 `invalid_params` with the generic
+ * message and no `data`, save the Zod `issues` a TS spine adds under DEV
+ * alone — an array of issue objects, each with a string `code` and
+ * `message`, and never a `reason`.
+ */
+const assert_schema_refusal = (r, label) => {
+    const detail = `${label}: got ${r.status} ${JSON.stringify(r.error ?? r.result)}`;
+    assert.strictEqual(r.status, 400, detail);
+    const { error } = r;
+    assert.ok(error, detail);
+    assert.strictEqual(error.code, -32602, detail);
+    assert.strictEqual(error.message, INVALID_PARAMS_MESSAGE, detail);
+    const { data } = error;
+    if (data === undefined)
+        return;
+    assert.ok(typeof data === 'object' && data !== null && Object.keys(data).join() === 'issues', `${detail} — data beyond the DEV-only issues`);
+    const { issues } = data;
+    assert.ok(Array.isArray(issues), `${detail} — DEV-only issues that are no array`);
+    for (const issue of issues) {
+        assert.ok(typeof issue === 'object' &&
+            issue !== null &&
+            typeof issue.code === 'string' &&
+            typeof issue.message === 'string', `${detail} — a DEV-only issue that is no Zod issue`);
+    }
+};
+/**
+ * Assert `r` is the IDOR mask: 404 with reason `cell_not_found` — the
+ * well-typed control beside a schema refusal of the same call.
+ */
+const assert_cell_not_found = (r, label) => {
+    const detail = `${label}: got ${r.status} ${JSON.stringify(r.error ?? r.result)}`;
+    assert.strictEqual(r.status, 404, detail);
+    assert.strictEqual(error_reason(r), 'cell_not_found', detail);
+};
 export const describe_cell_crud_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -327,5 +386,61 @@ export const describe_cell_crud_cross_tests = (options) => {
                 }
             }
         });
+        describe('mistyped data', () => {
+            /** Count every cell, read as the keeper (an admin sees every row). */
+            const count_cells = async (t, keeper_headers) => {
+                const { cells } = expect_output(await cross_rpc_call(t, rpc_path, 'cell_list', { limit: CELL_LIST_LIMIT_MAX }, keeper_headers), CellListOutput);
+                assert.ok(cells.length < CELL_LIST_LIMIT_MAX, 'the count needs a page that holds every cell');
+                return cells.length;
+            };
+            test_if(capabilities.cell_crud, 'cell_create and cell_update refuse it as invalid_params before any cell check', async () => {
+                const fixture = await setup_test();
+                const writer = await fixture.create_account({ username: 'cell_data_writer' });
+                const stranger = await fixture.create_account({ username: 'cell_data_stranger' });
+                const t = fixture.fresh_transport();
+                const keeper_headers = fixture.create_session_headers();
+                const writer_headers = writer.create_session_headers();
+                // the keeper's private cell, hidden from the stranger; the keeper
+                // creates it so a backend that refuses a non-admin root runs the case
+                const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, keeper_headers), CellCreateOutput).cell.id;
+                const missing = crypto.randomUUID();
+                const before = await count_cells(t, keeper_headers);
+                for (const data of MISTYPED_CELL_DATA) {
+                    const shown = JSON.stringify(data);
+                    assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_create', { data }, writer_headers), `cell_create data ${shown}`);
+                    for (const [cell_id, headers, who] of [
+                        [missing, writer_headers, 'a missing cell'],
+                        [hidden, stranger.create_session_headers(), 'a hidden cell']
+                    ]) {
+                        assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id, data }, headers), `cell_update of ${who} data ${shown}`);
+                    }
+                }
+                // the control: well-typed, the same call meets the 404 mask, so the
+                // 400s above came before the cell check
+                assert_cell_not_found(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: hidden, data: {} }, stranger.create_session_headers()), 'cell_update of a hidden cell data {}');
+                assert.strictEqual(await count_cells(t, keeper_headers), before, 'a refused write wrote a cell');
+            });
+            test_if(capabilities.cell_crud && capabilities.cell_relations, 'cell_clone refuses it in with_data_patch as invalid_params before any cell check', async () => {
+                const fixture = await setup_test();
+                const writer = await fixture.create_account({ username: 'cell_patch_writer' });
+                const stranger = await fixture.create_account({ username: 'cell_patch_stranger' });
+                const t = fixture.fresh_transport();
+                const keeper_headers = fixture.create_session_headers();
+                const hidden = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { kind: 'note', data: {} }, keeper_headers), CellCreateOutput).cell.id;
+                const missing = crypto.randomUUID();
+                const before = await count_cells(t, keeper_headers);
+                for (const with_data_patch of MISTYPED_CELL_DATA) {
+                    for (const [source_id, headers, who] of [
+                        [missing, writer.create_session_headers(), 'a missing cell'],
+                        [hidden, stranger.create_session_headers(), 'a hidden cell']
+                    ]) {
+                        assert_schema_refusal(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id, with_data_patch }, headers), `cell_clone of ${who} with_data_patch ${JSON.stringify(with_data_patch)}`);
+                    }
+                }
+                // the control: well-typed, the same clone meets the 404 mask
+                assert_cell_not_found(await cross_rpc_call(t, rpc_path, 'cell_clone', { source_id: hidden, with_data_patch: { label: 'patched' } }, stranger.create_session_headers()), 'cell_clone of a hidden cell with_data_patch {label}');
+                assert.strictEqual(await count_cells(t, keeper_headers), before, 'a refused clone wrote a cell');
+            });
+        });
     });
 };

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwkBF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -14,9 +14,10 @@ import '../assert_dev_env.js';
  * `create_test_cell_gated_create_authorize`, the Rust `testing_spine_stub` via
  * `TestCellGatedCreateAuthorize`): admin bypasses; a non-admin creating a
  * `kind: 'space'` **root** is denied (admin-only); a **contribution** under a
- * space is gated by the space's `data.policy[kind] = {min_role, moderation_required}`,
- * with the moderation outcome folded into the verdict; plain parentless creates
- * stay open. The suite asserts all spines agree on:
+ * space is gated by the space's `policy[kind] = {min_role, moderation_required}`
+ * (the root's manage-tier `policy` column), with the moderation outcome folded
+ * into the verdict; plain parentless creates stay open. The suite asserts all
+ * spines agree on:
  *
  * - **root-create admin-only** — a non-admin `space` root → **403**
  *   `cell_create_forbidden`; admin → succeeds.
@@ -37,6 +38,15 @@ import '../assert_dev_env.js';
  * - **clone is no side door** — `cell_clone` runs the authorizer for every cell
  *   it writes as a parentless create, so a non-admin clone of a viewable
  *   `space` root → **403** `cell_create_forbidden`; admin → succeeds.
+ * - **the root policy is the manager's** — `cell_policy_set` writes it (the new
+ *   and the previous policy audited), answers an editor-grant holder **403**
+ *   `cell_policy_manage_only` and a non-viewer the 404 mask, refuses a
+ *   contribution `cell_policy_root_only` (as `cell_create` refuses a policy
+ *   beside a `parent_id`), and passes each policy through the authorizer's
+ *   validation (`cell_policy_invalid`); an editor rewriting the root's
+ *   `data.policy` leaves moderation as the column says. The refusal with no
+ *   authorizer mounted (`cell_policy_unsupported`) can't run here — both spines
+ *   mount one — and is pinned in-process on each.
  *
  * Gated on `capabilities.cell_gated_create` — `true` only on the reference
  * spine binaries that mount the policy, so it skips for generic consumers and
@@ -46,7 +56,9 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { CellCreateOutput, CellGetOutput, CellPolicySetOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { CellGrantCreateOutput } from '../../auth/cell_grant_action_specs.js';
+import { list_audit_events } from './audit_cross_helpers.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -61,7 +73,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {} }, stranger.create_session_headers());
             assert.ok(!denied.ok, 'a non-admin must not create a space root');
             assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             assert.strictEqual(space.cell.kind, SPACE_CELL_KIND, 'admin creates the space root');
             assert.strictEqual(space.cell.parent_id, null, 'a root is parentless');
             assert.strictEqual(space.cell.root_id, null, 'a root has no governing root');
@@ -69,7 +81,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a contribution under a public space: unauthorized → 403, participant → allowed', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             // A non-participant sees the public space but can't contribute → 403.
             const stranger = await fixture.create_account({ username: 'post_stranger' });
             const forbidden = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
@@ -86,7 +98,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'moderation is set per `moderation_required` (post → pending+private, react → approved)', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'mod_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -103,7 +115,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a hidden (private) space is 404-masked (not 403)', async () => {
             const fixture = await setup_test();
             // A private space — only admin/owner can view it.
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
             const stranger = await fixture.create_account({ username: 'hidden_stranger' });
             const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
             assert.ok(!masked.ok, 'a stranger must not contribute under a hidden space');
@@ -111,14 +123,14 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a deep contribution (comment under a post) resolves policy from the governing root, not the parent', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'deep_participant',
                 roles: [PARTICIPATION_ROLE]
             });
             // A post lives directly under the space — the shallow case
-            // (`root_id === parent_id`), so the handler reuses the parent row as
-            // `root_data`. The post is gated `moderation_required: true`, so it's
+            // (`root_id === parent_id`), so the handler reuses the parent row's
+            // `policy`. The post is gated `moderation_required: true`, so it's
             // born pending + private; the author can still view their own pending
             // cell, so it's a valid parent for the comment below.
             const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
@@ -127,7 +139,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             // `root_id !== parent_id`, so the handler must read the governing
             // root (the space) *through* the post (the separate in-tx root read),
             // and the authorizer must resolve `policy.comment` from the SPACE's
-            // data, not the post's. This is the only case that exercises the
+            // policy, not the post's. This is the only case that exercises the
             // deep-read branch on both spines.
             const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, participant.create_session_headers()), CellCreateOutput);
             assert.strictEqual(comment.cell.parent_id, post.cell.id, 'the immediate parent is the post');
@@ -137,7 +149,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a soft-deleted root is 404 cell_not_found (the missing-parent shape)', async () => {
             const fixture = await setup_test();
             const admin_headers = fixture.create_session_headers();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'tombstone_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -155,5 +167,89 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             const missing_parent = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: '00000000-0000-4000-8000-000000000000' }, participant_headers);
             assert.deepStrictEqual(refused.error, missing_parent.error);
         });
+        describe('cell root policy parity', () => {
+            test_if(capabilities.cell_gated_create, 'a root takes a policy at create and through cell_policy_set, audited old and new', async () => {
+                const fixture = await setup_test();
+                const admin_headers = fixture.create_session_headers();
+                const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+                assert.deepStrictEqual(space.cell.policy, TEST_SPACE_POLICY, 'the create stores the policy');
+                // Any viewer reads it.
+                const stranger = await fixture.create_account({ username: 'policy_reader' });
+                const read = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: space.cell.id }, stranger.create_session_headers()), CellGetOutput);
+                assert.deepStrictEqual(read.cell.policy, TEST_SPACE_POLICY);
+                const opened = { post: { min_role: PARTICIPATION_ROLE, moderation_required: false } };
+                const set = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: opened }, admin_headers), CellPolicySetOutput);
+                assert.deepStrictEqual(set.cell.policy, opened);
+                const participant = await fixture.create_account({
+                    username: 'policy_participant',
+                    roles: [PARTICIPATION_ROLE]
+                });
+                const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+                assert.strictEqual(post.cell.moderation, 'approved', 'the new policy governs');
+                assert.strictEqual(post.cell.policy, null, 'a contribution carries no policy');
+                const cleared = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: null }, admin_headers), CellPolicySetOutput);
+                assert.strictEqual(cleared.cell.policy, null);
+                const events = await list_audit_events(fixture, { event_type: 'cell_policy_set' }, rpc_path);
+                assert.deepStrictEqual(events.map((e) => e.metadata).reverse(), [
+                    { cell_id: space.cell.id, policy: opened, previous_policy: TEST_SPACE_POLICY },
+                    { cell_id: space.cell.id, policy: null, previous_policy: opened }
+                ], 'each set is audited with the policy it wrote and the one it replaced');
+            });
+            test_if(capabilities.cell_gated_create, 'a policy is root-only and must pass the authorizer', async () => {
+                const fixture = await setup_test();
+                const admin_headers = fixture.create_session_headers();
+                const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+                const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id }, admin_headers), CellCreateOutput);
+                const on_contribution = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: react.cell.id, policy: TEST_SPACE_POLICY }, admin_headers);
+                assert.ok(!on_contribution.ok);
+                assert.strictEqual(error_reason(on_contribution), 'cell_policy_root_only');
+                const beside_parent = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, policy: TEST_SPACE_POLICY }, admin_headers);
+                assert.ok(!beside_parent.ok);
+                assert.strictEqual(error_reason(beside_parent), 'cell_policy_root_only');
+                for (const bad of [
+                    { post: true },
+                    { post: { min_role: 1 } },
+                    { post: { other: true } }
+                ]) {
+                    const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: bad }, admin_headers);
+                    assert.ok(!refused.ok, JSON.stringify(bad));
+                    assert.strictEqual(error_reason(refused), 'cell_policy_invalid', JSON.stringify(bad));
+                    const refused_create = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: bad }, admin_headers);
+                    assert.strictEqual(error_reason(refused_create), 'cell_policy_invalid', JSON.stringify(bad));
+                }
+            });
+            test_if(capabilities.cell_gated_create, "an editor-grant holder can't change a root's policy, through the verb or through data", async () => {
+                const fixture = await setup_test();
+                // A non-admin's root (a parentless non-`space` kind is open), its
+                // policy moderating posts.
+                const owner = await fixture.create_account({ username: 'policy_owner' });
+                const owner_headers = owner.create_session_headers();
+                const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, owner_headers), CellCreateOutput);
+                const editor = await fixture.create_account({ username: 'policy_editor' });
+                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                    cell_id: root.cell.id,
+                    level: 'editor',
+                    principal: { kind: 'actor', actor_id: editor.actor.id }
+                }, owner_headers), CellGrantCreateOutput);
+                const editor_headers = editor.create_session_headers();
+                const opened = { post: { min_role: PARTICIPATION_ROLE, moderation_required: false } };
+                const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: root.cell.id, policy: opened }, editor_headers);
+                assert.ok(!refused.ok, 'an editor must not set the policy');
+                assert.strictEqual(error_reason(refused), 'cell_policy_manage_only');
+                // The editor may rewrite `data` — a `data.policy` is just content.
+                const edited = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_update', { cell_id: root.cell.id, data: { policy: opened } }, editor_headers), CellUpdateOutput);
+                assert.deepStrictEqual(edited.cell.policy, TEST_SPACE_POLICY, 'a data write leaves the policy');
+                const participant = await fixture.create_account({
+                    username: 'policy_poster',
+                    roles: [PARTICIPATION_ROLE]
+                });
+                const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: root.cell.id }, participant.create_session_headers()), CellCreateOutput);
+                assert.strictEqual(post.cell.moderation, 'pending', "moderation follows the root's policy column, not its `data.policy`");
+                // Someone who can't view a private root gets the mask.
+                const hidden = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY }, owner_headers), CellCreateOutput);
+                const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: hidden.cell.id, policy: opened }, editor_headers);
+                assert.strictEqual(error_reason(masked), 'cell_not_found');
+            });
+        });
     });
 };

package/dist/testing/cross_backend/cell_moderate.d.ts

@@ -2,7 +2,8 @@ import '../assert_dev_env.js';
 import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /**
  * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
+ * approved | rejected` decision and the `approved → rejected` takedown) —
+ * root-authority-gated.
  *
  * Builds a moderated public space (admin) + a `participant`'s `post` (born
  * `pending` + private under the `moderation_required: true` policy), then
@@ -20,6 +21,11 @@ import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
  * - **a cell with no governing root** → `400 cell_not_a_contribution` for any
  *   viewer (owner, admin), the cell left unmoderated; a non-viewer gets the
  *   `cell_not_found` mask first.
+ * - **approval needs a pending contribution, rejection a pending or approved
+ *   one** → else `400 cell_not_pending`, the cell left as it was: a root owner
+ *   a private, born-approved contribution was shared with can't publish it by
+ *   "approving" it; an approved post is not approved again but can be taken
+ *   down (rejected, visibility untouched); a rejected post is final.
  *
  * And that moderation gates reads — a cell's effective audience is its
  * visibility or grants **and** its moderation admission (unmoderated or

package/dist/testing/cross_backend/cell_moderate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_moderate.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_moderate.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA69BF,CAAC"}
+{"version":3,"file":"cell_moderate.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_moderate.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAunCF,CAAC"}