@fuzdev/fuz_app 0.149.0 → 0.150.0

package/dist/testing/CLAUDE.md

@@ -345,7 +345,11 @@ field a loose output schema passes on one spine, shows up as a difference.
   one alone, registration throws. Per case, each backend's own `setup_test`
   (separate databases and keepers), the principal resolved and the request
   sent through `send_conformance_case` (`conformance_table.ts`), both answers
-  normalized and diffed. The per-case `expect` is not asserted —
+  normalized and diffed. Every HTTP request carries
+  `DIFFERENTIAL_REQUEST_HEADERS` (`accept-encoding: identity`), so a runtime's
+  own compression (`Deno.serve` gzips for a request accepting it, as Node's
+  `fetch` sends by default) never reads as a `content-encoding` / `vary`
+  difference. The per-case `expect` is not asserted —
   each backend's conformance leg holds it. `KnownDivergence` is the ledger
   row: `{case_name | method, tracking_id, reason, what_differs}`, the names a
   string or a list, `what_differs` the diff paths covered (a path covers
@@ -1173,7 +1177,8 @@ file; the dual-spawn and limiter-enabled suites name their own files.
   `fact_holder` row, so a non-admin can reference what it seeds, and whose
   optional `external_url` writes a bare external row naming that URL, so the
   suite can pin that a URL naming another hash's file is refused) — it also
-  gates `describe_cell_ref_admission_cross_tests`. `fact_serving_admin_hash`
+  gates `describe_cell_ref_admission_cross_tests` (its grant, item, and clone
+  cases with `cell_relations`). `fact_serving_admin_hash`
   is the admin-only bare-hash route (`GET /api/facts/:hash`), its own flag
   because a backend can serve the cell-gated route alone: it gates the
   fact-serving suite's bare-hash cases (with `fact_serving`) and the bare-hash
@@ -1484,18 +1489,19 @@ capabilities}` protocol every Tier 1 suite uses, so **one case array runs
   always-available principals to fixture accessors; `role_holder` /
   `wrong_role` read a seeded `extra_accounts` username named via
   `options.principals`. `send_conformance_case(c, {fixture, surface_source, principals?,
-  resolved_rpc_endpoints})` (exported) is the send half — principal resolved,
+  resolved_rpc_endpoints, request_headers?})` (exported) is the send half — principal resolved,
   request sent, the raw `{target, status, headers, body}` back unasserted; the
   table asserts on it, and the cross-backend differential compares two.
+  `request_headers` go on the HTTP request beneath the principal's (the
+  differential's identity encoding); the WS leg sends none.
   **WS leg:** `ws: WsEndpointTarget` (`{base_url, ws_path, origin?}`) on
   either sends each case as one frame on an admitted socket the principal
   opens — its headers on the upgrade, no `Origin` where the HTTP leg
-  suppresses it, its own actor as `?acting=`. Only the TS spine resolves an
-  actor at the upgrade, refusing a multi-actor account's upgrade without
-  `?acting=` (400 `actor_required`); the Rust spine's upgrade resolves the
-  account and ignores it. Per-frame dispatch resolves each frame's `acting` on
-  both. The leg always sends `?acting=`, so it does not cover that
-  upgrade-level difference; the front-door table's multi-actor row does. The frame is the envelope the HTTP
+  suppresses it, its own actor as `?acting=`. Both spines resolve an actor at
+  the upgrade, refusing a multi-actor account's upgrade without `?acting=`
+  (400 `actor_required`), and per-frame dispatch resolves each frame's
+  `acting` on both. The leg always sends `?acting=`, so it does not cover that
+  upgrade refusal; the front-door table's multi-actor row does. The frame is the envelope the HTTP
   body is (`perform_action_result_to_envelope` on TS), so the response reads
   `{status, headers: {}, body: frame}` with `status` the code's
   `jsonrpc_error_code_to_http_status` (200 for a result) and every row holds
@@ -1956,15 +1962,23 @@ the option type states whether the bundle is read.
   admin-only (a non-admin → **403** `cell_create_forbidden`, and the same for a
   non-admin `cell_clone` of a viewable space — clone runs the authorizer for
   every cell it writes); a **contribution**
-  under a space is gated by the root's `data.policy[kind] = {min_role,
-moderation_required}`, with `moderation` set per the verdict (`pending`+private
-  vs `approved`+author-visibility); a **hidden** parent **404**-masks vs a
-  **visible** one **403**s; plain parentless creates stay open. The moderate
-  suite then proves the `pending → approved | rejected` transition: an admin
-  (root manager) approves → public, the **author** self-approve → 403
-  (anti-self-approval), a non-viewer → 404, reject → stays private, and a cell
+  under a space is gated by the root's `policy[kind] = {min_role,
+moderation_required}` (the root's manage-tier `policy` column), with
+  `moderation` set per the verdict (`pending`+private vs
+  `approved`+author-visibility); a **hidden** parent **404**-masks vs a
+  **visible** one **403**s; plain parentless creates stay open. The root policy
+  itself: `cell_policy_set` writes it (audited old and new), answers an
+  editor-grant holder 403 `cell_policy_manage_only` and a non-viewer the 404,
+  refuses a contribution `cell_policy_root_only`, and runs each policy through
+  the authorizer's `validate_policy` (`cell_policy_invalid`); an editor
+  rewriting the root's `data.policy` leaves moderation as the column says. The moderate
+  suite then proves the `pending → approved | rejected` transition and the
+  `approved → rejected` takedown: an admin (root manager) approves → public,
+  the **author** self-approve → 403 (anti-self-approval), a non-viewer → 404, reject → stays private, and a cell
   with no governing root → 400 `cell_not_a_contribution` for any viewer, the
-  404 mask first for a non-viewer. It also
+  404 mask first for a non-viewer; approval needs a pending post and rejection
+  a pending or approved one (the takedown), else 400 `cell_not_pending` — so a
+  root owner shown a private born-approved contribution can't publish it. It also
   pins the moderation read gate (a pending or rejected post reaches no
   non-steward reader past its author and admins on `cell_get`, `cell_list`,
   `cell_item_list`, and fact serving, even flipped public or granted while
@@ -2388,10 +2402,9 @@ one is still asserted. The table
 is the exported `transport_composition_cases` data. `multi_actor:
 {setup_test, xfail?}` adds `transport_composition_multi_actor_cases`, run on
 a fixture whose keeper has `extra_actors`: the keeper's session upgrading with
-no `?acting=` → 400 `actor_required` (flat body), the TS upgrade's actor
-resolution. The Rust spine's upgrade resolves no actor and admits the socket,
-so fuz_app passes `xfail` (tracking id `rust-ws-upgrade-acting-fail-open`) for
-the Rust stub only. Given `base_url`, every
+no `?acting=` → 400 `actor_required` (flat body), the upgrade's actor
+resolution on both spines. `xfail` is for a backend known to admit the
+socket; fuz_app passes none. Given `base_url`, every
 probe is written to the socket (`raw_http_exchange`) and an over-cap request
 sends its head alone; with `base_url: null` the probes go through the
 fixture's transport and the WS rows skip. Not in the standard bundle. fuz_app's

package/dist/testing/app_server.d.ts

@@ -371,7 +371,9 @@ export interface CreateTestAppForBootstrapOptions {
     /**
      * Token contents the stub fs returns when reading `bootstrap.token_path`.
      * The test posts a body containing this same value as `token` to satisfy
-     * the timing-safe equality check inside `bootstrap_account`.
+     * the timing-safe equality check inside `bootstrap_account`. At least
+     * `BOOTSTRAP_TOKEN_MIN_BYTES` long, or the read refuses it as a missing
+     * file.
      */
     bootstrap_token: string;
     db?: Db;

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA2CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAmHD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,2PAA2P;IAC3P,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAO,IAAI,CACzD,gBAAgB,EAChB,iBAAiB,GAAG,OAAO,GAAG,YAAY,CAKzC,CAAC;AAoCH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAqFpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,mHAAmH;IACnH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAqE7B,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAGjC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAIpD,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG3E,OAAO,EAEN,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAOvD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AA2CjD;;;;;GAKG;AACH,MAAM,WAAW,uCAAuC;IACvD,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2DAA2D;AAC3D,MAAM,MAAM,0BAA0B,GAAG,uCAAuC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,uCAAuC,KAC9C,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAqDA,CAAC;AAEF,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,SAAS,sBAAsB,KAC7B,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,CAAA;CAAE,CAQpC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,0BAA0B,KACjC,OAAO,CAAC;IACV,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAQA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACzD,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAmHD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CA2BvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CACpC,IAAI,CACH,gBAAgB,EAChB,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,eAAe,GAAG,WAAW,CACpF,CACD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,KAAK,EAAE;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7E,2PAA2P;IAC3P,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kCAAkC,QAAO,IAAI,CACzD,gBAAgB,EAChB,iBAAiB,GAAG,OAAO,GAAG,YAAY,CAKzC,CAAC;AAoCH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAqFpF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,gCAAgC;IAChD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACxC,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,8EAA8E;IAC9E,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,aAAa,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,UAAU,CAAC;IACpB,mHAAmH;IACnH,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,yJAAyJ;IACzJ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,mBAAmB,CAqE7B,CAAC"}

package/dist/testing/cross_backend/actor_lookup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA8BxF,CAAC"}
+{"version":3,"file":"actor_lookup.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/actor_lookup.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAoC9B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG3D;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AASnE,eAAO,MAAM,iCAAiC,GAAI,SAAS,2BAA2B,KAAG,IA4DxF,CAAC"}

package/dist/testing/cross_backend/actor_lookup.js

@@ -18,6 +18,8 @@ import '../assert_dev_env.js';
  *   `account_id` / `email` / timestamp / role field (the wire shape's
  *   deliberate info-leak posture). This is the assertion that exercises the
  *   Rust row→JSON mapping against the TS canonical shape.
+ * - **a soft-deleted account's actor doesn't resolve** — beside a live one,
+ *   after the keeper's `account_delete`.
  *
  * Runs both legs via the shared `{setup_test}` protocol: the in-process leg
  * (`auth/actor_lookup_parity.db.test.ts`, plain `gro test`) and the
@@ -58,5 +60,30 @@ export const describe_actor_lookup_cross_tests = (options) => {
                 assert(!(key in row), `actor_lookup row must not leak '${key}'`);
             }
         });
+        test("a soft-deleted account's actor no longer resolves", async () => {
+            const fixture = await setup_test();
+            const gone = await fixture.create_account({ username: 'lookup_soft_deleted' });
+            const live = await fixture.create_account({ username: 'lookup_live' });
+            const deleted = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    method: 'account_delete',
+                    params: { account_id: gone.account.id },
+                    id: 'delete'
+                })
+            });
+            assert.strictEqual(deleted.status, 200, 'the admin deletes the account');
+            await deleted.text();
+            const res = await fixture.transport(rpc_path, {
+                method: 'POST',
+                headers: { ...fixture.create_session_headers(), 'content-type': 'application/json' },
+                body: lookup_envelope([gone.actor.id, live.actor.id], 'tombstone-lookup')
+            });
+            assert.strictEqual(res.status, 200);
+            const body = (await res.json());
+            assert.deepStrictEqual(body.result?.actors?.map((a) => a.id), [live.actor.id], 'the tombstoned actor drops out, the live one resolves');
+        });
     });
 };

package/dist/testing/cross_backend/capabilities.d.ts

@@ -66,7 +66,8 @@ export interface BackendCapabilities {
      * `testing_backdoors`, which `describe_spine_cross_suites` requires. Gates
      * `describe_fact_serving_cross_tests`' per-reference read model (cell-scoped
      * admit via a viewable cell, cross-owner-dedup-no-leak, 404-mask),
-     * `describe_cell_ref_admission_cross_tests`, and the fact cases of the
+     * `describe_cell_ref_admission_cross_tests` (its grant, item, and clone
+     * cases with `cell_relations`), and the fact cases of the
      * moderation suite. Like cells, the serve route stays off the standard
      * declared surface. The admin bare-hash route is its own flag,
      * `fact_serving_admin_hash`.

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,mBAAmB,CAAC,CAAC;AAEnG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA4BpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAkD9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,IAAI,CACjC,mBAAmB,EACjB,IAAI,GACJ,KAAK,GACL,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,yBAAyB,GACzB,OAAO,GACP,cAAc,GACd,oBAAoB,GACpB,eAAe,CACjB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,mBAAmB,EAAE,SAAS,GAAG,mBAAmB,CAAC,CAAC;AAEnG;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBA4BpC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAuTF,CAAC"}
+{"version":3,"file":"cell_gated_create.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_gated_create.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAuE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E,eAAO,MAAM,sCAAsC,GAClD,SAAS,uCAAuC,KAC9C,IAwkBF,CAAC"}

package/dist/testing/cross_backend/cell_gated_create.js

@@ -14,9 +14,10 @@ import '../assert_dev_env.js';
  * `create_test_cell_gated_create_authorize`, the Rust `testing_spine_stub` via
  * `TestCellGatedCreateAuthorize`): admin bypasses; a non-admin creating a
  * `kind: 'space'` **root** is denied (admin-only); a **contribution** under a
- * space is gated by the space's `data.policy[kind] = {min_role, moderation_required}`,
- * with the moderation outcome folded into the verdict; plain parentless creates
- * stay open. The suite asserts all spines agree on:
+ * space is gated by the space's `policy[kind] = {min_role, moderation_required}`
+ * (the root's manage-tier `policy` column), with the moderation outcome folded
+ * into the verdict; plain parentless creates stay open. The suite asserts all
+ * spines agree on:
  *
  * - **root-create admin-only** — a non-admin `space` root → **403**
  *   `cell_create_forbidden`; admin → succeeds.
@@ -37,6 +38,15 @@ import '../assert_dev_env.js';
  * - **clone is no side door** — `cell_clone` runs the authorizer for every cell
  *   it writes as a parentless create, so a non-admin clone of a viewable
  *   `space` root → **403** `cell_create_forbidden`; admin → succeeds.
+ * - **the root policy is the manager's** — `cell_policy_set` writes it (the new
+ *   and the previous policy audited), answers an editor-grant holder **403**
+ *   `cell_policy_manage_only` and a non-viewer the 404 mask, refuses a
+ *   contribution `cell_policy_root_only` (as `cell_create` refuses a policy
+ *   beside a `parent_id`), and passes each policy through the authorizer's
+ *   validation (`cell_policy_invalid`); an editor rewriting the root's
+ *   `data.policy` leaves moderation as the column says. The refusal with no
+ *   authorizer mounted (`cell_policy_unsupported`) can't run here — both spines
+ *   mount one — and is pinned in-process on each.
  *
  * Gated on `capabilities.cell_gated_create` — `true` only on the reference
  * spine binaries that mount the policy, so it skips for generic consumers and
@@ -46,7 +56,9 @@ import '../assert_dev_env.js';
  * @module
  */
 import { describe, assert } from 'vitest';
-import { CellCreateOutput } from '../../auth/cell_action_specs.js';
+import { CellCreateOutput, CellGetOutput, CellPolicySetOutput, CellUpdateOutput } from '../../auth/cell_action_specs.js';
+import { CellGrantCreateOutput } from '../../auth/cell_grant_action_specs.js';
+import { list_audit_events } from './audit_cross_helpers.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call, error_reason, expect_output } from './cross_rpc.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -61,7 +73,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             const denied = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {} }, stranger.create_session_headers());
             assert.ok(!denied.ok, 'a non-admin must not create a space root');
             assert.strictEqual(error_reason(denied), 'cell_create_forbidden');
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             assert.strictEqual(space.cell.kind, SPACE_CELL_KIND, 'admin creates the space root');
             assert.strictEqual(space.cell.parent_id, null, 'a root is parentless');
             assert.strictEqual(space.cell.root_id, null, 'a root has no governing root');
@@ -69,7 +81,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a contribution under a public space: unauthorized → 403, participant → allowed', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             // A non-participant sees the public space but can't contribute → 403.
             const stranger = await fixture.create_account({ username: 'post_stranger' });
             const forbidden = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
@@ -86,7 +98,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'moderation is set per `moderation_required` (post → pending+private, react → approved)', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'mod_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -103,7 +115,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a hidden (private) space is 404-masked (not 403)', async () => {
             const fixture = await setup_test();
             // A private space — only admin/owner can view it.
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'private' }, fixture.create_session_headers()), CellCreateOutput);
             const stranger = await fixture.create_account({ username: 'hidden_stranger' });
             const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, stranger.create_session_headers());
             assert.ok(!masked.ok, 'a stranger must not contribute under a hidden space');
@@ -111,14 +123,14 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         });
         test_if(capabilities.cell_gated_create, 'a deep contribution (comment under a post) resolves policy from the governing root, not the parent', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'deep_participant',
                 roles: [PARTICIPATION_ROLE]
             });
             // A post lives directly under the space — the shallow case
-            // (`root_id === parent_id`), so the handler reuses the parent row as
-            // `root_data`. The post is gated `moderation_required: true`, so it's
+            // (`root_id === parent_id`), so the handler reuses the parent row's
+            // `policy`. The post is gated `moderation_required: true`, so it's
             // born pending + private; the author can still view their own pending
             // cell, so it's a valid parent for the comment below.
             const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
@@ -127,7 +139,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             // `root_id !== parent_id`, so the handler must read the governing
             // root (the space) *through* the post (the separate in-tx root read),
             // and the authorizer must resolve `policy.comment` from the SPACE's
-            // data, not the post's. This is the only case that exercises the
+            // policy, not the post's. This is the only case that exercises the
             // deep-read branch on both spines.
             const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: post.cell.id }, participant.create_session_headers()), CellCreateOutput);
             assert.strictEqual(comment.cell.parent_id, post.cell.id, 'the immediate parent is the post');
@@ -137,7 +149,7 @@ export const describe_cell_gated_create_cross_tests = (options) => {
         test_if(capabilities.cell_gated_create, 'a contribution under a soft-deleted root is 404 cell_not_found (the missing-parent shape)', async () => {
             const fixture = await setup_test();
             const admin_headers = fixture.create_session_headers();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
             const participant = await fixture.create_account({
                 username: 'tombstone_participant',
                 roles: [PARTICIPATION_ROLE]
@@ -155,5 +167,89 @@ export const describe_cell_gated_create_cross_tests = (options) => {
             const missing_parent = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: '00000000-0000-4000-8000-000000000000' }, participant_headers);
             assert.deepStrictEqual(refused.error, missing_parent.error);
         });
+        describe('cell root policy parity', () => {
+            test_if(capabilities.cell_gated_create, 'a root takes a policy at create and through cell_policy_set, audited old and new', async () => {
+                const fixture = await setup_test();
+                const admin_headers = fixture.create_session_headers();
+                const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+                assert.deepStrictEqual(space.cell.policy, TEST_SPACE_POLICY, 'the create stores the policy');
+                // Any viewer reads it.
+                const stranger = await fixture.create_account({ username: 'policy_reader' });
+                const read = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: space.cell.id }, stranger.create_session_headers()), CellGetOutput);
+                assert.deepStrictEqual(read.cell.policy, TEST_SPACE_POLICY);
+                const opened = { post: { min_role: PARTICIPATION_ROLE, moderation_required: false } };
+                const set = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: opened }, admin_headers), CellPolicySetOutput);
+                assert.deepStrictEqual(set.cell.policy, opened);
+                const participant = await fixture.create_account({
+                    username: 'policy_participant',
+                    roles: [PARTICIPATION_ROLE]
+                });
+                const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: space.cell.id }, participant.create_session_headers()), CellCreateOutput);
+                assert.strictEqual(post.cell.moderation, 'approved', 'the new policy governs');
+                assert.strictEqual(post.cell.policy, null, 'a contribution carries no policy');
+                const cleared = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: null }, admin_headers), CellPolicySetOutput);
+                assert.strictEqual(cleared.cell.policy, null);
+                const events = await list_audit_events(fixture, { event_type: 'cell_policy_set' }, rpc_path);
+                assert.deepStrictEqual(events.map((e) => e.metadata).reverse(), [
+                    { cell_id: space.cell.id, policy: opened, previous_policy: TEST_SPACE_POLICY },
+                    { cell_id: space.cell.id, policy: null, previous_policy: opened }
+                ], 'each set is audited with the policy it wrote and the one it replaced');
+            });
+            test_if(capabilities.cell_gated_create, 'a policy is root-only and must pass the authorizer', async () => {
+                const fixture = await setup_test();
+                const admin_headers = fixture.create_session_headers();
+                const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, admin_headers), CellCreateOutput);
+                const react = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id }, admin_headers), CellCreateOutput);
+                const on_contribution = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: react.cell.id, policy: TEST_SPACE_POLICY }, admin_headers);
+                assert.ok(!on_contribution.ok);
+                assert.strictEqual(error_reason(on_contribution), 'cell_policy_root_only');
+                const beside_parent = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'react', data: {}, parent_id: space.cell.id, policy: TEST_SPACE_POLICY }, admin_headers);
+                assert.ok(!beside_parent.ok);
+                assert.strictEqual(error_reason(beside_parent), 'cell_policy_root_only');
+                for (const bad of [
+                    { post: true },
+                    { post: { min_role: 1 } },
+                    { post: { other: true } }
+                ]) {
+                    const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: space.cell.id, policy: bad }, admin_headers);
+                    assert.ok(!refused.ok, JSON.stringify(bad));
+                    assert.strictEqual(error_reason(refused), 'cell_policy_invalid', JSON.stringify(bad));
+                    const refused_create = await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: bad }, admin_headers);
+                    assert.strictEqual(error_reason(refused_create), 'cell_policy_invalid', JSON.stringify(bad));
+                }
+            });
+            test_if(capabilities.cell_gated_create, "an editor-grant holder can't change a root's policy, through the verb or through data", async () => {
+                const fixture = await setup_test();
+                // A non-admin's root (a parentless non-`space` kind is open), its
+                // policy moderating posts.
+                const owner = await fixture.create_account({ username: 'policy_owner' });
+                const owner_headers = owner.create_session_headers();
+                const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, owner_headers), CellCreateOutput);
+                const editor = await fixture.create_account({ username: 'policy_editor' });
+                expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                    cell_id: root.cell.id,
+                    level: 'editor',
+                    principal: { kind: 'actor', actor_id: editor.actor.id }
+                }, owner_headers), CellGrantCreateOutput);
+                const editor_headers = editor.create_session_headers();
+                const opened = { post: { min_role: PARTICIPATION_ROLE, moderation_required: false } };
+                const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: root.cell.id, policy: opened }, editor_headers);
+                assert.ok(!refused.ok, 'an editor must not set the policy');
+                assert.strictEqual(error_reason(refused), 'cell_policy_manage_only');
+                // The editor may rewrite `data` — a `data.policy` is just content.
+                const edited = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_update', { cell_id: root.cell.id, data: { policy: opened } }, editor_headers), CellUpdateOutput);
+                assert.deepStrictEqual(edited.cell.policy, TEST_SPACE_POLICY, 'a data write leaves the policy');
+                const participant = await fixture.create_account({
+                    username: 'policy_poster',
+                    roles: [PARTICIPATION_ROLE]
+                });
+                const post = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'post', data: {}, parent_id: root.cell.id }, participant.create_session_headers()), CellCreateOutput);
+                assert.strictEqual(post.cell.moderation, 'pending', "moderation follows the root's policy column, not its `data.policy`");
+                // Someone who can't view a private root gets the mask.
+                const hidden = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY }, owner_headers), CellCreateOutput);
+                const masked = await cross_rpc_call(fixture.transport, rpc_path, 'cell_policy_set', { cell_id: hidden.cell.id, policy: opened }, editor_headers);
+                assert.strictEqual(error_reason(masked), 'cell_not_found');
+            });
+        });
     });
 };

package/dist/testing/cross_backend/cell_moderate.d.ts

@@ -2,7 +2,8 @@ import '../assert_dev_env.js';
 import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
 /**
  * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
+ * approved | rejected` decision and the `approved → rejected` takedown) —
+ * root-authority-gated.
  *
  * Builds a moderated public space (admin) + a `participant`'s `post` (born
  * `pending` + private under the `moderation_required: true` policy), then
@@ -20,6 +21,11 @@ import type { RpcPathCapabilityGatedCrossSuiteOptions } from './setup.js';
  * - **a cell with no governing root** → `400 cell_not_a_contribution` for any
  *   viewer (owner, admin), the cell left unmoderated; a non-viewer gets the
  *   `cell_not_found` mask first.
+ * - **approval needs a pending contribution, rejection a pending or approved
+ *   one** → else `400 cell_not_pending`, the cell left as it was: a root owner
+ *   a private, born-approved contribution was shared with can't publish it by
+ *   "approving" it; an approved post is not approved again but can be taken
+ *   down (rejected, visibility untouched); a rejected post is final.
  *
  * And that moderation gates reads — a cell's effective audience is its
  * visibility or grants **and** its moderation admission (unmoderated or

package/dist/testing/cross_backend/cell_moderate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_moderate.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_moderate.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IA69BF,CAAC"}
+{"version":3,"file":"cell_moderate.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_moderate.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA+B9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAQ1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,eAAO,MAAM,kCAAkC,GAC9C,SAAS,uCAAuC,KAC9C,IAunCF,CAAC"}

package/dist/testing/cross_backend/cell_moderate.js

@@ -23,7 +23,8 @@ import { SPINE_RPC_PATH } from './spine_surface_constants.js';
 import { PARTICIPATION_ROLE, SPACE_CELL_KIND, TEST_SPACE_POLICY } from './test_cell_gated_create_authorize.js';
 /**
  * Cross-backend parity for the **`cell_moderate` verb** (the `pending →
- * approved | rejected` transition) — root-authority-gated.
+ * approved | rejected` decision and the `approved → rejected` takedown) —
+ * root-authority-gated.
  *
  * Builds a moderated public space (admin) + a `participant`'s `post` (born
  * `pending` + private under the `moderation_required: true` policy), then
@@ -41,6 +42,11 @@ import { PARTICIPATION_ROLE, SPACE_CELL_KIND, TEST_SPACE_POLICY } from './test_c
  * - **a cell with no governing root** → `400 cell_not_a_contribution` for any
  *   viewer (owner, admin), the cell left unmoderated; a non-viewer gets the
  *   `cell_not_found` mask first.
+ * - **approval needs a pending contribution, rejection a pending or approved
+ *   one** → else `400 cell_not_pending`, the cell left as it was: a root owner
+ *   a private, born-approved contribution was shared with can't publish it by
+ *   "approving" it; an approved post is not approved again but can be taken
+ *   down (rejected, visibility untouched); a rejected post is final.
  *
  * And that moderation gates reads — a cell's effective audience is its
  * visibility or grants **and** its moderation admission (unmoderated or
@@ -102,7 +108,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     // participant's pending post under it, optionally carrying a fact the
     // author put.
     const setup_pending_post_on = async (fixture, post_fact_content) => {
-        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+        const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'moderate_author',
             roles: [PARTICIPATION_ROLE]
@@ -118,7 +124,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     // put.
     const setup_stewarded_post_on = async (fixture, post_fact_content) => {
         const root_owner = await fixture.create_account({ username: 'steward_root_owner' });
-        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
+        const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
         const author = await fixture.create_account({
             username: 'steward_author',
             roles: [PARTICIPATION_ROLE]
@@ -208,6 +214,64 @@ export const describe_cell_moderate_cross_tests = (options) => {
             assert.strictEqual(got.cell.moderation, null);
             assert.strictEqual(got.cell.visibility, 'private');
         });
+        test_if(capabilities.cell_gated_create, 'a root owner shown a private approved contribution cannot publish it → 400 cell_not_pending', async () => {
+            // the contribution is approved at birth (`comment` is unmoderated
+            // under the policy), so it was never pending; its author shares it
+            // with the root owner, who "approves" it
+            const fixture = await setup_test();
+            const root_owner = await fixture.create_account({ username: 'not_pending_root_owner' });
+            const root = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'forum', data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, root_owner.create_session_headers()), CellCreateOutput);
+            const author = await fixture.create_account({
+                username: 'not_pending_author',
+                roles: [PARTICIPATION_ROLE]
+            });
+            const author_h = author.create_session_headers();
+            const comment = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: 'comment', data: {}, parent_id: root.cell.id, visibility: 'private' }, author_h), CellCreateOutput);
+            assert.strictEqual(comment.cell.moderation, 'approved', 'born approved');
+            expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_grant_create', {
+                cell_id: comment.cell.id,
+                level: 'viewer',
+                principal: { kind: 'actor', actor_id: root_owner.actor.id }
+            }, author_h), CellGrantCreateOutput);
+            const refused = await cross_rpc_call(fixture.transport, rpc_path, 'cell_moderate', { cell_id: comment.cell.id, moderation: 'approved' }, root_owner.create_session_headers());
+            assert.ok(!refused.ok, 'an approved contribution is not approved again');
+            assert.strictEqual(refused.error?.code, JSONRPC_ERROR_CODES.invalid_params);
+            assert.strictEqual(error_reason(refused), 'cell_not_pending');
+            const after = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id: comment.cell.id }, author_h), CellGetOutput).cell;
+            assert.strictEqual(after.visibility, 'private', 'the refusal publishes nothing');
+            assert.strictEqual(after.moderation, 'approved');
+            assert.strictEqual(await outcome(fixture, 'cell_get', { id: comment.cell.id }, null), 'cell_not_found', 'still hidden from anon');
+        });
+        test_if(capabilities.cell_gated_create, 'approval needs a pending post, rejection a pending or approved one → else 400 cell_not_pending', async () => {
+            const try_moderate = async (fixture, cell_id, moderation) => outcome(fixture, 'cell_moderate', { cell_id, moderation }, fixture.create_session_headers());
+            const state = async (fixture, id) => {
+                const { cell } = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_get', { id }, fixture.create_session_headers()), CellGetOutput);
+                return [cell.moderation, cell.visibility];
+            };
+            // approved: approving again is refused; the takedown is not
+            {
+                const { fixture, post } = await setup_pending_post();
+                await moderate(fixture, post.cell.id, 'approved');
+                assert.strictEqual(await try_moderate(fixture, post.cell.id, 'approved'), 'cell_not_pending', 'approved, approve');
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['approved', 'public']);
+                assert.strictEqual(await try_moderate(fixture, post.cell.id, 'rejected'), 'ok', 'approved, reject');
+                // rejected is terminal
+                for (const again of ['approved', 'rejected']) {
+                    assert.strictEqual(await try_moderate(fixture, post.cell.id, again), 'cell_not_pending', `taken down, ${again}`);
+                }
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['rejected', 'public']);
+            }
+            // rejected from pending: neither decision moves it
+            {
+                const { fixture, post } = await setup_pending_post();
+                await moderate(fixture, post.cell.id, 'rejected');
+                for (const again of ['approved', 'rejected']) {
+                    assert.strictEqual(await try_moderate(fixture, post.cell.id, again), 'cell_not_pending', `rejected, ${again}`);
+                }
+                assert.deepStrictEqual(await state(fixture, post.cell.id), ['rejected', 'private']);
+                assert.strictEqual(await outcome(fixture, 'cell_get', { id: post.cell.id }, null), 'cell_not_found');
+            }
+        });
     });
     describe('moderation gates reads (parity)', () => {
         test_if(capabilities.cell_gated_create, 'a pending post its author flips public stays hidden past the author and admins', async () => {
@@ -493,7 +557,7 @@ export const describe_cell_moderate_cross_tests = (options) => {
     describe('cell_clone runs the creation authorizer (parity)', () => {
         test_if(capabilities.cell_gated_create, 'a non-admin clone of a viewable `space` root → 403, admin clone succeeds', async () => {
             const fixture = await setup_test();
-            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
+            const space = expect_output(await cross_rpc_call(fixture.transport, rpc_path, 'cell_create', { kind: SPACE_CELL_KIND, data: {}, policy: TEST_SPACE_POLICY, visibility: 'public' }, fixture.create_session_headers()), CellCreateOutput);
             // Every cell a clone writes is a parentless create of the source's
             // kind, gated like `cell_create` — so a caller denied a `space` root
             // can't clone one they can see into one they own.

package/dist/testing/cross_backend/cell_ref_admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ref_admission.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_ref_admission.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AA6B1E,eAAO,MAAM,uCAAuC,GACnD,SAAS,uCAAuC,KAC9C,IA8eF,CAAC"}
+{"version":3,"file":"cell_ref_admission.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_ref_admission.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwD9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AA6B1E,eAAO,MAAM,uCAAuC,GACnD,SAAS,uCAAuC,KAC9C,IA2fF,CAAC"}