auth/cell_steward.ts

The steward read arm, with the governing-root load it needs.

can_steward_cell (auth/cell_authorize.ts) is pure over (auth, cell, root); cell_steward_admits is the composition every steward site runs after can_view_cell denies: it loads the governing root (active rows only, so a soft-deleted root stewards nothing) and applies the predicate. It short-circuits with no query unless the caller is authenticated and the cell is a pending or rejected contribution.

Where the steward arm applies — the surfaces a moderator works from: cell_get, cell_moderate (whose root-authority check it lets a non-admin root owner reach), the cell-scoped fact route, and cell_list's general predicate (the SQL twin in query_cell_list).

Where it must not — every other read keeps can_view_cell alone: cell_clone (a steward copying a contribution out from under its moderation), the parent check on cell_create (a steward contributing under a pending post), the relation endpoint gates, filter_visible_target_ids (the cell_get bundle), the field / item lists' SQL view filter (db/cell_view_sql.ts), cell_list's shared_with semi-join (a grant footprint, not a moderation queue), and cell_grant_revoke's still_admitted recompute. Widening one of these is a decision, not a sweep. Twin of the Rust fuz_cell::cell_steward.