The cell.moderation read rules, in pure and SQL form side by side.
moderation is free TEXT with no CHECK, so each rule is an allowlist over
the literals: a marker this module doesn't name (a typo, a future state)
admits nothing.
Audience admission — cell_moderation_admits_audience and
cell_moderation_admits_audience_sql: unmoderated (null) or 'approved'.
A cell's effective audience is its visibility (or grants) and its
admission, so the public and grant read arms of can_view_cell require it,
as do the editor grant arm of can_edit_cell and the matching arms of
query_cell_list (general and shared_with shapes). The owner and
global-admin arms don't: an author keeps reading and editing their own
pending or rejected contribution, and an admin reads everything.
Stewardship — cell_moderation_is_stewardable and
cell_moderation_is_stewardable_sql: exactly 'pending' or 'rejected', the
states in which the governing root's manager reads a contribution its
audience can't (can_steward_cell). An unknown marker is neither admitted
nor stewardable, so only its owner and admins read it.
The pure and SQL forms are written once each here, next to each other, over
the same literal constants; every predicate and query composes them rather
than restating the rule. Twin of the Rust fuz_cell::cell_moderation.