testing/cross_backend/cell_moderate.ts

Cross-backend parity for the cell_moderate verb (the `pending → approved | rejected decision and the approved → rejected` takedown) — root-authority-gated.

Builds a moderated public space (admin) + a participant's post (born pending + private under the moderation_required: true policy), then proves both spines agree:

• a root manager (admin) approves → moderation: 'approved' + visibility: 'public' (the contribution goes live).
• the author cannot self-approve → 403 cell_moderate_forbidden (the author can *view* their own pending cell, so they reach the gate, and are denied — moderation authority is over the governing root, not the contribution).
• a non-viewer is 404-masked → a stranger who can't see the pending contribution gets cell_not_found, never learns it exists.
• reject → moderation: 'rejected', visibility stays private.
• a cell with no governing root → 400 cell_not_a_contribution for any viewer (owner, admin), the cell left unmoderated; a non-viewer gets the cell_not_found mask first.
• approval needs a pending contribution, rejection a pending or approved one → else 400 cell_not_pending, the cell left as it was: a root owner a private, born-approved contribution was shared with can't publish it by "approving" it; an approved post is not approved again but can be taken down (rejected, visibility untouched); a rejected post is final.

And that moderation gates reads — a cell's effective audience is its visibility or grants and its moderation admission (unmoderated or approved), so a pending or rejected contribution reaches no one past its author and admins:

• an author's self-flip to public admits nobody — a pending post its author makes public stays 404 to anon and a fresh non-admin on cell_get, and out of their cell_list; the author and admin still read it.
• rejection holds a public post back — pending → rejected → public, and approved → rejected (approval made it public, rejection leaves visibility alone), both 404 past the author; a grant made while the post was approved stops admitting once it is rejected, on cell_get and shared_with: 'me'.
• an approved post is live — the control.
• relation reads follow — a pending post in a public collection is omitted from anon cell_item_list, beside a live sibling that isn't; at the far end of all four relation lists, a pending post is hidden from anon even flipped public, and a rejected one from its grant holder.
• fact serving follows — a pending post's fact is 404 to anon, even with the post flipped public (also gated on capabilities.fact_serving).

And the steward arm — the owner of a non-admin root (a parentless non-space kind carrying the same policy, which the test authorizer leaves open) reads the pending posts under it and moderates them:

• the queue — cell_list({root_id, moderation: 'pending'}) and cell_get (with can_edit / can_grant false) → 200; a stranger 404s.
• moderation — the root owner approves → 200; the author 403, a stranger 404.
• the arm stops there — the root owner's cell_clone of the pending post and a contribution under it are both 404.
• fact serving — the root owner fetches a pending post's fact → 200, anon 404 (also gated on capabilities.fact_serving).

And that cell_grant_create refuses a pending contribution — 403 cell_grant_unapproved for its author and an admin, actor- and role-shaped, while a non-manager keeps the 404 mask; the same grant lands once the post is approved.

Gated on capabilities.cell_gated_create — a pending contribution only exists when the directory authorizer is mounted (reference spine binaries).