testing/cross_backend/fact_serving.ts

Cross-backend fact-serving parity suite — the per-reference (cell-scoped) read model over real HTTP.

Re-proves the D1 fact-access cases (docs/security.md § Fact Access Control) against each backend's real auth resolution, twinning fuz_app's server/serve_fact_route.ts and the Rust fuz_fact_serving routers:

• cell-scoped admit — anon reads a fact through a viewable (public) referencing cell → 200 + bytes;
• cross-owner dedup does not leak — A's *private* reference to bytes that B *also* publishes from a *public* cell stays 404 for everyone but A, even though the identical bytes are world-readable via B's cell (one deduped fact row; authz lives on the (cell, hash) edge, never unioned);
• 404-mask — a missing cell and a viewable cell that doesn't reference the hash both 404 (never 403, never "exists elsewhere");
• bare-hash admin-only — GET /api/facts/:hash is admin (keeper) only: non-admin → 403, anonymous → 401;
• multi-actor fallthrough — a multi-actor caller resolves to a null (anonymous) context on the (acting-less) cell-scoped route, so it can't read its own *private* fact there (admitted only by public cells). Opt-in (needs the multi-actor setup); every spine resolves the acting actor at the dispatcher's authorization phase from account-grain credentials, so the multi-actor account is drivable on TS and Rust alike.

Facts are seeded embedded via _testing_put_fact (the cross-process driver has no DB handle); the referencing cell via the cell_create RPC (extract_refs lifts the blake3: hash in data into cell.refs). Gated on capabilities.fact_serving; runs under every cross_backend_* project — the TS spine binary and the Rust testing_spine_stub both mount the serve routes + the seeder.

$lib-free by contract (relative specifiers only) so it imports from the spawnable cross-process test files.