testing/cross_backend/cell_relations.ts

Dedicated cell relation / ACL / audit parity suite for the cross-backend harness — the sibling of describe_cell_crud_cross_tests covering every cell verb beyond plain CRUD: cell_grant_*, cell_field_*, cell_item_*, cell_clone, and cell_audit_list.

Like the CRUD suite (and ws / sse), these verbs are live-mounted on the spine RPC path but stay off the standard declared surface, so the generic describe_rpc_round_trip_tests never drives them. Every success response is parsed against the verb's declared Zod output schema, so a TS↔Rust envelope drift fails the suite — not just a payload-field drift.

Coverage (gated on capabilities.cell_relations):

• grant lifecycle — owner grants an actor-shaped editor; the grantee gains edit (was 404 before the grant); cell_grant_list is manage-tier (owner sees it, the editor gets the IDOR 404); revoke drops the edit path.
• cell_visibility_manage_only — the editor-grant holder can edit content but flipping visibility is 403 (the case the 5-verb CRUD cut couldn't reach without a grant principal).
• fields — cell_field_set UPSERT, forward + reverse cell_field_list, idempotent cell_field_delete.
• items — cell_item_insert at fractional-index positions, forward (lex-ordered) + reverse cell_item_list, cell_item_move, idempotent cell_item_delete.
• clone — shallow copies item / field *edges* (shared child_id / target_id); deep clones each viewable child into a fresh cell at the same position. Both null path and stamp the caller as owner.
• shared_with: 'me' — the grant-driven cell_list branch: a grantee lists exactly the cells that admit them via cell_grant, their own cells excluded, with the cell_grants enrichment keyed by cell id. Plus the two guards — null-auth is cell_list_shared_with_requires_auth, and any value other than 'me' is invalid_params on both spines. The cross twin of the in-process auth/cell_actions.list.db.test.ts §"shared_with: me".
• audit — cell_audit_list is manage-tier: the owner reads the cell's timeline; a viewer-grant holder who can cell_get the cell still gets the IDOR 404 on the timeline (D14).
• relation-read visibility (D8) — listing edges toward a cell the caller can't view filters them out (no-existence-leak-via-edge): an anonymous viewer of a public parent — and a viewer-grant holder of a private parent — sees only independently-viewable children in the cell_get bundle and the forward cell_item_list / cell_field_list. The cross twin of the in-process auth/cell_relation_visibility.db.test.ts.
• clone D8 — a cloner who can view a public parent but not a private child silently drops that child: an admin (who *can* view it) reading the clone still sees only the viewable edge/child, and the cell_clone audit row records no skipped-child count — so the source's hidden-child count can't leak to the cloner. The cross twin of auth/cell_actions.clone.db.test.ts.

Only actor-shaped grants are exercised — role-shaped principals need a closed role registry the Rust spine deliberately lacks, so role-grant parity is out of scope here (the TS impl covers it in-process).

$lib-free by contract (relative specifiers only) so the suite can be imported from the spawnable cross-process test files.