test(plugin-auth): route the gate pin's findOne double through the engine predicate; record the new pinned doubles

check:engine-double-contract asks a new findOne double to route through
assertEngineFindOnePredicate and the RETAINED ledger to learn the three new
pinned (file, verb) rows (node scripts/check-engine-double-contract.mjs --write).

Claude-Session: https://claude.ai/code/session_01WkL6Eijt432S1Y7ekb6ovQ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-auth/src/default-org-bootstrap-once.test.ts

@@ -30,7 +30,7 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import { resetPlatformAdminEmailMemo } from '@objectstack/core';
-import { assertEngineUpdateDispatch } from '@objectstack/objectql';
+import { assertEngineFindOnePredicate, assertEngineUpdateDispatch } from '@objectstack/objectql';
 import {
   ensureDefaultOrganization,
   type EnsureDefaultOrganizationOptions,
@@ -87,9 +87,11 @@ function rig(seed: Partial<Record<string, Row[]>> = {}) {
       const rows = (tables[object] ?? []).filter((r) => matches(r, query?.where));
       return rows.slice(0, query?.limit ?? rows.length);
     }),
-    findOne: vi.fn(async (object: string, query: any) =>
-      (tables[object] ?? []).find((r) => r.id === query?.where?.id) ?? null,
-    ),
+    findOne: vi.fn(async (object: string, query: any) => {
+      // Pinned to ObjectQL.findOne's predicate contract (the ledger reads by id).
+      assertEngineFindOnePredicate(object, query);
+      return (tables[object] ?? []).find((r) => r.id === query?.where?.id) ?? null;
+    }),
     insert: vi.fn(async (object: string, data: Row) => {
       if (object === 'sys_migration') {
         ledgerInserts.push(data);

scripts/engine-double-contract.pinned.json

@@ -2436,6 +2436,11 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/plugins/organizations/src/walled-default-org-owner-bind-in-flight.pin.test.ts",
+      "verb": "findOne",
+      "pinned": 1
+    },
     {
       "file": "packages/plugins/plugin-approvals/src/admin-exemption-retired.test.ts",
       "verb": "delete",
@@ -2776,6 +2781,16 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/plugins/plugin-auth/src/default-org-bootstrap-once.test.ts",
+      "verb": "findOne",
+      "pinned": 1
+    },
+    {
+      "file": "packages/plugins/plugin-auth/src/default-org-bootstrap-once.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/plugins/plugin-auth/src/durability-swallow-repair.test.ts",
       "verb": "findOne",