fix(organizations): state the engine doors the plugin forwards to the back-fills

`OrgScopingQuerySlot` named only the three members the plugin calls itself, but
it also FORWARDS the slot: `claimOrphanOrgRows(ql, ...)` writes through that very
value. While the back-fill's parameter was `any` that coupling was invisible to
the types; with the parameter named it is a type error, which is the finding
rather than an obstacle. Extend the slot from `OrgScopingEngine` so it states the
doors it forwards, and require `query` on the engine's `find` so the slot's own
stricter spelling satisfies it.

Regenerate the census artefacts: the recognised engine-shaped type count moves
61 to 63 (corpus scale, dated and unenforced); the certified population is
unchanged at 225.

Claude-Session: https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

content/docs/permissions/tenant-audit-census.mdx

@@ -232,12 +232,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-16 at `737b106f4`.
+Measured on 2026-09-16 at `11daf7f69`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
 | tracked non-test sources scanned | 570 |
-| engine-shaped types recognised | 62 |
+| engine-shaped types recognised | 63 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 146 |
 

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -52,12 +52,12 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-16 at `737b106f4`.
+Measured on 2026-09-16 at `11daf7f69`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
 | tracked non-test sources scanned | 570 |
-| engine-shaped types recognised | 62 |
+| engine-shaped types recognised | 63 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 146 |
 

packages/plugins/organizations/src/org-scoping-engine.ts

@@ -22,7 +22,7 @@
 import type { ServiceObject } from '@objectstack/spec/data';
 
 export interface OrgScopingEngine {
-  find(object: string, query?: any, options?: any): Promise<any>;
+  find(object: string, query: any, options?: any): Promise<any>;
   update(object: string, data: any, options?: any): Promise<any>;
   /**
    * Optional on purpose. "registry unavailable" is a real, tested, logged no-op

packages/plugins/organizations/src/organizations-plugin.ts

@@ -2,6 +2,7 @@
 
 import { Plugin, PluginContext } from '@objectstack/core';
 import { claimOrphanOrgRows } from './claim-orphan-org-rows.js';
+import type { OrgScopingEngine } from './org-scoping-engine.js';
 import { isDefaultOrganizationBootstrapTrigger } from '@objectstack/plugin-auth';
 import { ensureDefaultOrganization } from './ensure-default-organization.js';
 import { assertWalledMembershipPolicyDeclared } from './membership-policy-gate.js';
@@ -66,13 +67,18 @@ export interface OrganizationsPluginOptions {
  * repository types its lookups rather than inheriting a grandfather clause it is
  * not on. Structural rather than the engine's full contract for the same reason
  * `membership-policy-gate.ts` states about ITS probes: this plugin needs three
- * members, the `catch` arms below already treat every one of them as possibly
- * absent, and naming the whole engine interface here would claim a coupling the
- * runtime checks do not make.
+ * members, and the `catch` arms below already treat every one of them as
+ * possibly absent.
+ *
+ * It extends `OrgScopingEngine` because this plugin does not only CALL the slot,
+ * it FORWARDS it: `claimOrphanOrgRows(ql, ...)` below writes through this very
+ * value. While that parameter was `any` the forwarded doors were a coupling the
+ * types did not state and the tenant-audit census could not read. Naming them
+ * here is the narrow claim -- only the doors that are actually forwarded, not
+ * the engine's full contract.
  */
-interface OrgScopingQuerySlot {
+interface OrgScopingQuerySlot extends OrgScopingEngine {
   registerMiddleware(mw: (opCtx: any, next: () => Promise<void>) => Promise<void>): void;
-  find(object: string, query: unknown, options?: unknown): Promise<any>;
   getSchema?(object: string): any;
 }