test(plugin-approvals): judge the #14946 fake engine's find bound by presence; re-anchor the system-context page; ledger the new pin file

- the fake engine's `find` no longer reads `this` (the objectql-double-limit
  probe calls it unbound) and applies the caller's bound after the filter, by
  presence, instead of a default page of 1000
- content/docs/permissions/system-context.mdx: six approval-service.ts line
  anchors re-aimed by +57, the net insertion of the businessUnitMemberScope
  docblock above them (check-system-context-census --fix)
- engine-double-contract ledger learns business-unit-member-org-screen.test.ts

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Author: claude

content/docs/permissions/system-context.mdx

@@ -145,7 +145,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 40 | **Approval record lock released** — a locked record is writable | plugin-approvals | Get: engine self-writes (the status mirror) pass. Lose: the lock that stops edits while an approval is live. Note there is deliberately **no admin exemption** here — only `isSystem` | `lifecycle-hooks.ts:347` |
 | 41 | Delegation write guard bypassed | plugin-approvals | Get: service / seed / import may write delegation rows naming another delegator | `lifecycle-hooks.ts:570` |
-| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:963`, `:1072`, `:3248`, `:3396`, `:3564`, `:3635`, `:3824`, `:3864` |
+| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:963`, `:1072`, `:3305`, `:3453`, `:3621`, `:3692`, `:3881`, `:3921` |
 | 43 | Saved-report ownership is **assignable**, and an update may reassign it | plugin-reports | Get: `ownerId` from input is honoured. A non-system caller always owns what it creates and can never reassign | `plugin-reports/src/report-service.ts:404`, `:425` |
 | 44 | Saved-report access / export / mutation gates bypassed | plugin-reports | Get: read, bulk-export and overwrite any report | `plugin-reports/src/report-service.ts:343`, `:372`, `:447`, `:684` |
 | 45 | Attachment access hooks return early (insert + update + delete, and the read AST) | service-storage | Lose: attachment visibility scoping | `attachment-access-hooks.ts:300`, `:349`, `:448`, `:524` |

packages/plugins/plugin-approvals/src/business-unit-member-org-screen.test.ts

@@ -76,14 +76,17 @@ function makeFakeEngine() {
     }
     return true;
   }
+  /** Every `find` anyone made, with its options — pins the predicate SHAPE (B5). */
+  const finds: Array<{ object: string; options: any }> = [];
   return {
     _tables: tables,
-    /** Every `find` anyone made, with its options — pins the predicate SHAPE (B5). */
-    _finds: [] as Array<{ object: string; options: any }>,
+    _finds: finds,
     async find(object: string, options?: any) {
-      this._finds.push({ object, options });
+      finds.push({ object, options });
       const rows = ensure(object).filter(r => matches(r, options?.filter ?? options?.where));
-      return rows.slice(0, options?.limit ?? 1000);
+      // The caller's bound, applied AFTER the filter and by PRESENCE — the
+      // shape `check:objectql-double-limit` holds every ObjectQL double to.
+      return typeof options?.limit === 'number' ? rows.slice(0, options.limit) : rows;
     },
     async insert(object: string, data: any) { ensure(object).push({ ...data }); return { ...data }; },
     async update(object: string, data: any, options?: any) {

scripts/engine-double-contract.pinned.json

@@ -2131,6 +2131,16 @@
       "verb": "update",
       "pinned": 1
     },
+    {
+      "file": "packages/plugins/plugin-approvals/src/business-unit-member-org-screen.test.ts",
+      "verb": "delete",
+      "pinned": 1
+    },
+    {
+      "file": "packages/plugins/plugin-approvals/src/business-unit-member-org-screen.test.ts",
+      "verb": "update",
+      "pinned": 1
+    },
     {
       "file": "packages/plugins/plugin-approvals/src/decision-strand-envelope.test.ts",
       "verb": "delete",