docs(changeset): qualify the enforcement claim — unchanged on every reachable input, fail-closed on the two that are not

Clause-② review measured `PermissionEvaluator.resolvePermissionSets` through
this PR's own `dbLoaderFor(ORG)` over a real ObjectQL/SqlDriver, at HEAD and at
the merge-base blob, on five engine conditions. A healthy page, a thrown read
and `undefined` resolve identically before and after — every result the shipped
engine actually produces. An envelope and a page carrying a non-object element
do NOT: they granted at base and refuse at HEAD.

Both are fail-closed and both are unreachable on the measured engine, which is
what the eleven pins establish, so this is a declared narrowing rather than a
discovered move — but "unchanged in both directions" is an unqualified claim
about behaviour and it sits in the changeset, which feeds release notes. The
reviewer's wording replaces it verbatim.

⛔ No source change: the refusal itself was reviewed and passed exactly as it
stands. Changeset and PR body carry identical wording.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Author: os-warren

.changeset/quiet-pans-repair.md

@@ -6,4 +6,4 @@ Remove seven dead `{ records }` union-normalizer limbs on engine `find()` result
 
 Six seams in this plugin normalized an engine read as `Array.isArray(x) ? x : x.records`. The envelope limb was unreachable: `ObjectQL.find` resolves a bare array of row objects, measured by booting a real engine over a real `SqlDriver` and driving each seam through the shipped function that owns it, rather than inferred from `IDataEngine.find`'s declared `Promise<any[]>` (a declared type is not proof — this repo also has a `find()` that resolves an envelope). Each seam keeps its existing disposition for a non-array; only the dead limb is gone.
 
-The seventh is repaired in the opposite direction. `SecurityPlugin`'s `sys_permission_set` loader mapped three different facts onto one value: a read that succeeded on an empty catalog, a read that threw, and a read that resolved something it could not read all left as `[]`. On the enforcement plane that silently withdraws grants that exist while every request still looks normal, and it made `PermissionEvaluator`'s existing "db lookup failed" warning unreachable — so a transient database error and an empty catalog produced identical, undiagnosable 403s. The loader now lets the read fault propagate and refuses an unreadable result with `DATABASE_ERROR`. Enforcement is unchanged in both directions: an unanswered read still grants nothing. What changes is that it is now reported instead of silent.
+The seventh is repaired in the opposite direction. `SecurityPlugin`'s `sys_permission_set` loader mapped three different facts onto one value: a read that succeeded on an empty catalog, a read that threw, and a read that resolved something it could not read all left as `[]`. On the enforcement plane that silently withdraws grants that exist while every request still looks normal, and it made `PermissionEvaluator`'s existing "db lookup failed" warning unreachable — so a transient database error and an empty catalog produced identical, undiagnosable 403s. The loader now lets the read fault propagate and refuses an unreadable result with `DATABASE_ERROR`. Enforcement is unchanged for every result the shipped engine produces; an envelope or a non-row element now refuses (fail-closed) where the old code read through it. An unanswered read still grants nothing; what changes is that it is now reported instead of silent.