docs(changeset): correct the share-link refusal log-volume sentence (#14668) (#14764)

The changeset for the #14033 redemption-time `publicSharing.enabled` hold
said the refusal "will burst the log once". Its own first half contradicts
that: per-hit and unlatched is precisely the property that means the volume
does NOT occur once.

Measured at the emitting site — `packages/plugins/plugin-sharing/src/
share-link-service.ts:697-708`, the `if (!policy.enabled)` arm of
`resolveToken()`: an unconditional `this.logger?.warn?.(…)` followed by
`return null`, with no latch, no `Set`, no memo and no sampling anywhere in
the path. The only latch in the file is `usageStampRefusalReported`, which
guards the unrelated #12981 usage-stamp degradation. `resolveToken` is
called once per HTTP redemption (`share-link-routes.ts:233` and `:317`)
with no cache or rate limit in front of it, so the line count tracks the
refused-hit rate and does not decay.

Prose only. The frontmatter, the level, the BREAKING banner and every
surrounding paragraph are byte-identical; the per-hit behaviour is ruled
and is NOT changed.


Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.changeset/share-link-enabled-at-redemption.md

@@ -64,6 +64,8 @@ Minting is unchanged: `createLink` still refuses `SHARING_NOT_ENABLED` for an
 ordinary caller, and the system / `permissive` bypass still mints — what it
 mints simply does not serve until the block is on. The refusal logs one `warn`
 line per refused hit and is not latched, so a retroactive deploy with many live
-links on switched-off objects will burst the log once.
+links on switched-off objects does not burst the log once and subside: the
+volume tracks traffic, one line per refused hit, for as long as requests keep
+reaching those links — until the block is re-enabled or the links are revoked.
 
 <!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, its type, its default and its accept-set, and the change is WHEN the platform holds it. There is therefore no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform — a deployment whose links stop resolving must decide whether the block should be on at all, which is an authoring decision no ledger entry can make on its behalf. -->