docs(changeset): declare the #27277 and #27425 changesets as Clause-② yes (narrowing) (#27671)

<!-- claude-projects-attribution: {"github_login":"marchtian"} -->
_Requested by **田騏** · [project
thread](https://claude.ai/code/project/chan_01VmuUhXU9SSUzqJYyXSmYSi?thread=cmsg_01VmuUhXU9SSUzqJYyXSmYSiVy7F2atKWpo5rp3YPrqddh)_

Epic #27261 follow-up, owed by two post-landing contract reviews. Both
pending changesets get the declaration arm their reviews named, before
the next release consumes them.

- `.changeset/27277-plugin-driver-floor.md` (PR #27403): `Clause-②: yes`
→ `yes (narrowing)`. The diff added two ledger codes (widening) and
narrowed the accept set on plugin-driver external datasources. Review
record 6502877381, ② should-fix.
- `.changeset/27425-phantom-owner-anchor-fails-closed.md` (PR #27476):
`no (narrowing)` → `yes (narrowing)`, and "Nothing is widened" becomes a
sentence naming the one widened accept set (`grant()` on a federated
object that maps `owner_id` through `external.columnMap`). Review record
6493803142, ② and ④ should-fix 2; seat ruling 6502747580.

Only changeset prose changes; no code, schema or level changes. Both
diffs' faces were reviewed at `CONTRACT_REVIEW_TIER` with PASS on their
landed heads.

Clause-②: no
Metadata-protocol: none

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_017ihL2c5z3q4h8inrn5kwqV

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/27277-plugin-driver-floor.md

@@ -5,7 +5,7 @@
 
 fix(objectql)!: a plugin driver on an external datasource answers every read correctly or refuses: the engine applies the whole query to the rows the driver returns, up to 1000 of them (#27277)
 
-Clause-②: yes (two codes join ERROR_CODE_LEDGER under `@objectstack/objectql`: `EXTERNAL_WRITE_REFUSED` and `EXTERNAL_ROW_CAP_EXCEEDED`, both 422)
+Clause-②: yes (narrowing) — two codes join ERROR_CODE_LEDGER under `@objectstack/objectql` (`EXTERNAL_WRITE_REFUSED` and `EXTERNAL_ROW_CAP_EXCEEDED`, both 422), and on a plugin-driver external datasource the accepted reads and writes narrow as described below
 Metadata-protocol: none
 
 <!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped. A read on a plugin-driver datasource that matches more than 1000 rows is now refused with a 422 that names its own remedy (narrow the filter, or mirror the data with DataSync); there is no metadata for a migration to rewrite. -->

.changeset/27425-phantom-owner-anchor-fails-closed.md

@@ -5,7 +5,7 @@
 
 fix(plugin-sharing)!: on a federated object whose `owner_id` is the platform's injected anchor, the read and bulk-write scopes narrow below `org` instead of going unscoped (#27425)
 
-Clause-②: no (narrowing) — `SharingService.buildReadFilter` and `buildWriteFilter` answer a deny-all scope, where they answered `null` (no scope), for a caller below `org` depth on an ADR-0015 federated object that neither declares `owner_id` in `fields` nor maps a remote column onto it; on `private` such an object's refused edit answers 404 where it answered 403. Nothing is widened and no key is added, removed or renamed.
+Clause-②: yes (narrowing) — `SharingService.buildReadFilter` and `buildWriteFilter` answer a deny-all scope, where they answered `null` (no scope), for a caller below `org` depth on an ADR-0015 federated object that neither declares `owner_id` in `fields` nor maps a remote column onto it; on `private` such an object's refused edit answers 404 where it answered 403. One accept set widens: `SharingService.grant()` on a federated object that maps a remote column onto `owner_id` through `external.columnMap` (without declaring it) is no longer refused as inert, because that object's share rows are now read. No key is added, removed or renamed.
 Metadata-protocol: none
 
 <!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type changes: the record-sharing scope of one class of federated object fails closed where it went unscoped. The remedy is a metadata choice the author already has (declare the owner column, or choose the sharing model on purpose), so there is nothing for a migration to rewrite and no tombstone. -->