Add governed public form intake

docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md

@@ -51,6 +51,23 @@ Runtime form submissions for validation, drafts, attachments, signatures, status
 - native Case and Workflow handoffs that commit a durable effect intent before
   invoking the owner capability, use stable provider idempotency keys, and
   reconcile outcome-unknown execution
+- invitation and explicitly enabled anonymous public-intake profiles with
+  hash-only bearer tokens, bounded profile-level rate limits, 14-day invitation
+  expiry, 30-day draft expiry, isolated synthetic actors, and no anonymous
+  identity-claim path
+- an administrator-only public-intake dialog that selects exact published Form
+  revisions, configures expiry/rate limits, enables or disables profiles, and
+  exposes invitation secrets only once
+- Files-owned one-time evidence upload grants bound to the tenant, exact Form
+  instance and definition revision, purpose, custodian, size, media types, and a
+  maximum 15-minute upload window
+- final-submission evidence inspection that rejects wrong-submission, deleted,
+  quarantined, unverifiable, cross-tenant, or checksum-mismatched managed files
+- authenticated acknowledgement evidence bound to the acting account,
+  statement/version, exact Form revision, submitted values, and attachments
+- authenticated and public WebUI attachment capture through the shared drop
+  target; changing values or attachments invalidates the local acknowledgement
+  selection before submission
 - migrations, uninstall guards, tenant summaries, events, recovery notes, and
   tenant/replay/stale-write/validation/handoff tests
 
@@ -67,10 +84,18 @@ Policy-referenced definitions fail closed when no compatible
 `forms_runtime.policy_evaluator` is active.
 
 Files and signature providers retain their own content and key custody. Runtime
-stores only same-tenant evidence references. Cases and Workflow Engine retain
+stores only same-tenant evidence references and bounded inspection snapshots.
+Files stores only upload-token digests and never grants a public intake actor
+general Files permissions. Cases and Workflow Engine retain
 their own target state; Runtime stores only a permitted same-tenant handoff
 reference and status evidence.
 
+Administrators create public profiles from the Forms Runtime workspace. An
+anonymous profile has one reusable public URL. An invitation profile creates a
+new one-time bearer URL for each participant. The UI can copy a newly issued
+secret but cannot retrieve it later. Disabling a profile prevents new starts;
+already submitted revisions and their evidence remain governed records.
+
 ## Approved Intake And Evidence Profiles
 
 The product and security profile approved on 2026-08-04 sets the next
@@ -100,6 +125,16 @@ not an advanced or qualified electronic signature. Those assurance levels
 require a separately selected external trust-service provider and current
 provider evidence; a required signature never silently degrades.
 
+## Search
+
+When Search is enabled, `forms_runtime.submissions` indexes only the Form
+definition identity and revision, lifecycle state, receipt identifier, Service
+reference, and route back to the instance. Submitted field values and managed
+evidence content are never copied into the search index. Workspace readers may
+resolve tenant submissions; participants may resolve only instances owned by
+their current actor identity. Every result receives a current authorization
+recheck before disclosure.
+
 ## Recovery And Operations
 
 Database recovery restores identities, revisions, and events together. After
@@ -113,8 +148,11 @@ Destructive retirement is blocked while state exists and requires a verified
 database snapshot plus an export or retention decision for referenced evidence.
 No local generated files are required, so API and worker nodes remain stateless.
 
-The approved public-intake and concrete file/signature provider profiles remain
-implementation depth. Conditional multi-page definitions are resolved from Forms, and
-native Case/Workflow handoffs execute automatically when the exact owner
-capability is installed. Additional target kinds remain adapter depth; the
-owner and security boundaries no longer depend on those additions.
+Public intake, Files-backed attachment evidence, and authenticated
+acknowledgements implement the approved first profiles. Conditional multi-page
+definitions are resolved from Forms, and native Case/Workflow handoffs execute
+automatically when the exact owner capability is installed. CAPTCHA,
+pseudonymous intake, advanced or qualified electronic signatures, richer
+attachment classification/retention controls, and additional target kinds
+remain provider or product depth; none may weaken the implemented owner and
+security boundaries.