feat: add configurable application status access

docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md

@@ -78,6 +78,15 @@ Runtime form submissions for validation, drafts, attachments, signatures, status
   selection before submission
 - migrations, uninstall guards, tenant summaries, events, recovery notes, and
   tenant/replay/stale-write/validation/handoff tests
+- an administrator-configured applicant-status policy on each exact published
+  Form revision: authenticated applicant access, short-lived links delivered
+  after a linked-email match, or a permanent bearer link
+- per-submission, high-entropy tracking grants and a deliberately bounded
+  projection containing only title, lifecycle status, update time, receipt
+  identifier, and deduplicated public lifecycle events
+- hash-only short-lived secrets, grant-bound email comparison, generic link
+  request responses, bounded hourly requests, resend revocation, and
+  Notifications-owned mail delivery
 
 ## Security And Policy
 
@@ -111,6 +120,28 @@ new one-time bearer URL for each participant. The UI can copy a newly issued
 secret but cannot retrieve it later. Disabling a profile prevents new starts;
 already submitted revisions and their evidence remain governed records.
 
+Applicant status is separately configured for one exact published Form
+revision. The administrator selects one of three disclosure profiles:
+
+- `authenticated` binds access to the submitting account. Assisted intake can
+  bind this profile only when its affected party is an explicit `account:`
+  reference; otherwise no status grant is issued.
+- `email_link` binds a grant to the normalized value of one configured Form
+  field. A request supplies the tracking identifier and email address, always
+  receives the same response, and results in delivery only after a match. The
+  new short-lived link revokes its predecessor and Notifications owns the raw
+  delivery address, delivered URL, and attempt under its retention policy.
+  Forms Runtime stores only the secret digest.
+- `permanent_link` makes the high-entropy tracking URL itself a non-expiring
+  bearer credential. Anyone possessing it can read the bounded projection.
+
+Policy changes apply to later submissions; grants already issued retain their
+mode and limits. Disabling the policy suspends all its grants immediately.
+Submitted values, applicant identity, evidence, internal notes, and handoff
+details never enter the public projection. Administrators must therefore choose
+permanent links only where their possession-based disclosure and forwarding
+risk is acceptable.
+
 Administrators enable assisted profiles against the same published Form
 revisions. An authenticated operator starts the session only after recording
 the governed party and function references, authority and purpose, channel,