feat: implement immutable form definitions

docs/FORMS_BOUNDARY.md

@@ -18,7 +18,7 @@ Forms owns:
 - schema contracts that let portal, workflow, cases, and reporting understand a
   form without importing form internals
 
-`govoplan-forms-runtime` owns, when implemented:
+`govoplan-forms-runtime` owns:
 
 - public/internal submission sessions, drafts, receipts, submitted values,
   validation evidence, attachment references, and submission status
@@ -62,19 +62,25 @@ Form definitions should carry:
 - localization keys and fallback text
 - data classification for privacy/retention decisions
 
-## Candidate Capabilities
+## Capabilities
 
-- `forms.catalog`
-- `forms.schema`
-- `forms.validation`
-- `forms.packageFragments`
-- `forms.runtime` when runtime is installed
+- `forms.definitions` resolves an exact, tenant-bound immutable definition.
+- The API provides bounded catalogue and history reads plus OCC-guarded writes.
+- The designer provides explicit revision, publication, field-order, type,
+  option, constraint, draft, attachment, signature, policy, and handoff editing.
+- Forms Runtime performs value validation against the resolved definition; the
+  definition owner does not persist submissions.
 
-## First Implementation Slice
+## Recovery And Operations
 
-1. Define manifest metadata, permissions, and capability names.
-2. Add form definition/version DTOs.
-3. Add validation metadata for one reusable form schema.
-4. Add package fragment import/export format.
-5. Add tests that portal/workflow/reporting can detect form capabilities
-   without importing form internals.
+Definition revisions are append-only. Recovery restores the database and then
+verifies that every runtime submission's `form_id` and `form_revision` resolves
+to the same payload. Destructive module retirement requires a verified database
+snapshot and is blocked while definition rows remain. The transactional event
+boundary emits only schema identity, revision, publication state, and field
+count; field content remains in the owning database.
+
+The schema vocabulary covers scalar, choice, structured, attachment, signature,
+policy-reference, and handoff constraints. Conditional page layout,
+localization authoring, and package-fragment tooling remain product depth that
+can deepen this owner without changing the runtime boundary.