@@ -4,8 +4,14 @@ import { describe, it, expect } from 'vitest';
 import { SharingConfigSchema } from '@objectstack/spec/ui';
 import {
     anonymousFormIntakeCandidates,
+    anonymousFormIntakePosture,
     anonymousFormIntakeSlug,
     anonymousFormIntakeSlugs,
+    anonymousFormIntakeUnavailability,
+    anonymousFormIntakeUnavailableMessage,
+    anonymousFormIntakeUnavailableRemedy,
+    anonymousFormObjectName,
+    anonymousFormSharingPath,
     publicFormSlug,
 } from './anonymous-form-intake.js';
 
@@ -79,3 +85,102 @@ describe('anonymousFormIntakeCandidates / anonymousFormIntakeSlugs — the three
         expect(publicFormSlug('//forms/x')).toBe('x');
     });
 });
+
+// [#21476] Whether an open form can take an anonymous submission on this
+// posture — the one predicate both anonymous doors, the admin read and the
+// runtime authoring gate's advisory read.
+describe('anonymousFormIntakeUnavailability — the intake-availability predicate', () => {
+    /** The object as a served document carries it: the registry injects `organization_id`. */
+    const served = (extra: Record<string, unknown> = {}) => ({
+        name: 'inquiry',
+        fields: { organization_id: { type: 'lookup', reference: 'sys_organization' }, email: { type: 'text' } },
+        ...extra,
+    });
+    /** The same object as a stored or pending body carries it: declared fields only. */
+    const raw = (extra: Record<string, unknown> = {}) => ({ name: 'inquiry', fields: { email: { type: 'text' } }, ...extra });
+
+    it.each(['isolated', 'group'] as const)("'%s': a walled object is unavailable, naming the object, the posture and the column", (posture) => {
+        expect(anonymousFormIntakeUnavailability('inquiry', posture, () => served()))
+            .toEqual({ object: 'inquiry', posture, tenantField: 'organization_id' });
+    });
+
+    it('judges the EFFECTIVE schema: a stored body with no declared organization_id is walled all the same', () => {
+        expect(anonymousFormIntakeUnavailability('inquiry', 'isolated', () => raw()))
+            .toEqual({ object: 'inquiry', posture: 'isolated', tenantField: 'organization_id' });
+    });
+
+    it('a declared tenancy.tenantField the object really has is the column named', () => {
+        const schema = served({ tenancy: { tenantField: 'company_id' }, fields: { company_id: { type: 'text' } } });
+        expect(anonymousFormIntakeUnavailability('inquiry', 'isolated', () => schema)?.tenantField).toBe('company_id');
+    });
+
+    it.each<[string, unknown]>([
+        ['tenancy: { enabled: false } (ADR-0066)', served({ tenancy: { enabled: false } })],
+        ['an object the universe does not hold', undefined],
+        ['an object with no fields record and no wall', { name: 'inquiry', systemFields: false }],
+    ])('CONTROL, walled posture — %s: available', (_label, schema) => {
+        expect(anonymousFormIntakeUnavailability('inquiry', 'isolated', () => schema)).toBeNull();
+    });
+
+    it.each<[string, 'single' | undefined]>([
+        ["the 'single' posture", 'single'],
+        ['no tenancy service (no posture)', undefined],
+    ])('CONTROL — %s: available, and the object is never read', (_label, posture) => {
+        let reads = 0;
+        expect(anonymousFormIntakeUnavailability('inquiry', posture, () => { reads += 1; return served(); })).toBeNull();
+        expect(reads).toBe(0);
+    });
+
+    it('an asynchronous reader gets a promise when a wall is in force, and null without reading otherwise', async () => {
+        const walled = anonymousFormIntakeUnavailability('inquiry', 'group', async () => served());
+        expect(walled).toBeInstanceOf(Promise);
+        expect(await walled).toEqual({ object: 'inquiry', posture: 'group', tenantField: 'organization_id' });
+        expect(anonymousFormIntakeUnavailability('inquiry', 'single', async () => served())).toBeNull();
+    });
+});
+
+describe('anonymousFormIntakePosture — the posture IN FORCE, as the tenancy service reports it', () => {
+    it('reads `posture`, never `requestedPosture`: a degraded walled request is single', () => {
+        expect(anonymousFormIntakePosture({ posture: 'single', requestedPosture: 'isolated' })).toBe('single');
+        expect(anonymousFormIntakePosture({ posture: 'group' })).toBe('group');
+        expect(anonymousFormIntakePosture({ posture: 'multi' })).toBe('isolated');
+    });
+
+    it('no service, or no recognisable posture: undefined', () => {
+        for (const tenancy of [undefined, null, {}, { posture: 'walled' }, 'isolated']) {
+            expect(anonymousFormIntakePosture(tenancy)).toBeUndefined();
+        }
+    });
+});
+
+describe('where the reason is located, and the reason itself', () => {
+    it('anonymousFormSharingPath: form.sharing, formViews.KEY.sharing, config.sharing', () => {
+        const view = {
+            name: 'inquiry.contact',
+            form: { sharing: { ...OPEN, publicLink: '/forms/nested' } },
+            formViews: { contact: { sharing: { ...OPEN, publicLink: '/forms/a' } } },
+            viewKind: 'form',
+            config: { sharing: { ...OPEN, publicLink: '/forms/flat' } },
+        };
+        expect(anonymousFormIntakeCandidates(view).map((c) => anonymousFormSharingPath(view, c)))
+            .toEqual(['form.sharing', 'formViews.contact.sharing', 'config.sharing']);
+    });
+
+    it('anonymousFormObjectName: the form\'s own data.object first, then the view\'s', () => {
+        const view = { object: 'v_obj', list: { data: { object: 'list_obj' } } };
+        expect(anonymousFormObjectName(view, { data: { object: 'form_obj' } })).toBe('form_obj');
+        expect(anonymousFormObjectName(view, {})).toBe('list_obj');
+        expect(anonymousFormObjectName({ object: 'v_obj' }, {})).toBe('v_obj');
+        expect(anonymousFormObjectName(undefined, undefined)).toBeUndefined();
+    });
+
+    it('the message names the slug, the object, the column and the posture, and ends with the remedy', () => {
+        const u = { object: 'inquiry', posture: 'isolated' as const, tenantField: 'organization_id' };
+        const message = anonymousFormIntakeUnavailableMessage('contact-us', u);
+        for (const named of ["'/forms/contact-us'", "'inquiry'", "'organization_id'", "'isolated'"]) {
+            expect(message).toContain(named);
+        }
+        expect(anonymousFormIntakeUnavailableRemedy(u)).toContain('tenancy: { enabled: false }');
+        expect(message.endsWith(` ${anonymousFormIntakeUnavailableRemedy(u)}`)).toBe(true);
+    });
+});
@@ -30,7 +30,13 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 // would close a dependency cycle turbo rejects outright — which is why all 26
 // of this package's (file, verb) pairs sat in the gate's DEBT ledger until
 // #5619 sank the two predicates into a package both sides already depend on.
-import { assertEngineDeleteDispatch, assertEngineUpdateDispatch, assertEngineFindOnePredicate } from '@objectstack/metadata-core';
+import {
+    assertEngineDeleteDispatch,
+    assertEngineUpdateDispatch,
+    assertEngineFindOnePredicate,
+    // [#21476] The reason the admin read of a view states — the advisory must carry the same bytes.
+    anonymousFormIntakeUnavailableMessage,
+} from '@objectstack/metadata-core';
 // [#4716] The advisory-tier rule the Q2 fence test proves its body WOULD trip
 // — imported from the full barrel deliberately: this is a TEST, not the gate
 // (the gate itself may only reach the registry through `@objectstack/lint/runtime`,
@@ -39,7 +45,7 @@ import { validateSemanticRoles } from '@objectstack/lint';
 import { ObjectStackProtocolImplementation } from './protocol.js';
 import type { MetadataAuthoringChannel } from './protocol.js';
 import { SDUI_MANIFEST_SERVICE } from './index.js';
-import { stampHtmlPageRequires } from './runtime-authoring-gate.js';
+import { PUBLIC_FORM_INTAKE_UNAVAILABLE, stampHtmlPageRequires } from './runtime-authoring-gate.js';
 
 /** The issue's body. Zod-valid: `approvers[].value` is just a string to the schema. */
 const brokenApprovalFlow = () => ({
@@ -1454,3 +1460,131 @@ describe('stored html page `requires` at load and at draft promotion (#20312)',
         expect(storedPage(rows)?.requires).toEqual(['plugin-absent']);
     });
 });
+
+/**
+ * [#21476] The public-form intake advisory, end to end through the two write
+ * doors: `saveMetaItem` (REST `PUT /meta/view/:name`) and the draft → active
+ * promotion `publishMetaItem` (REST `POST /meta/view/:name/publish`).
+ *
+ * The posture is read off a `tenancy` service in the protocol's own services
+ * table — the service, and the reader (`anonymousFormIntakePosture`), the
+ * anonymous form doors read. The rows pin both halves: on a walled posture in
+ * force the write SUCCEEDS with exactly one warning, located at the form's
+ * `sharing` and carrying the admin read's reason byte for byte; every control
+ * the doors serve the form on raises nothing, the degraded deployment included
+ * — whose REQUESTED posture (`OS_TENANCY_POSTURE`) walls while its in-force
+ * posture does not.
+ */
+describe('public-form intake advisory on save and publish (#21476)', () => {
+    const SLUG = 'contact-us';
+    const NAME = 'showcase_inquiry';
+    /** The showcase's contact form: a container whose public form is `formViews.contact`. */
+    const contactContainer = () => ({
+        list: { type: 'grid', data: { provider: 'object', object: NAME }, columns: [{ field: 'name' }] },
+        formViews: {
+            contact: {
+                type: 'simple',
+                data: { provider: 'object', object: NAME },
+                sections: [{ name: 'about', fields: [{ field: 'name' }, { field: 'email' }] }],
+                sharing: { enabled: true, allowAnonymous: true, publicLink: `/forms/${SLUG}` },
+            },
+        },
+    });
+    /** The bound object as the live registry holds it — `organization_id` injected at registration. */
+    const inquiry = (tenancyDisabled: boolean) => ({
+        name: NAME,
+        label: 'Inquiry',
+        ...(tenancyDisabled ? { tenancy: { enabled: false } } : {}),
+        fields: {
+            organization_id: { type: 'lookup', reference: 'sys_organization' },
+            name: { type: 'text', label: 'Name' },
+            email: { type: 'email', label: 'Email' },
+        },
+    });
+
+    type Tenancy = 'isolated' | 'group' | 'degraded' | 'single' | 'no-service';
+    /** A `tenancy` service as plugin-auth registers it: `posture` is the posture IN FORCE. */
+    const tenancyService = (t: Exclude<Tenancy, 'no-service'>) => ({
+        posture: t === 'degraded' ? 'single' : t,
+        requestedPosture: t === 'degraded' ? 'isolated' : t,
+        defaultOrgId: async () => (t === 'single' ? 'org_alpha' : null),
+    });
+
+    function hostOn(tenancy: Tenancy, tenancyDisabled = false) {
+        const { engine, rows } = makeStubEngine();
+        engine.registry.listItems = (type: string) => (type === 'object' ? [inquiry(tenancyDisabled)] : []);
+        const services = new Map<string, unknown>(
+            tenancy === 'no-service' ? [] : [['tenancy', tenancyService(tenancy)]],
+        );
+        const protocol = new ObjectStackProtocolImplementation(engine, () => services, 'env_test') as any;
+        return { protocol, rows };
+    }
+
+    const put = (protocol: any, extra: Record<string, unknown> = {}) =>
+        protocol.saveMetaItem({ type: 'view', name: NAME, item: contactContainer(), ...extra });
+    const publish = async (protocol: any) => {
+        await expect(put(protocol, { mode: 'draft' })).resolves.toMatchObject({ success: true });
+        return protocol.publishMetaItem({ type: 'view', name: NAME });
+    };
+    const intake = (response: { advisories?: Array<{ rule: string }> }) =>
+        (response.advisories ?? []).filter((a) => a.rule === PUBLIC_FORM_INTAKE_UNAVAILABLE);
+
+    let warn: ReturnType<typeof vi.spyOn>;
+    const savedPosture = process.env.OS_TENANCY_POSTURE;
+    beforeEach(() => {
+        warn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        delete process.env.OS_ALLOW_UNLINTED_METADATA_WRITES;
+    });
+    afterEach(() => {
+        warn.mockRestore();
+        if (savedPosture === undefined) delete process.env.OS_TENANCY_POSTURE;
+        else process.env.OS_TENANCY_POSTURE = savedPosture;
+    });
+
+    for (const posture of ['isolated', 'group'] as const) {
+        for (const [door, write] of [['PUT', put], ['publish', publish]] as const) {
+            it(`'${posture}' in force, walled object — ${door} succeeds with exactly one warning, the admin read's reason at the form's sharing`, async () => {
+                const { protocol, rows } = hostOn(posture);
+                const response = await write(protocol);
+                expect(response.success).toBe(true);
+                expect(response.advisories).toEqual([{
+                    severity: 'warning',
+                    rule: PUBLIC_FORM_INTAKE_UNAVAILABLE,
+                    where: `view "${NAME}" · public form "/forms/${SLUG}"`,
+                    path: 'views[0].formViews.contact.sharing',
+                    message: anonymousFormIntakeUnavailableMessage(SLUG, {
+                        object: NAME, posture, tenantField: 'organization_id',
+                    }),
+                    hint: expect.stringContaining('tenancy: { enabled: false }'),
+                }]);
+                // Never a refusal: the row landed active.
+                expect([...rows.values()].filter((r) => r.type === 'view' && r.state === 'active')).toHaveLength(1);
+            });
+        }
+    }
+
+    it.each<[string, Tenancy, boolean]>([
+        ['walled posture, object declared tenancy: { enabled: false }', 'isolated', true],
+        ["the 'single' posture", 'single', false],
+        ['no tenancy service registered', 'no-service', false],
+    ])('CONTROL — %s: PUT and publish raise no intake advisory', async (_label, tenancy, tenancyDisabled) => {
+        const { protocol } = hostOn(tenancy, tenancyDisabled);
+        const saved = await put(protocol);
+        expect(saved.success).toBe(true);
+        expect(intake(saved)).toEqual([]);
+        const published = await publish(protocol);
+        expect(published.success).toBe(true);
+        expect(intake(published)).toEqual([]);
+    });
+
+    it('CONTROL — a degraded walled deployment: the REQUESTED posture walls, the posture in force does not; the doors serve, so nothing is raised', async () => {
+        process.env.OS_TENANCY_POSTURE = 'isolated';
+        const { protocol } = hostOn('degraded');
+        const saved = await put(protocol);
+        expect(saved.success).toBe(true);
+        expect(intake(saved)).toEqual([]);
+        const published = await publish(protocol);
+        expect(published.success).toBe(true);
+        expect(intake(published)).toEqual([]);
+    });
+});