@@ -172,7 +172,12 @@ export const SysRecordShare = ObjectSchema.create({
 
     // ── Recipient (who receives access) ──────────────────────────
     recipient_type: Field.select(
-      ['user', 'group', 'position', 'unit_and_subordinates', 'guest'],
+      // `guest` was removed (ADR-0138 D8): a share to the anonymous principal
+      // was declared here and honoured nowhere — `grant()` refused it and no
+      // gate reads such a row — since guest access flows through the guest
+      // position and share links only (ADR-0090 D11). Held equal to
+      // `RecordShareRecipientType` in `@objectstack/spec/contracts`.
+      ['user', 'group', 'position', 'unit_and_subordinates'],
       {
         label: 'Recipient Type',
         required: true,
 
@@ -80,6 +80,27 @@ function makeShareId(): string {
 /** System-elevated context for the plugin's own queries / mutations. */
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } as const;
 
+/**
+ * [ADR-0138 D8] Recipient values `RecordShareRecipientType` no longer declares,
+ * each with the refusal {@link SharingService.grant} answers when one still
+ * arrives at runtime — a REST body, an untyped caller. A retired value is told
+ * where its access actually lives; every other non-`user` value keeps the
+ * generic refusal in `grant()`. Keyed by the value exactly as a caller sends it.
+ */
+const RETIRED_RECIPIENT_TYPE_REFUSALS: Readonly<Record<string, string>> = {
+  guest:
+    "recipientType 'guest' was removed (ADR-0138 D8) — a record share to the anonymous principal "
+    + 'was never honoured, because guest access flows through the guest position and share links '
+    + '(ADR-0090 D11). Expose the record through a public form or a share link instead.',
+};
+
+/** The retired-value refusal for a `recipientType` a caller sent, or `undefined`. */
+function retiredRecipientTypeRefusal(value: unknown): string | undefined {
+  return typeof value === 'string' && Object.prototype.hasOwnProperty.call(RETIRED_RECIPIENT_TYPE_REFUSALS, value)
+    ? RETIRED_RECIPIENT_TYPE_REFUSALS[value]
+    : undefined;
+}
+
 /**
  * Owner field convention. Hard-coded to `owner_id` for MVP — the
  * sharing model in Salesforce / ServiceNow / Dynamics all assume a
@@ -1346,9 +1367,15 @@ export class SharingService implements ISharingService {
     // (ADR-0078). Group / business-unit principals are delivered via sharing
     // rules, whose evaluator expands them into per-user rows.
     if (recipientType !== 'user') {
+      // [ADR-0138 D8] A retired value no longer typechecks, yet still reaches
+      // here untyped. It is told where guest access lives, never that a sharing
+      // rule delivers it: the rule vocabulary retired the same recipient.
+      const retired = retiredRecipientTypeRefusal(recipientType);
       throw new Error(
-        `VALIDATION_FAILED: recipientType must be 'user' (received ${JSON.stringify(recipientType)}) — `
-        + `group/position recipients are delivered via sharing rules (ADR-0111 D7)`,
+        retired !== undefined
+          ? `VALIDATION_FAILED: ${retired}`
+          : `VALIDATION_FAILED: recipientType must be 'user' (received ${JSON.stringify(recipientType)}) — `
+            + `group/position recipients are delivered via sharing rules (ADR-0111 D7)`,
       );
     }
     // Validate BEFORE any write. Previously anything at all was persisted
 
@@ -87,6 +87,15 @@ import type { ExecutionContext } from '../kernel/execution-context.zod.js';
  * as expanded `user` rows. The remaining members are persisted-for-forward-
  * compatibility vocabulary, kept in lockstep with the select.
  *
+ * `guest` is NOT a member: it was removed (ADR-0138 D8). A record share to the
+ * anonymous principal was declared and never honoured — the grant refused it,
+ * and no gate reads such a row — because guest access flows through the guest
+ * position and share links only (ADR-0090 D11). A record a guest must reach is
+ * exposed through a public form or a share link. {@link ISharingService.grant}
+ * refuses a `'guest'` that still arrives at runtime with that prescription, and
+ * the select refuses it on a row write. The sharing-RULE vocabulary retired the
+ * same recipient earlier (the ADR-0087 entry `sharing-rule-recipient-reconcile`).
+ *
  * NOT the sharing-RULE recipient vocabulary — that is
  * {@link SharingRuleRecipientType} here, whose authorable subset is
  * `ShareRecipientType` in `spec/security` (a different concept that shares
@@ -96,8 +105,7 @@ export type RecordShareRecipientType =
   | 'user'
   | 'group'
   | 'position'
-  | 'unit_and_subordinates'
-  | 'guest';
+  | 'unit_and_subordinates';
 
 /**
  * Access level on a single record — the authorable subset, mirroring