@@ -7,7 +7,7 @@ The path an author writes as a public form's `sharing.publicLink` now answers: `
 Clause-②: yes (widening)
 
 - **What was wrong.** An app declares a public form as `sharing: { enabled: true, allowAnonymous: true, publicLink: '/forms/contact-us' }`, the spelling the platform's own examples use. The Console serves that form to an anonymous visitor at `/_console/f/contact-us`, but the path as written answered `404 ENDPOINT_NOT_FOUND`, so the link an author put on a website reached nothing.
-- **What it does now.** Wherever the Console is mounted (`os serve` / `os dev` with the Console, or any host that mounts `createConsoleStaticPlugin` from `@objectstack/cli/console`), `GET /forms/SLUG` answers `302` with `Location: /_console/f/SLUG`. It does so only when the anonymous form door, `GET /api/v1/forms/SLUG`, serves the form to the same request: the form's `sharing` has `enabled` and `allowAnonymous` set and names the slug, no other metadata layer withdraws it, and the deployment's tenancy posture lets it take an anonymous submission. The redirect asks that door in-process with the visitor's own request, so it decides nothing the door does not, and it reveals nothing the door does not.
+- **What it does now.** Wherever the Console is mounted (`os serve` / `os dev` with the Console, or any host that mounts `createConsoleStaticPlugin` from `@objectstack/cli/console`), `GET /forms/SLUG` answers `302` with `Location: /_console/f/SLUG`, followed by the request's query string. It does so only when the anonymous form door, `GET /api/v1/forms/SLUG`, serves the form to the same request: the form's `sharing` has `enabled` and `allowAnonymous` set and names the slug, no other metadata layer withdraws it, and the deployment's tenancy posture lets it take an anonymous submission. The redirect asks that door in-process with the visitor's own request, so it decides nothing the door does not, and it reveals nothing the door does not.
 - **Unchanged.** Every other request under `/forms/` answers exactly as before: a disabled form, a form not open to anonymous visitors, an unknown slug, a form the posture withholds, any method other than `GET` / `HEAD`, a trailing slash or a deeper path all get the same `404 ENDPOINT_NOT_FOUND`. Nothing is mounted at the root for a bare slug. The signed-in Console route `/_console/forms/NAME` is untouched. A deployment without the Console (`--no-ui`, `--no-console`, `OS_DISABLE_CONSOLE=1`, or no built Console) mounts no redirect.
-- **Status and target.** The redirect is a `302`, never a permanent one, because whether a form is served can change with its sharing. The `Location` is built from the Console path and the slug, encoded as one path segment, so no request can point it anywhere else. The request's query string is not carried; the public form page reads none.
+- **Status and target.** The redirect is a `302`, never a permanent one, because whether a form is served can change with its sharing. The `Location` path is built from the Console path and the slug, encoded as one path segment, so no request can point it anywhere else. The request's query string is carried verbatim after that path, because the public form page seeds its fields from `?prefill_FIELD=` parameters: `/forms/contact-us?prefill_source=website` lands on `/_console/f/contact-us?prefill_source=website`. A query string can change only the query of the page the visitor lands on, never its origin or path.
 - **Nothing to migrate.** No key, export or signature changes. `sharing.publicLink` keeps its meaning and its accepted spellings (`/forms/x`, `forms/x` and `x` name one slug).
@@ -39,6 +39,7 @@ type DoorAnswer = 'serve' | 'not-found' | 'fail' | 'throw';
 interface DoorCall {
   method: string;
   slug: string;
+  query: unknown;
   host: unknown;
   cookie: unknown;
 }
@@ -74,7 +75,7 @@ async function mount(opts: {
 
   server.get('/api/v1/forms/:slug', async (req: any, res: any) => {
     const slug = String(req.params?.slug ?? '');
-    doorCalls.push({ method: req.method, slug, host: req.headers?.host, cookie: req.headers?.cookie });
+    doorCalls.push({ method: req.method, slug, query: req.query, host: req.headers?.host, cookie: req.headers?.cookie });
     const answer = door(slug);
     if (answer === 'throw') throw new Error('door exploded');
     if (answer === 'fail') {
@@ -187,10 +188,75 @@ describe('GET /forms/:slug — the Location cannot be steered off the console pa
     });
   }
 
-  it('the query string of the request is not carried', async () => {
+  it('a query string cannot steer it either: origin and path stay the console page', async () => {
+    const app = await mount({ console: true, door: servesEverything });
+    for (const query of ['?next=https://evil.example', '?x=%0D%0ASet-Cookie:%20a=b', '?/..//evil.example']) {
+      const res = await app.request(`/forms/${OPEN}${query}`);
+      expect(res.status).toBe(302);
+      expect(res.headers.get('set-cookie')).toBeNull();
+      const location = res.headers.get('location')!;
+      expect(location).toBe(`/_console/f/${OPEN}${query}`);
+      const resolved = new URL(location, ORIGIN);
+      expect(resolved.origin).toBe(ORIGIN);
+      expect(resolved.pathname).toBe(`/_console/f/${OPEN}`);
+    }
+  });
+});
+
+describe('GET /forms/:slug — the request\'s query string travels to the page', () => {
+  // The public form page seeds its fields from `?prefill_<field>=`, so a link
+  // that carries one must land with it, byte for byte.
+  for (const query of [
+    '?prefill_source=website&utm_campaign=spring',
+    '?prefill_name=Ada%20Lovelace&prefill_email=ada%40example.com&ref=a+b',
+    '?prefill_message=line%0Aone&prefill_message=dup',
+  ]) {
+    it(`${query} arrives on Location unchanged`, async () => {
+      const app = await mount({ console: true });
+      const res = await app.request(`/forms/${OPEN}${query}`);
+      expect(res.status).toBe(302);
+      expect(res.headers.get('location')).toBe(`/_console/f/${OPEN}${query}`);
+    });
+  }
+
+  it('a slug that needs encoding, together with a query: the path is re-encoded, the query is untouched', async () => {
+    const app = await mount({ console: true, door: () => 'serve' });
+    const query = '?prefill_source=website&lang=fr';
+    const res = await app.request(`/forms/caf%C3%A9%20form${query}`);
+    expect(app.doorCalls.map((d) => d.slug)).toEqual(['café form']);
+    expect(res.status).toBe(302);
+    const location = res.headers.get('location')!;
+    expect(location).toBe(`/_console/f/caf%C3%A9%20form${query}`);
+    const resolved = new URL(location, ORIGIN);
+    expect(resolved.pathname).toBe('/_console/f/caf%C3%A9%20form');
+    expect(resolved.searchParams.get('prefill_source')).toBe('website');
+    expect(resolved.searchParams.get('lang')).toBe('fr');
+  });
+
+  it('the door is asked without the query', async () => {
     const app = await mount({ console: true });
-    const res = await app.request(`/forms/${OPEN}?next=https://evil.example`);
-    expect(res.headers.get('location')).toBe(`/_console/f/${OPEN}`);
+    await app.request(`/forms/${OPEN}?prefill_source=website&utm_campaign=spring`);
+    expect(app.doorCalls).toHaveLength(1);
+    expect(app.doorCalls[0].query).toEqual({});
+  });
+
+  it('HEAD carries it too', async () => {
+    const app = await mount({ console: true });
+    const res = await app.request(`/forms/${OPEN}?prefill_source=website`, { method: 'HEAD' });
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe(`/_console/f/${OPEN}?prefill_source=website`);
+  });
+
+  it('an empty query or a fragment adds nothing', async () => {
+    const app = await mount({ console: true });
+    expect((await app.request(`/forms/${OPEN}?`)).headers.get('location')).toBe(`/_console/f/${OPEN}`);
+    expect((await app.request(`/forms/${OPEN}?a=1#frag`)).headers.get('location')).toBe(`/_console/f/${OPEN}?a=1`);
+  });
+
+  it('a slug the door does not serve keeps the same 404 with a query, byte for byte', async () => {
+    const { answer, before } = await withAndWithout('/forms/unknown-slug?prefill_source=website');
+    expect(before.status).toBe(404);
+    expect(answer).toEqual(before);
   });
 });
 
 
@@ -489,8 +489,9 @@ async function resolveHttpServer(ctx: any): Promise<any> {
  *
  * It also answers the path an author writes as a public form's
  * `sharing.publicLink`: `GET /forms/<slug>` redirects (302) to the Console's
- * public form page, `/_console/f/<slug>`, when the anonymous form door serves
- * that slug, and otherwise gets the same not-found answer as before. Mounted
+ * public form page, `/_console/f/<slug>` with the request's query string, when
+ * the anonymous form door serves that slug, and otherwise gets the same
+ * not-found answer as before. Mounted
  * only with the Console, because without it there is no page to send anyone to.
  */
 export function createConsoleStaticPlugin(distPath: string, options?: { isDev?: boolean; rootRedirect?: boolean }) {
@@ -567,10 +568,18 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
       // there only when the anonymous form door serves that slug to this
       // request; anything else falls through to the unmatched-request answer
       // every other unrouted path gets.
+      //
+      // The request's query string travels with it: the public form page reads
+      // `?prefill_<field>=` to seed its fields, so a link that carries one must
+      // land with it. The path is built from `CONSOLE_PATH` and the encoded
+      // slug alone; the query, as the URL parser holds it (it cannot carry a
+      // `#`, a control character or a path), is appended after it, so it can
+      // change nothing but the query of the page the visitor lands on.
       app.get('/forms/:slug', async (c: any, next: () => Promise<void>) => {
         const slug = String(c.req.param('slug') ?? '');
         if (slug && (await anonymousFormDoorServes(app, c, slug))) {
-          return c.redirect(`${CONSOLE_PATH}/f/${encodeURIComponent(slug)}`, 302);
+          const query = new URL(c.req.url).search;
+          return c.redirect(`${CONSOLE_PATH}/f/${encodeURIComponent(slug)}${query}`, 302);
         }
         await next();
       });
 
@@ -13,6 +13,8 @@
 //   - an anonymous `GET /forms/contact-us` answers 302 to `/_console/f/contact-us`,
 //     that page is the Console bundle, the door it reads serves the form, and
 //     the form accepts a submission that lands;
+//   - a `prefill_` query on the authored link (the page seeds fields from it)
+//     arrives on the redirect's `Location` unchanged;
 //   - a disabled form, a non-anonymous form and an unknown slug each answer
 //     exactly the unmatched-request 404 an unrouted path gets (compared byte for
 //     byte against a path nothing mounts, on the same boot), and the form comes
@@ -146,6 +148,23 @@ describe('showcase: the authored public form path redirects to the console form
     expect(landed).toHaveLength(1);
   });
 
+  it('a prefill_ query on the authored link arrives on the page it redirects to', async () => {
+    // The page seeds a field from `?prefill_<field>=`; `company` is one of the
+    // fields the form declares, so this is a link an author would publish.
+    const spec = await stack.api(`/forms/${SLUG}`);
+    const fields = Object.keys(((await spec.json()) as { objectSchema: { fields: Record<string, unknown> } }).objectSchema.fields);
+    expect(fields).toContain('company');
+
+    const query = '?prefill_company=Analytical%20Engines&utm_source=website';
+    const redirect = await answerOf(await stack.raw(`${AUTHORED}${query}`));
+    expect(redirect.status).toBe(302);
+    expect(redirect.location).toBe(`${PAGE}${query}`);
+
+    const page = await stack.raw(redirect.location!);
+    expect(page.status).toBe(200);
+    expect(await page.text()).toContain(BUNDLE_MARKER);
+  });
+
   it('an unknown slug answers the unmatched-request 404, byte for byte', async () => {
     expect(await answerOf(await stack.raw('/forms/no-such-form'))).toEqual(unrouted);
   });