feat(forms): gate Form A production embedding

www/integrations/jotform/README.md

@@ -31,7 +31,22 @@ PUBLIC_AIA_FORMS_LIVE_APPROVED=false
 PUBLIC_ALLOW_INDEXING=false
 ```
 
-It uses fixed allowlisted hosted URLs only: the contact routes use `formContext=contact` with their fixed English or Spanish language value, and the five landing routes use `formContext=landing&language=en`. `formContext` is the exact case-sensitive Jotform Unique Name supplied by the owner; it is presentation-only and does not accept visitor query values. A missing gate, any other environment role, an indexing-enabled build, a route outside that seven-route allowlist, or `live` mode renders the normal fail-closed Astro fallback instead.
+It uses fixed allowlisted hosted URLs only: the contact routes use `formContext=contact` with their fixed English or Spanish language value, and the five landing routes use `formContext=landing&language=en`. `formContext` is the exact case-sensitive Jotform Unique Name supplied by the owner; it is presentation-only and does not accept visitor query values. In `isolated-test` mode, a missing gate, any other environment role, an indexing-enabled build or a route outside that seven-route allowlist renders the normal fail-closed Astro fallback. The separately documented `live` gate uses the same route allowlist and its own independent approvals.
+
+## Production-gated Form A adapter
+
+The adapter remains off in normal builds. A production artifact may render Form A only when all four independent settings are present at build time:
+
+```sh
+PUBLIC_AIA_FORMS_MODE=live
+PUBLIC_AIA_FORMS_LIVE_APPROVED=true
+PUBLIC_AIA_FORMS_ENVIRONMENT=production
+PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true
+```
+
+`PUBLIC_ALLOW_INDEXING=true` is required for an indexing-enabled release artifact, but it is **not** a Form A authorization setting and cannot activate a frame by itself. The production gate preserves the same fixed seven-route allowlist, URLs, `formContext`, locale parameters, fixed heights, sandbox, no-referrer policy and conditional fallback. It does not enable Forms B/C, service drawers, native POST forms, analytics, advertising, tracking, webhooks, API forwarding or the Jotform resize handler.
+
+For a deployment rollback, set `PUBLIC_AIA_FORMS_MODE=off` or remove any one of the three approval/environment values, rebuild the static artifact, verify no Form A identifier is emitted, and switch to the reviewed artifact. This disables Form A in Astro without changing the static site or the Jotform account. Do not change Jotform notification recipients, fields or availability as part of that rollback.
 
 The adapter has a localized iframe title, a fixed-height responsive frame, a `no-referrer` policy, a minimal sandbox, and a direct hosted-form fallback. The fallback is outside the iframe, initially hidden without layout space, revealed after a 15-second missing-load timeout, cleared on frame load or component disposal, and duplicated only as localized `<noscript>` content. A frame `load` cancels the timeout but is never treated as Jotform initialization, accepted submission, conversion, or proof that the cross-origin application is healthy. It loads no Jotform helper script, reads no iframe DOM, and installs no `postMessage` handler.
 
@@ -77,4 +92,4 @@ JF-01 through JF-09, privacy/security review, operations approval, fluent-langua
 
 ## 2026-10-28 reconciliation
 
-The current records supersede the earlier Form B mapping only for the five named landing journeys: all five now use Form A under the seven-route isolated-test gate. Form B remains for the other service-consultation journeys. The official Jotform JavaScript embed handler is **conditionally acceptable pending targeted verification**; it is not included in this adapter. Any future adoption must first verify its current source, origin and source-window validation, parent-page privileges, URL mutation, network requests, Firefox behavior and all supported error states. Fixed heights remain the current approved architecture until that review is separately accepted.
+The current records supersede the earlier Form B mapping only for the five named landing journeys: all five now use Form A under the seven-route isolated-test or separately approved production gate. Form B remains for the other service-consultation journeys. The official Jotform JavaScript embed handler is **conditionally acceptable pending targeted verification**; it is not included in this adapter. Any future adoption must first verify its current source, origin and source-window validation, parent-page privileges, URL mutation, network requests, Firefox behavior and all supported error states. Fixed heights remain the current approved architecture until that review is separately accepted.