feat(forms): add Form A iframe fallback safeguards

www/integrations/jotform/README.md

@@ -10,8 +10,8 @@ The current Builder theme reconciliation adds narrowly scoped `!important` decla
 
 ## Installation and comparison
 
-1. Create or open the approved blank Form A in AIA's HIPAA-enabled Jotform account.
-2. Keep the form disabled while field, PHI, notification, conditional-logic, and language review is pending.
+1. Open the approved Form A in AIA's HIPAA-enabled Jotform account. Do not change its fields or settings from this repository workflow.
+2. Keep production activation disabled while embedded-runtime, accessibility, telemetry/privacy, and release review remain pending.
 3. Paste the contents of `aia-form-a.css` into Jotform's custom CSS area.
 4. Compare the Jotform preview with the Astro Form A mock at 390px and 1440px. Check the form surface, label rhythm, input height, button fill, outlined hover/focus state, error state, and mobile reflow.
 5. Check both English and Spanish configurations. Confirm translated labels, required indicators, validation messages, confirmation copy, and the accessible iframe title supplied by the parent Astro integration.
@@ -27,12 +27,15 @@ The Astro adapter exists only for a separately approved, non-indexing isolated t
 PUBLIC_AIA_FORMS_MODE=isolated-test
 PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test
 PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true
+PUBLIC_AIA_FORMS_LIVE_APPROVED=false
 PUBLIC_ALLOW_INDEXING=false
 ```
 
 It uses fixed allowlisted hosted URLs only: the contact routes use `formContext=contact` with their fixed English or Spanish language value, and the five landing routes use `formContext=landing&language=en`. `formContext` is the exact case-sensitive Jotform Unique Name supplied by the owner; it is presentation-only and does not accept visitor query values. A missing gate, any other environment role, an indexing-enabled build, a route outside that seven-route allowlist, or `live` mode renders the normal fail-closed Astro fallback instead.
 
-The adapter has a localized iframe title, a fixed-height responsive frame, a `no-referrer` policy, a minimal sandbox, and a direct hosted-form fallback. It loads no Jotform helper script, reads no iframe DOM, and treats no frame load as a submission or conversion. The disabled Form A must undergo owner-authorized synthetic EN/ES testing before the isolated adapter or its fixed height can be accepted for a live workflow.
+The adapter has a localized iframe title, a fixed-height responsive frame, a `no-referrer` policy, a minimal sandbox, and a direct hosted-form fallback. The fallback is outside the iframe, initially hidden without layout space, revealed after a 15-second missing-load timeout, cleared on frame load or component disposal, and duplicated only as localized `<noscript>` content. A frame `load` cancels the timeout but is never treated as Jotform initialization, accepted submission, conversion, or proof that the cross-origin application is healthy. It loads no Jotform helper script, reads no iframe DOM, and installs no `postMessage` handler.
+
+Direct-Jotform Form A synthetic EN/ES submission, native thank-you, conditional-email/language, generic staff notification, autoresponder delivery, fixed Reply-To, no-answer/no-PDF and no-webhook/integration evidence is owner-confirmed. The owner also reports successful synthetic submission and confirmation through the isolated Astro iframe on English contact, Spanish contact and one ABA landing placement. This establishes owner-reported Form A functional submission acceptance for the sampled routes; it does not replace final seven-route responsive/keyboard/accessibility acceptance, Jotform runtime/network and telemetry privacy review, deployment review or site-release authorization.
 
 ### Landing-route extension — 2026-10-25 / 2026-10-26
 
@@ -57,15 +60,21 @@ The owner-approved Form A landing extension applies only to `/lp/aba-therapy`, `
 
 ## Verification checklist
 
-- [ ] Form A is disabled while configuration is reviewed.
-- [ ] Exact question types, required flags, choices, conditional logic, and `formContext` values are approved.
-- [ ] English and Spanish labels, validation, confirmation, and button variants are reviewed by fluent-language owners.
+- [x] Direct English/Spanish Form A language handling, conditional email requirement, synthetic submission and native thank-you were owner-verified; this is not embedded-iframe acceptance.
+- [x] Direct staff-notification/autoresponder delivery, generic no-answer/no-PDF content, fixed Reply-To, recipient access/retention, and absent webhooks/integrations were owner-verified for Form A.
+- [ ] Exact remaining question properties, choices, conditional routing, availability and future Forms B/C configuration are approved.
+- [ ] English and Spanish embedded-iframe labels, validation, confirmation, and button variants are reviewed by fluent-language owners.
 - [ ] The hidden honeypot remains present, effective, and excluded from user-facing visual changes.
 - [ ] Exactly one native Submit button is visible for every valid context.
 - [ ] Invalid or missing context does not expose an unintended submission path.
 - [ ] No PHI-bearing answer, PDF, recipient, redirect, webhook, or HTTP POST forwarding is inherited without privacy/security approval.
-- [ ] The iframe title, loading/error state, keyboard behavior, and mobile height are accepted.
-- [ ] Synthetic testing uses only approved synthetic values and a separately authorized test form.
+- [x] Owner-reported embedded synthetic submission and confirmation passed on English contact, Spanish contact and one ABA landing placement; record the exact ABA path in the owner test log before release.
+- [ ] All seven placements have final responsive, keyboard, screen-reader and fluent-language acceptance, including timeout/fallback and error expansion.
+- [ ] Jotform runtime requests, telemetry and cross-origin failure behavior are reviewed with privacy/security owners.
 - [ ] No Jotform, Contabo, analytics, advertising, or production API request is made by off/mock builds.
 
 JF-01 through JF-09, privacy/security review, operations approval, fluent-language review, and production activation remain pending. This guide does not authorize Jotform account changes or live integration.
+
+## 2026-10-28 reconciliation
+
+The current records supersede the earlier Form B mapping only for the five named landing journeys: all five now use Form A under the seven-route isolated-test gate. Form B remains for the other service-consultation journeys. The official Jotform JavaScript embed handler is **conditionally acceptable pending targeted verification**; it is not included in this adapter. Any future adoption must first verify its current source, origin and source-window validation, parent-page privileges, URL mutation, network requests, Firefox behavior and all supported error states. Fixed heights remain the current approved architecture until that review is separately accepted.