feat(forms): add Form A iframe fallback safeguards

www/reports/SESSION_HANDOFF.md

@@ -1,6 +1,6 @@
 # AIA Astro Migration — Living Session Handoff
 
-**Last updated:** October 20, 2026 (UTC)
+**Last updated:** October 28, 2026 (UTC)
 **Repository:** `AIAMarketing/azinstitute4autism.com`
 **Working branch:** `faithful-astro-migration`
 **Last accepted technical implementation:** Phase 9 bounded landing-page integration (presentation and inactive lead UI only; human decisions and production activation pending)
@@ -152,8 +152,10 @@ trusted-source comparison. No insecure retrieval was repeated.
   header/footer, source section order, existing byte-identical local imagery and
   cache-qualified source evidence. It is self-canonical and adds one sitemap URL.
 - Omitted the sibling project's API, tracking, success-state and attribution
-  runtime. All five visible lead panels remain inactive, with no native POST,
-  live Jotform or conversion behavior. P9-01, P9-03, P9-05 and P9-07 remain open.
+  runtime. Normal staging and indexing artifacts keep all five lead panels inactive,
+  with no native POST, live Jotform or conversion behavior. The later seven-route
+  Form A isolated-test adapter is separately gated and remains outside those artifacts.
+  P9-01, P9-03, P9-05 and P9-07 remain open.
 - Added `/lp` as a temporary staging/testing index linking the five pages. It is
   always `noindex,nofollow`, sitemap/hreflang-excluded and omitted entirely when
   `PUBLIC_ALLOW_INDEXING=true`. This build gate is not access control.
@@ -165,6 +167,12 @@ trusted-source comparison. No insecure retrieval was repeated.
   Earlier October 20 reconciliations remain superseded local evidence outside
   the checkpoint.
 
+### Current Form A status — 2026-10-28 (uncommitted reconciliation; not a signed acceptance)
+
+- Form A (`262946078314059`) is implemented only in a non-indexing, seven-route `isolated-test` adapter: `/contact`, `/es/contact`, the four campaign landing routes and `/lp/early-intervention`. The five landing journeys use fixed `formContext=landing&language=en`, superseding only their earlier Form B mapping. Form B remains for the other service-consultation journeys; Form C remains professional referrals.
+- Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-seven-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
+- The adapter retains fixed URLs, responsive fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, no helper script, and a hosted fallback that is hidden without space until a 15-second missing-load timeout. A frame load only clears that timeout; it does not prove cross-origin application health or accepted submission. The official Jotform resizing handler is conditionally acceptable pending separately authorized source, origin, privilege, Firefox and error-state verification; it is not implemented. Fixed heights remain current.
+
 The indexing-enabled build has 127 HTML routes/canonicals and 109 sitemap URLs.
 Normal staging has 128 `noindex,nofollow` pages because it also contains `/lp`;
 its sitemap and hreflang are empty. Existing 180 hreflang links across 55 routes,