feat(forms): add Form A iframe fallback safeguards

www/reports/phase-9-jotform-implementation-plan-2026-10-18.md

@@ -1,10 +1,10 @@
 # P9-03 source-specific implementation plan
 
-Date: **2026-10-18** · Plan version **1.3 revision 2026-10-27** · Governing contract: [P9-03-JF-2026-10-18 v1.3](phase-9-jotform-integration-contract-2026-10-18.md).
+Date: **2026-10-18** · Plan version **1.5 revision 2026-10-28** · Governing contract: [P9-03-JF-2026-10-18 v1.5](phase-9-jotform-integration-contract-2026-10-18.md).
 
 **Planning only. Do not execute any batch from this document without separate authorization.** Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes.
 
-> **Form A progress note — 2026-10-25 (supplemental implementation evidence, no release approval):** The owner authorized a new blank-built **AIA | Website | General Enquiries** form (`262946078314059`) and reports successful browser checks of contact vs. compact visibility, conditional email requiredness, and the added Spanish language. Its hidden presentation field must have **Advanced → Field Details → Unique Name = `formContext`** (exact case); using only that text as its visible label did not enable URL prepopulation. See [Form A Builder/runtime verification](phase-9-form-a-jotform-runtime-verification-2026-10-25.md) for evidence, limitations, future Forms B/C key verification, and open gates. This records a separately authorized owner/connector activity since the original planning snapshot: it **does not** approve a live embed or submissions, modify the Form B mapping for the four campaign pages, certify notifications/PHI handling, or close JF/OA acceptance. Forms B and C remain planned; their field keys and IDs must not be guessed. The existing uncommitted Jotform integration README/CSS belong to a separate Codex workstream and are not overwritten here.
+> **Form A reconciliation — 2026-10-28 (current implementation evidence, no production release approval):** Form A — **AIA | Website | General Enquiries** (`262946078314059`) has owner-confirmed direct EN/ES synthetic submission, native thank-you, generic no-answer/no-PDF staff notification, autoresponder delivery, fixed hidden Reply-To, no-webhook/integration, conditional-email and language evidence. The owner also reports successful isolated Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record that third route explicitly before release rather than inferring it. This completes functional submission acceptance for the reported samples, not seven-route responsive, accessibility, telemetry/privacy, deployment or site-release acceptance. Its hidden presentation field is **Advanced → Field Details → Unique Name = `formContext`** (exact case). The current Astro adapter is implemented only for gated, non-indexing isolated tests: `/contact`, `/es/contact`, `/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay`, and `/lp/early-intervention`; the five landing journeys now use fixed `formContext=landing`, superseding their earlier Form B mapping. Forms B and C remain planned; their field keys and IDs must not be guessed.
 
 ## 1. Actual baseline and reconciliation
 
@@ -16,7 +16,7 @@ Current source-manifest construction confirmed nine eligible enquiry routes and
 
 The owner reports that new **Form A — General Enquiries** (`262946078314059`) has field PHI protection; a generic notification without submitted values or PDF attachment; no webhooks or integrations; and privacy approval for that direct-to-Jotform configuration. This is owner-confirmed evidence from a ChatGPT WebUI/Jotform review, not a repository-side Builder audit. It does not authorize production activation, external submissions, analytics, or advertising.
 
-The confirmation is limited. Recipient access and Form A retention/deletion controls are owner-verified, while exact role/retention-policy details remain account-policy information outside this repository. Exact conditional logic, default/reply-to/header behavior, redirects/confirmation, autosave/save-and-continue, availability/spam settings, full EN/ES runtime acceptance, and synthetic delivery acceptance remain pending. Forms B and C are not covered.
+The confirmation is limited. Recipient access and Form A retention/deletion controls are owner-verified, while exact role/retention-policy details remain account-policy information outside this repository. Direct conditional-email/language, Reply-To, notification/autoresponder delivery and native confirmation evidence is recorded, but the exact wider conditional logic, defaults, autosave/save-and-continue, availability/spam settings, embedded-iframe submission/confirmation, full responsive/accessibility acceptance and runtime network/privacy behavior remain pending. Forms B and C are not covered.
 
 | Inventory ID | Route | Source content under `www/src/content/pages` | Owning component under `www/src/components` | Target |
 |---|---|---|---|---|
@@ -32,7 +32,7 @@ The confirmation is limited. Recipient access and Form A retention/deletion cont
 
 Nine instances = 7 EN + 2 ES, three implementations. Eleven GET search instances remain separate. No Arabic enquiry form or Spanish referral route is created. EN/ES-capable logical forms do not imply new published routes.
 
-The five imported landing-page journeys—`/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay` and `/lp/early-intervention`—are accounted for as future Form B destinations. Their inactive consultation panels are not additional native form implementations and do not have Jotform IDs.
+The five imported landing-page journeys—`/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay` and `/lp/early-intervention`—are current gated Form A isolated-test placements with fixed `formContext=landing&language=en`. This supersedes their earlier Form B mapping only for these journeys. Form B remains the future destination for other service-consultation routes that need its additional approved fields. The landing panels are not additional native form implementations, and Form A is absent from off/mock/indexing output.
 
 ### Discrepancies and supersession notes
 
@@ -97,7 +97,7 @@ For off mode prefer non-form fallback markup without editable lead controls or a
 
 Mock fixtures must be synthetic and inert to external requests, including Enter and native submission paths; Playwright aborts unapproved requests before transmission. Fixture URLs/assets must not appear in the production route manifest. Live descriptors must not leak into off/mock emitted bundles through shared imports—scan generated HTML, scripts and preload hints.
 
-Parent component preserves approved page design, explanatory text, iframe title, hosted fallback and responsive width/height. Cross-origin child labels/errors must be verified in Jotform; Astro locale and CSS do not localize/fix them. No guessed `?language=es`, hidden-field mapping, completion event or helper script. Loading/error UI must not claim it can inspect the child DOM. A frame load is not proof of availability or accepted submission.
+Parent component preserves approved page design, explanatory text, iframe title, hosted fallback and responsive width/height. The Form A adapter uses owner-verified fixed `language=en|es` and `formContext=contact|landing` values only; it forwards no visitor data. Cross-origin child labels/errors must be verified in Jotform; Astro locale and CSS do not localize/fix them. The first-party fallback remains hidden without layout space, appears only after a 15-second missing-load timeout, and has a localized noscript version. Loading/error UI must not claim it can inspect the child DOM. A frame load is not proof of availability, application initialization or accepted submission.
 
 Drawer decision is a prerequisite for replacing its live content: retain timer only if approved and incapable of loading vendor resources without the approved trigger; otherwise use an explicitly approved open/load interaction or full-page fallback. Preserve Escape/initial focus/restoration and test cross-origin focus boundaries. No wholesale dialog replacement.
 
@@ -145,7 +145,7 @@ The owner separately reports that the existing `AIA Lead Generator | plain` form
 - **Objective:** verify JF-09 and runtime JF-03/08 with actual approved isolated form(s).
 - **Authorization:** separately approve test form IDs, origins, environment, synthetic input set, notification recipient roles, permitted methods/network destinations and test window. This is not covered by GET-only prior browser authorization.
 - **Prerequisites:** Three blank forms created and their configuration review recorded in B; C mode guards; operations/privacy/language settings approved. Use loopback preview, exact test-only allowlist; production counters/maps/Google/unrelated resources blocked.
-- **Acceptance:** actual EN/ES submit/error/cancel/retry behavior; delivered generic emails and headers inspected in a controlled workflow; no answers/identifiers/attachments; no Contabo forwarding; iframe/fallback, keyboard, real screen reader where available, 200%/400% zoom, slow/offline/block scenarios. Use no real patient data; retain only sanitized results.
+- **Acceptance:** for Forms B/C, actual approved EN/ES submit/error/cancel/retry behavior and controlled generic-email/header inspection. For Form A, owner-reported direct-Jotform and sampled Astro-iframe synthetic submission/confirmation are complete; final fallback, keyboard, real screen reader where available, 200%/400% zoom, slow/offline/block scenarios, all-seven-route acceptance and runtime-network review remain pending. Use no real patient data; retain only sanitized results.
 - **Stop:** test-form evidence and remaining gates; no production IDs or deployment.
 
 ### Batch E — Approved production mapping and staged-site integration
@@ -236,3 +236,7 @@ Roster reconciliation, version 1.1: only the October 18 contract, plan and check
 Decision revision, version 1.2, 2026-10-21: the owner superseded the working-copy proposal with three new blank Jotform forms. Batch A now finalizes specifications, Batch B creates the three disabled forms only after explicit mutation authorization, and later batches retain off/mock/live safeguards. The 27-form legacy roster and all existing workflows remain historical/operationally independent. No source components, tests, Jotform forms or production systems were changed.
 
 Version 1.3, 2026-10-27: records owner-confirmed Form A configuration evidence from the owner’s ChatGPT WebUI/Jotform review. Form A field PHI protection, the generic no-PHI notification template, absence of submission-PDF attachment, absence of webhooks/integrations, and privacy approval are confirmed for that form’s configuration scope. The update records recipient access and retention/deletion as owner-verified for Form A. It does not close conditional routing, runtime acceptance, live activation, Forms B/C configuration or any broader P9-03/P9-07 gate.
+
+Version 1.4, 2026-10-28: reconciles owner-confirmed direct Form A runtime evidence and the implemented seven-route isolated iframe adapter. The five landing routes now use Form A under the isolated-test gate, superseding their earlier Form B mapping; Form B remains for other service-consultation journeys. Direct tests do not close embedded-iframe, runtime/privacy, accessibility or production gates.
+
+Version 1.5, 2026-10-28: records owner-reported embedded synthetic submission and confirmation on the English and Spanish contact routes plus one ABA landing placement. It completes Form A functional submission acceptance for the reported samples, while retaining route-specific confirmation, all-seven-route responsive/accessibility, runtime/privacy, deployment and release gates.