feat(forms): add Form A iframe fallback safeguards

www/reports/phase-9-jotform-integration-contract-2026-10-18.md

@@ -1,10 +1,10 @@
 # P9-03 Jotform integration contract
 
-**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.3 · **Decision revision:** 2026-10-27
+**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.5 · **Decision revision:** 2026-10-28
 
 **Status: documented planning architecture; implementation and activation NOT authorized.**
 
-This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 27. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence. No future commit SHA is invented.
+This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 28. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence; version 1.4 reconciles completed direct-Jotform testing and the seven-route isolated iframe adapter; version 1.5 records owner-reported embedded synthetic acceptance for sampled routes without treating it as seven-route release acceptance. No future commit SHA is invented.
 
 Companions: [source-specific implementation plan](phase-9-jotform-implementation-plan-2026-10-18.md), [verification and approval ledger](phase-9-jotform-verification-checklist-2026-10-18.csv).
 
@@ -50,7 +50,24 @@ The owner supplied the following **Form A-specific configuration evidence** afte
 - Form A has no webhooks or third-party integrations configured.
 - The owner reports privacy approval for these Form A controls and the direct-to-Jotform boundary.
 
-This confirmation includes owner-verified notification-recipient access and Form A submission-retention controls. The exact authorized roles and retention period remain account-policy information and are intentionally not copied into the repository. Conditional routing, reply-to/default-header behavior, autoresponder policy, redirect/thank-you behavior, EN/ES runtime behavior, spam/availability settings, and successful synthetic submission remain pending. It does not enable Form A, approve an iframe in a production artifact, or close P9-03, P9-05, P9-07, or Phase 10 release approval. Forms B and C remain separately planned and unverified.
+This confirmation includes owner-verified notification-recipient access and Form A submission-retention controls. The exact authorized roles and retention period remain account-policy information and are intentionally not copied into the repository. The later owner-confirmed direct-Jotform runtime evidence is recorded in section 2.2. It does not enable Form A, approve an iframe in a production artifact, or close P9-03, P9-05, P9-07, or Phase 10 release approval. Forms B and C remain separately planned and unverified.
+
+### 2.2 Form A direct runtime evidence and isolated iframe status — 2026-10-28
+
+The owner reports the following **direct-Jotform synthetic test evidence** for Form A. These tests were performed through Jotform itself; the repository did not submit data, inspect submissions, or access the Jotform account.
+
+- English and Spanish synthetic submissions completed successfully.
+- Native Jotform thank-you behavior was verified.
+- Staff-notification and family-autoresponder delivery were verified. The generic staff notification contained no submitted answers or PDF attachment.
+- Staff Reply-To was corrected with a fixed hidden email field and verified in Thunderbird.
+- No webhooks or third-party integrations are configured.
+- The conditional email requirement and language handling were verified.
+
+The owner additionally reports successful synthetic submission and native confirmation through the isolated Astro iframe on `/contact`, `/es/contact`, and one ABA landing placement. The owner report identifies the third placement only as an ABA landing page; record its exact route in the release test log rather than inferring it from the allowlist. These tests establish Form A's **functional submission acceptance** for the reported direct and embedded samples. The repository did not reproduce the submissions or inspect their answers.
+
+The remaining four or five landing placements, depending on the exact sampled ABA route, have automated rendering and fixed-URL coverage only. The current adapter is restricted to the seven placements listed in section 5 and to a separately gated, non-indexing `isolated-test` build. Its frame `load` event is only a transport signal; it is never treated as Jotform initialization, an accepted submission, or a conversion.
+
+Open Form A gates are therefore: final responsive, keyboard, screen-reader and fluent-language acceptance across all seven placements; Jotform runtime/network and telemetry privacy review; deployment/hosting acceptance; and final site-release authorization.
 
 ## 3. Account assets and accounting for all 27
 
@@ -178,7 +195,7 @@ Cross-checked against F-001–F-009 in the local CSV, current source and eligibl
 
 Three implementations, nine instances: seven EN, two ES, zero AR. Eleven GET search instances are not lead forms and must not be disabled or routed to Jotform. No new Arabic form or translated publication is authorized. Spanish service pages currently use Spanish consultation CTAs, not drawers. Arabic visitors retain established English fallbacks and clear language notices. All three logical forms prefer EN/ES capability, but no Spanish referral page or new route is implied.
 
-The five imported landing-page journeys—`/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay` and `/lp/early-intervention`—are all future Form B destinations. Their current consultation panels remain inactive; they do not add five native form implementations or new Jotform IDs.
+The five imported landing-page journeys—`/lp/aba-therapy`, `/lp/aba-insurance`, `/lp/aba-ahcccs`, `/lp/aba-private-pay` and `/lp/early-intervention`—are owner-approved **Form A** isolated-test placements, each using fixed `formContext=landing&language=en`. This supersedes their earlier Form B mapping only for these five journeys. Form B remains for other service-consultation journeys requiring its additional approved fields. The five panels do not add five native form implementations, and Form A remains unavailable in normal, indexing-enabled and production-shaped artifacts.
 
 Tour's actual CTA currently goes to `/client-consultation` (B destination). A is the provisional proposed Tour mapping, **not a completed route change**. Fundraising awaits owner confirmation. Historical event requests remain separate; do not reinterpret the historical Eventbrite link as the account's Event Submission Form without evidence. `/client-forms` retains existing clinical, agreement, Sign and CentralReach links. The six repository-linked Jotform destinations are not automatically matched to the four named account assets.
 
@@ -200,7 +217,7 @@ The connector supplied titles, IDs, enabled status, timestamps, labels and limit
 | JF-08 | Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback | Account/hosting/accessibility owners; exported code and later authorized runtime evidence |
 | JF-09 | Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary | **Later separately authorized** isolated form/environment; never real patient data |
 
-For Form A only, JF-01 (field PHI protection), JF-04 (generic no-PHI notification, recipient access and no PDF attachment), JF-06 (no webhooks/integrations), and the corresponding privacy/access/retention portions of JF-07/OA-05 are owner-verified as of 2026-10-27. Each is **partial**: the remaining verification listed in its row is still required. JF-02, JF-03, JF-05, JF-08 and JF-09 remain pending. Read-only Builder review may complete other configuration portions; runtime portions remain pending until explicitly authorized. Generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) tracks the exact scope, remaining work and supplied complete roster.
+For Form A only, JF-01 (field PHI protection), JF-04 (generic no-PHI notification, corrected fixed Reply-To, tested notification/autoresponder delivery, recipient access and no PDF attachment), JF-06 (no webhooks/integrations), and the corresponding privacy/access/retention portions of JF-07/OA-05 are owner-verified. JF-03 is partially verified for direct English/Spanish language handling and the conditional email requirement. JF-05 is partially verified for direct native thank-you behavior. JF-09 functional submission acceptance is owner-reported as complete for direct EN/ES and embedded English contact, Spanish contact and one ABA landing sample. The exact third embedded route remains to be recorded; that prevents treating the evidence as seven-route acceptance. JF-02 and the remaining portions of JF-03, JF-05, JF-07, JF-08 and JF-09—including seven-route accessibility, runtime/network privacy and release scope—remain pending. Read-only Builder review may complete other configuration portions; generic vendor documentation does not close a gate. The [CSV ledger](phase-9-jotform-verification-checklist-2026-10-18.csv) tracks the exact scope, remaining work and supplied complete roster.
 
 ## 7. Future integration-mode contract
 
@@ -210,13 +227,14 @@ Suggested semantic setting: `PUBLIC_AIA_FORMS_MODE`, exact values `off`, `mock`,
 |---|---|
 | off | No active lead form/empty POST action, live iframe, Jotform preconnect/helper/network request, or analytics. Render approved localized contact fallback; no native-submit bypass on inactive lead UI |
 | mock | Synthetic local-only fixture, no external endpoint or real data; safe guarded Playwright use; no Jotform ID required |
-| live | Separate owner/deployment approval; exact approved IDs/HTTPS origins/URLs and build/deploy gate; no automatic original-form fallback. Distinguish authorized isolated test form from authorized production form |
+| isolated-test | Form A only: requires `PUBLIC_AIA_FORMS_MODE=isolated-test`, `PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test`, `PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=false`, `PUBLIC_ALLOW_INDEXING=false`, and a fixed seven-route allowlist. It is not a production mode. |
+| live | Separate owner/deployment approval; exact approved IDs/HTTPS origins/URLs and build/deploy gate; no automatic original-form fallback. The current Form A adapter rejects it. |
 
 Off/mock output must not contain **new lead embed IDs/URLs or the historical `250727122848156` reference ID** in HTML, scripts, preload hints or client bundles. Existing clinical/Sign links intentionally remain in the site; they already contain production destinations. Preserving them conflicts with a blanket “no production ID anywhere” assertion, so this contract's new-embed restriction is scoped to the new lead integration. Existing user-initiated clinical navigation is not permission for automatic loading or test submissions. Do not claim the whole site has zero vendor destinations.
 
 A separately approved isolated test can exercise live integration capability with **test-only mappings** and controlled notifications. Normal staging defaults off and cannot inherit production mappings. `PUBLIC_ALLOW_INDEXING` is independent and provides no privacy isolation. Forms modes do not change the separate likes/views API policy or existing map resource behavior; guarded tests still block those endpoints.
 
-Reusable iframe requirements: exact approved HTTPS origin and URL, localized accessible title, responsive width and tested height, visible hosted fallback, loading/error explanation, mobile scroll, keyboard/focus support and minimal permissions. No arbitrary queries, unreviewed helper scripts, guessed language keys or untrusted cross-origin events. Frame `load` is not success. CSP/referrer policy require review; a parent policy does not control all resources inside the cross-origin document. Do not introduce a Contabo CORS proxy.
+Reusable iframe requirements: exact approved HTTPS origin and URL, localized accessible title, responsive width and tested height, keyboard/focus support and minimal permissions. The Form A adapter keeps a direct hosted-form fallback hidden without layout space, reveals it after a 15-second missing-load timeout, cancels that timeout on `load`/disposal, and exposes a localized `<noscript>` fallback. A frame `load` only ends the timeout; it is not proof of Jotform initialization, application health, accepted submission or conversion, and cannot diagnose cross-origin application errors. No arbitrary queries, unreviewed helper scripts, guessed language keys or untrusted cross-origin events. CSP/referrer policy require review; a parent policy does not control all resources inside the cross-origin document. Do not introduce a Contabo CORS proxy.
 
 The existing ten-second drawer timer must not cause Jotform loading without explicit UX/privacy approval. Retention of auto-opening, explicit open and click-to-load are pending options. No wholesale dialog redesign is authorized. If embedding cannot satisfy usability/accessibility/privacy, use the approved hosted fallback.
 
@@ -281,3 +299,7 @@ Version 1.1, 2026-10-18: adds the complete owner-supplied 27-ID roster and disti
 Version 1.2, 2026-10-21: records the owner's decision to create three new blank Jotform forms from scratch. Supersedes the earlier working-copy proposal for `250727122848156`; preserves that ID as historical reference evidence only. Adds the owner-reported legacy-form remediation summary, retains all existing workflows, changes Batch B and OA-03 to blank-form creation, and leaves JF-01–09 and all owner approvals Pending/Unverified. No Jotform access or mutation occurred during this documentation revision.
 
 Version 1.3, 2026-10-27: records owner-confirmed Form A (`262946078314059`) evidence from the owner’s ChatGPT WebUI/Jotform review: field PHI protection, the generic no-PHI notification template, no submission-PDF attachment, no webhooks/integrations, and privacy approval for that configuration scope. It marks only the corresponding Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05 in the ledger. Recipient access and retention are owner-verified; routing/defaults, runtime acceptance and activation remain open; no account access, mutation, submission, deployment or tracking occurred in this repository update.
+
+Version 1.4, 2026-10-28: records owner-confirmed direct Form A EN/ES synthetic submission, native thank-you, notification/autoresponder delivery, fixed hidden Reply-To, no-answer/no-PDF staff notification, no webhook/integration, conditional-email and language evidence. It reconciles the five landing journeys to gated Form A isolated-test placements, documents the conditional hosted fallback, and preserves the remaining embedded-iframe, runtime/privacy and production gates. No repository-side Jotform access, submission, activation or deployment occurred.
+
+Version 1.5, 2026-10-28: records the owner's successful embedded synthetic submission and native-confirmation report for English contact, Spanish contact and an ABA landing placement. It marks Form A functional submission acceptance complete only for those owner-reported samples, explicitly keeps the third route name to be recorded, and retains seven-route accessibility, runtime/privacy, deployment and site-release gates. It changes the official Jotform embed-handler decision from rejected to conditionally acceptable pending a separately authorized source, origin, privilege and Firefox/error-state review; the handler is not implemented.