docs(referrals): retire Form C plan and document existing hosted workflow

www/reports/SESSION_HANDOFF.md

@@ -1,6 +1,22 @@
 # AIA Astro Migration — Living Session Handoff
 
-**Last updated:** October 30, 2026 (UTC)
+## Current referral decision — 2026-11-01 (supersedes Form C planning)
+
+The owner directs `/referrals` to retain the current public-site workflow: one
+button-styled **Refer a Client** link to
+[the existing hosted Jotform](https://form.jotform.com/231638510219149). There is **no separate Form C**
+to create, embed, configure or launch. The former Form C / proposed two-form
+architecture is historical only. `/referrals` renders no local form or Form A
+iframe; the original 16 approved Form A placements remain unchanged.
+
+This is authorization to restore the existing destination in Astro, **not**
+verification of that separate legacy Jotform's HIPAA configuration, notification
+recipients, patient-data handling, accessibility or continued operational
+suitability. Review the actual hosted form and its clinical/privacy claims before
+production cutover. No account modification or submission occurred in this PR.
+
+
+**Last updated:** November 1, 2026 (UTC)
 **Repository:** `AIAMarketing/azinstitute4autism.com`
 **Working branch:** `faithful-astro-migration`
 **Last pushed checkpoint:** `55adb797051473c3067a0d454515153237e9b8d6` — completion handling and portal styling. The new commit containing this handoff simplifies Form A to default-live without rewriting that history.
@@ -26,7 +42,7 @@ and form environment role are retired, not renamed.
 Indexing and forms are independent. Both publication modes emit ten immediate
 frames (two contact, five landing, three consultation) and six deferred bilingual
 service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
-origin, context and language. Forms B/C are not activated; physical B is retired.
+origin, context and language. Form B is retired; Form C is canceled by the November 1 referral decision.
 
 Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
 manual CTA override, deferred loading, verified completion acknowledgment for
@@ -213,10 +229,10 @@ trusted-source comparison. No insecure retrieval was repeated.
 
 ### Current two-form status — 2026-10-29
 
-- Form A uses one 16-placement live registry: two contact, five landing, three standalone consultation and six EN/ES service drawers. Mode defaults to live; off/mock are explicit options. See the current decision above and the two-form specification.
+- Form A uses one 16-placement live registry: two contact, five landing, three standalone consultation and six EN/ES service drawers. Mode defaults to live; off/mock are explicit options. `/referrals` independently links to the owner-approved existing hosted Jotform; Form C creation is canceled. See the November 1 decision above.
 - Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-sixteen-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
 - The adapter retains fixed URLs, responsive fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, no helper script, and a hosted fallback that is hidden without space until a 15-second missing-load timeout. A frame load only clears that timeout; it does not prove cross-origin application health or accepted submission. The official Jotform resizing handler is conditionally acceptable pending separately authorized source, origin, privilege, Firefox and error-state verification; it is not implemented. Fixed heights remain current.
-- No additional Form A approval/environment flags remain. Indexing does not authorize or disable forms. Marketing-only notification routing remains a pre-cutover operational check. Rollback requires explicit mode `off`, rebuild and artifact verification; merely removing the mode restores live. Form C, counters, analytics and API forwarding remain inactive.
+- No additional Form A approval/environment flags remain. Indexing does not authorize or disable forms. Marketing-only notification routing remains a pre-cutover operational check. Rollback requires explicit mode `off`, rebuild and artifact verification; merely removing the mode restores live. No Form C is needed. Counters, analytics and API forwarding remain inactive.
 
 The indexing-enabled build has 127 HTML routes/canonicals and 109 sitemap URLs.
 Normal staging has 128 `noindex,nofollow` pages because it also contains `/lp`;