refactor(forms): enable approved Form A placements by default

www/README.md

@@ -582,12 +582,25 @@ The live crawl is optional and may fail in restricted network environments.
 
 ## Forms
 
-Forms are intentionally static and do not submit anywhere. Before production:
+As of the owner decision on 2026-10-30, `npm run dev` and `npm run build`
+use live Jotform Form A on exactly 16 approved placements: 10 immediate frames
+and six deferred bilingual service drawers. No Form A flags are required.
+Public development-host forms are owner-authorized. This does not authorize cutover.
 
-1. Select a form backend.
-2. Connect the forms.
-3. Add spam protection.
-4. Test validation, confirmation, and failure states.
+Use `PUBLIC_AIA_FORMS_MODE=off npm run build` for an offline artifact, or
+`PUBLIC_AIA_FORMS_MODE=mock npm run dev` for synthetic fixtures. Missing/empty
+mode means live; obsolete `isolated-test` and other invalid values produce an
+explicit configuration error. Remove old approval/environment variables from
+local settings. Indexing is independent of forms; counters remain off by default.
+
+See the [current Form A guide](integrations/jotform/README.md) for the exact
+registry, safeguards, rollback and owner acceptance requirements. Form C remains
+inactive. Employee-portal private input retains its own separate gates.
+
+Verify matching output with
+`node tools/phase10-artifact-verify.mjs --mode=staging --forms=live`;
+use `--mode=indexing` for indexing output and `--forms=off` or `--forms=mock`
+for those explicit builds. No actual submissions run in automated tests.
 
 ### Google Ads consultation-form conversion handoff
 
@@ -597,7 +610,7 @@ instructions are in
 This is documentation only: **do not install Google tags or conversion snippets**
 on health-service pages or turn on enhanced conversions until AIA's
 privacy/HIPAA and advertising-policy review explicitly approves the complete
-data flow. Count conversions only after the form API confirms success.
+data flow. Any future measurement needs separately approved success and privacy semantics; the former API-success premise is historical and no tracking is active.
 
 ## Troubleshooting