refactor(forms): enable approved Form A placements by default

www/reports/SESSION_HANDOFF.md

@@ -3,7 +3,7 @@
 **Last updated:** October 30, 2026 (UTC)
 **Repository:** `AIAMarketing/azinstitute4autism.com`
 **Working branch:** `faithful-astro-migration`
-**Last accepted technical implementation:** consolidated service drawers and employee-portal preview at `e97f0ea9b475715a1ea58110a27cdf50a2b3cb19`; the commit containing this handoff adds the focused completion/styling correction pass
+**Last pushed checkpoint:** `55adb797051473c3067a0d454515153237e9b8d6` — completion handling and portal styling. The new commit containing this handoff simplifies Form A to default-live without rewriting that history.
 **Previous accepted checkpoint:** P9-03 documentation, signed `537f9864a0a3d0806180cbeca909bf1d03200c6f`
 **Implementation checkpoint:** the commit containing this handoff update; obtain its actual SHA from Git history after the signed checkpoint is created.
 **Next milestone:** continue Phase 9 owner decisions and authorized integration batches; then Phase 10 — Final QA/Cutover Readiness.
@@ -12,6 +12,50 @@ The landing-page migration is technically completed for checkpoint purposes.
 Editorial, accessibility, stakeholder and production-release approval remain
 separate. This handoff does not authorize deployment or integration activation.
 
+## Current decision — 2026-10-30: default-live Form A
+
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+## Latest verified validation — 2026-10-30 default-live revision
+
+206 tests pass; Astro check has zero diagnostics. Normal default-live staging:
+128 routes, empty sitemap, zero hreflang, ten immediate plus six deferred Form A
+frames. Indexing-enabled: 127 routes, 109 sitemap URLs, 180 hreflang links, the
+same 16 placements. Explicit off/mock artifacts contain no real Form A frames.
+Guarded browser regressions preserve drawer completion/suppression and portal
+fixture behavior; 128/128 staging routes open. Link/image/blog audits have zero
+findings. See the current default-live report for exact overlapping check counts,
+network interception evidence and remaining owner acceptance. No deployment,
+Jotform mutation or new real submission was performed.
+
 ## Authority and checkpoint history
 
 Read repository-root `AGENTS.md`, `MIGRATION_BRIEF.md` and `AUTONOMOUS-CODEX.md`,
@@ -169,10 +213,10 @@ trusted-source comparison. No insecure retrieval was repeated.
 
 ### Current two-form status — 2026-10-29
 
-- Form A (`262946078314059`) has a frozen seven-route production-eligible allowlist: `/contact`, `/es/contact`, the four campaign landing routes and `/lp/early-intervention`. The five landing journeys use fixed `formContext=landing&language=en`. The owner has retired physical Form B. The owner reports Form A `consultation` is configured, and the repository now has a separate nine-route, non-indexing isolated-test allowlist: `/client-consultation`, `/es/client-consultation`, `/schedule-consultation`, the three English service drawers and the three matching Spanish service drawers. Those routes require `PUBLIC_AIA_FORMS_CONSULTATION_TEST_APPROVED=true` in addition to every isolated-test gate and are never production-authorized by the seven-route resolver. Form C remains a separate future professional-referral form. See [the two-form integration specification](phase-9-two-form-integration-specification-2026-10-28.md).
-- Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-seven-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
+- Form A uses one 16-placement live registry: two contact, five landing, three standalone consultation and six EN/ES service drawers. Mode defaults to live; off/mock are explicit options. See the current decision above and the two-form specification.
+- Owner-confirmed direct-Jotform evidence covers synthetic EN/ES submission, native thank-you, conditional email/language, generic no-answer/no-PDF staff notification, autoresponder delivery, corrected fixed Reply-To, no webhooks/integrations, privacy scope, recipient access and retention. The owner also reports successful Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record the exact third route before release. Functional submission acceptance is complete only for those owner-reported samples. All-sixteen-route accessibility, runtime-network/telemetry, deployment and site-release acceptance remain open.
 - The adapter retains fixed URLs, responsive fixed heights, `no-referrer`, `allow-forms allow-scripts allow-same-origin`, no helper script, and a hosted fallback that is hidden without space until a 15-second missing-load timeout. A frame load only clears that timeout; it does not prove cross-origin application health or accepted submission. The official Jotform resizing handler is conditionally acceptable pending separately authorized source, origin, privilege, Firefox and error-state verification; it is not implemented. Fixed heights remain current.
-- A separate local production gate is prepared for Form A only. It requires `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production` and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true`; the fixed seven-route allowlist remains enforced. `PUBLIC_ALLOW_INDEXING=true` permits an indexing-enabled release artifact but never authorizes a form. Normal/off/mock behavior remains fail-closed. The isolated consultation surfaces require an explicit user action before a service-drawer iframe gets a `src`; they retain no-referrer, minimal sandbox, fixed dimensions and the conditional hosted fallback. Form C, analytics and API forwarding remain inactive. Marketing-only notification routing is a pre-cutover operational check. Rolling back Form A means rebuilding with mode `off` or an absent approval value and switching only the static artifact; it does not alter Jotform.
+- No additional Form A approval/environment flags remain. Indexing does not authorize or disable forms. Marketing-only notification routing remains a pre-cutover operational check. Rollback requires explicit mode `off`, rebuild and artifact verification; merely removing the mode restores live. Form C, counters, analytics and API forwarding remain inactive.
 
 The indexing-enabled build has 127 HTML routes/canonicals and 109 sitemap URLs.
 Normal staging has 128 `noindex,nofollow` pages because it also contains `/lp`;

www/reports/phase-10-technical-readiness-package-2026-10-22.md

@@ -3,6 +3,40 @@
 Date: 2026-10-22 UTC
 Status: Technical handoff prepared; production gates remain open.
 
+## Current decision — 2026-10-30: default-live Form A
+
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+The following acceptance matrix records the original October 22 results; see the new report for October 30 validation.
+
 ## Acceptance matrix
 
 | Area | Evidence | Result | Human/owner gate |
@@ -35,10 +69,12 @@ node --test tools/phase9-nonproduction.test.mjs
 node --test tools/phase10-artifact.test.mjs
 npm run build
 PUBLIC_ALLOW_INDEXING=true npm run build
+node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
+npm run build
 npm run audit:links
 npm run audit:images
 npm run audit:blog
-node tools/phase10-artifact-verify.mjs --mode=staging
+node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
 node tools/phase10-release-rehearsal.mjs
 ```
 
@@ -49,7 +85,7 @@ The final normal staging build was restored after the indexing build. The explic
 1. Record a locked Node/npm/toolchain and reproducible artifact manifest.
 2. Obtain sanitized Contabo/NixOS/nginx/TLS/DNS/Cloudflare facts.
 3. Verify host-local serving, canonical host, redirects, 404s, cache headers and rollback on an approved staging host.
-4. Form A has owner-reported functional acceptance and a local production gate, but still needs exact release-environment review, all-seven-route accessibility acceptance, runtime telemetry/privacy review, marketing-recipient operational review and no-deployment static-artifact verification. Its owner-reported configured `consultation` context is limited to nine isolated-test-only placements and remains outside the production resolver; physical Form B is retired; Form C remains unimplemented. Use Form A only when all four explicit build settings are approved: `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production`, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true`. `PUBLIC_ALLOW_INDEXING=true` is publication behavior only.
+4. Default-live Form A is owner-authorized on exactly 16 placements, including public development hosting. No approval flags remain; indexing is independent. Final accessibility, Spanish options/provider-event, runtime privacy and marketing-recipient operational review remain open. Form C remains unimplemented. Site cutover still needs release authorization.
 5. Obtain P9-04 counter origin/credential/consent approval before a live adapter.
 6. Resolve P9-05 analytics/advertising measurement and P9-07 privacy/legal approval.
 7. Obtain P9-06 clinical/organizational and fluent-language approvals, including Arabic diagrams and Spanish HSA/FSA claims.
@@ -59,7 +95,7 @@ The final normal staging build was restored after the indexing build. The explic
 
 ## Decision status
 
-P9-01 through P9-10 remain **Pending decision**. No technical feasibility result in this package is an approval. Jotform, counters, analytics, advertising, forms, employee portal, redirects and hosting remain inactive.
+P9-01 through P9-10 remain **Pending decision**. No technical feasibility result in this package is an approval. Default-live Form A is explicitly owner-authorized. Counters, analytics, advertising, Form C, private portal serving and hosting activation remain separate and unauthorized by this package.
 
 ## Recommended checkpoint boundaries
 

www/reports/phase-9-contabo-deployment-readiness-2026-10-21.md

@@ -1,5 +1,7 @@
 # Phase 9 P9-09 — Contabo Deployment Readiness and Rollback Plan
 
+> **Historical configuration superseded on 2026-10-30:** The default-live [Form A revision](phase-9-form-a-default-live-2026-10-30.md) replaces the former form approval/environment gates with optional live/off/mock mode on 16 placements. Earlier commands and results below describe their recorded checkpoint, not current startup requirements. No historical test result has been rerun or relabeled here.
+
 Date: 2026-10-21
 Status: Planning only; no VPS, DNS, Cloudflare, nginx or TLS system was contacted or changed.
 

www/reports/phase-9-drawer-portal-corrections-2026-10-30.md

@@ -1,5 +1,7 @@
 # Focused consultation completion and portal presentation correction
 
+> **Historical configuration superseded on 2026-10-30:** The default-live [Form A revision](phase-9-form-a-default-live-2026-10-30.md) replaces the former form approval/environment gates with optional live/off/mock mode on 16 placements. Earlier commands and results below describe their recorded checkpoint, not current startup requirements. No historical test result has been rerun or relabeled here.
+
 Date: 2026-10-30 UTC. Starting branch `faithful-astro-migration`, starting HEAD
 `e97f0ea9b475715a1ea58110a27cdf50a2b3cb19`. Tracked tree and index were clean;
 no untracked paths were reported at preflight. The checkpoint is the commit

www/reports/phase-9-form-a-consultation-isolated-test-2026-10-29.md

@@ -1,5 +1,7 @@
 # Phase 9 — Form A consultation isolated-test integration
 
+> **Historical configuration superseded on 2026-10-30:** The default-live [Form A revision](phase-9-form-a-default-live-2026-10-30.md) replaces the former form approval/environment gates with optional live/off/mock mode on 16 placements. Earlier commands and results below describe their recorded checkpoint, not current startup requirements. No historical test result has been rerun or relabeled here.
+
 **Recorded:** 2026-10-29 UTC
 **Scope:** Form A (`262946078314059`) consultation context in local, non-indexing isolated-test builds
 **Status:** implemented and locally verified without a Jotform submission; owner acceptance pending

www/reports/phase-9-form-a-default-live-2026-10-30.md

@@ -0,0 +1,248 @@
+# Phase 9 — Default-live Form A simplification
+
+Recorded: 2026-10-30 UTC. This is an owner-authorized architectural revision,
+not a site-cutover or deployment authorization.
+
+## Baseline and authority
+
+Started on `faithful-astro-migration` at pushed checkpoint
+`55adb797051473c3067a0d454515153237e9b8d6`
+(`fix(forms): close completed drawers and restore portal styling`). The tracked
+working tree and index were clean. This work is a new descendant checkpoint;
+the pushed commit is not amended, rebased or reset.
+
+The owner explicitly authorizes working Form A on publicly reachable
+`https://aia.web3app.dev/`, with owner-controlled test notifications and cleanup.
+No extra hostname, environment-role, password or approval gate is introduced.
+Earlier isolated-test/seven-route production-gate reports retain their original
+results and now link to this superseding decision.
+
+## Implementation
+
+- `PUBLIC_AIA_FORMS_MODE` supports `live`, `off`, `mock`. Absent, empty or
+  whitespace-only mode defaults to live. Invalid explicit values, including
+  `isolated-test`, stop configuration with instructions to remove the obsolete
+  value or choose a supported mode.
+- Removed the five former form approval/environment variables from active code,
+  `.env.example` and current operating instructions. No replacement gate exists.
+- One typed registry fixes 16 route/locale/context triples. The ID and origin
+  remain `262946078314059` and `https://form.jotform.com`. No visitor input,
+  arbitrary origin, service preselection or extra query parameter is accepted.
+- Indexing is independent: both publication modes contain the same ten immediate
+  frames and six deferred drawer URLs. Publication metadata and content are unchanged.
+- Native inactive/mock surfaces remain separate from the real iframe adapter.
+  `/referrals` and future Form C cannot activate through live mode.
+- Live drawers retain four-second OR 50%-scroll opening, first-trigger wins,
+  global 30-day dismissal/success suppression, manual CTA override, deferred
+  iframe loading, native dialog focus/Escape/backdrop handling and reduced motion.
+  Off mode stops automatic inactive drawers; CTA navigation remains usable.
+- Verified completion handling is unchanged: exact origin, actual activated/open
+  iframe window, correct form ID/action, idempotence, localized acknowledgment,
+  full five-second interval, slide-out and focus restoration. A later manual
+  reopening after completion gets a fresh iframe. No load/click is success.
+- Shared iframe heights, sandbox, no-referrer, fixed URLs, 15-second conditional
+  hosted fallback and localized noscript fallback remain unchanged.
+- Employee portal no longer reads the retired form environment variable. It
+  still requires its own explicit approval, a valid private ciphertext input and
+  explicit non-indexing preview setting. Normal builds contain no private payload.
+  Decryption, sanitized rendering, styles, SOPS and private resources are unchanged.
+
+## Approved placements
+
+| Route | Locale | Context | Loading |
+|---|---|---|---|
+| `/contact` | en | contact | immediate |
+| `/es/contact` | es | contact | immediate |
+| `/lp/aba-therapy` | en | landing | immediate |
+| `/lp/aba-insurance` | en | landing | immediate |
+| `/lp/aba-ahcccs` | en | landing | immediate |
+| `/lp/aba-private-pay` | en | landing | immediate |
+| `/lp/early-intervention` | en | landing | immediate |
+| `/client-consultation` | en | consultation | immediate |
+| `/es/client-consultation` | es | consultation | immediate |
+| `/schedule-consultation` | en | consultation | immediate |
+| `/aba-therapy` | en | consultation | deferred drawer |
+| `/autism-evaluations` | en | consultation | deferred drawer |
+| `/learner-social-club` | en | consultation | deferred drawer |
+| `/es/aba-therapy` | es | consultation | deferred drawer |
+| `/es/autism-evaluations` | es | consultation | deferred drawer |
+| `/es/learner-social-club` | es | consultation | deferred drawer |
+
+Each URL is `https://form.jotform.com/262946078314059?formContext=CONTEXT&language=LOCALE`
+with the exact fixed values above. The six deferred frames do not have `src`
+until the drawer opens. Academy copy remains typed but has no published placement.
+
+## Validation
+
+- Astro check: 151 files, zero errors, warnings or hints. Each real build also
+  executes Astro check through the existing npm script.
+- Complete sequential test run: **206 passed, 0 failed/skipped**, including
+  Markdown, publication, SEO, Library, routes, campaign, preview, Form A,
+  counter/form isolation, artifact integrity and service/portal tests.
+- Initial consolidated run: 205/206. A campaign section-count assertion needed
+  to exclude the nested shared iframe section while preserving the original
+  seven page sections. Corrected the selector; focused rerun and full rerun pass.
+- Library/SEO off-mode presentation fixtures now explicitly select `off`, preserving
+  their existing localization assertions. Publication fixtures deliberately test
+  the empty/default-live mode in both publication configurations.
+- Links: 0 broken internal links. Images: 0 missing mapped images. Blog: 0 failures.
+- Invalid `PUBLIC_AIA_FORMS_MODE=isolated-test` build: rejected with actionable
+  guidance, as expected. Default build restored afterward.
+- Ordinary `npm run dev`: eight representative contact, landing, consultation
+  and EN/ES service routes returned default-live markup using loopback HTTP only.
+  The npm launcher detached its managed server; the initial process-group cleanup
+  returned ESRCH, so the identified task-owned server was stopped directly.
+- Markdown local links/fences, checklist column/ID consistency and `git diff --check`
+  pass. Historical evidence is retained; no current-source reconciliation claim
+  is made from an older fingerprint, and no historical JSON was regenerated.
+
+| Built artifact | HTML routes | Sitemap URLs | Hreflang links | Immediate/deferred Form A | Result |
+|---|---:|---:|---:|---:|---|
+| Normal staging, default live | 128 | 0 | 0 | 10 / 6 | Pass |
+| Indexing enabled, default live | 127 | 109 | 180 | 10 / 6 | Pass |
+| Staging, explicit off | 128 | 0 | 0 | 0 / 0 | Pass |
+| Staging, explicit mock | 128 | 0 | 0 | 0 / 0 | Pass |
+
+Staging remains `noindex,nofollow`; `/lp` review index appears only there.
+Indexing preserves author/campaign exclusions and translation architecture.
+Artifact unit fixtures additionally test off/mock against both publication modes,
+reject unknown destinations and premature drawer sources, and reject private
+portal payloads/resources, extra form IDs, API origins and tracking signals.
+No normal artifact contains active native lead-form actions or portal ciphertext.
+
+Guarded Chromium 149.0.7827.55 evidence (temporary, not committed screenshots):
+
+| Harness / artifact | Checks | Attempted Jotform GETs, intercepted locally | Evidence directory |
+|---|---:|---:|---|
+| Service/portal, default live | 47 | 37 | `/tmp/aia-service-portal-eOmGmZ` |
+| Contact/landing, default live | 35 | 38 | `/tmp/aia-form-a-iframe-5439e1` |
+| Consultation, default live | 45 | 40 | `/tmp/aia-form-a-consultation-ZzxRRB` |
+| Service/portal, off | 18 | 0 | `/tmp/aia-service-portal-IkEh6j` |
+| Contact/landing, off | 28 | 0 | `/tmp/aia-form-a-iframe-z838nC` |
+| Service/portal, mock | 18 | 0 | `/tmp/aia-service-portal-KxmUhB` |
+| Contact/landing, mock | 28 | 0 | `/tmp/aia-form-a-iframe-cetW0I` |
+
+Live coverage includes 320/390/768/1440px, all 16 placements, exact URLs,
+localized titles, delayed/late-load fallback, no-JavaScript, keyboard/dialog
+behavior, trigger/suppression lifecycle, five-second verified-message handling,
+duplicate/wrong messages, fresh-frame reopening and both encrypted synthetic
+portal views. Off/mock drawer checks cover all six routes at 390/1440px; off
+CTAs navigate and do not auto-open, mock retains its synthetic drawer behavior.
+
+The all-route guarded pass separately opened **128/128** staging routes with no
+failures or JavaScript exceptions. It recorded 10 approved Form A GET attempts,
+all blocked before transmission, and four blocked existing non-form resources.
+Evidence: `/tmp/aia-phase10-browser-zjwRCA`. These counts overlap the focused
+checks and are not additional unique routes. Every external request was blocked
+or fulfilled locally; zero real Jotform submissions, production API requests,
+analytics or advertising requests were sent. Existing map/resource attempts are
+recorded separately from approved Form A attempts. Real provider behavior,
+Firefox and human screen-reader acceptance were not reproduced.
+
+## Operator workflow
+
+From `www/`, with no Form A environment overrides:
+
+```sh
+npm run dev
+# Or build and inspect local static output:
+npm run build
+node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
+npm run preview -- --host 127.0.0.1
+```
+
+Both ordinary commands enable Form A. No deployment was performed. Remove stale
+`isolated-test` values from local `.env` files if the actionable error appears.
+Remove unused former approval/environment variables; they are not recognized gates.
+
+```sh
+# Indexing changes publication only:
+PUBLIC_ALLOW_INDEXING=true npm run build
+node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
+# Explicit form rollback/offline artifact:
+PUBLIC_AIA_FORMS_MODE=off npm run build
+node tools/phase10-artifact-verify.mjs --mode=staging --forms=off
+# Synthetic local fixtures:
+PUBLIC_AIA_FORMS_MODE=mock npm run dev
+# Restore ordinary staging output:
+npm run build
+```
+
+For service acceptance, use a fresh browser profile or remove only the
+`aia:service-inquiry:auto-suppressed-until` test preference. On EN/ES service pages,
+verify four-second/half-scroll opening; after dismissal, automatic opening stays
+suppressed while the existing CTA reopens manually. With JavaScript disabled or
+forms off, the CTA remains a consultation-page link. Do not clear unrelated storage.
+
+## Remaining owner acceptance and boundaries
+
+Owner-controlled real submissions must verify the provider's actual completion
+message and thank-you behavior. Automated fixtures validate the parent code, not
+Jotform delivery. The Spanish seven-option consultation dropdown remains a
+Builder translation/Update Options diagnostic; Astro supplies only fixed context
+and language and cannot modify the cross-origin options. No Jotform settings changed.
+
+Final fluent-language, screen-reader, all-route responsive/keyboard, runtime
+telemetry/privacy, HTTPS-host and notification-recipient operational acceptance
+remain distinct from this owner-authorized default-live architecture. Historical
+owner-reported direct and sampled embedded functional acceptance is preserved.
+Form C creation/integration, counter activation, analytics and advertising remain
+separate work. Site cutover, private portal serving and infrastructure activation
+are not authorized.
+
+No submissions, account mutations, API calls, deployment, push or infrastructure
+changes occurred. The accepted Jotform CSS backup is unchanged. Protected `merge-plan.md`,
+reconciliation archives and private portal collection were not read or changed.
+
+## Final artifact integrity
+
+Normal default-live staging restored: 410 files, aggregate SHA-256
+`cd042f9f6c27574e458223a73625f28e56b4bb964f7faf4cdb53a40acb19a4db`. This hashes only generated public output; it is not a production-release approval.
+
+## Exact checkpoint path inventory
+
+All paths below belong to this focused revision. Source changes remove form gates
+and decouple portal input; no content or accepted Jotform CSS was edited. The only
+new file is this report.
+
+- `www/.env.example`
+- `www/README.md`
+- `www/integrations/employee-portal/README.md`
+- `www/integrations/jotform/README.md`
+- `www/reports/SESSION_HANDOFF.md`
+- `www/reports/phase-10-technical-readiness-package-2026-10-22.md`
+- `www/reports/phase-9-contabo-deployment-readiness-2026-10-21.md`
+- `www/reports/phase-9-drawer-portal-corrections-2026-10-30.md`
+- `www/reports/phase-9-form-a-consultation-isolated-test-2026-10-29.md`
+- `www/reports/phase-9-form-a-default-live-2026-10-30.md`
+- `www/reports/phase-9-jotform-implementation-plan-2026-10-18.md`
+- `www/reports/phase-9-jotform-integration-contract-2026-10-18.md`
+- `www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv`
+- `www/reports/phase-9-service-portal-consolidated-2026-10-30.md`
+- `www/reports/phase-9-two-form-integration-specification-2026-10-28.md`
+- `www/src/components/ContactForm.astro`
+- `www/src/components/FormAPreview.astro`
+- `www/src/components/FormShell.astro`
+- `www/src/components/JotformIframe.astro`
+- `www/src/components/ServiceInquiryDrawer.astro`
+- `www/src/components/campaign/ConsultationForm.astro`
+- `www/src/components/campaign/EarlyInterventionPage.astro`
+- `www/src/components/pages/ContactPage.astro`
+- `www/src/components/pages/EmployeePortal.astro`
+- `www/src/scripts/service-inquiry.ts`
+- `www/src/utils/form-integration.ts`
+- `www/src/utils/portal-input.mjs`
+- `www/tools/campaign.test.mjs`
+- `www/tools/jotform-consultation-browser.mjs`
+- `www/tools/jotform-form-a-browser.mjs`
+- `www/tools/jotform-form-a-real-iframe-sizing.mjs`
+- `www/tools/jotform-form-a.test.mjs`
+- `www/tools/library.test.mjs`
+- `www/tools/phase10-artifact-verify.mjs`
+- `www/tools/phase10-artifact.test.mjs`
+- `www/tools/phase10-browser-regression.mjs`
+- `www/tools/phase9-nonproduction.test.mjs`
+- `www/tools/publication.test.mjs`
+- `www/tools/seo.test.mjs`
+- `www/tools/service-portal-browser.mjs`
+- `www/tools/service-portal.test.mjs`

www/reports/phase-9-jotform-implementation-plan-2026-10-18.md

@@ -1,6 +1,38 @@
 # P9-03 source-specific implementation plan
 
-Date: **2026-10-18** · Plan version **1.7 revision 2026-10-28** · Governing contract: [P9-03-JF-2026-10-18 v1.7](phase-9-jotform-integration-contract-2026-10-18.md).
+## Current decision — 2026-10-30: default-live Form A
+
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+Date: **2026-10-18** · Plan version **1.9 revision 2026-10-30** · Governing contract: [P9-03-JF-2026-10-18 v1.9](phase-9-jotform-integration-contract-2026-10-18.md).
 
 **Planning only. Do not execute any batch from this document without separate authorization.** Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes.
 

www/reports/phase-9-jotform-integration-contract-2026-10-18.md

@@ -1,8 +1,40 @@
 # P9-03 Jotform integration contract
 
-**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.8 · **Decision revision:** 2026-10-29
+## Current decision — 2026-10-30: default-live Form A
 
-**Status: Form A owner-approved for existing contexts; consultation surfaces implemented for isolated testing only; deployment and production consultation activation NOT authorized.**
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+**Contract ID:** P9-03-JF-2026-10-18 · **Version:** 1.9 · **Decision revision:** 2026-10-30
+
+**Current status: default-live Form A approved on 16 placements; site deployment/cutover not authorized. Historical contract follows.**
 
 This is the authoritative P9-03 planning contract for the owner decisions supplied on October 18 and revised through October 29. It supersedes conflicting *proposals* in the [October 17 inventory](phase-9-form-entry-point-inventory-2026-10-17.md), without rewriting that historical record. It does not supersede project policy, approve clinical/legal content beyond the Form A configuration scope recorded below, close the Phase 9 register, or authorize production changes. Future changes require an explicit owner decision, a version/change record and evidence links. Version 1.0 records the original planning instruction; version 1.1 adds the owner-supplied complete roster; version 1.2 supersedes the copy-based Form B proposal with three new blank forms; version 1.3 records limited owner-confirmed Form A configuration evidence; version 1.4 reconciles completed direct-Jotform testing and the seven-route isolated iframe adapter; version 1.5 records owner-reported embedded synthetic acceptance for sampled routes; version 1.6 adds the independent production-build gate without deploying it; version 1.7 retires physical Form B and specifies Form A consultation plus Form C referral planning; version 1.8 records the owner-reported consultation configuration and a separate nine-route isolated-test adapter. No future commit SHA is invented.
 

www/reports/phase-9-jotform-verification-checklist-2026-10-18.csv

@@ -6,8 +6,8 @@ JF-04,Emails,"Notifications/autoresponders, recipient roles, subject/body/dynami
 JF-05,Thank-you behavior,"Native confirmation, redirects, answer echo, all targets, HTTP POST forwarding",Account/privacy owner; Builder; submission-data POST to Astro/Contabo OFF,"Owner-confirmed 2026-10-28 direct-Jotform tests: native thank-you behavior verified. Redirect, answer echo, POST-forwarding settings and Astro-embedded confirmation remain open",Partially verified — Form A direct native thank-you,2026-10-28,Separate batch authorization; no action authorized by this checklist
 JF-06,Integrations,"Integrations, webhooks, exports, destinations, Google/analytics, protected-data flows","Account/security/privacy owner; actual integration inventory, not cloning assumptions",Owner-confirmed 2026-10-27 ChatGPT WebUI/Jotform review: Form A has no webhooks or integrations; export/default/vendor behaviors beyond that reported review remain unverified,Verified — Form A webhooks/integrations absent,2026-10-27,Separate batch authorization; no action authorized by this checklist
 JF-07,Security and availability,"HIPAA/form/field protection, spam, availability, prefill, save/continue, access, retention, limits and duplicates",Account/privacy/security owner; settings and approved operational policy,"Owner-verified 2026-10-27: privacy approval covers Form A PHI protection, generic no-PHI notification, no PDF attachment, no webhooks/integrations, recipient access and retention/deletion; other security/availability controls remain unverified","Partially verified — Form A approved configuration, access and retention scope",2026-10-27,Separate batch authorization; no action authorized by this checklist
-JF-08,Embedding,"Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback",Account/hosting/accessibility owners; exported code and later authorized runtime evidence,"Repository evidence 2026-10-28: fixed Form A origin/URLs, no-referrer policy, minimal sandbox, localized conditional hosted fallback and seven-route isolated-test gate. Owner reports embedded synthetic submission/confirmation on EN contact, ES contact and one ABA landing placement; exact third route and all-seven-route keyboard/responsive/runtime-network acceptance remain open",Partially verified — owner-reported sampled embedded acceptance plus adapter/fallback,2026-10-28,Separate batch authorization; no action authorized by this checklist
-JF-09,Controlled synthetic acceptance,"Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary",Later separately authorized isolated form/environment; never real patient data,"Owner-confirmed 2026-10-28 direct-Jotform EN/ES and sampled Astro-iframe synthetic submissions with native thank-you and notification/autoresponder delivery. Functional submission acceptance is complete for the reported samples; exact ABA landing route, all-seven-route runtime/privacy and production-release acceptance remain open",Owner-verified — Form A functional submission samples,2026-10-28,Separate batch authorization; no action authorized by this checklist
+JF-08,Embedding,"Approved HTTPS origin, hosted/iframe URLs, dimensions/mobile, scripts, referrer, locale and fallback",Account/hosting/accessibility owners; exported code and later authorized runtime evidence,"Repository evidence 2026-10-28: fixed Form A origin/URLs, no-referrer policy, minimal sandbox, localized conditional hosted fallback and seven-route isolated-test gate. Owner reports embedded synthetic submission/confirmation on EN contact, ES contact and one ABA landing placement; exact third route and all-seven-route keyboard/responsive/runtime-network acceptance remain open; 2026-10-30 supersession: 16 placements are default-live by owner authorization, with remaining all-route runtime/accessibility acceptance separate",Partially verified — owner-reported sampled embedded acceptance plus adapter/fallback,2026-10-28,Separate batch authorization; no action authorized by this checklist
+JF-09,Controlled synthetic acceptance,"Actual EN/ES synthetic submission, notifications, success/failure, redirects and privacy boundary",Later separately authorized isolated form/environment; never real patient data,"Owner-confirmed 2026-10-28 direct-Jotform EN/ES and sampled Astro-iframe synthetic submissions with native thank-you and notification/autoresponder delivery. Functional submission acceptance is complete for the reported samples; exact ABA landing route, all-seven-route runtime/privacy and production-release acceptance remain open; 2026-10-30 supersession: 16 placements are default-live by owner authorization, with remaining all-route runtime/accessibility acceptance separate",Owner-verified — Form A functional submission samples,2026-10-28,Separate batch authorization; no action authorized by this checklist
 OA-01,Intake/operations,"Minimum fields, required flags/contact preference consistency, follow-up/callback expectations, Tour/fundraising scope",Intake/operations,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
 OA-02,Clinical leadership,"Eligibility, service/evaluation availability, private-pay Social Club distinction, referral boundary and approved claims",Clinical leadership,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
 OA-03,Jotform account owner,"JF-01–08 for Form A consultation and Form C, Form C blank-form creation, actual configuration/ID and preservation of all existing forms",Jotform account owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
@@ -16,7 +16,7 @@ OA-05,Privacy/legal/security,"Protected fields, generic email/headers/recipients
 OA-06,Marketing,Deferred attribution categories and redesigned successful-submission semantics,Marketing,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
 OA-07,Hosting owner,"Static/API separation, compile/deploy gates, CSP/referrer/log policy, preview isolation and fallback topology",Hosting owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
 OA-08,Release owner,"Phase 10 integration activation, go/no-go, artifact/vendor rollback and deployment",Release owner,Dated owner approval with scope and sanitized supporting evidence,Pending/Unverified,,Separate batch authorization; no action authorized by this checklist
-FA-PRD-01,Form A production build gate,"Confirm live mode, existing live approval, production environment role and independent Form A production approval are all set only in the intended release environment; verify no Form C or unrelated surface activates",Release + hosting owner,"Repository configuration resolver and production-artifact test; no deployed environment configured",Implemented locally — deployment verification pending,2026-10-28,Phase 10 deployment authorization and sanitized environment review
-FA-CONS-01,Form A consultation context,"Verify fixed `consultation` presentation value, required service-interest question, five approved choices, conditional email/phone behavior, EN/ES translations and no additional collection; no diagnostic-evaluation explanatory note",Account + operations + clinical + privacy owners,"Owner reports connected-app configuration; sanitized Builder configuration and approved synthetic test evidence still required; no ID/condition inferred by repository",Owner-reported configured — browser acceptance pending,2026-10-29,No Jotform mutation by repository; isolated-test route acceptance is separate from production authorization
-FC-01,Form C referral initiation,"Create only after authorization, then verify minimum professional fields, no patient data instruction, PHI controls, notification/retention and protected-workflow handoff",Account + operations + privacy owners,"Sanitized Form C Builder configuration and approved synthetic test evidence",Pending/Unverified,,Separate creation and synthetic-test authorization required
+FA-PRD-01,Form A mode and placement contract,Superseded 2026-10-30: live is default on 16 fixed placements; explicit off/mock isolate forms; indexing is independent; invalid modes fail clearly,Release + hosting owner,Owner authorizes public development forms; repository registry/artifact/browser tests; no hosting deployment performed,Owner-authorized architecture — runtime/site-release acceptance separate,2026-10-30,No additional Form A build approval flags; site cutover requires separate authorization
+FA-CONS-01,Form A consultation context,"Verify fixed `consultation` presentation value, required service-interest question, five approved choices, conditional email/phone behavior, EN/ES translations and no additional collection; no diagnostic-evaluation explanatory note",Account + operations + clinical + privacy owners,Owner reports connected-app configuration; sanitized Builder configuration and approved synthetic test evidence still required; no ID/condition inferred by repository,Owner-reported configured — browser acceptance pending,2026-10-29,Default-live consultation placements owner-authorized 2026-10-30; Jotform runtime/language acceptance and site cutover remain separate
+FC-01,Form C referral initiation,"Create only after authorization, then verify minimum professional fields, no patient data instruction, PHI controls, notification/retention and protected-workflow handoff",Account + operations + privacy owners,Sanitized Form C Builder configuration and approved synthetic test evidence,Pending/Unverified,,Separate creation and synthetic-test authorization required
 INV-01,Supplied roster provenance and remaining verification,Complete 27-ID roster received and uniqueness checked; verify uncertain generic titles and relevant operational classification with account owner without inferring usage or retrieving submissions,Jotform account owner,Owner-supplied read-only connector roster; contract v1.2 section 3 lists all 27 unique IDs; individual roster no longer outstanding; new-form configuration and usage verification pending,Pending/Unverified,,Read-only metadata review authorization; no account mutation

www/reports/phase-9-service-portal-consolidated-2026-10-30.md

@@ -1,5 +1,7 @@
 # Consolidated service-drawer and employee-portal development
 
+> **Historical configuration superseded on 2026-10-30:** The default-live [Form A revision](phase-9-form-a-default-live-2026-10-30.md) replaces the former form approval/environment gates with optional live/off/mock mode on 16 placements. Earlier commands and results below describe their recorded checkpoint, not current startup requirements. No historical test result has been rerun or relabeled here.
+
 Date: 2026-10-30 UTC. Starting branch: `faithful-astro-migration`.
 Starting HEAD: `ff80ee516f0185023af1f29937e29dfb30d31f47`.
 Tracked tree and index were clean; only owner-provided `prompt.txt` was untracked.

www/reports/phase-9-two-form-integration-specification-2026-10-28.md

@@ -1,28 +1,60 @@
 # Phase 9 — Two-form integration specification
 
-**Recorded:** 2026-10-28 UTC; revised 2026-10-29 UTC
+## Current decision — 2026-10-30: default-live Form A
 
-**Scope:** Form A consultation isolated-test integration and future Form C referral initiation
-**Status:** owner-reported Jotform consultation configuration; Astro routes limited to isolated testing; no production activation authorized
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+**Recorded:** 2026-10-28 UTC; revised 2026-10-30 UTC
+
+**Scope:** Default-live Form A integration and future Form C referral initiation
+**Status:** 16 default-live placements owner-authorized; Jotform language/runtime acceptance and site cutover remain separate
 
 ## Decision revision
 
 The owner has replaced the former three-physical-form plan with two physical Jotform forms:
 
-- **Form A — General Enquiries, landing enquiries and family service consultations.** The existing Form A ID remains `262946078314059`; its approved `contact` and `landing` contexts and seven current Astro placements are unchanged.
+- **Form A — General Enquiries, landing enquiries and family service consultations.** The existing Form A ID remains `262946078314059`; its approved `contact`, `landing` and `consultation` contexts cover 16 current Astro placements.
 - **Form C — Professional Referral Initiation.** It remains a separate future blank form with no assigned Jotform ID.
 
-**Form B is retired as a physical form.** Historical Form B decisions remain in the versioned contract and plan. The repository may keep `service` as a logical visitor-intent classification, but it will map to Form A's planned `consultation` context after the required Builder configuration and acceptance.
+**Form B is retired as a physical form.** Historical Form B decisions remain in the versioned contract and plan. The repository may keep `service` as a logical visitor-intent classification, but it maps to Form A's `consultation` context; remaining Builder/runtime acceptance does not constitute a new code gate.
 
-This revision does not enable a new route, add an iframe placement, modify Form A, create Form C, add a query parameter, alter a canonical URL, promise an appointment, or change the frozen seven-route Form A production allowlist.
+The October 30 decision enables all 16 existing placements by default without creating routes, modifying Jotform, creating Form C, changing query parameters or canonicals, or promising appointments.
 
 ## Form A contexts and planned consultation contract
 
 | Context | Status | Intended audience | Required route state |
 |---|---|---|---|
-| `contact` | Existing, owner-tested | General contact enquiries | Current two-contact-route gate only |
-| `landing` | Existing, owner-tested | Five named campaign landing journeys | Current five-landing-route gate only |
-| `consultation` | Configured in Jotform; isolated-test Astro placements only | Family service consultations | Owner browser acceptance; no production route authorization |
+| `contact` | Existing, owner-tested | General contact enquiries | Two approved live placements |
+| `landing` | Existing, owner-tested | Five named campaign landing journeys | Five approved live placements |
+| `consultation` | Configured in Jotform; nine live Astro placements | Family service consultations | Owner runtime acceptance remains separate |
 
 The context value is presentation-only. It is not an authorization, attribution, security, analytics or visitor-controlled value. `formContext` remains the known case-sensitive hidden-field Unique Name; no other Jotform field ID or condition name is inferred here.
 
@@ -60,48 +92,48 @@ Form C remains a separate future physical Jotform created from a blank form. Its
 
 The visible form must instruct referrers not to submit patient names, dates of birth, diagnosis narratives, medical records or other patient-identifying information. Detailed referrals remain in the separately approved protected workflow. No Form C ID, hosted URL, iframe, language route or conditional logic is assigned by this document.
 
-## Isolated-test route and component matrix
+## Current consultation route and component matrix
 
-The following nine placements are implemented only for an explicitly authorized, non-indexing isolated-test build. Normal staging, mock, indexing-enabled and production builds retain their existing inactive/off/mock behavior. The seven existing Form A production-eligible placements remain a separate frozen allowlist.
+The following nine placements join the original seven in one live registry. Both indexing and non-indexing builds enable them by default. Explicit off/mock builds contain no real Form A frames.
 
 | Route or entry point | Locale | Current component / behavior | Future physical form and context | Dependencies |
 |---|---|---|---|---|
-| `/client-consultation` | EN | `FormShell.astro` through `PageLayout.astro`; immediate isolated-test iframe | Form A / `consultation` | Owner Jotform visibility/requiredness/confirmation acceptance |
-| `/es/client-consultation` | ES | Same component; immediate isolated-test iframe | Form A / `consultation` | Spanish Jotform labels, errors and locale acceptance |
-| `/schedule-consultation` | EN | `FormShell.astro` through `PageLayout.astro`; immediate isolated-test iframe | Form A / `consultation` | No-booking copy and owner acceptance |
-| `/aba-therapy` drawer | EN | `ServiceInquiryDrawer.astro`; explicit user-triggered isolated-test drawer | Form A / `consultation` | Owner acceptance and dialog accessibility review |
-| `/autism-evaluations` drawer | EN | Same component; explicit user-triggered isolated-test drawer | Form A / `consultation` | Clinical/operations copy and owner acceptance |
-| `/learner-social-club` drawer | EN | Same component; explicit user-triggered isolated-test drawer | Form A / `consultation` | Program copy and owner acceptance |
-| `/es/aba-therapy` drawer | ES | Same shared drawer; explicit user-triggered isolated-test drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
-| `/es/autism-evaluations` drawer | ES | Same shared drawer; explicit user-triggered isolated-test drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
-| `/es/learner-social-club` drawer | ES | Same shared drawer; explicit user-triggered isolated-test drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
+| `/client-consultation` | EN | `FormShell.astro` through `PageLayout.astro`; immediate live iframe | Form A / `consultation` | Owner Jotform visibility/requiredness/confirmation acceptance |
+| `/es/client-consultation` | ES | Same component; immediate live iframe | Form A / `consultation` | Spanish Jotform labels, errors and locale acceptance |
+| `/schedule-consultation` | EN | `FormShell.astro` through `PageLayout.astro`; immediate live iframe | Form A / `consultation` | No-booking copy and owner acceptance |
+| `/aba-therapy` drawer | EN | `ServiceInquiryDrawer.astro`; live automatic/manual drawer | Form A / `consultation` | Owner acceptance and dialog accessibility review |
+| `/autism-evaluations` drawer | EN | Same component; live automatic/manual drawer | Form A / `consultation` | Clinical/operations copy and owner acceptance |
+| `/learner-social-club` drawer | EN | Same component; live automatic/manual drawer | Form A / `consultation` | Program copy and owner acceptance |
+| `/es/aba-therapy` drawer | ES | Same shared drawer; live automatic/manual drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
+| `/es/autism-evaluations` drawer | ES | Same shared drawer; live automatic/manual drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
+| `/es/learner-social-club` drawer | ES | Same shared drawer; live automatic/manual drawer | Form A / `consultation` | Spanish Jotform and fluent-language acceptance |
 | `/referrals` | EN | `FormShell.astro`, `logicalForm=referral`; inactive | Form C / future referral initiation | Create and verify Form C; no patient data in initial form |
 
-English and Spanish service-page CTAs already route visitors to the client consultation routes. They are navigation dependencies, not independent Form A iframe placements. The same is true of homepage, services, FAQ and library consultation CTAs that resolve to those pages.
+English and Spanish service-page CTAs open their authorized live drawer with JavaScript, retaining their consultation-page navigation destination otherwise. They are not additional iframe placements. The same is true of homepage, services, FAQ and library consultation CTAs that resolve to those pages.
 
 The current Tour CTA in `src/content/pages/en/tour.mdx` points to `/client-consultation`. The planned consultation service list contains no tour choice. Intake/operations must decide whether Tour keeps that destination, moves to the existing general-contact/tour journey, or receives a separately approved context before any code or CTA change. This specification makes no Tour-route change.
 
-## Owner and Jotform actions before consultation activation
+## Remaining owner and Jotform acceptance actions
 
 1. Confirm that the configured Form A `consultation` context has not changed the approved `contact` or `landing` journeys; record the rollback method for the Builder configuration.
 2. Verify the exact hidden context value, service question, five display options, requiredness, EN/ES translations, validation messages and confirmation language in Jotform. Do not invent fields or accept query-controlled context values.
 3. Confirm that no child/clinical/payment/location/booking fields, webhooks, integrations, answer-bearing notifications, PDF attachments, analytics or forwarding are introduced for the consultation context.
 4. Obtain intake/operations, clinical and privacy approval for the field set and approved service options. Obtain fluent English/Spanish review for all added presentation and error text.
 5. Run separately authorized synthetic Jotform and Astro-iframe acceptance tests with no real patient data. Cover both locales, all service choices, validation/error states, no-JavaScript and keyboard behavior, confirmation, notifications, responsive sizes and direct hosted fallback.
-6. Only then authorize a production allowlist and production-gate update. The current seven Form A routes remain the only production-eligible real iframes until that implementation is independently reviewed.
+6. Record acceptance separately from the owner-authorized default-live 16-route registry. Site deployment/cutover still requires release authorization; no further Form A build flags are required.
 7. For Form C, separately authorize creation from a blank form, then verify its minimum fields, PHI protections, recipients, retention, hosted/iframe behavior and protected-workflow handoff before mapping `/referrals`.
 
 ## Retained gates
 
 This decision does not close P9-01, P9-03, P9-05, P9-06, P9-07, P9-09 or P9-10. Form A's existing owner-reported direct and sampled embedded acceptance does not prove the new consultation context. Final real screen-reader, all-route responsive, runtime telemetry/privacy, hosting, notification-recipient and release-owner acceptance remain open.
 
-## 2026-10-29 supersession and implementation addendum
+## Historical 2026-10-29 supersession and implementation addendum (gate superseded above)
 
 The owner reports that the Form A `consultation` context and its conditional rules have been configured through the connected Jotform app. The repository now permits the nine matrix placements only when every isolated-test gate is present, including `PUBLIC_AIA_FORMS_CONSULTATION_TEST_APPROVED=true`. Three standalone pages load the fixed consultation URL immediately; six English/Spanish service drawers retain no iframe `src` until the visitor explicitly opens them. This does not change the frozen seven-route production allowlist.
 
 The earlier version of this specification required a conditional Autism Diagnostic Evaluation explanation. That requirement is superseded: no conditional explanatory note is required in Form A or Astro. The historical decision is preserved by this dated addendum; the current contract is the client-advocate conversation described above.
 
-## 2026-10-30 consolidated drawer behavior revision
+## Historical 2026-10-30 consolidated drawer behavior revision (mode superseded above)
 
 The later owner prompt supersedes explicit-only opening for the six EN/ES
 service drawers. Authorized consultation-test drawers now open after four seconds