refactor(forms): enable approved Form A placements by default

www/reports/phase-10-technical-readiness-package-2026-10-22.md

@@ -3,6 +3,40 @@
 Date: 2026-10-22 UTC
 Status: Technical handoff prepared; production gates remain open.
 
+## Current decision — 2026-10-30: default-live Form A
+
+The owner intentionally supersedes the earlier isolated-test and seven-route
+production-gate architecture. `npm run dev` and `npm run build` now enable Form A
+on exactly **16 approved placements**, including the publicly reachable
+`aia.web3app.dev` environment. No additional approval flags or access restriction
+are required. `PUBLIC_AIA_FORMS_MODE` is optional: absent/empty means `live`;
+explicit `off` and `mock` remain available. Invalid/obsolete `isolated-test`
+settings produce an actionable configuration error. The former approval flags
+and form environment role are retired, not renamed.
+
+Indexing and forms are independent. Both publication modes emit ten immediate
+frames (two contact, five landing, three consultation) and six deferred bilingual
+service-drawer frames. The bounded registry fixes ID `262946078314059`, HTTPS
+origin, context and language. Forms B/C are not activated; physical B is retired.
+
+Live drawers retain four-second/50%-scroll opening, shared 30-day suppression,
+manual CTA override, deferred loading, verified completion acknowledgment for
+five seconds, animated dismissal and fresh-form reopening. Off mode does not
+automatically show inactive drawers. All iframe security/fallback behavior is
+preserved. Employee-portal preview remains independently gated by explicit local
+approval, valid private ciphertext input and non-indexing output; Form A cannot
+authorize private content. No portal private resources enter normal artifacts.
+
+This owner authorization does not modify Jotform, authorize site cutover or
+complete pending consultation-language, provider-event, accessibility, runtime
+telemetry/privacy, recipient-routing or hosting acceptance. See the
+[current operating guide](../integrations/jotform/README.md) and
+[implementation and validation report](phase-9-form-a-default-live-2026-10-30.md).
+Earlier dated decisions and test results below are historical evidence, not
+current environment setup instructions.
+
+The following acceptance matrix records the original October 22 results; see the new report for October 30 validation.
+
 ## Acceptance matrix
 
 | Area | Evidence | Result | Human/owner gate |
@@ -35,10 +69,12 @@ node --test tools/phase9-nonproduction.test.mjs
 node --test tools/phase10-artifact.test.mjs
 npm run build
 PUBLIC_ALLOW_INDEXING=true npm run build
+node tools/phase10-artifact-verify.mjs --mode=indexing --forms=live
+npm run build
 npm run audit:links
 npm run audit:images
 npm run audit:blog
-node tools/phase10-artifact-verify.mjs --mode=staging
+node tools/phase10-artifact-verify.mjs --mode=staging --forms=live
 node tools/phase10-release-rehearsal.mjs
 ```
 
@@ -49,7 +85,7 @@ The final normal staging build was restored after the indexing build. The explic
 1. Record a locked Node/npm/toolchain and reproducible artifact manifest.
 2. Obtain sanitized Contabo/NixOS/nginx/TLS/DNS/Cloudflare facts.
 3. Verify host-local serving, canonical host, redirects, 404s, cache headers and rollback on an approved staging host.
-4. Form A has owner-reported functional acceptance and a local production gate, but still needs exact release-environment review, all-seven-route accessibility acceptance, runtime telemetry/privacy review, marketing-recipient operational review and no-deployment static-artifact verification. Its owner-reported configured `consultation` context is limited to nine isolated-test-only placements and remains outside the production resolver; physical Form B is retired; Form C remains unimplemented. Use Form A only when all four explicit build settings are approved: `PUBLIC_AIA_FORMS_MODE=live`, `PUBLIC_AIA_FORMS_LIVE_APPROVED=true`, `PUBLIC_AIA_FORMS_ENVIRONMENT=production`, and `PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true`. `PUBLIC_ALLOW_INDEXING=true` is publication behavior only.
+4. Default-live Form A is owner-authorized on exactly 16 placements, including public development hosting. No approval flags remain; indexing is independent. Final accessibility, Spanish options/provider-event, runtime privacy and marketing-recipient operational review remain open. Form C remains unimplemented. Site cutover still needs release authorization.
 5. Obtain P9-04 counter origin/credential/consent approval before a live adapter.
 6. Resolve P9-05 analytics/advertising measurement and P9-07 privacy/legal approval.
 7. Obtain P9-06 clinical/organizational and fluent-language approvals, including Arabic diagrams and Spanish HSA/FSA claims.
@@ -59,7 +95,7 @@ The final normal staging build was restored after the indexing build. The explic
 
 ## Decision status
 
-P9-01 through P9-10 remain **Pending decision**. No technical feasibility result in this package is an approval. Jotform, counters, analytics, advertising, forms, employee portal, redirects and hosting remain inactive.
+P9-01 through P9-10 remain **Pending decision**. No technical feasibility result in this package is an approval. Default-live Form A is explicitly owner-authorized. Counters, analytics, advertising, Form C, private portal serving and hosting activation remain separate and unauthorized by this package.
 
 ## Recommended checkpoint boundaries