docs(forms): record Form A privacy verification

www/reports/phase-9-jotform-implementation-plan-2026-10-18.md

@@ -1,6 +1,6 @@
 # P9-03 source-specific implementation plan
 
-Date: **2026-10-18** · Plan version **1.2 revision 2026-10-21** · Governing contract: [P9-03-JF-2026-10-18 v1.2](phase-9-jotform-integration-contract-2026-10-18.md).
+Date: **2026-10-18** · Plan version **1.3 revision 2026-10-27** · Governing contract: [P9-03-JF-2026-10-18 v1.3](phase-9-jotform-integration-contract-2026-10-18.md).
 
 **Planning only. Do not execute any batch from this document without separate authorization.** Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes.
 
@@ -12,6 +12,12 @@ Verified `faithful-astro-migration`, HEAD `59911eb929579af7bcd6c42de6476128dab62
 
 Current source-manifest construction confirmed nine eligible enquiry routes and corresponding existing generated HTML forms. Source files still match Git. No build/browser/submission test was run for this documentation-only task. Counts below are verified route mapping plus the signed checkpoint's accepted publication baseline, not new full-suite results.
 
+### Form A configuration update — 2026-10-27
+
+The owner reports that new **Form A — General Enquiries** (`262946078314059`) has field PHI protection; a generic notification without submitted values or PDF attachment; no webhooks or integrations; and privacy approval for that direct-to-Jotform configuration. This is owner-confirmed evidence from a ChatGPT WebUI/Jotform review, not a repository-side Builder audit. It does not authorize production activation, external submissions, analytics, or advertising.
+
+The confirmation is limited. Recipient access and Form A retention/deletion controls are owner-verified, while exact role/retention-policy details remain account-policy information outside this repository. Exact conditional logic, default/reply-to/header behavior, redirects/confirmation, autosave/save-and-continue, availability/spam settings, full EN/ES runtime acceptance, and synthetic delivery acceptance remain pending. Forms B and C are not covered.
+
 | Inventory ID | Route | Source content under `www/src/content/pages` | Owning component under `www/src/components` | Target |
 |---|---|---|---|---|
 | F-001 | `/contact` | `en/contact.mdx` | `pages/ContactPage.astro` → `ContactForm.astro` | A EN |
@@ -97,7 +103,7 @@ Drawer decision is a prerequisite for replacing its live content: retain timer o
 
 ## 4. Builder review and blank-form creation prerequisites
 
-Use [JF-01–09 and owner gates](phase-9-jotform-verification-checklist-2026-10-18.csv). All start Pending/Unverified. Verify the blank-form Builder settings in A/B before any synthetic test; no existing form is a source for inheritance. Runtime portions of JF-03/08 remain open until D.
+Use [JF-01–09 and owner gates](phase-9-jotform-verification-checklist-2026-10-18.csv). Form A has the limited owner-confirmed configuration portions recorded in the 2026-10-27 ledger update; all remaining verification starts Pending/Unverified. Verify the blank-form Builder settings in A/B before any synthetic test; no existing form is a source for inheritance. Runtime portions of JF-03/08 remain open until D.
 
 Before any creation, approve an account process that creates exactly three disabled blank forms, prevents public access and live notifications, and records the new IDs only after the account owner confirms the forms are isolated. Configure minimum fields, PHI protection, generic notifications, confirmation behavior and no-forwarding settings explicitly. Do not copy/import fields, settings or submissions from existing forms. If safe isolation cannot be established, stop before creation.
 
@@ -215,7 +221,7 @@ Source changes require a newly named offline reconciliation using explicit final
 
 First recommended authorized batch: **Batch A**, final blank-form specifications and owner field approval, using the now-complete owner-supplied 27-asset roster as historical context only. First safe **code** batch is C's off/mock contact slice after its explicit authorization; it can avoid external account changes while B is pending, but cannot invent Jotform settings.
 
-Owner ledger OA-01–08 and JF-01–09 are all Pending/Unverified in the companion CSV. Pending facts include actual new-form question IDs/types/defaults/options, PHI flags, conditional routing, real translations/locale URLs, email recipients/templates, integrations/webhooks/exports, thank-you/POST behavior, security/retention/access, blank-form isolation and supported success signaling. No new production embed ID exists. Final field approval and creation of A/B/C are pending. Tour/event/fundraising separation must be retained.
+The companion CSV records limited owner-confirmed Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05. Pending facts still include actual question IDs/types/defaults/options, conditional routing, real translations/locale URLs, default email behavior, thank-you/POST behavior, blank-form isolation and supported success signaling. Form A recipient access and retention/deletion are owner-verified; detailed role and retention-policy records remain outside the repository. Form A now exists but has no production-activation approval; B and C remain pending. Tour/event/fundraising separation must be retained.
 
 Any approval record must identify approver role, date, exact form/environment/version, sanitized evidence and scope. An account label ENABLED, a BAA, a successful static build or a generic vendor help article cannot close these gates. Keep the real screen-reader, authorized visual/non-Chromium, fluent-language, clinical, financial and policy/source-provenance requirements from SESSION_HANDOFF.
 
@@ -228,3 +234,5 @@ Validation passed: local Markdown links, balanced code fences and whitespace; 18
 Roster reconciliation, version 1.1: only the October 18 contract, plan and checklist were updated. The individual inventory gap is closed by owner-supplied metadata; no JF or owner approval is closed and no implementation batch is executed.
 
 Decision revision, version 1.2, 2026-10-21: the owner superseded the working-copy proposal with three new blank Jotform forms. Batch A now finalizes specifications, Batch B creates the three disabled forms only after explicit mutation authorization, and later batches retain off/mock/live safeguards. The 27-form legacy roster and all existing workflows remain historical/operationally independent. No source components, tests, Jotform forms or production systems were changed.
+
+Version 1.3, 2026-10-27: records owner-confirmed Form A configuration evidence from the owner’s ChatGPT WebUI/Jotform review. Form A field PHI protection, the generic no-PHI notification template, absence of submission-PDF attachment, absence of webhooks/integrations, and privacy approval are confirmed for that form’s configuration scope. The update records recipient access and retention/deletion as owner-verified for Form A. It does not close conditional routing, runtime acceptance, live activation, Forms B/C configuration or any broader P9-03/P9-07 gate.