# Phase 9 — Form A isolated iframe campaign extension

**Date:** 2026-10-25 UTC
**Repository state:** `faithful-astro-migration` at `f41af1966e5fc46ff3fe37019c30826304997b67` before this unstaged extension
**Scope:** initially extend the existing Form A isolated-test adapter to four approved English campaign routes; updated on 2026-10-26 to include `/lp/early-intervention`. This is not a live Jotform activation.

## Owner decision and mapping

The owner supplied this revised decision: use Form A (`262946078314059`) for the five landing pages below, with fixed `formContext=landing`. It supersedes the earlier Form B mapping only for these five visitor journeys. Form B remains the planned destination for other service-consultation journeys that require its additional approved fields.

| Route | Locale | Form A context | Fixed hosted URL |
|---|---|---|---|
| `/contact` | English | `contact` | `https://form.jotform.com/262946078314059?formContext=contact&language=en` |
| `/es/contact` | Spanish | `contact` | `https://form.jotform.com/262946078314059?formContext=contact&language=es` |
| `/lp/aba-therapy` | English | `landing` | `https://form.jotform.com/262946078314059?formContext=landing&language=en` |
| `/lp/aba-insurance` | English | `landing` | `https://form.jotform.com/262946078314059?formContext=landing&language=en` |
| `/lp/aba-ahcccs` | English | `landing` | `https://form.jotform.com/262946078314059?formContext=landing&language=en` |
| `/lp/aba-private-pay` | English | `landing` | `https://form.jotform.com/262946078314059?formContext=landing&language=en` |
| `/lp/early-intervention` | English | `landing` | `https://form.jotform.com/262946078314059?formContext=landing&language=en` |

The 2026-10-26 owner decision supersedes the earlier exception for `/lp/early-intervention`. Its existing AIA-branded card keeps its off-mode controls and shows the embedded Form A adapter only when the same isolated-test gate permits it. There are no Spanish campaign routes in this implementation, so no Spanish landing parameter has been invented.

## Supersession addendum — 2026-10-28

The earlier statement that Form B remained the destination for other service-consultation journeys is superseded. Physical Form B is retired. Those journeys are now future Form A `consultation` targets, subject to the separate Builder, clinical, privacy, synthetic-acceptance and Astro-allowlist work in [the two-form integration specification](phase-9-two-form-integration-specification-2026-10-28.md). This addendum does not change the five current landing placements, their fixed `landing` context or the seven-route gate.

## Implementation

`src/utils/form-integration.ts` now owns one typed route/locale/context allowlist for all seven Form A placements. `resolveFormAIframe` still requires every existing isolated-test gate:

- `PUBLIC_AIA_FORMS_MODE=isolated-test`;
- `PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test`;
- `PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true`; and
- a non-indexing build.

Missing, malformed, `mock`, `off`, or `live` configuration continues to render the pre-existing non-submitting Astro surface. An indexing-enabled build also fails closed. An API URL, Jotform ID, route query, referrer, user value, or `PUBLIC_AIA_FORMS_LIVE_APPROVED` value cannot enable this adapter.

`components/campaign/ConsultationForm.astro` reuses `JotformIframe.astro` only when the resolver permits its four campaign routes. `components/campaign/EarlyInterventionPage.astro` uses the same resolver and embedded adapter inside its existing `.lead-form` card. Each page retains its existing section, heading, CTA context, telephone details, and form wrapper. The adapter's embedded variant removes its own card styling so it does not nest a second form card or duplicate availability notices. The Form A mock remains available only in explicit non-indexing mock builds. No external Astro-controlled submit button is used; Jotform's current native Submit label is left unchanged.

The adapter styles are route-local inline component CSS. This prevents a CSS asset shared by the main contact page and campaign layout from appearing in both route families, preserving the existing campaign-style isolation assertion.

The iframe still supplies its localized accessible title and direct hosted-form fallback. It uses `referrerpolicy="no-referrer"`, no Jotform helper script, no `allow` feature policy, and the constrained sandbox `allow-forms allow-scripts allow-same-origin`. This is sufficient in principle for Jotform's in-frame controls and confirmation but is not proof that its current disabled runtime works. It intentionally withholds popups, modals, top navigation, downloads, and cross-origin parent control.

## Documentation continuity

The versioned October P9-03 contract and implementation plan are not edited by this extension because documentation PR #2 is open. This report and the additive README section record the supersession without overwriting that in-review history. The accepted documentation update must change the five named landing routes from Form B to Form A while retaining Form B for all other service-consultation routes.

## Local verification

| Check | Result |
|---|---|
| `npm run check` | 0 errors, 0 warnings, 0 hints |
| Focused Form A, preview, and nonproduction tests | 14 passed |
| Markdown, publication, SEO, Library, and route suites | 20, 33, 35, 53, and 10 passed respectively; publication and Library fixtures were rerun sequentially with `TMPDIR=/tmp` after an unsafe concurrent fixture collision |
| Campaign and artifact tests | 18 passed |
| Normal staging build | 128 HTML routes; every page `noindex,nofollow`; empty sitemap; zero hreflang; no Form A identifier or iframe |
| Explicit mock build | 128 routes; no Form A identifier, iframe, external form request, or native form action |
| Fully gated isolated-test build | 128 routes; adapter appears only at the seven allowlisted routes |
| Indexing-enabled build with every isolated-test value supplied | 127 routes; 109 sitemap URLs; 180 hreflang links; `/lp` absent; no Form A identifier or iframe |

Playwright 1.61.0 with Chromium exercised all seven placements on a loopback-only preview at 320px, 390px, 768px, and 1440px. The latest isolated-test mode completed 35 checks: all seven routes at every width and all seven with JavaScript disabled at 390px. The browser asserted a visible, responsive iframe, one direct fallback, keyboard focusability, no horizontal page overflow, and the campaign adapter as the single embedded surface inside the existing `.form-wrap` or the Early Intervention `.lead-form`, rather than the inactive or mock form.

The latest isolated run created 28 full-page screenshots and an evidence JSON outside the repository at `/tmp/aia-form-a-iframe-AuhT7S`. It attempted 35 fixed Jotform iframe GETs: ten `contact` and 25 `landing` URLs across the JavaScript and no-JavaScript runs. The request guard recorded and aborted every attempt before transmission. There were no attempted POST, DELETE, WebSocket, production API, analytics, advertising, conversion, form-submission, or Contabo requests. Existing Leaflet resource GETs on contact routes were likewise blocked before transmission.

## Required acceptance before live activation

1. Owner-authorized synthetic testing must confirm the disabled form's actual EN/ES language behavior, `formContext` conditions, validation, confirmation, and native Submit controls using approved synthetic values only.
2. Privacy/security review must confirm Jotform configuration, PHI protections, notification recipients/templates, redirects, integrations, retention, and no HTTP POST forwarding to Astro or Contabo.
3. Accessibility review must confirm real iframe keyboard behavior, focus, screen-reader experience, frame height, mobile reflow, direct fallback, and blocked/slow resource handling at 320px, 390px, 768px, and 1440px.
4. Hosting/CSP/referrer review must approve the Jotform origin and sandbox for the intended deployment environment.
5. Operations, clinical, language, privacy, and release owners must approve the final Form A field contract and workflow. Analytics, advertising, webhooks, conversion events, and PHI forwarding remain prohibited.

No Jotform account access, form mutation, real submission, external network transmission, analytics, advertising, Contabo form endpoint, deployment, staging, commit, merge, or push occurred in this extension.