aia-website/www/reports/phase-9-jotform-implementation-plan-2026-10-18.md

P9-03 source-specific implementation plan

Current referral decision — 2026-11-01 (supersedes Form C planning)

The owner directs /referrals to retain the current public-site workflow: one button-styled Refer a Client link to the existing hosted Jotform. There is no separate Form C to create, embed, configure or launch. The former Form C / proposed two-form architecture is historical only. /referrals renders no local form or Form A iframe; the original 16 approved Form A placements remain unchanged.

This is authorization to restore the existing destination in Astro, not verification of that separate legacy Jotform's HIPAA configuration, notification recipients, patient-data handling, accessibility or continued operational suitability. Review the actual hosted form and its clinical/privacy claims before production cutover. No account modification or submission occurred in this PR.

Current decision — 2026-10-30: default-live Form A

The owner intentionally supersedes the earlier isolated-test and seven-route production-gate architecture. npm run dev and npm run build now enable Form A on exactly 16 approved placements, including the publicly reachable aia.web3app.dev environment. No additional approval flags or access restriction are required. PUBLIC_AIA_FORMS_MODE is optional: absent/empty means live; explicit off and mock remain available. Invalid/obsolete isolated-test settings produce an actionable configuration error. The former approval flags and form environment role are retired, not renamed.

Indexing and forms are independent. Both publication modes emit ten immediate frames (two contact, five landing, three consultation) and six deferred bilingual service-drawer frames. The bounded registry fixes ID 262946078314059, HTTPS origin, context and language. Form B is retired; Form C planning is canceled as of 2026-11-01.

Live drawers retain four-second/50%-scroll opening, shared 30-day suppression, manual CTA override, deferred loading, verified completion acknowledgment for five seconds, animated dismissal and fresh-form reopening. Off mode does not automatically show inactive drawers. All iframe security/fallback behavior is preserved. Employee-portal preview remains independently gated by explicit local approval, valid private ciphertext input and non-indexing output; Form A cannot authorize private content. No portal private resources enter normal artifacts.

This owner authorization does not modify Jotform, authorize site cutover or complete pending consultation-language, provider-event, accessibility, runtime telemetry/privacy, recipient-routing or hosting acceptance. See the current operating guide and implementation and validation report. Earlier dated decisions and test results below are historical evidence, not current environment setup instructions.

Date: 2026-10-18 · Plan version 2.0 revision 2026-11-01 · Governing contract: P9-03-JF-2026-10-18 v1.9.

Planning only. Do not execute any batch from this document without separate authorization. Phase 9 establishes decisions and bounded implementation authority. Phase 10 retains final production integration acceptance, rollback and cutover. The user stages, signs and pushes.

Form A reconciliation — 2026-10-28 (current implementation evidence, no production release approval): Form A — AIA | Website | General Enquiries (262946078314059) has owner-confirmed direct EN/ES synthetic submission, native thank-you, generic no-answer/no-PDF staff notification, autoresponder delivery, fixed hidden Reply-To, no-webhook/integration, conditional-email and language evidence. The owner also reports successful isolated Astro-iframe synthetic submission and confirmation on English contact, Spanish contact and one ABA landing placement; record that third route explicitly before release rather than inferring it. This completes functional submission acceptance for the reported samples, not seven-route responsive, accessibility, telemetry/privacy, deployment or site-release acceptance. Its hidden presentation field is Advanced → Field Details → Unique Name = formContext (exact case). The current Astro adapter is implemented only for gated, non-indexing isolated tests: /contact, /es/contact, /lp/aba-therapy, /lp/aba-insurance, /lp/aba-ahcccs, /lp/aba-private-pay, and /lp/early-intervention; the five landing journeys now use fixed formContext=landing, superseding their earlier Form B mapping. Physical Form B is retired. Form A consultation now has a separate nine-route isolated-test adapter; Form C remains future work. Jotform field keys and IDs must not be guessed.

Production-gate addendum — 2026-10-28: The local adapter now also supports the same seven Form A placements only when PUBLIC_AIA_FORMS_MODE=live, PUBLIC_AIA_FORMS_LIVE_APPROVED=true, PUBLIC_AIA_FORMS_ENVIRONMENT=production, and PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true are all set. This is a build-time configuration contract, not a deployed environment or site-release authorization. It leaves Form C, drawers and every unrelated lead surface in their off/mock path. An indexing-enabled release artifact is compatible with the gate, but PUBLIC_ALLOW_INDEXING never enables a form.

1. Actual baseline and reconciliation

Verified faithful-astro-migration, HEAD 59911eb929579af7bcd6c42de6476128dab62289, clean tracked tree and empty index. Three October 17 untracked inventory artifacts exist, alongside the five exclusions and .phase8-stage-paths.nul. No unexpected implementation change was found. The prior 27-row owner worksheet remains blank; the current supplied connector summary is not silently written into it.

Current source-manifest construction confirmed nine eligible enquiry routes and corresponding existing generated HTML forms. Source files still match Git. No build/browser/submission test was run for this documentation-only task. Counts below are verified route mapping plus the signed checkpoint's accepted publication baseline, not new full-suite results.

Form A configuration update — 2026-10-27

The owner reports that new Form A — General Enquiries (262946078314059) has field PHI protection; a generic notification without submitted values or PDF attachment; no webhooks or integrations; and privacy approval for that direct-to-Jotform configuration. This is owner-confirmed evidence from a ChatGPT WebUI/Jotform review, not a repository-side Builder audit. It does not authorize production activation, external submissions, analytics, or advertising.

The confirmation is limited. Recipient access and Form A retention/deletion controls are owner-verified, while exact role/retention-policy details remain account-policy information outside this repository. Direct conditional-email/language, Reply-To, notification/autoresponder delivery and native confirmation evidence is recorded, but the exact wider conditional logic, defaults, autosave/save-and-continue, availability/spam settings, embedded-iframe submission/confirmation, full responsive/accessibility acceptance and runtime network/privacy behavior remain pending. The planned Form A consultation context and Form C are not covered.

Inventory ID	Route	Source content under www/src/content/pages	Owning component under www/src/components	Target
F-001	/contact	en/contact.mdx	pages/ContactPage.astro → ContactForm.astro	A EN
F-002	/es/contact	es/contact.mdx	Same	A ES
F-003	/client-consultation	en/client-consultation.md	FormShell.astro via PageLayout	Form A / consultation EN, isolated-test only
F-004	/es/client-consultation	es/client-consultation.md	Same	Form A / consultation ES, isolated-test only
F-005	/schedule-consultation	en/schedule-consultation.mdx	Same	Form A / consultation EN, isolated-test only
F-006	/referrals	en/referrals.mdx	Preserve the existing Refer a Client button, directly link https://form.jotform.com/231638510219149; no inline form	Existing hosted Jotform; no Form C
F-007	/aba-therapy	en/aba-therapy.mdx	ServiceInquiryDrawer.astro	Form A / planned consultation; drawer redesign
F-008	/autism-evaluations	en/autism-evaluations.mdx	Same	Form A / planned consultation; referral-assistance approval
F-009	/learner-social-club	en/learner-social-club.mdx	Same	Form A / planned consultation; program approval

Nine instances = 7 EN + 2 ES, three implementations. Eleven GET search instances remain separate. No Arabic enquiry form or Spanish referral route is created. EN/ES-capable logical forms do not imply new published routes.

The five imported landing-page journeys—/lp/aba-therapy, /lp/aba-insurance, /lp/aba-ahcccs, /lp/aba-private-pay and /lp/early-intervention—are current gated Form A isolated-test placements with fixed formContext=landing&language=en. This supersedes their earlier Form B mapping. Physical Form B is retired; the nine documented consultation routes are current isolated-test-only Form A placements and are never production-eligible. The landing panels are not additional native form implementations, and Form A is absent from off/mock/indexing output.

Discrepancies and supersession notes

1. October 17 proposed possible event/fundraising consolidation into general enquiries. October 18 explicitly preserves the Event Submission Form separately; fundraising still needs approval. Tour currently points to /client-consultation, a Form A consultation isolated-test route whose service list has no tour choice; its CTA disposition requires an intake/operations decision.
2. October 17 proposed one chosen contact channel. Form A retains its existing conditional email/phone behavior; the planned consultation context adds only service interest. Operations must approve any additional field or contact-preference change; do not implement the old alternative.
3. The older report allowed date/time/source notification extensions after review. Initial contract now explicitly defers them; use only the exact generic template after notification approval.
4. The older inventory knew no confirmed lead source. The supplied October 18 evidence preserves 250727122848156 as a historical structural reference only. The revised owner decision rejects cloning or repurposing it; it is not a validated schema or active embed destination.
5. Three multilingual forms are the new preference, including C capability. Earlier fallback five physical forms assumed C EN-only; a complete EN/ES physical fallback for all three would be six. No new Spanish route is implied or authorized.
6. The follow-up owner-supplied roster now lists all 27 unique IDs in contract section 3. IDs/titles are reported connector metadata; classifications are supplied planning categories, not verified settings or usage. Preserve the historical 27/27 ENABLED report. The October 17 worksheet remains unchanged; field/configuration and usage approvals remain pending.
7. Connector element totals are not field counts; the prompt's plain-form title contains a literal vertical bar. Record the title correctly rather than treating it as an extra table column.
8. Current “Schedule”/“Make an Appointment” headings/CTAs are not functioning booking. No calendar should be inherited. Obtain approved explanatory copy; do not silently change metadata, clinical text or publication identity.
9. Zero new lead production IDs/traffic in off/mock is compatible with preserving existing clinical links. A blanket assertion of no Jotform IDs anywhere would be false because /client-forms already links to them. Test scoped new integration isolation and preserve existing click-only workflows.

2. Source findings and future edit surface

All paths below are relative to repository root. Proposed additions do not exist as part of this task.

Existing file	Current behavior	Eventual bounded treatment
www/src/components/ContactForm.astro	Lines 17–28: empty POST, disabled submit, five optional contact/service/message controls	Keep card/layout styling; delegate mode-dependent lead UI to reusable integration; remove inactive native submission surface in off mode
www/src/components/FormShell.astro	Lines 12–21: same POST pattern; outer section and form-title	Preserve section/background and referral fragment; pass logical form/locale explicitly
www/src/components/ServiceInquiryDrawer.astro	Empty POST, child fields, stale options/copy; ten-second modal; dismissal sessionStorage	Preserve verified native dialog unless approved otherwise; replace lead content only after copy/UX decisions; no timed vendor request
www/src/layouts/PageLayout.astro	showForm routes at line 15; EN-only drawers at line 81; FormShell at 82	Explicit route→Form A consultation/Form C configuration; retain publication architecture and locale guards
www/src/components/pages/ContactPage.astro	ContactForm with lang, address and Leaflet/map resources	Pass integration props if needed, preserve map provider/layout; map traffic separately blocked in controlled tests
www/src/utils/form-messages.ts	EN/ES text only; other locales rejected	Add approved mode/fallback/accessibility copy only; do not invent Arabic messages or remote-form translations
www/src/scripts/forms.ts	Unused submit-event prevention helper	Do not treat as adequate isolation; future removal/wiring only if justified by selected architecture
www/src/styles/forms.css	Existing source-faithful form styling	Narrow iframe/fallback styling only where necessary; preserve visual tokens
www/.env.example; proposed www/src/env.d.ts only if needed	Existing environment example; no current src/env.d.ts	Document optional mode default-off and type semantics if needed; no actual live IDs or credentials
www/src/content/pages/en/tour.mdx	CTA to /client-consultation	No route edit until intake/operations resolves the Tour destination under Form A contexts
www/src/content/pages/en/client-forms.mdx	Clinical, Sign, CentralReach and PDF links	Preserve; not part of lead-form replacement
www/reports/google-ads-consultation-conversion.md	Accepted-API-success premise	Do not edit in this batch; future separate P9-05 contract must reconcile direct Jotform semantics

Proposed additions for authorized Batch C:

• www/src/utils/form-integration.ts: typed logical visitor intent (general/service/referral), locale, mode and deployment-role validation; pure functions suitable for existing Node tests.
• www/src/data/form-integrations.ts: explicit route mapping and build-time descriptors; no production descriptor until later approval; semantic service hints are not Jotform field keys.
• www/src/components/FormIntegration.astro: mode orchestration, localized off fallback and local mock selection.
• www/src/components/JotformEmbed.astro: reviewed iframe/fallback presentation, inactive until approved live descriptor; defer its live behavior to authorized test work if unnecessary for C.
• www/tools/form-integration.test.mjs: focused configuration/output tests, not full-copy snapshots.
• www/tools/phase9-forms-browser.mjs: guarded local runner using the established Playwright approach; test fixture served from the loopback harness or browser route interception, not a new public production route.

Names are proposed and may be refined in an authorized batch. No dependency, database, backend, CMS, hosting configuration or Jotform SDK is needed to prototype off/mock. Do not add API tokens to PUBLIC variables or retrieve secrets. The iframe URL itself is not a substitute for an approved contract.

3. Typed configuration and fail-closed behavior

Suggested mode name PUBLIC_AIA_FORMS_MODE; exact enum off | mock | live, default off. A second build/deployment-role gate must identify approved isolated-test versus approved production context. Its implementation/name needs hosting review; do not infer approval from PUBLIC_ALLOW_INDEXING, localhost detection or the presence of a URL.

Logical descriptor semantics: logical form key; supported locale set; reviewed accessible title; approved hosted and frame URLs; approved origin; environment role; evidence/version reference. These are application semantics, not guessed Jotform uniqueName/field identifiers. Keep original source IDs in evidence only; never use them as default URLs. Fail an explicit invalid live build rather than rendering a broken or fallback original form.

Case	Required result
Missing, empty or unknown mode	Off/no active lead submission; report invalid config safely where appropriate
Off with a stray live URL	Ignore/reject without emitting URL/ID, frame, helper, preload, cookie or vendor request
Mock	Harness-served synthetic document only; no live configuration required or included; no external submission traffic
Live without approved deployment role, logical mapping, locale, exact HTTPS origin/URL or evidence	Build rejection; never silently substitute another form/locale
Live A, B or C configured with existing source 250727122848156	Reject; an approved ID from a separately created blank form is required
Unsupported locale	No invented translation; localized approved route fallback where available, otherwise fail configuration safely
Approved isolated-test live configuration	Explicit test-only mapping and recipient controls; no production fallback; separate D authorization
Approved production live configuration	E/F authorization, correct reviewed artifact and mapping; no inference from indexing-enabled build

For off mode prefer non-form fallback markup without editable lead controls or an enclosing native form. Removing the form surface prevents the specific form.submit() bypass; disabling a button or catching submit alone does not. Test the actual resulting DOM, not just a handler string. Do not claim protection against arbitrary malicious script execution.

Mock fixtures must be synthetic and inert to external requests, including Enter and native submission paths; Playwright aborts unapproved requests before transmission. Fixture URLs/assets must not appear in the production route manifest. Live descriptors must not leak into off/mock emitted bundles through shared imports—scan generated HTML, scripts and preload hints.

Parent component preserves approved page design, explanatory text, iframe title, hosted fallback and responsive width/height. The Form A adapter uses fixed language=en|es and formContext=contact|landing|consultation values selected only by its typed allowlists; it forwards no visitor data. consultation is emitted only by the separately approved non-indexing isolated-test gate and never by the production resolver. Cross-origin child labels/errors must be verified in Jotform; Astro locale and CSS do not localize/fix them. The first-party fallback remains hidden without layout space, appears only after a 15-second missing-load timeout, and has a localized noscript version. Loading/error UI must not claim it can inspect the child DOM. A frame load is not proof of availability, application initialization or accepted submission.

Drawer decision is a prerequisite for replacing its live content: retain timer only if approved and incapable of loading vendor resources without the approved trigger; otherwise use an explicitly approved open/load interaction or full-page fallback. Preserve Escape/initial focus/restoration and test cross-origin focus boundaries. No wholesale dialog replacement.

4. Builder review and blank-form creation prerequisites

Use JF-01–09 and owner gates. Form A has the limited owner-confirmed configuration portions recorded in the 2026-10-27 ledger update; all remaining verification starts Pending/Unverified. Verify the planned Form A consultation settings and future blank Form C Builder settings before any synthetic test; no existing form is a source for inheritance. Runtime portions of JF-03/08 remain open until D.

Before a Form C creation or Form A consultation change, approve an account process that protects the existing Form A contexts, prevents unintended public access or live notifications, and records Form C’s new ID only after the account owner confirms isolation. Configure minimum fields, PHI protection, generic notifications, confirmation behavior and no-forwarding settings explicitly. Do not copy/import fields, settings or submissions from existing forms. If safe isolation cannot be established, stop before creation.

Review all default/hidden fields, protected flags, conditional routing, reply-to, subjects, attachments, staff recipients, autoresponders, integrations, webhooks, exports, save/continue, limits, duplicates and access/retention. Inspect actual thank-you behavior and ensure answer echo and HTTP POST forwarding to Astro/Contabo are off. Generic notification setup itself requires authorized Jotform mutation; no “test email” to inherited recipients before review.

The owner separately reports that the existing AIA Lead Generator | plain form has had field PHI protection enabled, automatic email-template updates disabled, autoresponder content revised to exclude submitted PHI, Spanish autoresponder behavior checked, delivery tested and its generated PDF attachment removed. Treat this as owner-reported remediation only. It does not audit historical recipients, access, retention, other legacy forms or HIPAA compliance, and it does not make that form a source for Form A consultation or Form C. No submissions or historical emails are to be retrieved in this planning document.

5. Independently authorizable batches

Batch A — Final form specifications

• Objective: close configuration knowledge gaps and secure owner decisions, not change forms.
• Authorization: explicit read-only Builder/metadata review scope. No credentials or submissions requested; owner may provide sanitized screenshots/exports. Use the complete roster in contract section 3; verify uncertain generic titles and relevant configuration without retrieving answers or assuming operational usage.
• Owners/dependencies: account owner, operations, clinical, privacy, EN/ES reviewers; JF-01–08 configuration portions, OA-01–05; P9-01 Tour/campaign boundaries where relevant.
• Outputs: versioned semantic field map, approved options/required flags, notification contract, eligibility/form decision, blank-form creation procedure, language/embed uncertainties. Update only separately authorized evidence/ledger files.
• Acceptance: distinguish static elements from fields; every proposed field mapped or explicitly pending; no guessed internal IDs or locale behavior. Required callback/contact expectations approved.
• Stop: before any form creation/editing, tests generating notifications, or production mapping.

Historical Batch B — Configure Form A consultation and create Form C (Form C canceled)

• Objective: configure Form A’s future consultation context without changing approved contact/landing behavior, and create one disabled blank Form C — Professional Referral Initiation.
• Authorization: explicit Jotform mutation permission naming the Form A context, Form C, account owner, reviewers, environment, isolation steps, proposed settings and stopping conditions. The historical 250727122848156 form is not a source and must not be cloned or repurposed.
• Prerequisites: Batch A field decisions; account/privacy owner available; approved test recipient roles; a Form A rollback plan; no unapproved production route is edited.
• Systems: Form A configuration, one new Form C and sanitized provenance documents only. Preserve all 27 existing assets, including clinical, agreement, event and operational workflows.
• Acceptance: record Form C’s actual ID, Form A context settings, protected fields, generic notification, no booking/child identifiers, no PHI forwarding, no Google integration, and no inherited recipients/conditions/attachments/redirects. JF-01–08 are verified for the changed scope.
• Stop: Form C remains disabled and unembedded; Form A consultation has no Astro placement or synthetic submission unless Batch D is separately authorized.

Batch C — Local-only Astro off/mock integration

• Objective: implement typed mode boundary and source-faithful inactive/mock presentation on existing routes.
• Authorization: explicit repository implementation scope; no Jotform account mutation or external form requests. Can begin independently of B after minimal fallback/form/UX decisions; no fabricated schema may substitute for A.
• Files: proposed files in section 2; bounded edits to ContactForm/FormShell/PageLayout/drawer, form-messages and styles; environment example/types only if needed. Preserve ContactObfuscation, search, map provider, content metadata and publication policies.
• Suggested first code slice: configuration + /contact and /es/contact off/mock with inert fallback, then remaining seven instances in a separately reviewed continuation. Report partial coverage honestly until all nine are protected. First slice must not claim a whole-site form-isolation guarantee.
• Acceptance: off no POST surface or vendor hints; local mock; EN/ES fallback; invalid configuration tests; guarded Chromium checks and existing regression suites. No live IDs in emitted new lead integration.
• Stop: reviewable unstaged local changes and evidence; no hosted preview, live descriptors or account use.

Batch D — Isolated synthetic Jotform integration and accessibility

• Objective: verify JF-09 and runtime JF-03/08 with actual approved isolated form(s).
• Authorization: separately approve test form IDs, origins, environment, synthetic input set, notification recipient roles, permitted methods/network destinations and test window. This is not covered by GET-only prior browser authorization.
• Prerequisites: Form A consultation and Form C configuration review recorded in B; C mode guards; operations/privacy/language settings approved. Use loopback preview, exact test-only allowlist; production counters/maps/Google/unrelated resources blocked.
• Acceptance: for Form A consultation and Form C, actual approved submit/error/cancel/retry behavior and controlled generic-email/header inspection. For Form A, owner-reported direct-Jotform and sampled Astro-iframe synthetic submission/confirmation are complete; final fallback, keyboard, real screen reader where available, 200%/400% zoom, slow/offline/block scenarios, all-seven-route acceptance and runtime-network review remain pending. Use no real patient data; retain only sanitized results.
• Stop: test-form evidence and remaining gates; no production IDs or deployment.

Batch E — Approved production mapping and staged-site integration

• Objective: prepare reviewed production lead descriptors and page integration without activating them.
• Authorization: separate approval of exact IDs, origins, locales, recipients, privacy/security/operations decisions and static artifact scope. “Staged-site” means a proposed release artifact unless a hosted preview is separately authorized; it never means permission to use Git staging.
• Prerequisites: A–D evidence, OA-01–05 and OA-07, JF settings stable, Tour/evaluation/payment decisions resolved. P9-04 preview isolation remains separate.
• Files/systems: approved typed mapping, reviewed components/messages, tests and configuration documentation; no nginx/DNS/API changes. Isolated-test and production IDs must be explicitly distinguished.
• Acceptance: all approved consultation/referral instances mapped, controlled comparison with approved forms, production-mode artifact inspected without browser egress, normal staging still off; no original-form fallback or publication changes.
• Stop: release-candidate review. No live submissions, notification activation, deployment or indexing activation.

Batch F — Phase 10 production acceptance, release and rollback

• Authorization: explicit Phase 10 go/no-go, operator, environment, form activation, approved synthetic operational test and rollback window. Not authorized by this plan.
• Prerequisites: pending human accessibility/visual/language/clinical/privacy reviews, P9-01/03/04/07/09/10 dispositions, hosting validation and release authority. Measurement can remain off.
• Acceptance: correct HTTPS/CSP/referrer/log boundaries, actual approved integrations, failure monitoring, reproducible artifact, route/SEO policies, safe rollback of both Astro and Jotform configuration, named responder. Raspberry Pi fallback requires its own verified parity/security plan.
• Stop: only the explicitly approved operational scope; no automatic ads activation or campaign changes.

Batch G — Separate conversion measurement under P9-05

• Authorization: explicit P9-05/P9-07 approval of vendor data flows, consent, event semantics and tests. Independent of form planning; not required to launch an approved untracked enquiry flow.
• Prerequisites: supported evidence of accepted Jotform submission and duplicate handling; no invented cross-origin event. Existing Ads IDs are documentation only.
• Acceptance: local mocks first, no CTA/open/load/failed-submit conversions, no answer/identifier leakage; any vendor-network test separately authorized.
• Stop: measurement review before tag installation/activation. No GA4/GTM/Ads/remarketing/enhanced-conversion code in Batches A–F by implication.

7. Future test matrix and validation procedure

These are specifications for later tests, not test results or executable code added now.

Test ID	Required assertion	Where / authorization
FT-01	Missing/empty/invalid mode defaults safely; explicit invalid live config rejected	Pure config tests, C
FT-02	No native lead form or active POST in off; Enter/native submit/requestSubmit cannot use an inactive lead surface	Rendered DOM + guarded browser, C; do not merely assert disabled button
FT-03	Off/mock new integration emits no source/live ID, iframe URL, helper/preconnect or external request	HTML/bundle scan + network ledger, C; existing clinical links scoped separately
FT-04	Exact nine route mappings and EN/ES behavior, no invented AR/C-ES publication	Existing manifest/content tests, C/E
FT-05	Mock local-only, no external endpoints, realistic synthetic errors and completion without tracking	Loopback harness, C
FT-06	320/390/768/1440, actual 200%/400% zoom, text/reflow, named iframe/fallback, long labels	Guarded Chromium; record browser/device/zoom method, C/D
FT-07	Keyboard, focus entry/restoration, Escape, scrolling, drawer timer does not load vendor resources	C/D; UX decision required
FT-08	Missing/invalid ID/locale, iframe blocked/unavailable/slow, offline, JS-disabled fallback	C/D; no guessed language parameter
FT-09	Screen-reader names/errors/confirmation and EN/ES review	D + human reviewers; remains Pending if unavailable
FT-10	Actual approved synthetic success/failure, email privacy/headers, no identifiers/attachments/POST forwarding	D only, JF-09; protected data never used
FT-11	No production Jotform, Contabo form POST, Google/GA4 or counter traffic outside explicitly approved test endpoints	C/D guarded request ledger; attempted versus transmitted distinguished
FT-12	No booking, child identifiers, unapproved service/payment/location/claim inheritance in approved form copy	Form A consultation/Form C schema and copy review; D rendered confirmation
FT-13	No conversion on click/load/start/failure/thank-you replay/untrusted message	G only; supported success contract required
FT-14	Clinical/Sign/CentralReach paths, search and publication invariants unchanged	Existing link/publication suites, C/E

Existing test/tooling hooks: www/tools/publication.test.mjs, seo.test.mjs, library.test.mjs, phase8.test.mjs, playwright-smoke.mjs and Phase 8 guarded runners. Extend focused tests; do not duplicate 122 complete page snapshots. Do not put a mock fixture in the published collection or add a production route just to test it.

After an authorized implementation batch, run sequentially from www:

npm run check
npm run test:markdown
npm run test:publication
npm run test:seo
npm run test:library
npm run test:routes
node --test tools/phase8.test.mjs
# Run the approved new form tests and guarded browser runner once implemented.
npm run build
PUBLIC_ALLOW_INDEXING=true npm run build
npm run audit:links
npm run audit:images
npm run audit:blog
npm run build

Use TMPDIR=/tmp for affected fixtures where needed. No network submissions during normal builds/tests. Keep mode off except explicit mock tests; indexing-enabled build is not live-mode approval. Expected unchanged: 122 routes/canonicals, 108 indexing sitemap URLs, 180 hreflang links/55 routes, 25 translation sets, 74 Library articles, search 55/12/7, nine archives/nine redirects, 182 FAQs across 30 articles. Final staging 122 noindex,nofollow, empty sitemap/no hreflang. Existing Phase 8 counts (156 tests) are history, not future totals to force.

Source changes require a newly named offline reconciliation using explicit final Phase 8 evidence reports/route-reconciliation-2026-10-15-offline-18-21-22-820Z.json, preserving all history and excluded files. Verify the actual new artifact explicitly with --check --evidence; no unrestricted crawl. Documentation alone does not require a new reconciliation. Finish git diff --check, source/status/index review; no staging/commit by Codex.

8. Remaining approvals, evidence and next action

First recommended authorized batch: Batch A, final Form A consultation/Form C specifications and owner field approval, using the now-complete owner-supplied 27-asset roster as historical context only. First safe code batch is C's off/mock contact slice after its explicit authorization; it can avoid external account changes while B is pending, but cannot invent Jotform settings.

The companion CSV records limited owner-confirmed Form A portions of JF-01, JF-04, JF-06, JF-07 and OA-05. Pending facts still include actual question IDs/types/defaults/options, conditional routing, real translations/locale URLs, default email behavior, thank-you/POST behavior, blank-form isolation and supported success signaling. Form A recipient access and retention/deletion are owner-verified; detailed role and retention-policy records remain outside the repository. Form A consultation has nine isolated-test routes but no production activation approval; Form C remains pending and physical Form B is retired. Tour/event/fundraising separation must be retained.

Any approval record must identify approver role, date, exact form/environment/version, sanitized evidence and scope. An account label ENABLED, a BAA, a successful static build or a generic vendor help article cannot close these gates. Keep the real screen-reader, authorized visual/non-Chromium, fluent-language, clinical, financial and policy/source-provenance requirements from SESSION_HANDOFF.

9. Documentation-only validation record

Preflight branch/HEAD/index checked; three October 17 artifacts present; their contents preserved. Reconciled nine F IDs against current source manifest and generated form instances; seven EN/two ES, no AR, eleven search forms excluded. All 27 reported assets are now individually listed in contract section 3 with 27 unique IDs; metadata provenance and supplied planning classifications are distinguished from unverified Builder settings and operational usage. All reference IDs labeled source-only; no production mapping created. No Builder gate marked verified.

Validation passed: local Markdown links, balanced code fences and whitespace; 18 unique checklist gates all Pending/Unverified (INV-01 retains configuration/usage verification, while roster receipt is recorded in its evidence) with blank approval dates; unchanged hashes for the three permitted October 17 inventory artifacts; unchanged tracked files; empty index; and git diff --check. Protected exclusions were not hashed or read. This task creates only the two October 18 Markdown documents and sanitized checklist CSV. No account mutation, form creation, submission/network POST, tracking, hosting change, build or deployment is performed. No historical document or living handoff is advanced. Protected exclusions and prior staging aid are neither read nor changed.

Roster reconciliation, version 1.1: only the October 18 contract, plan and checklist were updated. The individual inventory gap is closed by owner-supplied metadata; no JF or owner approval is closed and no implementation batch is executed.

Decision revision, version 1.2, 2026-10-21: the owner superseded the working-copy proposal with three new blank Jotform forms. Batch A now finalizes specifications, Batch B creates the three disabled forms only after explicit mutation authorization, and later batches retain off/mock/live safeguards. The 27-form legacy roster and all existing workflows remain historical/operationally independent. No source components, tests, Jotform forms or production systems were changed.

Version 1.3, 2026-10-27: records owner-confirmed Form A configuration evidence from the owner’s ChatGPT WebUI/Jotform review. Form A field PHI protection, the generic no-PHI notification template, absence of submission-PDF attachment, absence of webhooks/integrations, and privacy approval are confirmed for that form’s configuration scope. The update records recipient access and retention/deletion as owner-verified for Form A. It does not close conditional routing, runtime acceptance, live activation, Forms B/C configuration or any broader P9-03/P9-07 gate.

Version 1.4, 2026-10-28: reconciles owner-confirmed direct Form A runtime evidence and the implemented seven-route isolated iframe adapter. The five landing routes now use Form A under the isolated-test gate, superseding their earlier Form B mapping; Form B remains for other service-consultation journeys. Direct tests do not close embedded-iframe, runtime/privacy, accessibility or production gates.

Version 1.5, 2026-10-28: records owner-reported embedded synthetic submission and confirmation on the English and Spanish contact routes plus one ABA landing placement. It completes Form A functional submission acceptance for the reported samples, while retaining route-specific confirmation, all-seven-route responsive/accessibility, runtime/privacy, deployment and release gates.

Version 1.6, 2026-10-28: adds the exact production-gate configuration for Form A and its seven fixed placements. It does not activate an environment, change the Jotform account, map Forms B/C, or authorize a production release.

Version 1.7, 2026-10-28: records the owner-approved two-physical-form architecture. Physical Form B is retired; Form A gains a planned, unconfigured consultation context and Form C remains a future referral form. The exact future route/component matrix, service-interest options, evaluation explanation and pre-activation owner actions are in the two-form integration specification. No source component, current seven-route gate, Jotform configuration or deployment changed.

Version 1.8 addendum — 2026-10-29 consultation isolated-test implementation

The owner reports that Form A's consultation context is configured in Jotform. Astro implements it for a separate, non-indexing isolated-test build only; the repository has not inspected the configured Builder rules or submitted data. It extends FormAIframeContext to the fixed value consultation and uses the existing trusted Form A URL builder. No Jotform field identifier, service-option value or condition identifier is represented in source.

Placement class	Routes	Locale and activation behavior
Standalone consultation	/client-consultation, /es/client-consultation, /schedule-consultation	Fixed formContext=consultation; EN for the first and third routes, ES for the second
Service drawer	/aba-therapy, /autism-evaluations, /learner-social-club	EN. An accessible button opens the native dialog; only then does the adapter assign its fixed iframe URL.
Service drawer	/es/aba-therapy, /es/autism-evaluations, /es/learner-social-club	Same shared drawer and behavior in ES, with a fixed language=es URL and localized parent controls/fallback.

Every consultation placement requires all of the following build-time values:

PUBLIC_AIA_FORMS_MODE=isolated-test
PUBLIC_AIA_FORMS_ENVIRONMENT=isolated-test
PUBLIC_AIA_FORMS_ISOLATED_TEST_APPROVED=true
PUBLIC_AIA_FORMS_LIVE_APPROVED=false
PUBLIC_AIA_FORMS_CONSULTATION_TEST_APPROVED=true
PUBLIC_ALLOW_INDEXING=false

The original seven contact/landing placements are the complete production allowlist. PUBLIC_AIA_FORM_A_PRODUCTION_APPROVED=true, whether alone or with the consultation flag, does not authorize these nine routes. Off, mock, normal staging, indexing-enabled and production builds emit no consultation iframe. For the six drawers, the static artifact contains a deferred adapter; its fixed source is assigned only after the visitor opens the dialog, so static iframe counts and on-demand browser requests must be reported separately.

The shared ServiceInquiryDrawer.astro keeps legacy off/mock behavior scoped outside the isolated consultation test. In the authorized test it removes the legacy child-information surface, uses localized English/Spanish drawer copy, relies on the native dialog's close/Escape/backdrop/focus-restoration behavior, and provides a localized no-JavaScript hosted-form path. It does not auto-open or load Jotform merely because the closed drawer is present. The fixed iframe keeps referrerpolicy="no-referrer", sandbox="allow-forms allow-scripts allow-same-origin", its 15-second hosted fallback, no Jotform helper, no cross-origin DOM access and no postMessage handler.

The previously proposed conditional Autism Diagnostic Evaluation explanation is superseded. The consultation form must not add that note or imply in-clinic diagnostic availability. The AIA client advocate will explain available options and coordination with qualified diagnostic providers in the later conversation. Required owner acceptance remains: rendered service question/choices/conditions, English/Spanish translations and validation, synthetic submission/confirmation, notification boundary, responsive/error sizing, keyboard/dialog behavior, real screen-reader review, telemetry/privacy review and any future production route authorization.