Spec · v2 draft · for red-pen · review-graded 9/10 build-ready

Forms, done right

Both JotForm pages come back to the fairfax site with the forms served from the practice’s own domain, submissions landing in DE’s Cloudflare intake — proven equivalent field-by-field before either page is re-admitted. No interim JotForm. No sticky notes.

v2 for Robert’s annotation · independent review: BUILD-READY · building starts on your word
01

The story — and what changed since you asked

A pet owner opens the new-client page and sees exactly the form they’d see today — a prior validation of this exact approach measured 0% visual difference. They hit submit. The lead lands in DE’s own Cloudflare pipeline — stored, delivered, receipt-verified — and the page never talks to JotForm at all.

Better news than my first answer: most of the path is already built and proven. This repo already contains a toolchain that photographs the JotForm form exactly as a browser sees it, rebuilds it to run from the practice’s own site — swapping JotForm’s spam-check for Cloudflare’s, pointing the submit at our intake — and proves the result equivalent field-by-field. The equivalence checks are already wired into the door’s battery. What’s genuinely missing is smaller than first thought: the door’s pipeline never runs that toolchain. Wiring it in is the build.
02

Decisions locked

Built to your two rulings: no interim JotForm (“no sticky notes — do it right the first time”), and as close to byte-identical as honesty allows.

Mechanism
Connect proven parts — build only the wiring
A prior independent validation already proved embedded forms can be preserved: capture + rebuild achieved 0% visual diff, all fields intact, zero contact with JotForm. We are not inventing form machinery; we are connecting proven parts.
Hosting
The form becomes part of the practice’s own site
Served from the practice’s domain like every other page. The “unverifiable third-party window” objection dissolves on its own, and the site’s zero-outside-calls guarantee stays intact.
Admission
Pages return only when their swap is green
No exception, no override — the exclusion reason is simply gone once the form is same-origin and verified. The site ships complete with native forms, or not at all.
Proof
Equivalence proven, not assumed
Field-by-field census of before vs. after, plus one test submission arriving at the pinned DE test inbox with a provider receipt. A form that renders but can’t submit goes red.
Safety
No test traffic can ever reach a practice
The intake worker refuses real-recipient delivery by construction until a separate, per-practice go-live step. Pointing real leads at a real inbox is its own checklist, later.
Honesty
This is more than “one attribute”
The iframe address is rewritten in two places (a lazy-load duplicate hides in the page), and the site gains a new form-document subtree. Every byte is recorded as authored provenance — who, when, why — and the new subtree gets the same byte-anchoring as everything else served.
03

How this spec was made honest

  1. v1 was wrong. My first draft claimed existing edit rails could carry the change and revived an approach this repo retired months ago. I wrote from memory, not disk.
  2. The independent review refuted it before any code existed. Every refutation disk-verified; I re-checked all five load-bearing claims myself. Grade: 5/10, revise-first.
  3. v2 is rebased on what actually exists. Re-graded by the same reviewer against their own findings: 9/10, build-ready, no blocking residue.
04

What could go wrong

JotForm residue
The captured form may lean on scripts that assume JotForm’s backend. The rebuilder strips the known ones; the equivalence gate catches any residue — looks-right-but-can’t-submit goes red.
Spam
Handled: Cloudflare’s human-check (Turnstile) replaces JotForm’s, and the intake’s policy layer sits behind it. One operational prerequisite: a Turnstile key provisioned per site.
The new subtree’s integrity
The form document is new bytes the practice’s capture never had. It gets anchored into the byte-integrity gate deliberately — with a planted-defect test proving the gate goes red on a mutated form byte. Never waived.
05

How we’ll know it works

Equivalence green (field census match + one proven arrival with receipt) · both pages move excluded → admitted with the objection gone, not overridden · a control run with the swap disabled must still exclude them (the gate can be made to fail) · the next full door run shows the site complete.

06

Your two calls — the red-pen targets

1 ★
Replicate or improve?
The JotForm forms may have clunky fields. My rec: replicate exactly now — the swap proves the rails; improvements become later recorded edits, each cheap.
2 ★
Where do newsletter signups land?
It’s a signup, not a lead. My rec: same intake with a “newsletter” tag now; choose its long-term home (an email tool) later without touching the page again.