# Conditional intake and safe seed updates

This delivery updates intake and existing five-form prefill foundations. It does not add the remaining eleven IMM maps or the authenticated PR/Express Entry portal adapters.

## Preview and Content Management controls

Forms Library > Autofill PDF drafts supports independent EN/FR selection and case-linked applicant selection. IMM 5476 uses the assigned case consultant for Section B; additional applicants must have confirmed age 18+. Additional applicants do not inherit unbound principal-applicant questionnaire responses.

Five forms (IMM 5476, IMM 5707, IMM 5257, IMM 1294 and IMM 1295) have separate EN/FR maps. The other eleven requested codes remain visible with mapping pending. All 32 official templates were downloaded locally; storage assets must also be installed on the deployment server.

Preview shows filled values and missing mapped answers before download. Its 15-minute fingerprint binds user, case, person, representative, language, template and mapped values. Changed or expired reviews return HTTP 409. Existing direct PDF endpoint remains compatible; the new UI requires review.

The template SHA-256 registry is resources/imm/template_versions.json. Replacing an approved PDF changes its hash and blocks preview/download until the corresponding mapping and template version are reviewed. Catalog synchronization alone never approves a new mapping. A hash match and XML target audit do not prove Adobe validation or complete form coverage.

Run the organization_name users migration. My Account professional identity now includes Organization / firm name, used by IMM 5476 independently of address_line2. Existing address values are not copied into organization_name.

Content Management questionnaire bank editing supports visibility conditions, required defaults and bilingual structured column labels. Stable field keys remain unchanged. Missing references and circular conditions are rejected; sent questionnaire snapshots remain unchanged. Safe bank update/rollback still uses the command below, not a new admin UI.

## Added intake

- MEL 1.7.0: previous spouse family/given names; parents' accompanying intention. Existing combined names retained.
- Family Hub 1.1.0: sponsor employment/address histories; separate voluntary sponsor/applicant disclosure consent. IMM 5532 intake applies to spouse/common-law/conjugal partner sponsorship.
- H&C Hub 1.1.0: explicit IMM 5283 application selector and questions 7–13 narratives. Refugee/protected-person/public-policy classification alone never enables these questions.

Consent wording follows [official IMM 5532 instructions](https://www.canada.ca/en/immigration-refugees-citizenship/services/application/application-forms-guides/imm5532.html). Consent to disclose investigation results is distinct from a signature or declaration.

## Update

Run from `backend`:

```powershell
php artisan questionnaire-bank:update master_entry_level
php artisan questionnaire-bank:update family_sponsorship_hub
php artisan questionnaire-bank:update humanitarian_compassionate_hub
```

Each command first saves current bank metadata on the private local storage disk. The printed backup path is the rollback reference. Sync compares existing metadata against the retained old seed; consultant edits remain authoritative. Stable source keys and IDs are preserved. Sent questionnaire structures, answers and revision records are never rewritten.

Seed originals are retained in `database/data/versions/ircc-autofill-v1/`. Restoring those files alone does not restore database metadata. Standard legacy seeders retain their existing behavior; use the safe command for this rollout. If consultant schema changes prevent a seed delta, inspect that question and reconcile it explicitly.

## Rollback

```powershell
php artisan questionnaire-bank:update --rollback=questionnaire-bank-backups/BACKUP_UUID.json
```

Restore on the same database that produced the backup. Restores bank metadata; newly added bank rows are archived, never deleted. Client responses and sent assignments remain intact. Bank edits made after the backup are reverted too. Copy the private backup storage when moving this deployment; Git does not contain database backups.

Local rollout backups (2026-10-08):

| Bank | Backup reference |
|---|---|
| MEL | `questionnaire-bank-backups/c482260c-56e8-4dd6-b690-b46002654c78.json` |
| Family | `questionnaire-bank-backups/1ee857bd-f73a-4f78-999e-dd1591c89445.json` |
| H&C | `questionnaire-bank-backups/0e583a13-fde3-48ce-a304-fd38ace5e43c.json` |

## Autofill safety

Case routes read selected-case submitted assignments; client routes read submitted client-level assignments. Reviewed canonical scalar profile values take precedence, while open conflicts block the corresponding questionnaire/Person fallback. Active correction drafts are excluded until submitted, so temporary gaps are expected. Hidden parent answers are pruned before evaluating dependent questions. Unknown parent values never enable negative conditions.

Coverage counts unique enabled mapped targets after fallback and conditional clearing. It is not a claim of complete official-template coverage. The writer rejects values over its 2,000-character draft limit rather than cutting them; this is an implementation limit, not an IRCC narrative limit. Continuations need a form-specific implementation and review.