## Morning — make it work

1. **Wire production intake** — set `PUBLIC_GUIDE_WEBHOOK` (and optional GA4) in CI variables; test live contact form  
2. **Verify DNS & deploy** — custom domain, HTTPS, branded 404, privacy page  
3. **Fix trust content** — real testimonials or clear "representative outcomes" labeling; media entries need URLs or removal  

## Midday — polish & protect

4. **Spam layer** — honeypot minimum on public forms; rate limit webhook server-side  
5. **Analytics decision** — GA4 on + consent, or GA4 off entirely  
6. **Smoke test** — contact, search, theme, mobile nav, RSS, print résumé if applicable  

## Afternoon — content & ops

7. **Blog not empty** — at least one recent note if blog is promoted  
8. **CI quality gate** — consider `astro check` or equivalent typecheck in pipeline  
9. **Update discovery files** — `llms.txt`, sitemap, agent manifest if public  
10. **Final deploy** — green CI, live site matches local  

## End-of-day boxes

- [ ] Webhook tested on production  
- [ ] Testimonials defensible  
- [ ] Spam protection in place  
- [ ] Privacy policy live  
- [ ] Mobile smoke test passed  
- [ ] `npm run build` + audit clean  

Full expanded plan with agent-first maintenance notes: see `HANDOFF-DAY-PLAN.md` in the [davidcolecloud repo](https://github.com/davidthegnomad/davidcolecloud).