# Launch checklist ## A. Items that require Waters Church approval before launch Nothing below was fabricated; each item is either unverified or a legal/policy decision. ### Facts to confirm (config/campuses.json → `verify`) - [ ] **Coordinates** for every campus (derived from Google Maps links / OpenStreetMap; spot-check each pin). - [ ] **North Attleboro service times** — campus page says 7:30, 9:30, 11:30 AM; the locations index page shows "11:30p" (assumed typo). - [ ] **Parking and arrival notes** for each campus (currently empty; generic copy is shown instead). - [ ] **Woonsocket and Southcoast phone numbers** — the main office number is used because the campus pages list none. - [ ] **Orlando** — marked `launching` (launch team only) and excluded from recommendations. Flip `status` to `open` and add an SMS number when it opens. - [ ] **Central "Text Us" number** (`NEXT_PUBLIC_CENTRAL_SMS_NUMBER`, default +1 508-695-1300) — who answers general texts? - [ ] **Norwood** uses `info@waterschurchnorwood.org` and 781-762-3357 per its own page — confirm these are current. ### Content placeholders (src/content) - [ ] `faqs.ts` items flagged `confirm: true`: service length ("a little over an hour"), parking ("free on-site parking at every location"), accessibility ("step-free entrances"). - [ ] `kids.ts` items flagged `placeholder: true`: first-time check-in steps, "arrive 15 minutes early", what to bring, special-needs accommodations. - [ ] `testimonials.ts` is empty → section is hidden. Add real, permissioned quotes or leave hidden. - [ ] Headline and copy tone (`copy.ts`). ### Legal / compliance (not legal advice — route to Waters Church's adviser) - [ ] **SMS consent language** (`consent.ts` → `sms.detail`): TCPA/CTIA disclosures, frequency, "Msg & data rates may apply", STOP/HELP, consent not a condition. Confirm the number is registered (10DLC campaign / toll-free verification) for this use case. - [ ] **Email consent language** and single vs. double opt-in (`MAILCHIMP_DOUBLE_OPTIN`). - [ ] **Privacy Policy** at waterschurch.org/privacy covers this subdomain, SMS, geolocation estimate, analytics and ad pixels. Add a **Terms** URL (`NEXT_PUBLIC_TERMS_URL`) if one exists. - [ ] **Data retention**: set `LEAD_RETENTION_DAYS` (0 = keep forever). Decide who may run `export-leads.php` and where exports live. - [ ] **Analytics consent mode**: `implied` (default) vs `opt-in` banner. - [ ] **Location estimation** wording (`consent.ts` → `locationBlurb`). - [ ] Bump `consent.version` if any consent text changes. ## B. Post-deployment verification ### Hosting - [ ] `https://visit.waterschurch.org/` loads; `http://` and `www.` redirect (301) to `https://visit.waterschurch.org/`. - [ ] SSL padlock valid (AutoSSL) — check with https://www.ssllabs.com/ssltest/. - [ ] `/BUILD.txt` shows the expected build; `/404.html` and a random URL return the branded 404. - [ ] `/api/health.php` → `"ok": true`, `integration_mode: "live"`. - [ ] `/api/lib/Config.php`, `/api/config/campuses.json`, `/api/cron/retry-integrations.php` → **403**. - [ ] Response headers include `Strict-Transport-Security`, `X-Content-Type-Options`, cache headers (`immutable` on `/_next/static`, `must-revalidate` on HTML), `Content-Encoding: br|gzip`. - [ ] Old Church Center redirect removed. ### Location detection - [ ] On a phone off Wi-Fi: a campus is *recommended* with the "based on your general area" badge. - [ ] Deny "Use my precise location" → friendly message, page still usable. - [ ] ZIP search: 02763 → North Attleboro, 02062 → Norwood, 02895 → Woonsocket, 02878 → Southcoast, 33572 → Apollo Beach, 32789 → Apollo Beach (far away notice), 90210 → far away notice. - [ ] Bad ZIP (`abc`, `1234`) → inline error, no crash. - [ ] Choose a different campus → form step 1 updates to match. ### Form, consent and integrations (use your own email/phone) - [ ] Email consent only → Mailchimp contact created with tags; **no** text sent. - [ ] SMS consent without phone → blocked with an inline error. - [ ] SMS + phone → confirmation text arrives from the **campus** number within a minute; Mailchimp `Visit:SMS Opt-In` tag present. - [ ] Neither box → lead stored (export shows it), nothing sent. - [ ] Reply STOP to the text → opt-out confirmed by Sinch; resubscribe afterwards. - [ ] Double-tap "Send" / refresh and resubmit → one lead, one text (`duplicate: true` in the network response). - [ ] Temporarily set a wrong `SINCH_API_SECRET` → submit → confirmation still shows, `sms_status = retry`, cron log shows retry; fix the secret → text arrives on the next cron run. - [ ] Confirmation screen shows campus, times, directions, "Text Us a Question" with the campus number. - [ ] Mailchimp journey/automation fires for the new contact. ### Attribution and analytics - [ ] Visit with `?utm_source=facebook&utm_campaign=test&fbclid=abc&v=b`, submit → export shows the attribution JSON and `variant = b`; Mailchimp tags include `Visit:Platform Facebook`, `Visit:Campaign test`. - [ ] Visit with no parameters and with malformed ones (`?utm_source=