`CHANGES.md`

17 lines
## Applied

- None — no P0/P1 review item matched the approved safe fix list for autonomous edits.

## Deferred (needs Steve)

- P0 — `index.html:17` — public root serves the theme mockup chooser — deferred because changing production routing/customer-facing HTML is out of scope.
- P0 — `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` — lead forms prevent submission and do not send data — deferred because wiring a real lead backend/mail handler requires a product/infrastructure decision.
- P0 — `theme-3-costa-rica-modern/index.html:14`, `theme-3-costa-rica-modern/contact/index.html:13`, `theme-3-costa-rica-modern/about/index.html:15`, `theme-3-costa-rica-modern/services-legal/index.html:15` — production pages load Figma MCP capture JavaScript — deferred because removing scripts from public-facing pages is outside the approved safe fix list and may affect the current design workflow.
- P0 — `README.md:6`, `README.md:63`, `DIARY.md:164` — SSL/DNS are documented as unfinished — deferred because DNS, certbot, nginx, and certificate work are explicitly excluded and require Steve/server access.
- P0 — `CODEX_REVIEW.md:13` — no SQL injection/auth/CVE backend issue observed — deferred because there is no fix to apply.
- P1 — `README.md:27`, `DIARY.md:116`, `DIARY.md:272` — public docs include root SSH/deploy runbook details — deferred because this is documentation/content cleanup, not one of the approved safe fixes.
- P1 — `theme-3-costa-rica-modern/contact/index.html:184` — privacy policy link is `href="#"` while collecting personal data — deferred because adding a real privacy policy is a legal/content decision.
- P1 — `theme-3-costa-rica-modern/index.html:489`, `theme-3-costa-rica-modern/index.html:551`, `theme-3-costa-rica-modern/contact/index.html:249`, `theme-3-costa-rica-modern/contact/index.html:321` — core CTAs are dead `#` links — deferred because replacing them changes public-facing behavior/content and needs real destination choices.
- P1 — `theme-3-costa-rica-modern/index.html:15` — homepage duplicates shared CSS — deferred because CSS migration is not in the approved safe fix list and touches customer-facing presentation.
- P1 — `README.md:41` — docs say About and Legal are planned though files exist — deferred because documentation cleanup is outside the approved safe fix list.