Every screen in the build, checked against one rule: nothing hardcoded, nothing faked.

Nine parallel reads, one rule applied consistently everywhere.

Every page now reads real data and every control does something real.

• Site & profile. Logo upload, headshot/hero photo replace, theme picker, and the About form are now real client state (new LogoUploader/PhotoUploader/ThemePicker/AboutForm components), matching the wireframe-state-only convention SocialLinksEditor already established on this same page.
• Digital card. Share URL now derives from DOMAIN_SETTINGS.defaultDomain instead of a private, drifted "closingboss.io/dave" literal. Copy link is real. Card fields (phone/email) now have a working Save form and read/write the new single-source AGENT.phone/AGENT.email fields instead of three independently-typed copies of the same strings across three files.
• Lead capture. Target zips are a real chip add/remove editor; available days are real toggled state; both channel sections have working draft+Save forms.
• Testimonials. Featured/Hidden toggle actually flips state; "+ Add a review" appends to real local state.
• Domain. Add/Remove domain both work against real state, Remove uses the same two-step Delete-then-Confirm pattern as Listing Alerts.
• Billing. Plan name now derives from a single planLabel(AGENT.plan) helper instead of a second, disconnected BILLING.plan string that Team's own plan gate never agreed with. Update card opens a real inline form. Change plan links to Team (the one real place a plan change actually leads for a single-plan product) instead of faking a self-serve switcher.
• Notifications. Previously the only Settings page with zero fixture backing at all — five hardcoded checkboxes wired to nothing. Now reads a real NOTIFICATION_SETTINGS fixture with real toggle state.
• Account. Login email now reads AGENT.email; the form has a real onSubmit with a saved confirmation instead of a page-reloading native submit.

Two genuinely un-buildable actions — QR code download, invoice PDF download — get honest click feedback (a real, disclosed "not wired in this wireframe" response) instead of either silence or a fabricated file. tsc, lint, and a full production build all pass clean.

The first client-facing surface in the app — real data, one deliberately deferred state.

Two of the three forms whose entire job is capturing a lead do not work.

• /site/valuation — the whole page's single purpose (capture a valuation lead) is non-functional. Needs the same client-component + preventDefault + local confirmation pattern already proven in ShowingRequestButton.tsx.
• /site/contact — both forms are dead the same way. The day/time picker for booking a consultation has a second, separate bug: the "selected" highlight is computed from the loop index, not from which radio is actually checked, so clicking Friday at 2:30 still visually shows Monday at 10:30 as selected.
• /site/listings/[id] — the "Request info" form has the identical dead-form defect. Unlike the two above, this is the one form on an otherwise fully real page (live SimplyRETS data, a working mortgage calculator, a real showing-request button that does work).
• /site/login — same defect class, lower priority (not a lead-capture path).

Once wired, a real submission genuinely can't reach the agent's Inbox — there's no shared store between the public site and the dashboard yet, the same disclosed architecture limit that applies everywhere else in this app. The honest ceiling here is a local "got it, Dave will follow up" confirmation, matching what ShowingRequestButton already achieves. Right now these three forms don't even reach that ceiling — they just silently fail.

Smaller finds in the same cluster: the AI chat bubble (present on every public page) has buttons that do nothing at all, not even a canned reply, despite already having local state wired up and an honest "Wireframe — not connected yet" caption printed right next to them. The homepage's Showcase section doesn't disclose that its listings come from a SimplyRETS trial-dataset agent ID standing in for Dave's real MLS ID, the way the equivalent code in /spotlight already does. And the About page overstates what /site/search actually shows ("straight from Dave's own MLS feed" — it's actually the whole board, other agents included, which is why every result already carries a "Listing courtesy of" line).

The one module backed by a real database — genuinely live, with a couple of real bugs.

• Duplicate listings possible. The merge of the agent's own synced listings with board listings they've manually "added" never dedupes by listing ID. Searching the whole board and adding one of your own already-synced listings creates a second row that renders twice, on both the admin page and the public Showcase grid.
• Stale cache after Remove. Removing a listing from Spotlight only revalidates the Spotlight page's own cache, not the Browse page's — the "✓ Added" badge and hidden "+ Add" button on Browse stay stuck showing the listing as still added until that route's cache happens to expire on its own.
• Wrong tie-break copy. "The first one you starred wins" doesn't match the actual logic (array order, not chronological starring — no timestamp is ever stored for when a listing was starred).
• Courtesy-line compliance gap. The Browse page correctly prefers the brokerage name for IDX-compliant attribution; the main Spotlight page's simplified inline version always falls back to the individual agent's name, which can render non-compliant attribution for an added listing that has a real office name on file.
• Unlabeled 20-result cap. Browse silently caps at the API's default page size against a board that can hold up to 65 listings, while the results banner reports the truncated count as if it were the true total.

The most disciplined cluster in the app — small, concrete bugs, not gaps.

• Tasks — a fabricated date next to a real completed item. A sort-order sentinel (dueInDays ?? 999, used to push undated finished checklist steps to the back of the queue) leaks into the actual displayed date. Elena Rostova's three already-completed, never-dated inspection/appraisal steps render with a fabricated date roughly 999 days out — the Completed tab can show something like "May 5 · Today" for a step that has no real due date at all.
• Contacts list — a row action that fakes success. The list view's "Send e-sign" icon button writes an already-marked-done "Sent for e-signature" activity log entry directly, with no real envelope, no listing, no wizard — an agent clicking it believes a document went out when nothing did. Every other "Send e-sign" entry point in the app (Inbox, Contact Detail) correctly deep-links into the real Documents upload wizard instead.

Smaller nit, same root cause in four places: the Contact "Source" dropdown's six option values are independently hand-typed in four different files with no shared fixture array backing them — a maintainability risk, not a functional break.

Consistently the most rigorously self-disclosing area of the app.

• No way to delete a whole campaign. Both the Campaign Dashboard and the Drip Campaign editor offer Clone, a status dropdown, and per-step delete — but nothing to remove a campaign created by mistake. It can only ever be Paused or Drafted, never actually removed.
• First-step delay can desync from its own label. A brand-new campaign's first step defaults to a 3-day delay while the UI still labels it "Immediately upon enrollment" — the "add step" flow never forces the first step's delay to zero the way "edit step" already does.
• Listing Alerts — three fields with no visible effect. Property type, subtype, and min sqft are real, saved, editable criteria, but changing them never moves the live "Matching listings currently" count sitting right below them, because no listing in the fixture data carries that information. Correctly disclosed in a code comment, but nothing on the actual page tells an agent testing it why the count doesn't move — reads as a broken control even though the underlying reasoning is sound.

Analytics is clean. Tracking Links' create flow is pure decoration.

• Analytics — every number and every bar traces to a real fixture value or a real computed ratio. No fixes needed.
• Tracking Links — the entire "+ Create link" form is decorative. None of its three inputs have a value or onChange; the submit handler only closes the panel — it never reads what was typed and never appends anything anywhere. TRACKING_LINKS is a plain module-level constant, not React state, so there's structurally nowhere for a created link to go yet. The stat tiles and the link list are genuinely real and correctly wired; only creation is fake.
• Wrong domain literal. The page's short-link base reads "closingboss.io/dana" — every other place in the app that shows a public short link (the digital card, both lead-capture public URLs) uses "closingboss.io/dave", the real agent. Every link and every clipboard copy this page produces is visibly wrong for this account.

A prioritized list, not a wall of code — each row is already scoped and ready to build.

Client Portal's State C (multi-transaction switcher) isn't on this list — it needs a real product decision about extending Contact beyond 1:1 with Deal, not a fix, and that decision touches Pipeline too.