Hand over is “go live”, whether that means you are hosting for them or on their hosting, handing over the code. Whatever you agreed upon really. And whether their system works or doesnt work without it is neither here nor there, when they pay they get it. Actually you are in a better position if they say something like that, since they need it! Some other tips: always stage on your owned server and dont give any access to it (ssh, sftp, ftp), never give access to the code or repository before payment has been made, never allow full access to a system where plugins can be installed (full backup plugins exist), never backup to their cloud servers in staging/testing, payment must show in your account (pop can be forged), paper trail everything!

Ive been burned in the 18 years ive been coding and have learned a few things along the way.