# Customer records and reviewed corrections — v0.14 Current addition: [v0.25 guarded merge correction](MERGE-CORRECTION.md), reached from an exact saved merge in customer history. The original merge remains, with a separately reviewed reactivation and optional selected return jobs. The following v0.14 walkthrough is historical. This checkpoint is for invented local records. It does not approve the live SHS app or import its customers. ## Find a record and inspect its history Open **Customers**. Search by exact ID, name, email, phone, address or owner-private notes. Choose active, archived, retained merged or all records. Matching text never links people or grants access. **History** shows current jobs, next actions, original document identities, receipt dates, defined financial totals, operational reviews, counts of associated work and saved change history. Follow a job to inspect its detailed field, photo, material and booking records. The timeline shows at most 1,000 entries; underlying history is retained. Private notes stay on their original customer record and do not revoke access or feedback permission. Contact corrections do revoke portal access and suspend feedback permission. Saved documents retain the contact details used when they were created. **Export this view** exports up to 500 matching records with the same search and state filter. Narrow a larger result first. The UTF-8 CSV includes exact IDs, state, contact information, private notes, created time and current financial totals in integer pence. It excludes credentials, private images and document bodies. Spreadsheet formula prefixes are escaped as text. This is an owner-private data extract, not a backup or accounting reconciliation. ## Keep separate, merge or reassign **Review possible duplicates** suggests exact pairs with matching normalized name/email or phone text. Check the identities and save a reasoned **Keep separate** decision when they differ. Use the checkbox to see previous separate decisions. Up to 500 active customers and the first 200 suggested/reviewed pairs are supported; exact record selection remains available for other pairs. **Review record transfer** lets an owner choose a source and retained customer. A merge moves all source jobs, up to 50. Reassignment moves only the selected jobs, up to 25, and leaves both records active. Merge contact fields are chosen from the two saved records; notes remain with their original record. Preview the exact jobs, documents, retained fields and associated record IDs. Read the access/sharing changes, enter a reason and deliberately confirm. Saved work anywhere in the business can make a preview stale; keep the form open, inspect current records and preview again. A stale or failed transaction moves nothing. Retries do not duplicate a successful transfer. Both customer portal accounts are revoked. Photo sharing is suspended, reviewed flags reset and published galleries withdrawn for both customers' jobs; old feedback permission is invalidated. Fresh exact-customer access and separate sharing reviews are required. Original responses, documents, receipts, field evidence and permission histories remain. A transferred job is excluded from follow-up suggestions until the owner reviews it; an old dismissed/completed source is not revived solely by changing the customer. A merged source remains as a visible historical alias. It cannot sign in, receive an invitation or own new jobs. Its historical documents link to the retained customer without counting money twice. This stage has no one-click merge undo, transitive alias chains or second transfer of the same job. A source already retaining aliases is blocked. Those corrections need a separate reviewed design. Unfinished timers, unreviewed field logs, active/paused recurrence and current/future bookings block transfer. Retired recurrence definitions remain under their original customer and cannot restart after transfer; create separately reviewed new repeat work if needed. A moved field source advances its identity version: source-backed drafts need explicit renewed source review before issue. Shared/accepted content stays sealed and may need a new revision; do not rewrite historical evidence to bypass the review. ## Fill a genuinely unknown completion date In an active customer's history, choose **Review missing completion dates**. Select an already-completed job whose completion date is blank, an issued invoice for that exact job, the actual completion date and a short evidence note. Preview every row, add a reason and confirm. Up to 25 rows save together; any invalid/stale row stops all of them. A payment or invoice date is not inferred to be the completion date. No customer, job, invoice or receipt is created. This deliberately replaces the reference code's paid-invoice-to-completed-job backfill with a bounded evidenced correction. Generic legacy import, inferred historical jobs, automatic identity matching and deletion remain outside this stage. ## Archive and recover Archive requires closed work and no blocking activity. It retains history and money, revokes access and suspends sharing. Restore re-enables the record for work but never revives old credentials or permissions. Merged aliases cannot be restored through this control. Recovery format 11 includes the seven customer record/review tables. Pinned formats 1–10 remain supported; migration observes existing contacts without inventing earlier notes, merges or dates. Stop the app and back up an older dataset with its matching old code before upgrading. Never downgrade a migrated folder in place. See [recovery instructions](BACKUP-AND-RECOVERY.md). ## Evidence and limits 560 backend tests, 90 client tests, 65 structural render checks and the build pass. A four-business disappearance/restore drill preserves 12 customers, four aliases, four transfers, four separate decisions and four evidenced date corrections alongside documents, receipts, field/photo/source and feedback histories. Tampered identity/history archives are rejected before creating a restore target. Actual browser evidence covers private-note save and Keep editing, a reasoned keep-separate decision, exact merge preview/confirmation, reopened retained/original history, unchanged £180/£50/£130 values, a reviewed completion date reopened in its job, a one-record filter and the export button completion message. Initial customers/billing and the unknown-date fixture were prepared with test APIs. Browser download file bytes were not retrieved; CSV bytes/escaping/scope and download context guards were tested separately. No customer-password creation or post-merge portal re-invitation journey is claimed here. Archive/restore, selected-job transfer, retained-field alternatives, stale-transfer UI, source re-review, full pair-history presentation, large data, physical phones, touch, screen readers, installed PWA/offline and second-machine recovery need broader UI verification. The build retains an existing bundle-size warning; the test suite retains a framework deprecation warning and the intentional image-limit warning. All 45 capabilities remain tracked and all 14 original SHS findings remain OPEN.