# Correct a mistaken whole-customer merge — v0.25

This is a local owner review using invented records. It adds a correction to the saved history. The original merge, its reason, contact snapshots and every earlier job move remain unchanged. It does not restore a whole database or claim complete duplicate/import parity.

## Review the exact saved merge

1. Open Customers, choose **Retained merged records** or **All records**, then open the original customer's history. The retained customer's history also lists the same exact merge.
2. Under **Original customer merges**, choose **Review correction of this merge**. Check its ID, original reason, both exact customer IDs, original contact details and current details.
3. Select the original jobs that should return. Nothing is selected automatically. Every original job remains visible with its current owner and ordered moves. Work that moved to a third customer is excluded and cannot be returned in this operation. The retained customer's own and newly added jobs are shown separately and stay there.
4. Choose contact values field by field. **Keep current** is the default. **Restore before merge** is available only while the current retained value still equals the value saved by the original merge. A later different value must be kept here; any other edit needs a separate customer review. The reactivated record keeps its original details and private notes.
5. Choose **Preview reviewed separation**. Check the full or selected scope, excluded jobs, new ownership moves, original documents/amounts, associated records and access effects. An empty selection explicitly means **reactivate the record only; no jobs will move**.
6. Enter a meaningful reason, tick the exact-review confirmation and choose **Confirm reviewed separation**. The final dialog defaults to **Keep reviewing**; Escape also keeps the form. Choose **Save reviewed separation** only for the displayed review.
7. Reopen the customer history. It shows the original merge and the new correction. Returned jobs have a new numbered move from the retained customer to the reactivated customer, including when their original identity is again current.

A successful save reactivates the original exact customer record. It does not create a replacement customer or infer identity from matching names, email addresses or phone numbers. There is one reviewed correction per original merge. Any remaining work can subsequently be considered through the existing selected-job review using active exact records.

## A blocked or uncertain review

In-progress work, unfinished timers/reviews, unreviewed field notes, current/future bookings and active/paused repeat definitions block a selected job. A selected job outside the original merge, or now owned elsewhere, blocks the entire selection. No eligible subset is silently saved. Resolve the blockers or explicitly select a narrower set and preview again. Each correction accepts up to 25 selected jobs; an original merge can contain up to 50, so larger original groups need an explicitly labelled subset followed by separate job reviews.

Stale contacts, new work, private-note changes, sharing/access changes and membership changes invalidate the preview. The form retains the reason, job selection and field choices through validation or stale-save errors. Preview again using current versions, then deliberately reconfirm.

If the reply is lost, the form freezes its exact reviewed body and operation ID. **Check saved separation** explicitly checks that same attempt. It never sends automatically when the connection returns. Duplicate/concurrent requests with the same operation return one durable result; changed contents under that ID are rejected even after the general retry cache is pruned. Keep this page open until the uncertain outcome is resolved. This form is not a persistent offline queue and does not promise to retain an uncertain attempt across closing the page or signing out.

## Access and evidence after correction

Both exact customer portal accounts are revoked, including any access deliberately issued after the merge. Passwords, sessions, setup/reset codes and grants are not restored. Photo customer sharing and review are suspended; published galleries are withdrawn; feedback permissions and public testimonials are suspended. Review any fresh invitation, photo sharing or publication separately afterward.

Returned jobs remain excluded from automatic follow-ups. Older decisions and retired repeat definitions remain historical even when the original customer becomes current again. Private device notes and receipts keep their original ownership scope; returning a job creates a new scope and cannot unlock old device copies or revive prior receipts.

The job ID, original public enquiry facts/receipt, preferred date, original photo facts/bytes, sealed quote/invoice snapshots, references, amounts and receipts remain. Current document ownership follows selected jobs through the existing chronological transfer rules. Field logs/timers, material/time source claims, photo history, calendar/recurrence history, private notes and financial totals remain evidence of what was saved. A moved draft document still needs renewed source review before use when its prior reservations are stale. Calendar bookings are tied to the same job; future bookings must be resolved before correction.

## Recovery and limits

Version 0.25 writes **format 14 / metadata 0.25.0**. The new correction table records the original merge, reviewed plan, exact child ownership operation (if jobs moved), reason, owner membership, result and completion window. Formats 1–13 retain pinned contracts. The format-13 customer validator is copied byte for byte from the immutable v0.24 package; the older format-12 validator is also retained.

The included sanitized format-13 fixture was genuinely created by v0.24 code. It contains a mistaken merge, sealed financial and field/photo/source history, later retained-customer work/contact edits, a job already moved to a third customer, retired repeat work, and an empty second business. Migration preserves the old merge, ledger and evidence; separation, a new backup, fresh restore and second backup are tested. Invalid histories fail before a restore destination is created. Older recovery tools reject format 14. Retain a stopped old-format backup with its matching old code; never downgrade a migrated folder in place.

Transitive whole-customer separation, arbitrary unmerge, imports, generic backfill/deletion, larger-volume operation and comprehensive original-source parity remain open. A further whole-customer merge, changed alias, archived/inactive retained customer, wrong business, already-corrected original merge or invalid history cannot be forced through this review. Nothing in this checkpoint operates live SHS, migrates protected owner-review data, sends messages or deploys a product.

See [source mapping](merge-correction-source-map.json) and [executed checks](merge-correction-checks.json). The checks distinguish API, client logic, actual React DOM interactions with mocked HTTP, static rendering, extracted recovery and native browser/device evidence. No v0.25 authenticated browser or phone walkthrough is claimed. The separately authorised, completed v0.23 owner-note walkthrough is delivered as an external supplement and does not certify this new feature.

## Executed local checks

822 full backend cases, 210 client tests, 11 separation React interactions, seven earlier job-correction interactions, 18 note interactions, 90 structural renders and the production build pass. The48 separation backend cases include full/subset/no-job scopes, later contacts/work, active blockers, old/new permission revocation, intake/source/history preservation, fresh authority after middleware, held registry lock, concurrent/lost replies, permanent IDs, late rollback and adversarial recovery. Initial failures and their resolutions are retained with the final logs. Fresh immutable extraction and older-tool rejection are reported separately in the external package proof. Native owner, staff, phone and second-machine evidence remain open for v0.25.