# Customers / consents migration playbook

## Goal
Migrate customers with **consent evidence**. Do not enable marketing without proof.

## Rules
- Marketing consent = only when source has explicit opt-in timestamp + channel.
- Missing consent → `marketing_consent = false` / no consent row.
- Passwords: force reset (never import hashes unless format verified).

## Steps
1. Export customers (email, name, phone, tags).
2. Export consent evidence (email, channel, granted_at, source).
3. Import customers (accounts disabled until password reset).
4. Import consents only when evidence present.
5. Spot-check 20 random marketing-true customers against evidence file.

## Validation
```sql
SELECT COUNT(*) FROM customers;
SELECT COUNT(*) FROM customer_consents WHERE granted = 1;
-- Orphans: marketing without consent row should be zero after import policy applied
```

## Rollback
Restore DB snapshot; communicate password-reset window cancel if needed.