AIが、同じミスをしにくくなる。

The customer management system is finished and saved to `C:\Users\user\dev\demo-theater\with-b612\crm\`. I copied it there and confirmed all 3 files match the originals exactly.

- [index.html](C:/Users/user/dev/demo-theater/with-b612/crm/index.html): the system itself, one file you open in a browser. Sample data is created on first launch.
- [docs/DESIGN_CONTRACT.md](C:/Users/user/dev/demo-theater/with-b612/crm/docs/DESIGN_CONTRACT.md): the requirements, how each number is defined (visit count, new customers and so on), and the permission table.
- [AGENTS.md](C:/Users/user/dev/demo-theater/with-b612/crm/AGENTS.md): the rules any AI tool editing this later must follow, so it doesn't break the safeguards.

## Know this before real use
- **Data isn't shared:** data is stored only in that browser. PCs, phones and stores don't share it.
- **Permissions aren't security:** the limits (e.g. staff see only their own store) prevent mistakes, but anyone can get around them with the browser's developer tools. This is shown at the top of every screen. Using real customer data across 3 stores needs a server version with proper logins.

## Changes after the review
I had 5 reviews run in parallel (security, CSV, data consistency, usability, legal). I checked every finding against the code and fixed the real ones. Main changes:
- **Tampered backups:** loading a tampered backup file could run a script. Data is now checked before it replaces anything.
- **Families excluded from merging:** a family marked "different people" could still be merged once a 3rd record joined them. That's now blocked, and merging defaults to "no consent" if any record lacked it.
- **Birthday messages (anti-spam email law):**
  - The sender's name, address and a way to stop messages are now added automatically. The template can't remove them.
  - Messages can't be copied until the sender details are set.
  - The date and method of consent, and the date someone opted out, are recorded.
- **Customer requests:** a customer's data can be exported when they ask to see it, and erased when they ask. Visit amounts are kept as sales records.
- **CSV:**
  - Names split into surname and given-name columns are read correctly.
  - Afternoon and PM times are read correctly.
  - Amounts like `▲500` and `\1,000` are read correctly.
  - Placeholders like "なし" are blanked.
  - Unclosed quotes are reported as errors.
  - 20,000 rows are checked in 0.7 seconds.
- **Usability:**
  - Error messages now show inside dialogs.
  - Refunds can be entered on iPhone.
  - Text fields no longer zoom the page on iPhone.
  - Rows can be opened with the keyboard.
- **Permissions:**
  - Only head office can change the birthday message template.
  - Store managers no longer see other stores' customer names in the change history.
  - The chosen user is forgotten when the browser closes.

## Checked and not checked
- **Checked in a real browser:**
  - Every role on every screen.
  - Merging, consent changes, erasure, rejecting tampered backups.
  - Re-importing an exported CSV marks every row as a duplicate.
  - No page wider than a 375px phone screen.
  - Detection of simultaneous edits in 2 tabs.
- **Not checked:**
  - Double-clicking the file to open it. I could only test through a local web server.
  - Real iPhone or Android devices, and copy and download there.
  - CSV files exported from your actual Excel.
  - The time the actual import of a very large file takes.
- **Differs from the review:** small buttons on phones are 40px tall, slightly under the 44px the review suggested.

## Please confirm
1. **Legal entity:** are the 3 stores run by the same company? If they're separate companies or franchises, sharing customer data between stores needs customer consent or a published joint-use notice.
2. **Purpose of use:** have customers been told their data is used for birthday messages and rank grouping?
3. **Birthday perks:** the defaults are discount-style. Check with an expert whether your actual perks stay within the premium limits of Japan's Act against Unjustifiable Premiums (景品表示法).
4. **CSV export:** it's limited to store managers and head office. Should staff have it too?
5. **Old copy:** the working copy I built in (`HP制作LP\salon-crm\`) is still there. Shall I delete it?

Before going live, head office should do these in the settings screen: enter the sender details, rename the staff to real names, and delete the sample customers.