Close the loop carefully.

Every expected row needs an accounted-for outcome—even when that outcome is held or unknown.

A successful join should expose unmatched and multiply matched rows instead of hiding them.

Review the proposed changes as a separate artifact before applying them.

A recovery plan needs an exact prior state and an authorised restoration path, not just a reassuring filename.

Record what happened, what remains unknown and who owns the next decision.

Decide what evidence must remain and what personal data should be removed through an authorised process.

Define a changed condition or documented need before spending on another batch.

Pause dependent changes, preserve the evidence and isolate the failing stage.

Test the process with fictional records before trusting it with real contact data.