> ## Documentation Index
> Fetch the complete documentation index at: https://internal.softcrum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Open Questions Register — Remaining modules (v2.0)

> Consolidates the 70 unique questions from identity, core, messaging and crm. Answer format: OQ-XXX-NN: answer. Each carries a recommendation (REC). The loyalty questions closed in open-questions-v1.md.

> Translation. Authoritative: [`../../design/open-questions-v2.md`](/design/open-questions-v2).

## How this is ordered

Not every question is the same kind, and mixing them means answering 70 things when only 52 are
actually yours to decide.

| Group                       | Count | Who decides                    | When                               |
| --------------------------- | ----- | ------------------------------ | ---------------------------------- |
| **A. Block approval**       | 52    | You                            | before its spec reaches `approved` |
| **B. Belong to the lawyer** | 7     | Daniel + lawyer                | in the same package as `legal/`    |
| **C. Are commercial**       | 10    | You, with the pricing exercise | before commercial launch           |
| **D. Blocked by an ADR**    | 1     | research, not a decision       | when the ADR is written            |

Answering group A alone moves 37 specs to `review` and from there to `approved`. Groups B and C block
nothing.

***

# Group A — Block approval

## identity (16)

| ID            | Question                                                                    | REC                                                                                                                                                                            |
| ------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **OQ-IDN-01** | MFA mandatory for every user, or only for roles with sensitive permissions? | **Only for sensitive roles.** Forcing it on an assistant who only reads a dashboard adds friction without reducing risk; the permission model already marks what is sensitive. |
| **OQ-IDN-02** | Console session lifetime: 12 hours, or 30 days sliding with re-prompts?     | **30 days sliding with re-prompts.** Twelve hours pushes people to save passwords in the browser, which is worse.                                                              |
| **OQ-IDN-03** | Passkeys in F1a, or is password plus magic link enough?                     | **F1a.** Better Auth already supports them and the marginal cost is low.                                                                                                       |
| **OQ-IDN-04** | Invitation expiry: 7 or 14 days?                                            | **7 days.** A two-week invitation is a live token sitting in an inbox for two weeks.                                                                                           |
| **OQ-IDN-05** | Can a user delete their own account, and what happens to memberships?       | **They can leave an organization, not delete the account.** Deleting while memberships are active leaves holes in the audit trail.                                             |
| **OQ-IDN-06** | Is a "billing" system role missing?                                         | **Yes, add it.** The most common case the current five do not cover.                                                                                                           |
| **OQ-IDN-07** | Minimum password length: 12, or 10 with a breach check?                     | **12 with a breach check.** The check is what works; 12 is today's reasonable floor against offline brute force.                                                               |
| **OQ-IDN-08** | Is the sensitive-action list configurable per organization, or fixed?       | **Fixed.** It is a security list, not a preference.                                                                                                                            |
| **OQ-IDN-09** | Do API keys expire by default?                                              | **No by default, with optional expiry.** A self-expiring key breaks an integration at 3 a.m.; rotation with overlap is the right mechanism.                                    |
| **OQ-IDN-10** | Rotation overlap window: 24 h, or configurable up to 7 days?                | **Configurable up to 7 days, default 24 h.** A weekly deploy cycle needs more than a day to propagate.                                                                         |
| **OQ-IDN-11** | Are OAuth clients reviewed before activation, or self-service?              | **Reviewed by us in F1b.** At the initial volume the review is cheap and prevents the first reputational incident.                                                             |
| **OQ-IDN-12** | Refresh token absolute lifetime: 30 or 90 days?                             | **90 days with rotation.** Rotation with reuse detection is the real protection.                                                                                               |
| **OQ-IDN-13** | Which social providers first?                                               | **Google and Microsoft.** They cover nearly the whole B2B market; GitHub can follow.                                                                                           |
| **OQ-IDN-14** | Can a tenant disable impersonation entirely?                                | **Yes, with an explicit slower-support warning.** Being able to say no is what makes it credible that it is audited when they say yes.                                         |
| **OQ-IDN-15** | Default impersonation window: 60 minutes, or 30 with easy renewal?          | **60 minutes.** Easy renewal turns the window into a formality rather than a limit.                                                                                            |
| **OQ-IDN-16** | Do we offer optional account linking later, for agencies?                   | **Recorded, not now.** Answered when a real customer asks.                                                                                                                     |

## core (18)

| ID             | Question                                                                      | REC                                                                                                                                                                  |
| -------------- | ----------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **OQ-CORE-01** | Which vertical taxonomy ships second?                                         | **Retail.** Highest event volume and best exercise for the rules engine; health and services bring sensitive data better tackled once the legal package is reviewed. |
| **OQ-CORE-02** | Does an anonymous contact's event history survive if they never become known? | **Purged at 90 days.** Retaining behaviour of someone who never identified themselves accumulates personal data without a purpose.                                   |
| **OQ-CORE-03** | Do we seed Central America and Mexico now?                                    | **No.** South America covers the target market; adding a country is a row plus a normalizer.                                                                         |
| **OQ-CORE-04** | Is `email` unique per tenant, or can two contacts share one?                  | **They can share.** Households and shared business inboxes are real. The uniqueness that matters is the document's.                                                  |
| **OQ-CORE-05** | Do we normalize phones to E.164 and reject the rest?                          | **Normalize yes, reject no.** A badly formatted phone does not prevent operating the way an invalid document does.                                                   |
| **OQ-CORE-06** | Is a national ID match a verified identity on its own?                        | **Yes.** A document with a valid check digit, within a tenant, is the strongest signal we have.                                                                      |
| **OQ-CORE-07** | Merge field conflict policy: most recent, or survivor always?                 | **Most recent non-null.** The survivor is chosen by age, not by data quality.                                                                                        |
| **OQ-CORE-08** | Do we version consent text, or is it an opaque tenant string?                 | **Opaque tenant string.** The text is theirs and their responsibility.                                                                                               |
| **OQ-CORE-09** | Hash-chain the audit log now, or append-only plus grants in F1?               | **Append-only plus grants in F1.** The chain protects against an attacker with database write access, which is a scenario where we have already lost.                |
| **OQ-CORE-10** | Do we accept events with a future `occurred_at`, and what tolerance?          | **Yes, 5 minutes.** POS clocks drift. Beyond that, accept but stamp with `received_at` and flag.                                                                     |
| **OQ-CORE-11** | `processed_jobs` TTL: 7 days, or longer?                                      | **7 days.** Comfortably exceeds the maximum retry window.                                                                                                            |
| **OQ-CORE-12** | Should an unreviewed dead letter escalate?                                    | **Yes, at 7 days with raised severity.** A forgotten dead letter is an effect that never happened.                                                                   |
| **OQ-CORE-13** | Maximum segment DSL depth and node count?                                     | **Depth 5, 50 nodes.** Enough for any realistic RFM, and it bounds incremental evaluation cost.                                                                      |
| **OQ-CORE-14** | Do RFM templates ship with the taxonomy or separately?                        | **With the taxonomy.** They are why installing one is worth it on day one.                                                                                           |
| **OQ-CORE-15** | Member session lifetime: 30 days sliding, or shorter?                         | **30 days sliding, with a re-prompt to redeem.** Members visit rarely and from a phone.                                                                              |
| **OQ-CORE-16** | Does token exchange support refresh, or does the tenant re-exchange?          | **Re-exchange.** The tenant already governs the member's session in their own system.                                                                                |
| **OQ-CORE-17** | Can more than one taxonomy be installed, and how do collisions resolve?       | **Yes, and an event-name collision is rejected by name.** Retail with subscriptions is a real case.                                                                  |
| **OQ-CORE-18** | Do we support a `list` (multi-value) attribute type?                          | **Not in F1b.** Multi-value complicates the segment builder for a case usually better modelled as a taxonomy.                                                        |

## messaging (12)

| ID            | Question                                                             | REC                                                                                                                                                                                                               |
| ------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **OQ-MSG-01** | Open and click tracking on by default?                               | **Clicks yes, opens no.** The open pixel is what regulators and mail clients dislike, and Apple Mail has falsified it for years — so the data is bad *and* politically expensive. A click is a deliberate action. |
| **OQ-MSG-02** | Default quiet hours for a new tenant                                 | **21:00–09:00 local.** A permissive default means the first tenant discovers quiet hours when a member complains about a 3 a.m. email.                                                                            |
| **OQ-MSG-03** | Can a tenant override a system template (OTP, invitation)?           | **Branding yes, content no.** An OTP with editable text is one someone will accidentally turn into phishing.                                                                                                      |
| **OQ-MSG-04** | How long is rendered content retained?                               | **90 days.** Enough for support and disputes; 25 months accumulates the text of every message to every person.                                                                                                    |
| **OQ-MSG-05** | Default marketing frequency cap                                      | **3 per week.** Above that, unsubscribe rates rise faster than conversion.                                                                                                                                        |
| **OQ-MSG-06** | Can a member re-subscribe after a complaint, or only after a bounce? | **Only after a bounce.** A spam complaint is a signal carriers record.                                                                                                                                            |
| **OQ-MSG-07** | Transactional depth threshold at which marketing yields              | **A function of throughput: when depth exceeds 30 seconds of pending work.** A fixed number is wrong for either large or small tenants.                                                                           |
| **OQ-MSG-08** | Consecutive webhook failures before deactivation                     | **A rate: 20 consecutive, or 50% over an hour.** Consecutive-only leaves alive an endpoint that fails half the time.                                                                                              |
| **OQ-MSG-09** | Do in-app notifications expire?                                      | **At 90 days if unread.** An infinite inbox is one nobody opens.                                                                                                                                                  |
| **OQ-MSG-10** | Default local send window for date-property campaigns                | **09:00–11:00.** Best open rates in most markets and it bothers nobody.                                                                                                                                           |
| **OQ-MSG-11** | Maximum blast size before a second confirmation                      | **10 000 recipients.** Below that, double confirmation is friction; above, a mistake costs domain reputation.                                                                                                     |
| **OQ-MSG-12** | Do we request a Resend limit raise before G1, and to what number?    | **Yes, to 50 rps.** With the batch endpoint that is 5 000 messages per second theoretical — enough headroom for dual rails to have real margin.                                                                   |

## crm (8)

| ID            | Question                                                  | REC                                                                                                                        |
| ------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| **OQ-CRM-01** | Can a note be edited, or only appended to?                | **Editable with visible history.** Append-only sounds more defensible but produces notes full of corrections nobody reads. |
| **OQ-CRM-02** | Are activities assignable to any user, or only the owner? | **Any active member of the organization.** Restricting it turns a team tool into a personal list.                          |
| **OQ-CRM-03** | Maximum note length                                       | **10 000 characters.** Fits any real note and stops someone pasting a whole document.                                      |
| **OQ-CRM-04** | Can an activity attach to a loyalty event?                | **Yes, with an optional reference.** "Follow up on this redemption" is the case that connects the two modules.             |
| **OQ-CRM-05** | Maximum static list size                                  | **5 000 contacts, with a warning at 1 000.** Above that it should almost always be a segment.                              |
| **OQ-CRM-06** | Can a saved view reference a dynamic segment?             | **Yes.** The DSL already allows it.                                                                                        |
| **OQ-CRM-07** | Default timeline date range when none is supplied         | **90 days.** Rejecting is correct but hostile to a first integrator.                                                       |
| **OQ-CRM-08** | Per-source timeout before degrading                       | **300 ms.** With sources in parallel, the 1 s budget absorbs it plus the merge.                                            |

***

# Group B — Belong to the lawyer (7)

These are not answered by intuition. They go in the same package as `legal/` when it is reviewed.

| ID            | Question                                                    | Affects      | Note for the lawyer                                                                                              |
| ------------- | ----------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------- |
| **OQ-LEG-01** | Does consent expire after a period of inactivity?           | FS-CORE-0004 | Some readings of Ley 21.719 suggest so. If it does, we need the period and a re-consent flow.                    |
| **OQ-LEG-02** | Legal minimum retention for the audit log                   | FS-CORE-0005 | 5 years by tax adjacency, or shorter for non-financial entities? Sets the floor under the per-plan policy.       |
| **OQ-LEG-03** | Do we accept a consent column in CSV imports?               | FS-CORE-0013 | A tenant asserting they have consent is not the same as having it. Does it expose us as processor?               |
| **OQ-LEG-04** | Does the tenant get a window to object before an erasure?   | FS-CORE-0014 | The data subject exercises against the controller, who is the tenant. Can we execute without their confirmation? |
| **OQ-LEG-05** | How long do we retain `subject_requests` after completion?  | FS-CORE-0014 | It is the proof we complied. Is there a maximum, or is it indefinite?                                            |
| **OQ-LEG-06** | Does point expiry have legal limits in supported countries? | FS-LOY-0002  | Consumer protection. Determines whether the vertical templates' default policy is even lawful.                   |
| **OQ-LEG-07** | Last-owner lockout process for an organization              | FS-IDN-0005  | What identity verification is sufficient and defensible to restore access?                                       |

***

# Group C — Commercial (10)

These block no spec. They are answered with the pricing exercise (P-3).

| ID            | Question                                                               | Affects      |
| ------------- | ---------------------------------------------------------------------- | ------------ |
| **OQ-COM-01** | Are custom roles plan-gated?                                           | FS-IDN-0002  |
| **OQ-COM-02** | Is enterprise SSO an enterprise tier, or on every plan?                | FS-IDN-0008  |
| **OQ-COM-03** | Is the custom domain add-on per domain or per tenant?                  | FS-MSG-0008  |
| **OQ-COM-04** | Is SMS included in a plan or always pay-as-you-go?                     | FS-MSG-0009  |
| **OQ-COM-05** | How many programs does the base plan include?                          | FS-LOY-0001  |
| **OQ-COM-06** | How many attribute definitions per tenant, and is it plan-gated?       | FS-CORE-0011 |
| **OQ-COM-07** | Maximum import file size and row count, plan-gated?                    | FS-CORE-0013 |
| **OQ-COM-08** | Is storage metered by database bytes, exported archive bytes, or both? | FS-CORE-0010 |
| **OQ-COM-09** | Does a spend cap stop the Runtime API or only billable effects?        | FS-CORE-0010 |
| **OQ-COM-10** | **P-3**: unit prices per metric                                        | ADR-016      |

On **OQ-COM-09**, the only one with a technical consequence: the recommendation is that it **stops
billable effects but not ingestion**. Rejecting `track` breaks a customer's point of sale over a
commercial debt, which is disproportionate damage; ceasing to award points and send messages hurts
where it should without breaking the operation.

***

# Group D — Blocked by an ADR (1)

| ID            | Item                                  | Nature                                                                    |
| ------------- | ------------------------------------- | ------------------------------------------------------------------------- |
| **OQ-ADR-01** | SMS provider and per-country coverage | Research, not a decision. FS-MSG-0009 stays `draft` until the ADR exists. |

***

## How one is closed

1. You answer `OQ-XXX-NN: <decision>`.
2. The decision enters the spec's normative section and disappears from its open-questions table.
3. The spec's version rises and it moves to `review`, then to `approved` with your sign-off.
4. The translation is updated in the same change — the `translation` validator requires it.
5. The row is marked closed with the date and the answer.

## Changelog

| Version | Date       | Change                                                                                        | Why                                                                                                                 | Author                 |
| ------- | ---------- | --------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ---------------------- |
| 2.0.0   | 2026-08-17 | Initial register: 70 questions from identity, core, messaging and crm, grouped by who decides | Separate 52 decisions of yours from 7 for the lawyer and 10 commercial, so that answering group A unblocks 37 specs | daniel + claude-opus-5 |