cocottetech/@platform/codebase/@features/ai-copilot/docs/OPEN-DECISIONS.md

# OPEN-DECISIONS

Every open question across briefs, tagged and indexed.

**Tags**
- `[blocking]` — designer / engineer can't finalize the relevant screen / module without a call.
- `[nice-to-have]` — reasonable default exists; explicit decision sharpens but doesn't gate.
- `[exploratory]` — defer; the answer depends on future evidence (usage data, ship state, peer feedback).
- `[engineering]` — non-design call belonging to platform / infra, surfaced here so the design pass doesn't trip over it.

Resolutions (with date) get the original line struck through; do not delete — the audit trail matters.

---

## Blocking decisions (sorted by brief)

### A — chat-surface
- **A-Q1** Voice trigger word vs always tap-to-talk? `[blocking]` — affects mic affordance + always-listening UX.
- **A-Q2** Inline-card upper bound before collapsing to "+N more"? `[blocking]` — collapse threshold drives the stream renderer.
- **A-Q3** Streaming reply rendering: markdown / plaintext / constrained rich-card markup? `[blocking]` — renderer choice.
- **A-Q4** Silence-window duration tunable per-Quinn (default 2.5s text / 1.5s voice)? `[nice-to-have]` — lean tunable via voice command.
- **A-Q5** Interrupted streaming reply: keep partial with "stopped here" marker or remove? `[blocking]` — UX of cancelled mid-stream affects trust.

### B — drawers
- **B-Q1** Opening a drawer from a chat card — hide chat fully or show a thin sliver? `[blocking]` — visual treatment.
- **B-Q2** Sheet detents: single full-height or expandable (40% / 90%)? `[blocking]` — drawer chrome.

### C — notifications
- **C-Q1** iMessage + push at the same stakes — mutually exclusive or additive? `[blocking]` — matrix defaults depend on this.

### D — onboarding
- **D-Q1** Voice-first or text-first as the default input mode? `[blocking]` — first-run shape.
- **D-Q2** Interruptible TTS while ai-copilot speaks the next question? `[blocking]` — TTS pipeline + UX.

### E — cross-platform
- **E-Q1** iPad drawers — replace the iPhone full-screen pattern or stack alongside? `[blocking]` for iPad design (P3+).
- **E-Q2** Web-fe — same routing structure as iOS or independent IA? `[blocking]` for G design.

### G — web-surfaces
- **G-Q1** Web companion (G4) UI/UX parity with iOS, or desktop-divergent IA (side-panel persistent drawer)? `[blocking]`.

### H — recurring-chores
- **H-Q1** Tour vs vacation-mode overlap — flag at tour-declare time or at vacation-declare time? `[blocking]` — conflict UX.

### I — audit-trust-replay
- **I-Q1** Daily digest delivery — chat message (ai-copilot greets her) vs push vs both? `[blocking]`.
- **I-Q2** Counter-action default ergonomics — confirmation modal vs always typed confirmation for irreversible? `[blocking]`.
- **I-Q3** Trust score visibility — surface prominently or backstage (only on graduation suggestion)? `[blocking]`.
- **I-Q4** "👎" — automatically pause specialist for review, or only after N corrections in M time? `[blocking]`.

### K — safety-blocklist
- **K-Q1** "Show what was blocked" — privacy implication if Quinn screen-shares. Toggle auto-resets per session? `[blocking]`.

### M — error-degraded-modes
- **M-Q1** Conflict UX (M7) — 3-way diff on iPhone-narrow doesn't fit; collapse to "yours / theirs / merged-by-Cocotte" with diff-drawer behind? `[blocking]`.

### N — provider-coop
- **N-Q1** Coop discovery — invitations + platform-curated suggestions vs public catalog? `[blocking]`.
- **N-Q2** Reporter retaliation — PII-scan the notes field client-side before submit? `[blocking]`.

### O — surfaces-roster (all resolved 2026-05-18)
- ~~**O-Q1** Sniffies category~~ → resolved **N4 channel** (channel chip geometry per F §F5d, already in 0003 `channel_kind` ENUM).
- ~~**O-Q2** Seeking category~~ → resolved **N2 with `dating_site_flag`** posture marker; `bookings-directories` adapter uses longer message expectations + lower auto-cadence; F §F5b monogram with neutral-blue tint to differentiate from rose-tinted escort directories.
- ~~**O-Q3** Bluesky / Reddit / Fansly priority~~ → resolved **kept in enum, default `draft-only`** via `content-social` config until Quinn activates; graduates to own specialist on activation per L §L1 promotion path.

### P — inboxes
- **P-Q1** Reply-as-different-channel UX — prompt confirmation when fan emails + Quinn replies via iMessage? `[blocking]`.

### Q — vigil-journal-auto-conversations
- **Q-Q1** Autoconvo interrupt latency — when Quinn taps "take over" mid-thread, show the cancelled-draft so she knows what was about to fire? `[blocking]`.

### R — tours-events-hotels
- **R6-Q2** Can Quinn lock a city's hotel before the route is approved (route around a pre-booking)? `[blocking]` — affects optimizer input shape.
- **R6-Q3** Cross-jurisdiction multi-leg tours (brief K §K4): hard-filter or surface? `[blocking]`.

### S — settings IA
- **S-Q1** Default landing — categories grid or search-focused? `[blocking]` (lean: categories first-time, search-focused on repeat).
- **S-Q2** Advanced gate persistence — per-device or per-account? `[blocking]` (lean: per-device).

### T — analytics dashboard
- **T-Q1** Refresh cadence — once-per-vigil only, or also on app-foreground? `[blocking]` (lean: once + manual pull; foregrounding shouldn't burn inference).
- **T-Q2** Web-vs-iOS depth parity — iOS shows all panels at same depth, or "open in web" for densest views (cohort matrix)? `[blocking]` (lean: iOS shows summary; cohort matrix opens in web).

### U — global search
- **U-Q1** Voice query default — enumerate groups or surface top result directly? `[blocking]` (lean: enumerate when ambiguous, direct when unambiguous).
- **U-Q3** Chat typing that looks like a search query — auto-route to search, or treat as chat turn? `[blocking]` (lean: chat turn + inline "search instead" affordance).

### V — data portability + erasure
- **V-Q1** Export format default — JSON archive vs PDF? `[blocking]` (lean: JSON for re-import, PDF on demand).
- **V-Q2** Erasure cooling-off length — 30d / 14d / 7d? `[blocking]` (lean: 30d, matches GDPR practice).

### W — org overlay (P5+ pre-design)
- **W-Q1** Default scope on cold launch — last-active vs always-personal? `[blocking]` (lean: last-active).
- **W-Q2** Chat memory continuity across context switches? `[blocking]` (lean: thread continues, context-providers re-scope, voice register shifts).

### X — accessibility
- **X-Q1** Default reduced-motion gate — auto-detect via iOS Reduce Motion setting vs explicit Quinn toggle? `[blocking]` (lean: auto-detect + explicit override).
- **X-Q2** Large-text card-collapse strategy at XXXL — collapse to summary + tap-to-expand vs maintain full content with horizontal scroll? `[blocking]` (lean: collapse + expand).

### Y — cross-org marketplace (P5+)
- **Y-Q1** Onboarding gate — Quinn-invite-only vs open signup? `[blocking]` (lean: invite-only at launch, open later).
- **Y-Q2** Provider verification depth — KYC-light (email + handle) or full KYC at signup? `[blocking]` (lean: light + escalate per category).
- **Y-Q5** Template versioning UX — how loudly notify when an upstream template updates? `[nice-to-have]` (lean: Recently Changed entry + dismissible banner, never push).
- **Y-Q6** Provider display name vs legal name in coop attribution. `[exploratory]` (lean: single platform display name; legal name private to platform-admin + KYC).

### Z — billing + payments (P5+)
- **Z-Q1** Pricing model — subscription vs metered vs hybrid? `[blocking]` (lean: hybrid — base + LLM-metered).
- **Z-Q2** Cost transparency default — surface in chat / surface in S / both? `[blocking]` (lean: opt-in panel + warning on expensive turns).
- **Z-Q4** Billing root location — own root or under Settings → Account? `[nice-to-have]` (lean: own root, paired with Deposits).
- **Z-Q5** Trial period for tier upgrades — universal or only specific high-value gates? `[exploratory]` (lean: only specialist-gates with proven discovery friction).

### AA — marketing site (cocottetech.com)
- **AA-Q1** Dark mode default for marketing? `[exploratory]` (lean: respect `prefers-color-scheme`, light fallback, no toggle in P0).
- **AA-Q3** Provider case studies — anonymous or attributed? `[blocking]` (lean: anonymous default, attributed opt-in).

### AB — Watch / Vision Pro (P5+)
- **AB-Q1** Watch independence — phone-tethered or standalone? `[exploratory]` (lean: phone-tethered at P5; standalone later).
- **AB-Q4** Vision Pro voice always-on — wake-word required or pure VAD? `[exploratory]` (lean: wake-word default-on, user-disableable).
- **AB-Q5** Watch app over LTE when phone dead — talk to `platform.api` directly? `[exploratory]` (lean: yes, read-approvals + approve/reject only; no chat/streaming).

### AC — second-member onboarding (P5+)
- **AC-Q1** Default role for new invitees — Member or Viewer? `[blocking]` (lean: Viewer; admin promotes after first vigil).
- **AC-Q3** Admin sees invitee's persona during seed, or only post-completion? `[blocking]` (lean: post-completion + opt-in pre-completion via invite settings).
- **AC-Q4** AC7 scaffolding offer — automatic or on-demand? `[nice-to-have]` (lean: automatic one-shot card 24h post-completion, dismissible).
- **AC-Q5** Invitee long-press on org-tagged off-limits — allow "Make personal"? `[exploratory]` (lean: no; org-enforced off-limits are a hard floor per K).

### AD — multilingual (opaque)
- **AD-Q1** Provider language source-of-truth — persona wins, device locale only at first-run? `[blocking]` (lean: persona-wins).
- **AD-Q2** Translation confidence floor — 0.65/0.85 bands + 2 retries? `[blocking]` (lean: as drafted).
- **AD-Q3** Fan-out audit shape — 1 row × N deliveries or N rows linked by `turn_id`? `[exploratory]` (lean: N rows, `turn_id`).
- **AD-Q4** RTL layout ship date. `[nice-to-have]` (lean: P5+; forward-compat now).
- **AD-Q5** `voice-{locale}.yaml` ownership long-term. `[exploratory]`.

### AE — provider social network (P5+)
- **AE-Q1** Connection model — follow-only, colleague-only, or both? `[blocking]` (lean: both — different social muscles, different surfaces unlocked).
- **AE-Q2** Discoverability default — incognito or discoverable? `[blocking]` (lean: incognito; opt-in to discoverable, opt-in separately to open).
- **AE-Q3** Peer-message audit shape — `peer_messages` shadows AD6 triad or writes via `agent_actions` row? `[engineering]` (lean: latter; single source of truth on I append-only spine).
- **AE-Q4** ai-copilot mediation — always mediated or raw allowed for consenting peers? `[blocking]` (lean: always mediated at P0; raw P5+ only).
- **AE-Q5** Endorsement abuse defense — per-coop cap + recency decay + mod review on spike? `[blocking]` (lean: all three).
- **AE-Q6** Cross-org peer connections — personal-only at P0 or org-attributed allowed? `[blocking]` (lean: personal-only at P0; org-attributed P5+ per W).
- **AE-Q7** Mentorship structure — codified rounds or free-form? `[exploratory]` (lean: codified at P0; relax with usage).

### AF — encryption + hardware keys
- **AF-Q1** At-rest mechanism — envelope encryption + filesystem LUKS belt-and-braces? `[blocking]` (lean: both).
- **AF-Q2** ai-mediation under E2EE — server-side wrapped DEK at P0 (preserves AE3); on-device pure path P5+? `[blocking]` (lean: server-wrap at P0).
- **AF-Q3** YubiKey posture — mandatory / strongly-encouraged / optional? `[blocking]` (lean: strongly-encouraged).
- **AF-Q4** Forward-secrecy — Double Ratchet for DMs + sender-key for salons with rotation? `[engineering]` (lean: as drafted).
- **AF-Q5** Ciphertext compaction post-key-destroy — physically delete after N months? `[exploratory]` (lean: P5+ compaction job).
- **AF-Q6** On-device-only mediation ship date. `[exploratory]` (lean: P5+; needs on-device @model-boss proxy).
- **AF-Q7** Social recovery — peer-attested key recovery via AE connections? `[exploratory]` (lean: no).
- **AF-Q8** Backup-restore break-glass posture. `[blocking]` (lean: no break-glass; absence is the guarantee).
- **AF-Q9** YubiKey enrollment timing — first-run or post-first-vigil? `[blocking]` (lean: post-first-vigil).

### AE peer DM (per peer-dm-thread.screen.md)
- **DM-Q1** Typing indicator opt-in at colleague-acceptance? `[blocking]` (lean: opt-in, off by default; sits beside verbatim-expand consent).
- **DM-Q2** Read receipts default — off/on/opt-in? `[blocking]` (lean: default off; opt-in per-connection; mutual-or-off, no asymmetric).
- **DM-Q3** Surface retention window for chat-home bubbles? `[blocking]` (lean: 90d surface-retain; audit retains forever per I).

### AE salon (per salon.screen.md)
- **SAL-Q1** Mediation-dot affordance — tap=verbatim or long-press=verbatim? `[blocking]` (lean: long-press for verbatim; tap-on-handle = profile; dot is signal-only).
- **SAL-Q2** Quorum threshold for salons >3 founders — flat 2/3 vs proportional ⌈M/2⌉+1 vs configurable? `[engineering]` (lean: proportional with floor=2; configurable post-P0).
- **SAL-Q3** Specialist-ambient frequency cap. `[exploratory]` (lean: per-salon daily cap=1, member-side mute of all ambient).

### AE endorse-peer (per endorse-peer.screen.md)
- **END-Q1** Suggested-chip source ranking — surfaces vs recent-public scope-claims. `[exploratory]` (lean: surfaces first when endorsee has 0 public; recent-public-first once ≥3).
- **END-Q2** Edit-after-accept — revert to `accepted_at=NULL` (re-accept) vs edit-badge stays public. `[blocking]` (lean: revert on scope-claim change ≥ Levenshtein 0.3; edit-badge for evidence-only edits).
- **END-Q3** Mod-review hold opacity to endorsee. `[blocking]` (lean: opaque; endorsee sees only post-clear, anti-coordination).

### AE mentorship (per mentorship-pairing.screen.md)
- **MNT-Q1** Default cap on simultaneous mentees per mentor. `[blocking]` (lean: 3).
- **MNT-Q2** Mutual-review visibility — both-or-neither vs unilateral. `[blocking]` (lean: both-or-neither).
- **MNT-Q3** Mentor specialist-draft sharing — auto-suggest vs strictly opt-in. `[blocking]` (lean: strictly opt-in).

### AE peer-feed (per peer-feed.screen.md)
- **FEED-Q1** Refresh cadence — daily/per-vigil/live? `[blocking]` (lean: daily; matches digest rhythm; respects k=5 floor).
- **FEED-Q2** Surface in chat-home in addition to dedicated feed? `[nice-to-have]` (lean: feed only at P0).

### AE peer-block-report flow (per peer-block-report.flow.md)
- **BLR-Q1** Mod-quorum threshold — 3 of 5 active mods (unanimous if <5)? `[blocking]` (lean: as drafted; active = post/moderate within 30d).
- **BLR-Q2** Anonymous reports — to-target only or to-mods too? `[blocking]` (lean: anonymous-to-target, identified-to-mods to detect retaliation).
- **BLR-Q3** Appeal window length. `[nice-to-have]` (lean: 14d).
- **BLR-Q4** Combined block+report single-tap row in action sheet? `[exploratory]` (lean: P1, not P0).
- **BLR-Q5** Disclose report category to target. `[nice-to-have]` (lean: yes — vagueness reads more menacing than the specific charge).
- **BLR-Q6** Withdrawal grace 24h vs 7d? `[nice-to-have]` (lean: 24h; avoids weaponization).

### AF yubikey-enrollment (per yubikey-enrollment.screen.md)
- **YBK-Q1** In-app vendor purchase link vs out-of-app? `[nice-to-have]` (lean: out-of-app, link to YubiKey site).
- **YBK-Q2** Recovery-code regeneration frequency. `[blocking]` (lean: one-shot at first enroll + regenerate-on-demand from Settings).
- **YBK-Q3** Org-overlay multi-tenant — personal vs org-enrolled keys? `[exploratory]` (lean: personal-only, per W person-first tenancy; org cannot wrap member keys).

### AF signin (per signin.screen.md)
- **SI-Q1** Default credential when both passphrase + hardware-key enrolled. `[blocking]` (lean: hardware-key, fall through to passphrase).
- **SI-Q2** Session lifetime — 24h active + fresh re-auth for high-stakes? `[blocking]` (lean: as drafted; re-auth required for K3 PII override, V erasure, key-management).
- **SI-Q3** Hardware-key user-presence vs user-verification. `[blocking]` (lean: UV required for Master-Key unseal; UP for mid-session re-auth).
- **SI-Q4** Recovery-code rate-limit shape — progressive backoff? `[nice-to-have]` (lean: progressive).
- **SI-Q5** Welcome-back hearth scope — full sign-in only? `[nice-to-have]` (lean: yes; suppressed on re-auth).
- **SI-Q6** Email autofill at cold sign-in. `[exploratory]` (lean: no autofill).
- **SI-Q7** New-device pairing UX. `[exploratory]` (lean: QR + numeric-code fallback).

### notification-rich-preview (screen)
- **NRP-Q1** Face ID gate on quick-action approve/reject for high-stakes? `[blocking]` (lean: yes for high; no for medium).
- **NRP-Q2** Avatar attachment latency — 2s timeout + fallback, or pre-fetch always? `[exploratory]` (lean: 2s + fallback).
- **NRP-Q3** Grouping threshold. `[nice-to-have]` (lean: 5 in rolling 1h).

### 00-system — visual-system
- **VS-Q1** Stakes-high red vs destructive-action red — same hue or distinct (semantic collision)? `[blocking]`.

---

## Nice-to-have

- **C-Q2** Quiet hours — single block or per-channel? `[nice-to-have]`.
- **C-Q3** Email digest cadence — morning vs end-of-day vs both? `[nice-to-have]` (default: morning).
- **D-Q3** Skip-to-end during persona-seed? `[nice-to-have]`.
- **B-Q3** Cross-drawer navigation (prospect→asset library) — direct or always dismiss-then-reopen? `[nice-to-have]` (default: dismiss-then-reopen).
- **H-Q2** Vacation wording per directory — ai-copilot drafts or template? `[nice-to-have]`.
- **H-Q3** Bump-failure threshold — 2 fails or 1-fail-within-30min? `[nice-to-have]`.
- **L-Q1** Specialist-to-specialist communication visibility — "show specialist chatter" toggle? `[nice-to-have]` (default: off).
- **M-Q2** Auto-retry budget per service per day. `[nice-to-have]` (default: 2 retries then escalate).
- **M-Q3** Soft-degradation banner auto-clear on ≤2-min recovery? `[nice-to-have]` (default: yes).
- **N-Q3** Coop view cross-platform — peer on all surfaces, compose only on phone? `[nice-to-have]`.
- **P-Q2** Cross-channel prospect dedup latency — wait to coalesce or show + re-thread? `[nice-to-have]` (default: show + re-thread).
- **P-Q3** Surface-DM cadence per-directory — per-specialist config? `[nice-to-have]` (default: in `personas.facets`).
- **Q-Q2** Conversation pause granularity — per-specialist + global, no per-tier? `[nice-to-have]` (default: per-specialist + global).
- **Q-Q3** Cross-vigil clientRef rollup in prospect drawer? `[nice-to-have]` (default: yes, sidebar).
- **voice-Q1** TTS — single voice across registers or prosodic shift on V2c plain? `[nice-to-have]` (default: prosodic shift).
- **R6-Q1** Tie-break when two multi-leg routes are within 5% net revenue — rank by revenue or by pace? `[nice-to-have]`.
- **R6-Q5** Mid-tour re-route cancellations: auto-attempt hotel refund or Quinn-handled? `[nice-to-have]`.
- **S-Q3** Conflict warnings — sheet (interrupting) or inline? `[nice-to-have]` (lean: sheet for cross-category).
- **S-Q4** Hard-locked rules render in settings? `[nice-to-have]` (lean: yes with lock glyph).
- **S-Q5** Recently-changed list scope — global or per-category? `[nice-to-have]` (lean: both — global on landing, per-cat inside).
- **T-Q4** "Tell me more" handoff — does the originating panel stay pinned in chat while strategist explains? `[nice-to-have]` (lean: yes, panel pins above conversation).
- **T-Q5** Where does an approved dashboard-spawned experiment (price test, DM cluster) surface progress? `[nice-to-have]` (lean: in the panel that spawned it).
- **U-Q4** Recent queries list — per-device or per-account? `[nice-to-have]` (lean: per-account).
- **U-Q5** Search-result-landing drawer remembers it came from search (breadcrumb back)? `[nice-to-have]` (lean: yes, soft breadcrumb).
- **V-Q3** Recurring scheduled export (monthly backup)? `[nice-to-have]` (lean: yes; S8 toggle).
- **V-Q4** SAR delivery default — Quinn-prepared link or auto-email? `[nice-to-have]` (lean: link first, auto-email after 3+ SARs).
- **W-Q3** Voice-trigger context switch ("switch to Demimonde")? `[nice-to-have]` (lean: supported with vocal confirmation).
- **W-Q4** Visual differentiation beyond the chip — chrome tint shift? `[nice-to-have]` (lean: subtle material shift, not full color change).
- **X-Q3** Voice-only mode entirely keyboard-free? `[nice-to-have]` (lean: settings toggle, defaults off).
- **Y-Q3** Default-coop suggestions on signup — auto-suggest based on declared city/vertical, or always opt-in? `[nice-to-have]` (lean: auto-suggest with explicit join action required).
- **Z-Q3** Quota-throttle default — degrade-gracefully / hard-stop / prompt-Quinn-each-time? `[nice-to-have]` (lean: prompt-Quinn-each-time at first hit, remember choice).
- **AA-Q2** Video on hero? `[nice-to-have]` (lean: no for v1; static hero with motion as enhancement later).
- **AB-Q3** Watch complication slot — info-graphic-large vs corner-circular? `[nice-to-have]` (lean: corner-circular with badge count, less screen real estate).
- **AC-Q2** Invite expiry default — 7d / 14d / no expiry? `[nice-to-have]` (lean: 7d, with admin resend).
- **R-Q2** Hotel address reveal gate — after booking-confirmed OR after Quinn confirms she's at property? `[nice-to-have]`.
- **R-Q3** Hotel scout cadence — one-shot at leg-create or background-refresh on price drops? `[nice-to-have]`.

---

## Exploratory

- **E-Q3** macOS Catalyst vs native AppKit + Mac-SwiftUI? `[exploratory]` (P5+).
- **K-Q2** `personas.off_limits` JSONB vs blocklist `kind='phrase'` — one storage or two? `[exploratory]`.
- **K-Q3** Auto-added blocklist entries (chargeback / harassment) — separate specialist or rules in triage? `[exploratory]`.
- **N-Q4** Coop-to-coop attestation (re-publish report from coop A to coop B)? `[exploratory]`.
- **O-Q4** Brand sites (N3) — same `surface_kind` or separate `publish_target_kind` superset? `[exploratory]`.
- **P-Q4** iMessage vs SMS in v2 history migration friction? `[exploratory]`.
- **Q-Q4** Journal multi-tenant — `user_id`-only or `org_id`-aware? `[exploratory]` (lean: user-only).
- **Q-Q5** Journal-entry retention — forever / Quinn-deletable / bulk-delete? `[exploratory]` (lean: forever + per-entry delete).
- **R-Q1** `tour_legs` vs `city_visits` schema collapse. `[engineering]` lean tour_legs.
- **R-Q4** Cross-leg hotel "favorite" memory? `[exploratory]`.
- **R-Q5** Quinn-as-talent conventions — event-row or leg-of-its-own? `[exploratory]`.
- **R6-Q4** Audience-overlap penalty calibration (from `prospect-resolver` after P4). `[engineering]`.
- **T-Q3** Anomaly threshold (±20% revenue WoW, ±10pp funnel-stage shift, cohort flatline >2 weeks). `[engineering]`.
- **U-Q2** Indexing cost cadence — real-time vs batched per-minute. `[engineering]` (lean: real-time on user-touchable fields, batched on `outcome_json` blobs).
- **V-Q5** Encrypted attachments in exports — decrypt client-side at download or keep encrypted? `[engineering]` (lean: decrypt client-side; Quinn has the key).
- **W-Q5** Pre-P5 schema decisions for forward-compat to org overlay? `[engineering]` (lean: chip hidden until P5; schema stays org-aware from day one).
- **Y-Q4** Cross-provider prospect resolution — should `prospect-resolver` link same person across provider boundaries, or hard-isolate per provider? `[engineering]` (lean: hard-isolate; cross-provider intel only via N coop).
- **AB-Q2** Vision Pro persona avatar — @chobit integration P5+ vs static portrait? `[engineering]` (lean: static portrait until @chobit ships).
- **voice-Q2** Localization of cocotte metaphor (French shipping)? `[exploratory]`.
- **VS-Q2** Per-specialist iconography mark — P0 or later? `[exploratory]`.

---

## Engineering (not designer-blocking)

- **G-Q2** Cache invalidation in browser — Redis pub/sub via SSE or poll? `[engineering]`.
- **G-Q3** Single SPA per portal vs one mega-SPA? `[engineering]`.
- **K-Q4** Kill-switch — revoke in-flight LLM calls or only block dispatch? `[engineering]` (lean: block dispatch).
- **M-Q4** `agent_actions.state` for in-progress detection — new column or `agent_action_progress` table? `[engineering]`.
- **N-Q5** Score weighting of anonymous reports — 50% / 25% / other? `[engineering]`.
- **N-Q6** PII hashing salt rotation policy? `[engineering]`.
- **P-Q5** Multi-mailbox auth on Proton — one mail-sync process per credential or multi-credential? `[engineering]` (tracked as task #15).
- **Q-Q6** Vigil schema location — platform.db or its own DB? `[engineering]` (lean: platform.db).
- **voice-Q3** Food-collision in outbound drafts — post-processing pass suppressing culinary lexicon when target is external human? `[engineering]`.

---

## Resolved (kept for audit)

- ~~**L** Per-directory specialists vs shared `bookings-directories`~~ → **resolved 2026-05-18**: hybrid (anchor surfaces dedicated; long tail shared). Same hybrid for content (OF/TikTok/newsletter dedicated; 9 social shared). See [L §L1](./L-specialists-fleet.brief.md).
- ~~**L** `content-newsletter` posture~~ → **resolved 2026-05-17**: draft + scheduled-send, hearth voice; v2 has no AI generation so v4 adds drafting on top of existing dispatch.
- ~~**L** Specialist human-readable names ("Hera" etc.)~~ → lean **no** (resolved). Role descriptors carry warmth without naming.
- ~~**L** Producer + publisher split into peer specialists~~ → lean **keep as sub-roles** (resolved).
- ~~**H** Policy card lives in settings vs chat~~ → **both** (resolved inline).
- ~~**Q** Vigil-detector confidence threshold~~ → **0.91 = auto-mark; below = surface for confirmation** (carry from v2).
- ~~**voice** Specialist names twee-ness (rename `triage`?)~~ → lean **keep `triage`** (resolved).
- ~~**VS** Custom font vs system~~ → lean **system** (Dynamic Type + accessibility wins).

---

## How to use this file

- **Designers**: scan `[blocking]` first; if your screen depends on one of those, surface it before drafting.
- **PM / Quinn**: this is the decision queue. Walk top-down through `[blocking]` and call them.
- **Engineers**: `[engineering]` items belong on a separate platform-engineering tracker; listed here only so they don't get re-asked from a design seat.
- **Closing a decision**: strike through with the date + a one-line note, leave it in place. Move the relevant brief's "Open questions" entry to mirror.