40 { "code": "passwords-never-imported", "severity": "warning", "summary": "Passwords are NOT imported — project decision (2026-08-03), not just an API gap. Members keep account/profile/contact linkage; they set a new password via reset. Never propose hash import." },
41 { "code": "activation-via-forgot-password", "severity": "warning", "summary": "Activation (decided 2026-08-03): passwordless members complete the standard forgot-password flow (confirmed). Delivery = post-import automation (label-added trigger, owner-branded email, label applied in API waves). Never mass-send Send Set Password Email — its link dies in 3h." },
42 { "code": "serial-create-only", "severity": "warning", "summary": "No bulk member create; documented >=1s spacing per Create Member call (10k members ~ 3h serial floor). Plan throughput and resume via loginEmail crosswalk." },
43 { "code": "chronology-server-controlled", "severity": "warning", "summary": "Original createdDate and lastLoginDate are not writable as native member chronology." }
44 ],
45 "mappingGuidance": [
46 "Split author, customer, contact, and login-member roles before selecting targets.",
47 "Create Member sends no email and does not fire the signup automations trigger (source-confirmed) — silent import is the default; the only member-facing email is the explicit Send Set Password Email call, which is per-member, interactive-mode, owner-approved only."
48 ],
49 "setupRequirements": ["Activation is decided end-to-end: no credential import; post-import the owner creates ONE dashboard automation (label-added trigger → branded email directing members to Log in → Forgot password), then the importer applies the label in API waves for rate control and re-targeting. Enable the automation only after the import window (AUTO-02 pause choreography)."],