My recollection is, if a merchant does not send through a matching transaaction for a pre-authorization timely the financial institution has chargeback rights. I thought that the merchant had 4 days to send through the matching charge. Is that correct?

Under Visa, the auth number is good for up to 180 days. For chargeback rights, review RC 74 - Late Presentment - on the provisions for chargebacks. Have been out of the MC loop for a bit and do not recall the specific timeframe, but it is also well beyond 4 days.

The time you set on your system to have an unmatched auth fall off is up to you, but the longer you go the greater the customer impact. I would say around 3 days is industry average. Most merchants want to get their funds ASAP so it is not a big deal as they settle as quickly as possible but your biggest risks with the auth falling off in 3-4 days will be with hotels and car rentals that are allowed to continue to get auths from day 1 up until the rental or stay has been exhausted. They are allowed to obtain an auth daily and post the lump sum amount using the original auth code.