fullstackgtm 0.42.0 → 0.43.0

package/CHANGELOG.md

@@ -7,6 +7,86 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](./docs/roadmap-to-1.0.md)
 
 ## [Unreleased]
 
+## [0.43.0] — 2026-06-25
+
+### Added
+
+- **`init` — scaffold a GTM workspace from cold scratch.** `fullstackgtm init
+  [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce]` writes
+  three files so the first acquire/signals/judge/draft commands work: a valid
+  starter `icp.json`, an acquire-ready `enrich.config.json` (the source preset
+  plus an explicit `acquire.assign` seam, placeholder owner id, so leads are
+  never silently ownerless), and a `PLAYBOOK.md` wired with the cold-start and
+  outbound-loop recipes for this workspace's source/provider/profile. Pure
+  file-writer: no network, keeps existing files unless `--force`. Library:
+  `scaffoldWorkspace`, `starterIcp`, `starterEnrichConfig`, `starterPlaybook`.
+- **`docs/recipes.md` — five composable GTM plays.** Documents how the governed
+  primitives compose into real plays (cold-start lead-fill, the
+  trigger→judge→draft outbound loop, scheduled-continuous, ABM-from-companies,
+  hygiene-gated outbound) — making explicit that the CLI ships primitives, the
+  coding agent is the orchestrator (no `outbound` mega-verb), and the package
+  never sends. Surfaced from the agent skill and `llms.txt`, which also now
+  carry the previously-undocumented GTM-brain layer (`signals`/`icp`/`judge`/
+  `draft`) and the `init`/`enrich acquire` account-stamping behavior.
+- **Account-level acquire for ABM (seam I).** `enrich acquire` creates net-new
+  **accounts**, not just contacts: configure `acquire.create.company` (match key
+  `domain`) and feed company rows (`enrich ingest companies.csv --objects
+  companies`). Each unmatched company becomes a `create_record` of
+  `objectType: account` with its domain stamped — so the acquired account is
+  immediately signal-watchable. (The spine already routed by object type; this
+  validates + documents the account path so it's discoverable.)
+- **`health` breaks down by object type.** `HealthEntry.byObjectType` reports a
+  separate record-normalized score (same 100/(1+weighted-per-record) curve) plus
+  finding/record counts for `account`, `contact`, and `deal` — so "is my contact
+  data clean but my pipeline messy?" is answerable from one audit, and `health`
+  speaks each object type instead of a single aggregate. Rendered as a "By object
+  type" table in `healthToMarkdown`.
+- **Outbound is contact-granular end to end (seam D).** `icp judge` now surfaces
+  `contacts` — all in-CRM contacts at the hot account (primary first, capped) —
+  alongside the single `contact`, so an agent can multi-thread instead of being
+  limited to one person. `signals outcome --contact <id>` records which contact a
+  touch reached (`SignalOutcome.contactId`), so the feedback loop credits the
+  person, not just the account domain.
+
+### Changed
+
+- **`call link` says HOW it matched (seam H); the findings split is documented
+  (seam G).** `CallDealSuggestion` now carries `resolvedVia`
+  (`account_domain` | `contact_email` | `both`) and `matchedContacts`, so an
+  agent can weight a deal match by whether it came from the company-wide domain
+  or a single (possibly stale) attendee email — and the contact↔account hop is
+  visible, not just the resolved account. Separately, `PatchPlan.findings` (the
+  complete, object-typed list) and `pipelineFindings` (the deliberately
+  deal/sales-pipeline subset) are now documented so account/contact findings
+  aren't mistaken for "dropped" — they live in `findings`.
+- **`enrich acquire` now gives every lead a signal-watchable account (contact↔
+  account seam).** Previously the presets wrote the company as a text field only,
+  so an acquired lead had no account record — invisible to `signals`/`icp judge`,
+  which key on account domain. Now acquire resolves-or-creates the lead's account
+  **by domain**: `AcquireCreateMap.associateCompanyDomainFrom` (preset:
+  `companyDomain`) threads the resolved domain — or the work-email's domain as a
+  free fallback — onto `CreateRecordPayload.associateCompanyDomain`. The HubSpot
+  and Salesforce connectors then match the account by domain first (the accurate
+  key), create it **with** the domain (`domain` / `Website`), and fill the domain
+  on a name-matched account that lacks one (fill-blank, never clobber). The dry-
+  run op reason now names the account + domain instead of resolving it silently.
+
+### Fixed
+
+- **Outbound now writes against a real record, not a domain (contact↔account
+  seam).** `draft` previously emitted a `create_task` op hardcoded to
+  `objectType: "contact"` while carrying the account **domain** as `objectId` —
+  an incoherent operation the apply layer had to re-interpret. The bridge is now
+  explicit: `icp judge` resolves each decision's CRM target and surfaces it on
+  `JudgeDecision` — `accountId` plus the best `contact` (`id`/`email`/`title`) at
+  the account — whenever a snapshot source is given (`--provider`/`--input`/etc;
+  `--with-history` still gates the memory + fit scoring inputs, so scores are
+  unchanged). `draft` writes the task against `contact.id` (who to message), or
+  the `accountId` when no contact resolves, and **rejects a domain-only decision**
+  ("acquire it first") instead of forging a contact-typed op with a domain. The
+  object-type coherence invariant — every op's `objectId` is a real id of its
+  declared type — now holds for the outbound path.
+
 ## [0.42.0] — 2026-06-25
 
 ### Added

package/dist/calls.d.ts

@@ -63,6 +63,19 @@ export type CallDealSuggestion = {
     dealName?: string;
     accountId?: string;
     accountName?: string;
+    /**
+     * HOW the deal's account was matched — `account_domain` (the company-wide,
+     * reliable signal) vs `contact_email` (a specific person, possibly stale) vs
+     * `both`. An agent needs this to weight the match; the bare confidence hides it.
+     */
+    resolvedVia?: "account_domain" | "contact_email" | "both";
+    /** The attendee contacts that matched (the email path), so the contact↔account
+     *  hop is visible, not just the resolved account. */
+    matchedContacts?: {
+        id: string;
+        email?: string;
+        accountId?: string;
+    }[];
     confidence: "high" | "low" | "none";
     reason: string;
 };

package/dist/calls.js

@@ -295,18 +295,27 @@ export function suggestCallDeal(snapshot, options) {
         return { dealId: null, confidence: "none", reason: "No attendee emails or domain supplied to match on." };
     }
     const accountIds = new Set();
+    let viaDomain = false;
+    let viaEmail = false;
+    const matchedContacts = [];
     for (const account of snapshot.accounts) {
         const domain = account.domain?.trim().toLowerCase().replace(/^www\./, "");
-        if (domain && domains.has(domain))
+        if (domain && domains.has(domain)) {
             accountIds.add(account.id);
+            viaDomain = true;
+        }
     }
     for (const contact of snapshot.contacts) {
         const email = contact.email?.trim().toLowerCase();
         const at = email ? email.indexOf("@") : -1;
         if (email && at > 0 && domains.has(email.slice(at + 1)) && contact.accountId) {
             accountIds.add(contact.accountId);
+            viaEmail = true;
+            matchedContacts.push({ id: contact.id, ...(contact.email ? { email: contact.email } : {}), accountId: contact.accountId });
         }
     }
+    const resolvedVia = viaDomain && viaEmail ? "both" : viaDomain ? "account_domain" : "contact_email";
+    const via = { resolvedVia, ...(matchedContacts.length ? { matchedContacts } : {}) };
     if (accountIds.size === 0) {
         return {
             dealId: null,
@@ -335,8 +344,9 @@ export function suggestCallDeal(snapshot, options) {
             dealName: top.name,
             accountId: top.accountId,
             accountName: account?.name,
+            ...via,
             confidence: "high",
-            reason: `"${top.name}" is the only open deal on matched account "${account?.name ?? top.accountId}".`,
+            reason: `"${top.name}" is the only open deal on matched account "${account?.name ?? top.accountId}" (via ${resolvedVia}).`,
         };
     }
     return {
@@ -344,8 +354,9 @@ export function suggestCallDeal(snapshot, options) {
         dealName: top.name,
         accountId: top.accountId,
         accountName: account?.name,
+        ...via,
         confidence: "low",
-        reason: `${openDeals.length} open deals on matched account(s); "${top.name}" has the most recent activity. Confirm before writing.`,
+        reason: `${openDeals.length} open deals on matched account(s); "${top.name}" has the most recent activity (matched via ${resolvedVia}). Confirm before writing.`,
     };
 }
 function callHash(value) {

package/dist/cli.js

@@ -32,6 +32,7 @@ import { marketMapToHtml, marketMapToMarkdown } from "./marketReport.js";
 import { DEFAULT_RUBRIC, classifyCallLlm, detectProviderFromKey, extractInsightsLlm, parseRubric, resolveLlmCredential, scoreCallLlm, validateLlmKey, } from "./llm.js";
 import { buildAcquirePlan, buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, builtinAcquirePreset, builtinEnrichPreset, enrichRunId, inferIngestObjectType, latestStamps, loadEnrichConfig, parseCsv, resolveCrmField, selectStaleWork, stagedSourceRecords, staleDaysFor, } from "./enrich.js";
 import { loadMeter, recordConsumption, remaining, } from "./acquireMeter.js";
+import { scaffoldWorkspace, } from "./init.js";
 import { crmContactKeys, fetchExploriumProspects, fetchPipe0CrustdataProspects, partitionFreshProspects, pipe0ResolveCompanyDomains, pipe0ResolveWorkEmails, prospectIdentityKeys, } from "./connectors/prospectSources.js";
 import { loadSeen, recordSeen } from "./acquireSeen.js";
 import { reportCounts, reportEvent } from "./runReport.js";
@@ -67,6 +68,10 @@ Usage:
   the process list and shell history. Pipe them on stdin or enter them at the
   interactive prompt:
     echo "$HUBSPOT_TOKEN" | fullstackgtm login hubspot
+  fullstackgtm init [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]
+                                               cold start: scaffold icp.json + enrich.config.json + a
+                                               PLAYBOOK wired for this workspace (the CLI ships primitives,
+                                               your agent is the orchestrator — see docs/recipes.md)
   fullstackgtm snapshot [source options] [--since <iso>] [--out <path> | --archive <dir>]
   fullstackgtm audit [source options] [audit options] [--save]
   fullstackgtm report [source options] [audit options] [report options]
@@ -269,6 +274,16 @@ Safety:
   and never writes requires_human_* placeholders without a --value override.`;
 }
 const HELP = {
+    // Get started
+    init: {
+        summary: "scaffold a workspace (icp.json + enrich.config.json + PLAYBOOK)",
+        phase: "Setup",
+        synopsis: [
+            "fullstackgtm init [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]",
+        ],
+        detail: "Cold start: writes a starter ICP, an acquire-ready enrich.config.json (with a visible assign seam so leads are never ownerless), and a PLAYBOOK wired with the cold-start + outbound-loop recipes for this workspace. Pure file-writer — no network, keeps existing files unless --force. The CLI ships governed primitives; your coding agent is the orchestrator (see docs/recipes.md).",
+        seeAlso: ["icp", "enrich", "signals"],
+    },
     // Setup & health
     login: {
         summary: "connect a provider or LLM key (secrets via stdin/env, never argv)",
@@ -502,11 +517,12 @@ const HELP = {
 };
 // Verbs that print their own richer multi-subcommand help; runCli routes their
 // `--help` to themselves, so commandHelp() only renders these via `help <verb>`.
-const BESPOKE_HELP = ["call", "market", "enrich", "bulk-update", "schedule", "signals", "icp", "draft"];
+const BESPOKE_HELP = ["init", "call", "market", "enrich", "bulk-update", "schedule", "signals", "icp", "draft"];
 // Lifecycle-grouped front door. One line per verb, organized by the
 // Prevent→Detect→Remediate→Verify loop so a new user sees ~6 jobs, not 22 verbs.
 function shortUsage() {
     const groups = [
+        ["Get started", ["init"]],
         ["Setup & health", ["login", "logout", "doctor", "profiles", "health"]],
         ["Detect — read-only", ["audit", "report", "snapshot", "diff", "rules"]],
         ["Prevent — gate writes", ["resolve"]],
@@ -2277,7 +2293,8 @@ NEVER emits a patch plan; --save persists only the local signal ledger (used by
             throw new Error(`signals outcome: --result must be one of ${valid.join(", ")}.`);
         }
         const touchId = option(rest, "--touch") ?? undefined;
-        const outcome = makeOutcome({ accountDomain: accountArg, touchId, result: result });
+        const contactId = option(rest, "--contact") ?? undefined;
+        const outcome = makeOutcome({ accountDomain: accountArg, touchId, contactId, result: result });
         await createFileSignalStore().appendOutcome(outcome);
         console.error(`Recorded outcome "${outcome.result}" for ${outcome.accountDomain} (${outcome.id}). ` +
             `Re-run \`fullstackgtm signals weights\` to see the learned shift.`);
@@ -2447,6 +2464,58 @@ LLM key it emits a clearly-labeled stub rather than fake authored copy.`);
         console.error("(not saved — re-run with --save to stage the plan for plans approve -> apply)");
     }
 }
+/**
+ * `init` — scaffold a GTM workspace from cold scratch: a starter icp.json, an
+ * enrich.config.json (acquire preset + a visible assign seam), and a PLAYBOOK
+ * wired with the chosen source/provider that points at the recipes. Pure
+ * file-writer: no network, never overwrites without --force.
+ */
+function initCommand(args) {
+    if (args.includes("--help") || args.includes("-h")) {
+        console.log(`Usage:
+  fullstackgtm init [--source pipe0|explorium|linkedin] [--provider hubspot|salesforce] [--out <dir>] [--force]
+
+Scaffolds a workspace so the first acquire/signals/judge/draft commands work:
+  icp.json            starter ICP (edit, or rebuild with \`icp interview\`)
+  enrich.config.json  acquire preset for --source + a placeholder assign policy
+  PLAYBOOK.md         the cold-start + outbound-loop recipes wired for this workspace
+
+The CLI ships governed primitives; your coding agent is the orchestrator. See
+docs/recipes.md for the full play set. Existing files are kept unless --force.`);
+        return;
+    }
+    const source = (option(args, "--source") ?? "pipe0");
+    if (!["pipe0", "explorium", "linkedin"].includes(source)) {
+        throw new Error(`init: --source must be pipe0|explorium|linkedin (got "${source}")`);
+    }
+    const provider = (option(args, "--provider") ?? "hubspot");
+    if (!["hubspot", "salesforce"].includes(provider)) {
+        throw new Error(`init: --provider must be hubspot|salesforce (got "${provider}")`);
+    }
+    const outDir = resolve(process.cwd(), option(args, "--out") ?? ".");
+    const force = args.includes("--force");
+    const current = activeProfile();
+    const profile = current === DEFAULT_PROFILE ? undefined : current;
+    const files = scaffoldWorkspace({ source, provider, profile });
+    const wrote = [];
+    const kept = [];
+    for (const file of files) {
+        const path = resolve(outDir, file.path);
+        if (existsSync(path) && !force) {
+            kept.push(file.path);
+            continue;
+        }
+        writeFileSync(path, file.content);
+        wrote.push(file.path);
+    }
+    console.log(`Scaffolded workspace (${provider}, discovery via ${source}${profile ? `, profile ${profile}` : ""}).`);
+    if (wrote.length)
+        console.log(`  wrote: ${wrote.join(", ")}`);
+    if (kept.length)
+        console.log(`  kept (use --force to overwrite): ${kept.join(", ")}`);
+    console.log("\nNext: edit icp.json + set acquire.assign.ownerId in enrich.config.json, then follow PLAYBOOK.md\n" +
+        "(full recipe set: docs/recipes.md).");
+}
 /**
  * `icp` — develop and inspect the Ideal Customer Profile that targets acquire.
  * The CLI can't run AskUserQuestion itself; `icp interview` emits the question
@@ -2521,12 +2590,19 @@ ops. Develop one by interview, then \`enrich acquire\` picks up ./icp.json.
         const unjudged = signalRun.signals.filter((s) => !s.judgedBy);
         if (unjudged.length === 0)
             throw new Error(`Signal run "${signalRun.runLabel}" has no unjudged signals.`);
-        // 2) Optional inputs: ICP (may be undefined), snapshot (only --with-history),
-        //    outcomes + config from the signal store / DEFAULT_SIGNALS_CONFIG.
+        // 2) Optional inputs: ICP (may be undefined), snapshot, outcomes + config.
+        //    The snapshot is loaded whenever a source is given (--provider/--input/
+        //    --demo/--sample) — it resolves each decision's CRM target (accountId +
+        //    best contact) so `draft` can write against a real record. --with-history
+        //    additionally enables the memory + fit scoring inputs.
         const icp = loadIcp(rest);
         const config = DEFAULT_SIGNALS_CONFIG;
         const outcomes = await signalStore.listOutcomes();
-        const snapshot = withHistory ? await readSnapshot(rest) : undefined;
+        const hasSnapshotSource = Boolean(option(rest, "--provider")) ||
+            Boolean(option(rest, "--input")) ||
+            rest.includes("--demo") ||
+            rest.includes("--sample");
+        const snapshot = withHistory || hasSnapshotSource ? await readSnapshot(rest) : undefined;
         // 3) Resolve the LLM seam ONLY if a key already exists (deterministic baseline
         //    otherwise — never PROMPT here; judge must run key-free).
         const cred = resolveLlmCredential();
@@ -4599,6 +4675,10 @@ export async function runCli(argv) {
         await enrichCommand(args);
         return;
     }
+    if (command === "init") {
+        initCommand(args);
+        return;
+    }
     if (command === "icp") {
         await icpCommand(args);
         return;

package/dist/connectors/hubspot.js

@@ -406,18 +406,35 @@ export function createHubspotConnector(options) {
             providerData: { companyId, ...(createdCompanyName ? { createdCompany: true } : {}) },
         };
     }
-    /** Exact-name company lookup for resolve-first creates. Returns matching ids (max 3 fetched). */
-    async function searchCompaniesByName(name) {
+    /** Exact-value company lookup (by `name` or `domain`) for resolve-first creates. */
+    async function searchCompaniesBy(property, value) {
         const data = await request(`/crm/v3/objects/companies/search`, {
             method: "POST",
             body: JSON.stringify({
-                filterGroups: [{ filters: [{ propertyName: "name", operator: "EQ", value: name }] }],
-                properties: ["name"],
+                filterGroups: [{ filters: [{ propertyName: property, operator: "EQ", value }] }],
+                properties: [property],
                 limit: 3,
             }),
         });
         return (data?.results ?? []).map((row) => String(row.id));
     }
+    const searchCompaniesByName = (name) => searchCompaniesBy("name", name);
+    /** Stamp `domain` on a company only when it has none (fill-blank, never clobber). */
+    async function fillCompanyDomainIfEmpty(companyId, domain) {
+        try {
+            const data = await request(`/crm/v3/objects/companies/${encodeURIComponent(companyId)}?properties=domain`);
+            const current = data?.properties?.domain;
+            if (typeof current === "string" && current.trim())
+                return; // already has one — leave it
+            await request(`/crm/v3/objects/companies/${encodeURIComponent(companyId)}`, {
+                method: "PATCH",
+                body: JSON.stringify({ properties: { domain } }),
+            });
+        }
+        catch {
+            // Best-effort: a failed domain fill must not sink the contact create.
+        }
+    }
     /** Exact-value contact lookup (by any searchable property) for resolve-first creates. */
     async function searchContactsBy(property, value) {
         const data = await request(`/crm/v3/objects/contacts/search`, {
@@ -431,39 +448,55 @@ export function createHubspotConnector(options) {
         return (data?.results ?? []).map((row) => String(row.id));
     }
     /**
-     * Resolve a company by exact name, creating it on a confirmed miss. Returns
-     * the company id, or null on ambiguity (≥2 existing) so the caller skips the
-     * association rather than guessing. Same-run safe via createdCompaniesByName.
+     * Resolve a company to a real account record, creating it on a confirmed miss.
+     * Matches by DOMAIN first (the accurate key) and falls back to exact name;
+     * creates with the domain stamped, and fills the domain on a name-matched
+     * account that lacks one — so the account is signal-watchable. Returns null on
+     * ambiguity (≥2 matches) so the caller skips the association rather than
+     * guessing. Same-run safe via createdCompaniesByName.
      */
-    async function resolveOrCreateCompanyByName(name, opId) {
-        const nameKey = name.toLowerCase();
-        const already = createdCompaniesByName.get(nameKey);
+    async function resolveOrCreateCompany(name, domain, opId) {
+        const cacheKey = domain ? `d:${domain.toLowerCase()}` : `n:${name.toLowerCase()}`;
+        const already = createdCompaniesByName.get(cacheKey);
         if (already)
             return already;
-        const matches = await searchCompaniesByName(name);
-        if (matches.length > 1)
-            return null;
-        if (matches.length === 1) {
-            createdCompaniesByName.set(nameKey, matches[0]);
-            return matches[0];
+        // 1. Domain-first match (accurate; an account matched here already has it).
+        if (domain) {
+            const byDomain = await searchCompaniesBy("domain", domain);
+            if (byDomain.length > 1)
+                return null;
+            if (byDomain.length === 1) {
+                createdCompaniesByName.set(cacheKey, byDomain[0]);
+                return byDomain[0];
+            }
         }
+        // 2. Exact-name match; stamp the domain if the account has none.
+        const byName = await searchCompaniesByName(name);
+        if (byName.length > 1)
+            return null;
+        if (byName.length === 1) {
+            if (domain)
+                await fillCompanyDomainIfEmpty(byName[0], domain);
+            createdCompaniesByName.set(cacheKey, byName[0]);
+            return byName[0];
+        }
+        // 3. Create with name + domain (provenance is best-effort).
+        const props = { name, ...(domain ? { domain } : {}) };
         let created;
         try {
             created = await request(`/crm/v3/objects/companies`, {
                 method: "POST",
-                body: JSON.stringify({
-                    properties: { name, hs_object_source_detail_2: `fullstackgtm acquire (${opId})` },
-                }),
+                body: JSON.stringify({ properties: { ...props, hs_object_source_detail_2: `fullstackgtm acquire (${opId})` } }),
             });
         }
         catch {
             created = await request(`/crm/v3/objects/companies`, {
                 method: "POST",
-                body: JSON.stringify({ properties: { name } }),
+                body: JSON.stringify({ properties: props }),
             });
         }
         const id = String(created.id);
-        createdCompaniesByName.set(nameKey, id);
+        createdCompaniesByName.set(cacheKey, id);
         return id;
     }
     /**
@@ -487,7 +520,7 @@ export function createHubspotConnector(options) {
             return { operationId: operation.id, status: "skipped", detail: "create_record needs a non-empty matchValue to resolve-first." };
         }
         if (operation.objectType === "account") {
-            const id = await resolveOrCreateCompanyByName(matchValue, operation.id);
+            const id = await resolveOrCreateCompany(matchValue, stringOrUndefined(payload.properties?.domain), operation.id);
             if (id === null) {
                 return { operationId: operation.id, status: "skipped", detail: `create_record: ambiguous — multiple companies named "${matchValue}". Not creating.` };
             }
@@ -534,10 +567,11 @@ export function createHubspotConnector(options) {
         let companyNote = "";
         if (payload.associateCompanyName) {
             try {
-                const companyId = await resolveOrCreateCompanyByName(payload.associateCompanyName, operation.id);
+                const companyId = await resolveOrCreateCompany(payload.associateCompanyName, payload.associateCompanyDomain, operation.id);
                 if (companyId) {
                     await request(`/crm/v4/objects/contacts/${encodeURIComponent(contactId)}/associations/default/companies/${encodeURIComponent(companyId)}`, { method: "PUT" });
-                    companyNote = ` Linked to company "${payload.associateCompanyName}" (${companyId}).`;
+                    const domainNote = payload.associateCompanyDomain ? ` (${payload.associateCompanyDomain})` : "";
+                    companyNote = ` Linked to company "${payload.associateCompanyName}"${domainNote} (${companyId}).`;
                 }
                 else {
                     companyNote = ` Company "${payload.associateCompanyName}" was ambiguous; left unlinked.`;

package/dist/connectors/salesforce.js

@@ -37,29 +37,53 @@ export function createSalesforceConnector(options) {
     // confirmed miss is created, and an ambiguous name (>1 match) is refused.
     // Caches within the run so the same name is never created twice — shared by
     // `link_record`'s create:<Name> path and `create_record`'s company linking.
-    async function resolveOrCreateAccountByName(name) {
-        const nameKey = name.toLowerCase();
-        const cached = createdAccountsByName.get(nameKey);
+    async function resolveOrCreateAccount(name, domain) {
+        const cacheKey = domain ? `d:${domain.toLowerCase()}` : `n:${name.toLowerCase()}`;
+        const cached = createdAccountsByName.get(cacheKey);
         if (cached)
             return { id: cached, createdNew: false };
-        const soqlName = name.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
-        const matches = await query(`SELECT Id FROM Account WHERE Name = '${soqlName}' LIMIT 3`);
-        if (matches.length > 1)
-            return { ambiguous: matches.length };
+        const esc = (v) => v.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+        // 1. Domain-first match on Website (the accurate key; Website often stores a
+        //    full URL, so match by substring).
+        if (domain) {
+            const byDomain = await query(`SELECT Id FROM Account WHERE Website LIKE '%${esc(domain)}%' LIMIT 3`);
+            if (byDomain.length > 1)
+                return { ambiguous: byDomain.length };
+            if (byDomain.length === 1) {
+                const id = String(byDomain[0].Id);
+                createdAccountsByName.set(cacheKey, id);
+                return { id, createdNew: false };
+            }
+        }
+        // 2. Exact-name match; stamp Website if the account has none (fill-blank).
+        const byName = await query(`SELECT Id, Website FROM Account WHERE Name = '${esc(name)}' LIMIT 3`);
+        if (byName.length > 1)
+            return { ambiguous: byName.length };
         let id;
         let createdNew = false;
-        if (matches.length === 1) {
-            id = String(matches[0].Id);
+        if (byName.length === 1) {
+            id = String(byName[0].Id);
+            if (domain && !stringOrUndefined(byName[0].Website)) {
+                try {
+                    await request(`/services/data/${apiVersion}/sobjects/Account/${encodeURIComponent(id)}`, {
+                        method: "PATCH",
+                        body: JSON.stringify({ Website: domain }),
+                    });
+                }
+                catch {
+                    // best-effort fill — a failed Website stamp must not sink the create.
+                }
+            }
         }
         else {
             const created = await request(`/services/data/${apiVersion}/sobjects/Account`, {
                 method: "POST",
-                body: JSON.stringify({ Name: name }),
+                body: JSON.stringify({ Name: name, ...(domain ? { Website: domain } : {}) }),
             });
             id = String(created.id);
             createdNew = true;
         }
-        createdAccountsByName.set(nameKey, id);
+        createdAccountsByName.set(cacheKey, id);
         return { id, createdNew };
     }
     async function request(path, init = {}) {
@@ -427,7 +451,7 @@ export function createSalesforceConnector(options) {
             return { operationId: operation.id, status: "skipped", detail: "create_record needs a non-empty matchValue to resolve-first." };
         }
         if (operation.objectType === "account") {
-            const resolved = await resolveOrCreateAccountByName(matchValue);
+            const resolved = await resolveOrCreateAccount(matchValue);
             if ("ambiguous" in resolved) {
                 return { operationId: operation.id, status: "skipped", detail: `create_record: ambiguous — ${resolved.ambiguous} accounts named "${matchValue}". Not creating.` };
             }
@@ -465,7 +489,7 @@ export function createSalesforceConnector(options) {
         let companyNote = "";
         if (payload.associateCompanyName) {
             try {
-                const resolved = await resolveOrCreateAccountByName(payload.associateCompanyName);
+                const resolved = await resolveOrCreateAccount(payload.associateCompanyName, payload.associateCompanyDomain);
                 if ("ambiguous" in resolved) {
                     companyNote = ` Account "${payload.associateCompanyName}" was ambiguous; left unlinked.`;
                 }
@@ -474,7 +498,8 @@ export function createSalesforceConnector(options) {
                         method: "PATCH",
                         body: JSON.stringify({ AccountId: resolved.id }),
                     });
-                    companyNote = ` Linked to account "${payload.associateCompanyName}" (${resolved.id}).`;
+                    const domainNote = payload.associateCompanyDomain ? ` (${payload.associateCompanyDomain})` : "";
+                    companyNote = ` Linked to account "${payload.associateCompanyName}"${domainNote} (${resolved.id}).`;
                 }
             }
             catch (error) {
@@ -617,7 +642,7 @@ export function createSalesforceConnector(options) {
                         if (!name) {
                             return { operationId: operation.id, status: "skipped", detail: "create: needs an account name (create:<Name>)." };
                         }
-                        const resolved = await resolveOrCreateAccountByName(name);
+                        const resolved = await resolveOrCreateAccount(name);
                         if ("ambiguous" in resolved) {
                             return {
                                 operationId: operation.id,

package/dist/draft.js

@@ -197,9 +197,6 @@ export function draft(opts) {
     const minScore = opts.minScore ?? 80;
     const channel = opts.channel ?? "task";
     const freshnessDays = opts.freshnessDays ?? DEFAULT_FRESHNESS_DAYS;
-    // `task`/`email`/`linkedin` all write a CRM task through the same gate; the
-    // object the task hangs off is the contact when known, else the account.
-    const objectType = "contact";
     const hot = opts.decisions
         .filter((d) => d.decision === "send" && d.score >= minScore)
         .sort((a, b) => b.score - a.score || a.accountDomain.localeCompare(b.accountDomain));
@@ -235,17 +232,42 @@ export function draft(opts) {
             });
             continue;
         }
+        // Resolve a REAL CRM target from the judge decision: a contact id (preferred
+        // — that's who we message), else the account id. A domain-only decision
+        // (the account isn't in the CRM yet) cannot hang a task off a record — reject
+        // it with the fix, instead of forging a contact-typed op carrying a domain.
+        let objectType;
+        let objectId;
+        let targetNote;
+        if (decision.contact?.id) {
+            objectType = "contact";
+            objectId = decision.contact.id;
+            targetNote = `contact ${decision.contact.email ?? decision.contact.id}`;
+        }
+        else if (decision.accountId) {
+            objectType = "account";
+            objectId = decision.accountId;
+            targetNote = `account ${domain}`;
+        }
+        else {
+            rejected.push({
+                accountDomain: domain,
+                opener,
+                reason: `account ${domain} is not in the CRM — acquire it first (enrich acquire), then judge with a snapshot, before drafting`,
+            });
+            continue;
+        }
         const stale = isStaleTrigger(signal.firstSeen, now, freshnessDays);
         const ev = draftEvidence(signal, nowIso);
         evidence.push(ev);
-        const reasonBase = `Signal-grounded opener for ${domain}: "${signal.trigger}"`;
+        const reasonBase = `Signal-grounded opener for ${domain} → ${targetNote}: "${signal.trigger}"`;
         const reason = stale
             ? `${reasonBase} [staleTrigger: grounding signal first seen ${signal.firstSeen}, older than ${freshnessDays}d — could this have gone out last month unchanged?]`
             : reasonBase;
         operations.push({
             id: draftOperationId(channel, domain),
             objectType,
-            objectId: domain,
+            objectId,
             operation: "create_task",
             field: "follow_up_task",
             beforeValue: null,

package/dist/enrich.d.ts

@@ -68,6 +68,12 @@ export type AcquireCreateMap = {
     matchKey: string;
     /** Optional source path to a company name; the connector resolves-or-creates it. */
     associateCompanyFrom?: string;
+    /**
+     * Optional source path to the company domain. With it (or a derivable email
+     * domain) the connector resolves the account by domain and stamps the domain
+     * on it — so the lead's account is signal-watchable, not just a text field.
+     */
+    associateCompanyDomainFrom?: string;
 };
 /**
  * Net-new discovery for an API acquire source. `provider` selects the adapter