sf-intelligence 0.1.21 → 0.1.22

package/dist/index.js

@@ -2315,7 +2315,8 @@ var init_resolve = __esm({
         const kind = c2.wholeExact ? "exact" : rollupKind(matched);
         const nodeTokenSet = new Set(c2.node.tokens);
         const matchedNodeTokens = new Set(matched.map((m2) => m2.matchedToken).filter((t2) => nodeTokenSet.has(t2)));
-        coverageById.set(c2.node.id, c2.wholeExact ? 1 : matchedNodeTokens.size / c2.node.tokens.length);
+        const nameCoverage = c2.wholeExact ? 1 : matchedNodeTokens.size / c2.node.tokens.length;
+        coverageById.set(c2.node.id, nameCoverage);
         if (c2.wholeExact)
           wholeExactIds.add(c2.node.id);
         if (c2.parentMatched)
@@ -2328,6 +2329,7 @@ var init_resolve = __esm({
           parentApiName: c2.node.parentApiName,
           score: Number(score.toFixed(6)),
           base: Number(base.toFixed(6)),
+          nameCoverage: Number(nameCoverage.toFixed(6)),
           matchKind: kind,
           evidence: c2.wholeExact ? `exact name match on "${query.trim()}"` : buildEvidence(kind, matched)
         });
@@ -21345,7 +21347,7 @@ var init_live_consent = __esm({
 });
 
 // ../mcp/dist/src/answer-render.js
-var cell, renderTrustFooter, mdTable, renderResolveMarkdown, formatDeltas, renderOrgOverviewMarkdown, renderLiveCountMarkdown, renderFieldPopulationMarkdown, renderInactiveUsersMarkdown, renderRouteMarkdown;
+var cell, renderTrustFooter, mdTable, renderResolveMarkdown, formatDeltas, renderOrgOverviewMarkdown, renderLiveCountMarkdown, renderFieldPopulationMarkdown, renderInactiveUsersMarkdown, renderContextApplied, renderRouteMarkdown;
 var init_answer_render = __esm({
   "../mcp/dist/src/answer-render.js"() {
     "use strict";
@@ -21459,9 +21461,16 @@ ${table}${capped}
 
 ${renderTrustFooter(data.trust)}`;
     };
+    renderContextApplied = (contextApplied) => {
+      const substituted = contextApplied.substitutedComponentId ?? contextApplied.selection;
+      return `Context applied: '${contextApplied.anaphor}'` + (substituted !== void 0 ? ` \u2192 ${substituted}` : "") + " (from previous turn)" + (contextApplied.inheritedTool !== void 0 ? `; tool inherited: \`${contextApplied.inheritedTool}\`.` : ".");
+    };
     renderRouteMarkdown = (route) => {
+      const contextLine = route.contextApplied !== void 0 ? `
+
+${renderContextApplied(route.contextApplied)}` : "";
       if (route.plane === "unknown") {
-        return `I don't have a tool for **"${route.question}"** yet \u2014 ${route.reason} ${route.gap ? `(logged as \`${route.gap.category}\`).` : ""}`;
+        return `I don't have a tool for **"${route.question}"** yet \u2014 ${route.reason} ${route.gap ? `(logged as \`${route.gap.category}\`).` : ""}` + contextLine;
       }
       const steps = [];
       let plannedTools = route.tools;
@@ -21491,7 +21500,7 @@ ${route.plan.map((step3, i2) => {
 
 Plan: ${steps.join(" \u2192 ")}` + enterprise + clarification + compoundPlan + (route.gap ? `
 
-_Partial: ${route.gap.note}_` : "");
+_Partial: ${route.gap.note}_` : "") + contextLine;
     };
   }
 });
@@ -24182,7 +24191,7 @@ ${renderTrustFooter(trust)}`;
 import { appendFile as appendFile3, mkdir as mkdir8 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
 import { dirname as dirname18, join as join13 } from "node:path";
-var riskForIntent, routeFromRule, routeForSelectedIntent, normalize, NAMED_COMPONENT_ID, NAMED_FIELD_ID, deriveSaveEvent, deriveKnowledgeTopic, deriveListType, FIELD_PARENT_OBJECTS, deriveFieldListParent, deriveMetadataParentId, NON_OBJECT_CAPTURES, deriveObjectApiFromQuestion, deriveImpactHops, FIELD_MAP_OBJECT, deriveFieldMappingArgs, deriveLayoutForUserArgs, derivePiiInventoryArgs, deriveMetadataCountArgs, deriveOmniType, routeText, RULES, alternativeFromIntent, semanticAlternatives, intentLabel, classifyQuestion, gapLogPath, logGapIfAny;
+var riskForIntent, routeFromRule, routeForSelectedIntent, normalize, NAMED_COMPONENT_ID, NAMED_FIELD_ID, deriveSaveEvent, deriveKnowledgeTopic, deriveListType, FIELD_PARENT_OBJECTS, deriveFieldListParent, deriveMetadataParentId, NON_OBJECT_CAPTURES, deriveObjectApiFromQuestion, deriveImpactHops, FIELD_MAP_OBJECT, deriveFieldMappingArgs, deriveLayoutForUserArgs, derivePiiInventoryArgs, deriveMetadataCountArgs, deriveOmniType, routeText, RULES, alternativeFromIntent, semanticAlternatives, intentLabel, COMPLEMENTARY_ALTERNATIVE_PAIRS, NAMES_COMPONENT_FOR_LAST_MODIFIED, classifyQuestion, gapLogPath, logGapIfAny;
 var init_intent_router = __esm({
   "../mcp/dist/src/intent-router.js"() {
     "use strict";
@@ -25159,7 +25168,9 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "Login activity (LastLoginDate) is runtime state that lives only in the org.",
         patterns: [
-          /\b(who|users?|people)\b.*\b(log(ged)?\s?in|login|active|inactive|dormant)\b/,
+          // `in(to)?` — "which users logged INTO the org last week" is the same
+          // LastLoginDate read; the bare `in\b` missed the fused "into" (P4).
+          /\b(who|users?|people)\b.*\b(log(ged)?\s?in(to)?|login|active|inactive|dormant)\b/,
           /\b(inactive|dormant|stale|unused)\b.*\busers?\b/,
           /\bhaven'?t\b.*\blog(ged)?\s?in\b/,
           /\blast\s+login\b/,
@@ -25184,15 +25195,24 @@ var init_intent_router = __esm({
           // near a field/value (so "empty queues" doesn't get swallowed here).
           /\b(populated|filled)\b/,
           // "field population for X" / "population rate" — the noun "population"
-          // (vs the adjective "populated"). Battery gap.
-          /\b(field\s+)?population\b/,
+          // (vs the adjective "populated"). Battery gap. Guarded (P4): "the FLOW
+          // THAT fires the 'General Population RR Group' step" uses "population"
+          // inside a quoted flow-step name — a flow-search ask, not field fill.
+          /^(?!.*\bflows?\s+that\b).*\b(field\s+)?population\b/,
           // `fields?`/`values?` — `\b(field|value)\b` missed the PLURALS, so
           // "which Account fields are empty" fell through to metadata-count
           // (vault plane) instead of this hybrid live-data intent.
           /\b(empty|blank|null)\b.*\b(fields?|values?)\b/,
           /\b(fields?|values?)\b.*\b(empty|blank|null|populated|filled)\b/,
           /\bhow\s+many\b.*\b(have|with|without)\b.*\b(field|value|filled|set)\b/,
-          /\b(actually|really)\s+(populated|filled)\b/
+          /\b(actually|really)\s+(populated|filled)\b/,
+          // Router-v2 P4 needs-live reachability: "fill rate", "completeness of
+          // key fields", and "how many X have a blank Y" are all the same live
+          // per-field population read. Queue/group emptiness and missing
+          // DESCRIPTIONS stay vault (excluded).
+          /\bfill\s+rates?\b/,
+          /\bcompleteness\b.*\b(fields?|data|records?)\b|\b(fields?|data)\b.*\bcompleteness\b/,
+          /\bhow\s+many\b(?!.*\b(queues?|groups?|descriptions?|help\s+text)\b)[^.?!]*\b(blank|null|missing)\b/
         ]
       },
       {
@@ -25228,7 +25248,11 @@ var init_intent_router = __esm({
           /^(?!.*(__mdt\b|\bcustom\s+metadata\b|\bcustom\s+settings?\b)).*\b(show|give|sample|example)s?\b.*\b(records?|rows?)\b/,
           /\b(show|give)\s+me\s+\d+\b/,
           /\bsample\s+\d+\b/,
-          /\b\d+\s+(sample|example)\s+\w+\b/
+          /\b\d+\s+(sample|example)\s+\w+\b/,
+          // Router-v2 P4: a literal Salesforce record ID (15/18 chars, leading 0 +
+          // keyprefix — "did lead 00Q5x000004abcd convert?") is a live row lookup;
+          // the vault never holds record data.
+          /\b0[0-9a-z]{2}[0-9a-z]{12}(?:[0-9a-z]{3})?\b/
         ]
       },
       {
@@ -25290,7 +25314,10 @@ var init_intent_router = __esm({
           // components (P0a). Keyed on the word "users" alone — metadata-count
           // questions ("how many profiles / layouts / … , and which is assigned to
           // each profile") never say "users", so they still fire here.
-          /\bhow\s+many\b(?!.*\busers?\b).*\b(page\s+layouts?|layouts?|custom\s+objects?|profiles?|permission\s+sets?|validation\s+rules?|flows?|(apex\s+)?classes?|triggers?|record\s+types?|list\s+views?|report\s+types?|record\s+pages?|flexipages?|approval\s+process(es)?|custom\s+settings?|quick\s+actions?|sharing\s+rules?|named\s+credentials?|picklists?)\b/,
+          // The second lookahead (P4): "how many RECORDS per record type" is a
+          // live GROUP BY over record data — the metadata noun ("record type") is
+          // the grouping key, not the thing being counted.
+          /\bhow\s+many\b(?!.*\busers?\b)(?!.*\brecords?\s+(?:per|by|for\s+each)\b).*\b(page\s+layouts?|layouts?|custom\s+objects?|profiles?|permission\s+sets?|validation\s+rules?|flows?|(apex\s+)?classes?|triggers?|record\s+types?|list\s+views?|report\s+types?|record\s+pages?|flexipages?|approval\s+process(es)?|custom\s+settings?|quick\s+actions?|sharing\s+rules?|named\s+credentials?|picklists?)\b/,
           /\bhow\s+many\b.*\blayouts?\b.*\b(per|for\s+each|by)\b.*\bprofiles?\b/,
           /\blayouts?\b.*\b(per|for\s+each|by)\b.*\bprofiles?\b/,
           // fields, but NOT field usage/population (those are unused-fields / field-population)
@@ -25312,7 +25339,16 @@ var init_intent_router = __esm({
           /\b(by|per)\s+(status|stage|type|industry|record\s+type)\b/,
           /\bhow\s+many\b.*\b(in|with)\s+(each|every)\b/,
           // "how many Applications with status Submitted" — filtered live COUNT, not vault metadata-count (B21).
-          /\bhow\s+many\b.*\bwith\s+(status|stage|type|record\s+type)\b/
+          /\bhow\s+many\b.*\bwith\s+(status|stage|type|record\s+type)\b/,
+          // Router-v2 P4: imperative "count X grouped by Y" / "count of X by Y" /
+          // "count X records by Y" — the same live GROUP BY, phrased without
+          // "how many".
+          /\bcount\b[^.?!]{0,60}\bgrouped?\s+by\b/,
+          /\bcount\s+of\b[^.?!]{0,60}\bby\b/,
+          /\bcount\b[^.?!]{0,60}\brecords?\s+by\b/,
+          // "who's in the ADA Team Queue" — queue/public-group membership is a
+          // live GroupMember read; the vault holds the queue definition only.
+          /\bwho(?:'?s|\s+is|\s+are)?\b[^.?!]{0,40}\bin\s+the\b[^.?!]{0,50}\b(queues?|public\s+groups?)\b/
         ]
       },
       {
@@ -25325,7 +25361,10 @@ var init_intent_router = __esm({
         patterns: [
           /\b(average|avg|mean|minimum|min|maximum|max|sum|total)\b.*\b(field|value|amount|revenue|score)\b/,
           /\bwhat\s+is\s+the\b.*\b(average|avg|min|max|sum)\b/,
-          /\bhow\s+(big|large|small)\b.*\b(on\s+average|average)\b/
+          /\bhow\s+(big|large|small)\b.*\b(on\s+average|average)\b/,
+          // Router-v2 P4: "average number of X per Y" — a live AVG/GROUP BY ask
+          // that named no field noun.
+          /\baverage\s+number\s+of\b/
         ]
       },
       {
@@ -25336,8 +25375,12 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "Duplicate detection needs live GROUP BY + HAVING on field values.",
         patterns: [
-          /\bduplicate\b.*\b(records?|values?|emails?|contacts?|accounts?|fields?|rows?)\b/,
-          /\b(records?|values?|emails?|contacts?|accounts?)\b.*\bduplicate\b/,
+          // `duplicat\w*` — "most DUPLICATED email domain" is the same live GROUP
+          // BY + HAVING read; the bare `duplicate` missed the participle (P4).
+          /\bduplicat\w*\b.*\b(records?|values?|emails?|domains?|contacts?|accounts?|fields?|rows?)\b/,
+          // Guarded: "which FIELDS are duplicated" is a SCHEMA-redundancy ask
+          // (vault), not live record duplicates — exclude the fields subject.
+          /^(?!.*\bfields?\b[^.?!]{0,40}\bduplicat)\b.*\b(records?|values?|emails?|domains?|contacts?|accounts?)\b.*\bduplicat\w*\b/,
           /\bsame\b.*\b(email|phone|name|value)\b/
         ]
       },
@@ -25360,7 +25403,14 @@ var init_intent_router = __esm({
           // vault cannot answer it at all (eval family D).
           /\b(which|what)\b[^.?!]{0,40}\bobjects?\b[^.?!]{0,50}\bempty\b/,
           /\bempty\b[^.?!]{0,20}\b(custom\s+)?objects?\b/,
-          /\bobjects?\b[^.?!]{0,40}\b(no|zero|barely\s+any|hardly\s+any)\s+(records?|rows?|data)\b/
+          /\bobjects?\b[^.?!]{0,40}\b(no|zero|barely\s+any|hardly\s+any)\s+(records?|rows?|data)\b/,
+          // Router-v2 P4: growth and per-object size asks are the same live
+          // per-object COUNT read ("which objects have grown the fastest",
+          // "inventory of every custom object and roughly how big each is").
+          /\bobjects?\b[^.?!]{0,60}\b(grown|growth|growing)\b/,
+          /\b(grown|growth|growing)\b[^.?!]{0,60}\bobjects?\b/,
+          /\bobjects?\b[^.?!]{0,60}\bhow\s+big\b/,
+          /\bhow\s+big\b[^.?!]{0,60}\bobjects?\b/
         ]
       },
       {
@@ -25371,8 +25421,10 @@ var init_intent_router = __esm({
         needsResolve: false,
         reason: "A record COUNT is live data; the offline vault holds metadata only.",
         patterns: [
-          /\bhow\s+many\b.*\b(records?|rows?|accounts?|contacts?|opportunit|leads?|cases?)\b/,
+          /\bhow\s+many\b.*\b(records?|rows?|accounts?|contacts?|opportunit(?:y|ies)?|leads?|cases?)\b/,
           /\b(count|number)\s+of\b.*\b(records?|rows?)\b/,
+          // Router-v2 P4: imperative "count <X> records" (no "of", no "how many").
+          /\bcount\b[^.?!]{0,60}\brecords?\b/,
           /\bhow\s+many\b.*\bin\s+(the\s+)?(org|production|prod)\b/,
           /\blive\s+count\b/,
           // A TEMPORAL qualifier cues live data regardless of the noun — "how
@@ -25382,7 +25434,7 @@ var init_intent_router = __esm({
           // win: the metadata-count rule sits earlier. fired/ran/logged forms
           // are excluded so automation/login activity asks don't collapse into
           // a bare record count.
-          /\bhow\s+many\b(?!.*\b(fired|ran|executed|triggered|logged)\b).*\b(right\s+now|currently|at\s+the\s+moment|as\s+of\s+(now|today)|today)\b/,
+          /\bhow\s+many\b(?!.*\b(fired|ran|executed|triggered|logged)\b).*\b(right\s+now|currently|at\s+the\s+moment|as\s+of\s+(now|today)|today|this\s+(term|semester|quarter))\b/,
           /\b(count|number)\s+of\b.*\b(right\s+now|currently|at\s+the\s+moment|today)\b/,
           // Named sObject totals without the word "records" — "how many Opportunities
           // are there" (TEST-SANDBOX-ROUTER-first-user). Exclude non-SF platforms
@@ -25415,7 +25467,53 @@ var init_intent_router = __esm({
         patterns: [
           /\b(recent(ly)?|last\s+\d+\s+days?|this\s+week|past\s+week)\b.*\b(created|modified|updated|changed|added)\b/,
           /\b(created|modified|updated|new)\b.*\b(recent(ly)?|last\s+\d+\s+days?|this\s+week)\b/,
-          /\bwhat\s+(was|were)\b.*\b(created|modified|updated|changed)\b.*\b(recent|last)\b/
+          /\bwhat\s+(was|were)\b.*\b(created|modified|updated|changed)\b.*\b(recent|last)\b/,
+          // Router-v2 P4: "who's been making the most changes lately" / "busiest
+          // user by record edits" — the same recent-modified read, cut by editor.
+          /\bwho\b[^.?!]{0,40}\b(making|made)\b[^.?!]{0,30}\bchanges\b/,
+          /\bbusiest\s+users?\b/
+        ]
+      },
+      {
+        // Live picklist VALUE USAGE — "which Case.Status values are never used",
+        // "distribution of Status values", "most common Resolution_Code__c".
+        // Distinct from picklist-values (vault, DECLARED value set): usage /
+        // distribution / most-common language means live GROUP BY counts per
+        // value (router-v2 P4 needs-live reachability). Placed in the live block
+        // so it wins over the vault picklist-values rule further down.
+        intent: "picklist-usage",
+        plane: "live",
+        tools: ["sfi.live_picklist_usage"],
+        liveRequired: true,
+        needsResolve: false,
+        reason: "How picklist/field VALUES are actually used across records (counts per value, never-used values) is live GROUP BY data \u2014 the vault only declares the value set.",
+        // NOTE the distance windows allow an interior dot (`Case.Status`) — a
+        // dotted field reference must not break the sentence-bounded window.
+        patterns: [
+          /\bpicklist\b(?:[^.?!]|\.(?=\w)){0,80}\b(never\s+used|actually\s+used|usage|distribut\w+|frequen\w+)\b/,
+          /\bvalues?\b(?:[^.?!]|\.(?=\w)){0,60}\b(never|rarely)\s+used\b/,
+          /\b(distribution|breakdown)\s+of\b(?:[^.?!]|\.(?=\w)){0,60}\bvalues?\b/,
+          /\bhow\s+are\b(?:[^.?!]|\.(?=\w)){0,40}\bvalues?\b(?:[^.?!]|\.(?=\w)){0,40}\bdistributed\b/,
+          /\b(most|least)\s+common\b(?:[^.?!]|\.(?=\w)){0,50}\b(value|status|code|__c)\b/,
+          /\b(?:whats?|what\s+is)\s+the\s+most\s+common\b/
+        ]
+      },
+      {
+        // Live automation execution — "did the flow FIRE yesterday?" is a runtime
+        // question about actual executions (FlowInterview / job traces), not the
+        // automation catalog (router-v2 P4). Temporal anchor required so the
+        // metadata asks ("what fires on save") never land here.
+        intent: "automation-fired",
+        plane: "live",
+        tools: ["sfi.live_automation_fired"],
+        liveRequired: true,
+        needsResolve: false,
+        reason: "Whether an automation actually RAN (and when) is runtime execution state \u2014 live_automation_fired reads it; the vault only holds the automation definitions.",
+        patterns: [
+          /\b(flow|trigger|automation|process|it)\b[^.?!]{0,60}\bfired\b[^.?!]{0,50}\b(yesterday|today|last\s+\w+|this\s+\w+|recently)\b/,
+          /\bfired\b[^.?!]{0,30}\b(yesterday|today|last\s+night|recently)\b/,
+          /\bdid\b[^.?!]{0,60}\b(flow|trigger|automation)\b[^.?!]{0,50}\b(fire|run|execute|actually\s+fire)\b/,
+          /\b(flow|trigger|automation)\b[^.?!]{0,40}\b(actually\s+(ran|fired|executed))\b/
         ]
       },
       {
@@ -25429,7 +25527,11 @@ var init_intent_router = __esm({
           /\b(org|org'?s?)\b.*\b(on\s+fire|unhealthy|health|healthy)\b/,
           /\b(failed|faulted|stuck)\b.*\b(jobs?|batch|async|apex\s+job)\b/,
           /\bpaused\b.*\bflows?\b/i,
-          /\bis\s+my\s+org\b.*\b(ok|fine|broken|failing)\b/
+          /\bis\s+my\s+org\b.*\b(ok|fine|broken|failing)\b/,
+          // Router-v2 P4: "give me a health snapshot of the org" — the noun order
+          // put "health" before "org", which the first pattern missed, and the
+          // word "snapshot" was stolen by the vault snapshot-diff rule.
+          /\bhealth\s+snapshot\b/
         ]
       },
       {
@@ -25525,7 +25627,13 @@ var init_intent_router = __esm({
           /\b(useless|unused|stale|dead)\b.*\breports?\b/,
           /\b(dashboards?)\b.*\b(unused|stale|broken|refresh)\b/,
           /\breports?\b.*\b(not\s+run|haven'?t\s+been\s+run)\b/,
-          /\breports?\b.*\b(last\s+year|in\s+the\s+last)\b/
+          /\breports?\b.*\b(last\s+year|in\s+the\s+last)\b/,
+          // "which reports are ACTUALLY USED" — run-history is live LastRunDate
+          // (router-v2 P4; previously a funnel plane near-tie that BLOCKED).
+          /\breports?\b[^.?!]{0,40}\bactually\s+used\b/,
+          // Router-v2 P4: "reports/dashboards nobody looks at / no one uses" —
+          // the colloquial unused-ask without the word "unused".
+          /\b(reports?|dashboards?)\b[^.?!]{0,60}\b(nobody|no\s+one)\b[^.?!]{0,40}\b(looks?|uses?|runs?|view\w*|open\w*)\b/
         ]
       },
       {
@@ -25544,7 +25652,7 @@ var init_intent_router = __esm({
           /\b(who\s+can|access\s+to)\b.*\bfolders?\b/,
           // Folder-gated artifacts asked about by ACCESS without the word "folder":
           // "who can see/access/view this report/dashboard/document".
-          /\bwho\s+can\s+(access|see|view|open)\b.*\b(reports?|dashboards?|documents?)\b/,
+          /\bwho\s+can\s+(access|see|view|open|run)\b.*\b(reports?|dashboards?|documents?)\b/,
           /\b(access|visib(le|ility))\b.*\b(reports?|dashboards?|documents?)\s+folders?\b/,
           /\b(dashboards?|reports?)\b.*\bshared\b.*\b(with|to)\b/
         ]
@@ -26116,6 +26224,8 @@ var init_intent_router = __esm({
           // Admin-level / least-privilege / security-gap phrasings (baseline-300).
           /\b(which|what)\s+users?\b.*\badmin\b/,
           /\busers?\b.*\badmin[-\s]level\b/,
+          // "do we have too many admins" (router-v2 P4).
+          /\btoo\s+many\s+admins?\b/,
           /\bleast\s+privilege\b/,
           /\bsecurity\s+gaps?\b.*\b(profile|permission)/,
           /\bpermission\s+sets?\b.*\binstead\s+of\b.*\bprofiles?\b/
@@ -26849,6 +26959,9 @@ var init_intent_router = __esm({
         patterns: [
           /\b(which|what)\s+flows?\b.*\b(references?|uses?|mentions?|touch(es)?|calls?)\b/,
           /\bflows?\b.*\b(that|which)\b.*\b(references?|uses?)\b/,
+          // Router-v2 P4: "pull the flow that FIRES/SENDS/CREATES the '<step
+          // name>' step" — find-a-flow-by-what-it-does is a Flow-XML grep.
+          /\bflows?\s+that\s+(fires?|sends?|creates?|assigns?|updates?|contains?|does)\b/,
           /\b(sync|stamping|affiliate|marketo|applicant|partner|budget)\b.*\bflows?\b/,
           /\bflows?\b.*\b(sync|stamping|affiliate|marketo|applicant|partner|budget)\b/,
           /\bflows?\b.*\b(send|sends|email)\b/,
@@ -26970,7 +27083,9 @@ var init_intent_router = __esm({
           // runs bulk") or test coverage ("which test class covers Y … the bulk
           // case"), those earlier rules win by order — this guard keeps the bare
           // word from firing even when their patterns miss a phrasing.
-          /^(?!.*\b(?:what\s+(?:fires|runs|happens)|test\s+class)\b).*\b(bulk|bulkif|unbounded)\b/,
+          // …and "WHICH CLASS HANDLES the Boomi integration for BULK loads" is a
+          // find-the-class source grep (apex-search), not a limit report (P4).
+          /^(?!.*\b(?:what\s+(?:fires|runs|happens)|test\s+class|(?:which|what)\s+(?:apex\s+)?class(?:es)?\s+(?:handles?|processes?|implements?))\b).*\b(bulk|bulkif|unbounded)\b/,
           /\bcpu\s+time\b/,
           /\bheap\s+size\b/,
           /\bmost\s+dml\b/,
@@ -27301,10 +27416,26 @@ var init_intent_router = __esm({
         liveRequired: false,
         needsResolve: false,
         reason: "Text grep over Apex source + usage edges.",
+        // A dotted CODE LITERAL in the question ("System.debug") is the grep text —
+        // bind it so the routed search_apex_source call is executable as-is.
+        suggestArgs: (q2) => {
+          const literal = q2.match(/\b[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*\b/)?.[0];
+          return literal !== void 0 ? { query: literal } : void 0;
+        },
         patterns: [
           /\bfind\b.*\b(class|apex|code)\b.*\b(mentions?|references?|uses?|calls?|reads?|writes?|with)\b/,
           /\b(which|what)\s+(classes?|apex)\b.*\b(mentions?|references?|uses?|touch(es)?|reads?|writes?|calls?|invokes?)\b/,
           /\bsearch\b.*\b(apex|code)\b/,
+          // Router-v2 P4 (q522 family): a CODE-LITERAL search — "does anything
+          // call System.debug", "leftover System.debug statements" — is a source
+          // grep, never the runtime-audit-trail fallback ("debug logs" in the
+          // prose must not swallow it; this rule sits earlier, so the literal
+          // wins).
+          /\bsystem\.debug\b/,
+          /\b(?:calls?|calling|invokes?|references?)\b[^.?!]{0,40}\b[a-z_][a-z0-9_]*\.[a-z_][a-z0-9_]*\s*\(/,
+          // "which apex class HANDLES the Boomi integration" — find-the-class-by-
+          // what-it-does is a source/usage grep, not a code-quality report.
+          /\b(?:which|what)\s+(?:apex\s+)?class(?:es)?\b[^.?!]{0,60}\b(?:handles?|processes?|implements?|integrates?|owns?)\b/,
           // "which classes make HTTP callouts and what endpoints do they hit" —
           // HTTP callouts live in Apex SOURCE, so the answer is a source grep,
           // not the outbound endpoint catalog and never field lineage (eval
@@ -28035,7 +28166,7 @@ var init_intent_router = __esm({
         patterns: [
           /\bfield\s*360\b/,
           /\b360\b[^.?!]{0,20}\b(on|of|for)\b[^.?!]{0,20}(?:[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*|[a-z][a-z0-9_]*__c)\b/,
-          new RegExp(`\\b(fulls+(?:picture|profile)|everythings+thats+(?:touches|uses))\\b[^.?!]{0,30}\\b${NAMED_FIELD_ID}\\b`)
+          new RegExp(`\\b(full\\s+(?:picture|profile)|everything\\s+that\\s+(?:touches|uses))\\b[^.?!]{0,30}\\b${NAMED_FIELD_ID}\\b`)
         ]
       },
       {
@@ -28604,6 +28735,12 @@ var init_intent_router = __esm({
       };
       return labels[intent] ?? `the ${intent.replaceAll("-", " ")} analysis`;
     };
+    COMPLEMENTARY_ALTERNATIVE_PAIRS = /* @__PURE__ */ new Set([
+      "impact-analysis|safe-to-delete",
+      "impact-analysis|what-if-field",
+      "who-can-access-object|object-access"
+    ]);
+    NAMES_COMPONENT_FOR_LAST_MODIFIED = /[a-z0-9]_[a-z0-9]|__(?:c|mdt|e|x|b|kav)\b|\w+\.\w+|\b(?:flow|flows|class|classes|trigger|triggers|validation\s+rule|permission\s+set|profile|layout|object|field|component|page|dashboard|report)\b/;
     classifyQuestion = (question) => {
       const q2 = routeText(question);
       if (q2.length === 0) {
@@ -28626,12 +28763,32 @@ var init_intent_router = __esm({
       const matches = RULES.filter((rule) => rule.patterns.some((p2) => p2.test(q2)));
       const first = matches[0];
       if (first !== void 0) {
-        const primary = routeFromRule(question, q2, first);
-        const alternatives = [...semanticAlternatives(q2, primary.intent)].filter((alternative, i2, all) => alternative.intent !== primary.intent && all.findIndex((candidate) => candidate.intent === alternative.intent) === i2).slice(0, 3);
-        const clarification = alternatives.length > 0 ? {
+        let primary = routeFromRule(question, q2, first);
+        let alternatives = [...semanticAlternatives(q2, primary.intent)].filter((alternative, i2, all) => alternative.intent !== primary.intent && all.findIndex((candidate) => candidate.intent === alternative.intent) === i2).slice(0, 3);
+        if (primary.intent === "runtime-audit-trail" && alternatives.some((alternative) => alternative.intent === "last-modified") && NAMES_COMPONENT_FOR_LAST_MODIFIED.test(q2)) {
+          const lastModifiedRule = RULES.find((rule) => rule.intent === "last-modified");
+          if (lastModifiedRule !== void 0) {
+            primary = routeFromRule(question, q2, lastModifiedRule);
+            alternatives = [];
+          }
+        }
+        const complementary = alternatives.filter((alternative) => COMPLEMENTARY_ALTERNATIVE_PAIRS.has(`${primary.intent}|${alternative.intent}`));
+        const blocking = alternatives.filter((alternative) => !complementary.includes(alternative));
+        const stackedTools = complementary.length > 0 ? [
+          ...primary.tools,
+          ...complementary.flatMap((alternative) => alternative.tools).filter((tool) => !primary.tools.includes(tool))
+        ] : primary.tools;
+        if (complementary.length > 0) {
+          primary = {
+            ...primary,
+            tools: stackedTools,
+            reason: `${primary.reason} The question also admits a complementary reading (${complementary.map((a2) => intentLabel(a2.intent)).join("; ")}) \u2014 its tools are stacked after the primary so either or both can run; no clarification needed.`
+          };
+        }
+        const clarification = blocking.length > 0 ? {
           required: true,
-          question: `Which result do you want first: ${intentLabel(primary.intent)}, or ${alternatives.map((a2) => intentLabel(a2.intent)).join(", ")}?`,
-          options: [primary.intent, ...alternatives.map((a2) => a2.intent)],
+          question: `Which result do you want first: ${intentLabel(primary.intent)}, or ${blocking.map((a2) => intentLabel(a2.intent)).join(", ")}?`,
+          options: [primary.intent, ...blocking.map((a2) => a2.intent)],
           fallback: {
             intent: primary.intent,
             warning: `Clarification was unavailable. Provisional route: ${primary.intent}. Show the user the alternatives before executing it.`
@@ -28639,7 +28796,7 @@ var init_intent_router = __esm({
         } : null;
         return {
           ...primary,
-          confidence: alternatives.length === 0 ? "high" : "low",
+          confidence: blocking.length > 0 ? "low" : complementary.length > 0 ? "medium" : "high",
           alternatives,
           clarification,
           plan: [{
@@ -54928,6 +55085,7 @@ var init_resolve2 = __esm({
                 parentApiName: a2.parentApiName,
                 score: a2.score,
                 base: a2.base,
+                nameCoverage: 1,
                 matchKind: "exact",
                 evidence: a2.evidence
               })),
@@ -55102,11 +55260,1785 @@ var init_retrieve_blindspot_report = __esm({
   }
 });
 
+// ../mcp/dist/src/context-resolution.js
+var PRONOUN_ANCHORS, REPARAM_ANCHORS, detectPronounAnchor, detectReparamAnchor, ANAPHOR_ONLY, isAnaphorOnly, ORDINAL_INDEX, SELECTION_SHAPE, NON_DESCRIPTOR_TOKENS, detectClarificationSelection, COMPONENT_ID_SHAPE, validatePreviousContext, CONTINUATION_TOOL_TYPES, continuationToolCompatible, REPARAM_FILLER, extractReparamTarget;
+var init_context_resolution = __esm({
+  "../mcp/dist/src/context-resolution.js"() {
+    "use strict";
+    PRONOUN_ANCHORS = [
+      /\bthat\s+one\b/i,
+      /\bthis\s+one\b/i,
+      /\bthe\s+same\b/i,
+      /\bthe\s+other(?:\s+one)?\b/i,
+      /\beach\s+of\s+them\b/i,
+      /\bany\s+of\s+them\b/i,
+      /\beither(?:\s+one)?\b/i,
+      /\bboth\b/i,
+      /\bit\b/i,
+      /\bits\b/i,
+      /\bthey\b/i,
+      /\bthem\b/i,
+      /\bthose\b/i,
+      /\bthese\b/i
+    ];
+    REPARAM_ANCHORS = [
+      /\bwhat\s+about\b/i,
+      /\bhow\s+about\b/i,
+      /\band\s+(?:on|for|the)\b/i,
+      /\bsame\s+(?:for|on|thing|question)\b/i,
+      /\bwhat\s+does\s+.*\s+look\s+like\s+on\b/i,
+      /\bthe\s+(?:first|second|third|last)\s+one\b/i,
+      /\bthe\s+[A-Za-z0-9_]+\s+one\b/i
+    ];
+    detectPronounAnchor = (question) => {
+      for (const anchor of PRONOUN_ANCHORS) {
+        const match = question.match(anchor);
+        if (match !== null)
+          return match[0];
+      }
+      return null;
+    };
+    detectReparamAnchor = (question) => {
+      for (const anchor of REPARAM_ANCHORS) {
+        const match = question.match(anchor);
+        if (match !== null)
+          return match[0];
+      }
+      return null;
+    };
+    ANAPHOR_ONLY = /* @__PURE__ */ new Set([
+      "it",
+      "its",
+      "they",
+      "them",
+      "those",
+      "these",
+      "both",
+      "either",
+      "that one",
+      "this one",
+      "the same",
+      "the other",
+      "the other one",
+      "same",
+      "other",
+      "either one"
+    ]);
+    isAnaphorOnly = (phrase) => ANAPHOR_ONLY.has(phrase.trim().toLowerCase());
+    ORDINAL_INDEX = {
+      first: 0,
+      second: 1,
+      third: 2
+    };
+    SELECTION_SHAPE = /^\s*(?:(?:show\s+me|pick|use|go\s+with|i\s+meant|let'?s\s+go\s+with|the\s+answer\s+is)\s+)?the\s+([A-Za-z0-9_]+)\s+one\s*[?.!]*\s*$/i;
+    NON_DESCRIPTOR_TOKENS = /* @__PURE__ */ new Set(["other", "same", "right", "wrong"]);
+    detectClarificationSelection = (question, options) => {
+      const match = question.match(SELECTION_SHAPE);
+      if (match === null)
+        return null;
+      const token = match[1].toLowerCase();
+      if (NON_DESCRIPTOR_TOKENS.has(token))
+        return null;
+      const anaphor = `the ${match[1]} one`;
+      if (token === "last") {
+        const selection = options.at(-1);
+        return selection === void 0 ? { kind: "re-ask", anaphor } : { kind: "selected", anaphor, selection };
+      }
+      const ordinal = ORDINAL_INDEX[token];
+      if (ordinal !== void 0) {
+        const selection = options[ordinal];
+        return selection === void 0 ? { kind: "re-ask", anaphor } : { kind: "selected", anaphor, selection };
+      }
+      const containing = options.filter((option) => option.toLowerCase().includes(token));
+      return containing.length === 1 ? { kind: "selected", anaphor, selection: containing[0] } : { kind: "re-ask", anaphor };
+    };
+    COMPONENT_ID_SHAPE = /^[A-Za-z]+:.+$/;
+    validatePreviousContext = (previous, isRegisteredTool) => {
+      const ignored = [];
+      let cleaned = previous;
+      if (previous.tool !== void 0 && !isRegisteredTool(previous.tool)) {
+        ignored.push(`previous.tool '${previous.tool}' is not a registered tool; ignored`);
+        cleaned = { ...cleaned, tool: void 0 };
+      }
+      if (previous.componentId !== void 0 && !COMPONENT_ID_SHAPE.test(previous.componentId)) {
+        ignored.push(`previous.componentId '${previous.componentId}' is not a canonical Type:Name id; ignored`);
+        cleaned = { ...cleaned, componentId: void 0 };
+      }
+      return { previous: cleaned, ignored };
+    };
+    CONTINUATION_TOOL_TYPES = /* @__PURE__ */ new Map([
+      ["sfi.call_graph", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.method_reachability", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.explain_apex_method", /* @__PURE__ */ new Set(["ApexClass", "ApexTrigger"])],
+      ["sfi.who_can_access_object", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.object_access_audit", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.field_access_audit", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.explain_flow", /* @__PURE__ */ new Set(["Flow"])],
+      ["sfi.who_can_run", /* @__PURE__ */ new Set(["Flow"])],
+      ["sfi.what_if_deactivate_flow", /* @__PURE__ */ new Set(["Flow"])],
+      ["sfi.explain_field", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.field_360", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.field_lineage", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.safe_to_delete_field", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.explain_formula", /* @__PURE__ */ new Set(["CustomField"])],
+      ["sfi.what_happens_on_save", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.order_of_execution", /* @__PURE__ */ new Set(["CustomObject"])],
+      ["sfi.what_if_disable_trigger", /* @__PURE__ */ new Set(["ApexTrigger"])]
+    ]);
+    continuationToolCompatible = (tool, resolvedType) => {
+      if (resolvedType === null)
+        return true;
+      const compatible = CONTINUATION_TOOL_TYPES.get(tool);
+      return compatible === void 0 || compatible.has(resolvedType);
+    };
+    REPARAM_FILLER = /* @__PURE__ */ new Set([
+      "what",
+      "whats",
+      "how",
+      "about",
+      "and",
+      "same",
+      "for",
+      "on",
+      "the",
+      "a",
+      "an",
+      "of",
+      "in",
+      "to",
+      "does",
+      "do",
+      "is",
+      "are",
+      "look",
+      "like",
+      "way",
+      "thing",
+      "question",
+      "too",
+      "also",
+      "instead",
+      "then",
+      "now",
+      "with",
+      "combined",
+      "anything",
+      "everything",
+      "else",
+      "one"
+    ]);
+    extractReparamTarget = (question) => {
+      const tokens = question.replace(/[?!.,;:]+/g, " ").split(/\s+/).filter((token) => token.length > 0).filter((token) => !REPARAM_FILLER.has(token.toLowerCase()));
+      if (tokens.length === 0 || tokens.length > 4)
+        return null;
+      return tokens.join(" ");
+    };
+  }
+});
+
+// ../mcp/dist/src/refusal-gates.js
+var INJECTION_PATTERNS, EXFIL_VERB, EXFIL_QUANTIFIER, EXFIL_SENSITIVE, EXFIL_VALUES, EXFIL_SINGLE_VALUE, INJECTION_DISCLOSURE, WRITE_VERB, WRITE_VERB_FILLER, WRITE_EXCLUDER, WRITE_SENTENCE_INITIAL, WRITE_LEAD_IN, WRITE_TRAILING_FRAME, WRITE_MAKE_SCHEMA, WRITE_GIVE_GRANT, WRITE_GIVE_INITIAL, WRITE_CHAINED_DUPE_DELETE, readOnlyAlternativeFor, RUNTIME_TRIGGERS, RUNTIME_WINDOW, RUNTIME_INCIDENT, runtimeDisclosure, EXTERNAL_SYSTEM, POLICY_ASK, RETENTION_POLICY_ASK, CONSENT_PROCESS_ASK, OPINION_ASK, SHOULD_WE, METADATA_NOUN, DELIVERY_ASK, WRITE_CODE_ASK, outOfScopeDisclosure, detectRefusalShape;
+var init_refusal_gates = __esm({
+  "../mcp/dist/src/refusal-gates.js"() {
+    "use strict";
+    INJECTION_PATTERNS = [
+      /\bignore\s+(?:your|all|the)\s+(?:previous|prior|read-?only)\s+(?:instructions?|rules?|restrictions?)\b/i,
+      /\bpretend\s+the\s+(?:previous|prior)\s+rules\b/i,
+      /\byou\s+are\s+now\s+(?:in\s+)?(?:admin|deploy|god)\s*[- ]?mode\b/i,
+      /\byou'?re\s+actually\s+an?\b[^.?!]*\bbot\b/i,
+      /\b(?:print|reveal|show)\s+(?:me\s+)?your\s+(?:system\s+)?prompt\b/i
+    ];
+    EXFIL_VERB = /\b(?:dump|export|give\s+me|tell\s+me|list|retrieve)\b/i;
+    EXFIL_QUANTIFIER = /\b(?:every|all|actual|the\s+real|random)\b/i;
+    EXFIL_SENSITIVE = /\b(?:ssn|social\s+security|pii|ferpa|hipaa)\b/i;
+    EXFIL_VALUES = /\bvalues?\b|\bstored\b/i;
+    EXFIL_SINGLE_VALUE = /\b(?:what(?:'s|s|\s+is)|show\s+me|give\s+me|pull)\s+the\s+(?:ssn|social\s+security(?:\s+number)?)\b(?!\s+fields?\b)[^.?!]{0,60}\b(?:lead|contact|record|student|person|user|account|applicant)s?\b/i;
+    INJECTION_DISCLOSURE = "REFUSED: this request asks me to override instructions or exfiltrate record values. sf-intelligence reads metadata only; it never returns stored record values and its instructions are not overridable.";
+    WRITE_VERB = "(?:create|add|delete|remove|update|change|(?<!permission\\s)set|deploy|assign|reassign|revoke|deactivate|activate|disable|enable|merge|reset|rename|fix|grant|provision|turn\\s+(?:on|off)|clean\\s+up|migrate|convert|insert|upsert|push|publish|install|uninstall|schedule|upgrade|downgrade|throttle|purge)";
+    WRITE_VERB_FILLER = "(?:(?:bulk|mass|batch|just|please|go\\s+ahead\\s+and)\\s+)*";
+    WRITE_EXCLUDER = /\b(?:am\s+i|can\s+i|could\s+i|do\s+i|who\s+can|who\s+is\s+able|allowed\s+to|able\s+to|what\s+if|what\s+would|would\s+happen|is\s+it\s+safe|safe\s+to|before\s+i|if\s+i|should\s+i|how\s+do\s+i|how\s+would\s+i|what\s+happens\s+when)\b/i;
+    WRITE_SENTENCE_INITIAL = new RegExp(`(?:^|[.!?;]\\s+)(?:please\\s+|just\\s+)?${WRITE_VERB_FILLER}(${WRITE_VERB}\\b[^.?!;]{0,80})`, "i");
+    WRITE_LEAD_IN = new RegExp(`\\b(?:please|just|go\\s+ahead\\s+and|can\\s+(?:you|u)|could\\s+(?:you|u)|would\\s+(?:you|u)|you\\s+should|i\\s+need\\s+you\\s+to)\\s+(?:please\\s+|just\\s+)?${WRITE_VERB_FILLER}(${WRITE_VERB}\\b[^.?!;]{0,80})`, "i");
+    WRITE_TRAILING_FRAME = new RegExp(`\\b(${WRITE_VERB}\\b[^.?!;]{0,80}?\\b(?:for\\s+me|right\\s+now|and\\s+confirm)\\b[^.?!;]{0,20})`, "i");
+    WRITE_MAKE_SCHEMA = new RegExp(`\\b(?:can|could|would)\\s+(?:you|u)\\b[^.?!;]{0,10}\\s(make\\b[^.?!;]{0,60}\\b(?:required|mandatory|optional|unique|read[-\\s]?only|editable|visible)\\b)`, "i");
+    WRITE_GIVE_GRANT = new RegExp(`\\b(?:can|could|would)\\s+(?:you|u)\\b[^.?!;]{0,30}\\b(give\\s+(?!me\\b)[^.?!;]{0,60}\\b(?:profile|permission|perm\\s+set|access|user)\\b[^.?!;]{0,40})`, "i");
+    WRITE_GIVE_INITIAL = /(?:^|[.!?;]\s+)(give\s+(?!me\b)[^.?!;]{0,60}\b(?:admin|access|permission|profile)\b[^.?!;]{0,30})/i;
+    WRITE_CHAINED_DUPE_DELETE = /\b(?:and|then)\s+(?:just\s+)?((?:delete|remove|purge|merge)\s+(?:the\s+)?dup(?:e|licate)s?\b[^.?!;]{0,30})/i;
+    readOnlyAlternativeFor = (verbPhrase, question) => {
+      const v2 = verbPhrase.toLowerCase();
+      const q2 = question.toLowerCase();
+      if (/^(?:delete|remove)\b/.test(v2) && /\bfield\b|__c\b/.test(q2)) {
+        return "sfi.safe_to_delete_field";
+      }
+      if (/^(?:deactivate|disable|turn)\b/.test(v2) && /\bflow\b/.test(q2)) {
+        return "sfi.what_if_deactivate_flow";
+      }
+      if (/^disable\b/.test(v2) && /\btrigger\b/.test(q2)) {
+        return "sfi.what_if_disable_trigger";
+      }
+      if (/^(?:change|convert)\b/.test(v2) && /\bfield\b/.test(q2)) {
+        return "sfi.what_if_change_field_type";
+      }
+      if (/^merge\b/.test(v2) && /\bprofile/.test(q2)) {
+        return "sfi.what_if_merge_profiles";
+      }
+      if (/^make\b/.test(v2) && /\brequired|mandatory\b/.test(v2)) {
+        return "sfi.what_if_make_field_required";
+      }
+      if (/^give\b/.test(v2) || /^grant\b/.test(v2) && /\b(?:profile|permission)\b/.test(q2)) {
+        return "sfi.permission_risk_report";
+      }
+      if (/^(?:upgrade|downgrade|install|uninstall)\b/.test(v2) && /\bpackage\b/.test(q2)) {
+        return "sfi.package_impact";
+      }
+      if (/^throttle\b/.test(v2) || /\basync\b/.test(q2)) {
+        return "sfi.async_chain_depth";
+      }
+      if (/dup(?:e|licate)s?\b/.test(v2)) {
+        return "sfi.live_duplicate_check";
+      }
+      return "sfi.get_impact";
+    };
+    RUNTIME_TRIGGERS = [
+      [/\blogin\s+history\b|\baudit\s+trail\s+of\s+logins?\b/i, "login history"],
+      [/\badoption\b|\bhow\s+often\s+do\s+users\s+actually\s+use\b/i, "adoption/usage telemetry"],
+      [
+        /\bping\s+(?:the\s+)?\S+|\bendpoints?\b[^.?!]*\bup\b|\b(?:returned|returning|throwing|threw)\s+errors?\b/i,
+        "endpoint health"
+      ],
+      [/\brunning[-\s]user\s+context\b/i, "the runtime running-user context"]
+    ];
+    RUNTIME_WINDOW = /\b(?:this\s+week|yesterday|last\s+night|in\s+the\s+\w+\s+incident)\b/i;
+    RUNTIME_INCIDENT = /\b(?:errors?|failed|failures?|incident|outage|gated)\b/i;
+    runtimeDisclosure = (topic) => `HONEST GAP: ${topic} is runtime telemetry sf-intelligence does not model \u2014 the vault holds metadata; the live plane covers counts/samples/limits, not event logs.`;
+    EXTERNAL_SYSTEM = /\b(sharepoint|jira|confluence|google\s+drive|onedrive|slack\s+workspace|s3\s+bucket)\b/i;
+    POLICY_ASK = /\bwhat(?:'s|s|\s+is)\s+our\b(?![^.?!]{0,60}\b(?:password|session|sharing|lockout|ip|login)\b)[^.?!]{0,60}\bpolic(?:y|ies)\b/i;
+    RETENTION_POLICY_ASK = /\bretention\s+(?:polic(?:y|ies)|schedule|rules?)\b/i;
+    CONSENT_PROCESS_ASK = /\bhow\s+do(?:es)?\s+(?:students?|users?|customers?|people|contacts?)\s+consent\b/i;
+    OPINION_ASK = /\bwhat\s+do\s+you\s+think\b/i;
+    SHOULD_WE = /\bshould\s+we\b/i;
+    METADATA_NOUN = /\b(?:field|object|flow|trigger|class|profile|permission|layout|validation|record\s+type|apex|report|dashboard|picklist|component|rule)\b|__(?:c|mdt|e|x|b|kav)\b/i;
+    DELIVERY_ASK = /\bemail\s+me\b|\bsend\s+(?:this|it)\s+to\b|\bpost\s+(?:this\s+|it\s+)?to\s+slack\b/i;
+    WRITE_CODE_ASK = /\bwrite\s+(?:me\s+)?(?:an?\s+)?(?:apex|lwc|trigger|class|component)\b[^.?!]*\b(?:that|to)\b/i;
+    outOfScopeDisclosure = (topic) => `OUT OF SCOPE: sf-intelligence answers questions about this org's Salesforce metadata. ${topic} is outside that boundary (no external systems, no policy authorship, no code generation, no message delivery).`;
+    detectRefusalShape = (question) => {
+      const q2 = question.replace(/[‘’ʼ]/g, "'").replace(/\s+/g, " ").trim();
+      if (q2.length === 0)
+        return null;
+      const injected = INJECTION_PATTERNS.some((p2) => p2.test(q2)) || EXFIL_VERB.test(q2) && EXFIL_QUANTIFIER.test(q2) && EXFIL_SENSITIVE.test(q2) && EXFIL_VALUES.test(q2) || EXFIL_SINGLE_VALUE.test(q2);
+      if (injected) {
+        return { kind: "injection-exfiltration", disclosure: INJECTION_DISCLOSURE };
+      }
+      if (!WRITE_EXCLUDER.test(q2)) {
+        const verbPhrase = (WRITE_SENTENCE_INITIAL.exec(q2) ?? WRITE_LEAD_IN.exec(q2) ?? WRITE_TRAILING_FRAME.exec(q2) ?? WRITE_MAKE_SCHEMA.exec(q2) ?? WRITE_GIVE_GRANT.exec(q2) ?? WRITE_GIVE_INITIAL.exec(q2) ?? WRITE_CHAINED_DUPE_DELETE.exec(q2))?.[1]?.trim().replace(/[,;:]$/, "");
+        if (verbPhrase !== void 0 && verbPhrase.length > 0) {
+          const alternative = readOnlyAlternativeFor(verbPhrase, q2);
+          return {
+            kind: "write-imperative",
+            disclosure: `REFUSED (read-only boundary): sf-intelligence never mutates the org \u2014 it cannot ${verbPhrase}. I can show you the read-side analysis instead: ${alternative}.`,
+            readOnlyAlternative: alternative
+          };
+        }
+      }
+      const runtimeTopic = RUNTIME_TRIGGERS.find(([pattern]) => pattern.test(q2))?.[1] ?? (RUNTIME_WINDOW.test(q2) && RUNTIME_INCIDENT.test(q2) ? "runtime incident forensics" : void 0);
+      if (runtimeTopic !== void 0) {
+        return { kind: "runtime-analytics", disclosure: runtimeDisclosure(runtimeTopic) };
+      }
+      const externalSystem = EXTERNAL_SYSTEM.exec(q2)?.[1];
+      const outOfScopeTopic = externalSystem !== void 0 ? `"${externalSystem}"` : RETENTION_POLICY_ASK.test(q2) ? "A data-retention policy (organizational governance, not org metadata)" : CONSENT_PROCESS_ASK.test(q2) ? "A consent process (organizational governance, not org metadata)" : POLICY_ASK.test(q2) ? "Org policy authorship" : OPINION_ASK.test(q2) ? "An opinion" : DELIVERY_ASK.test(q2) ? "Message delivery" : WRITE_CODE_ASK.test(q2) ? "Code generation" : SHOULD_WE.test(q2) && !METADATA_NOUN.test(q2) ? "An org-decision recommendation" : void 0;
+      if (outOfScopeTopic !== void 0) {
+        return { kind: "out-of-scope", disclosure: outOfScopeDisclosure(outOfScopeTopic) };
+      }
+      return null;
+    };
+  }
+});
+
+// ../mcp/dist/src/funnel-utterances.js
+var FUNNEL_UTTERANCES;
+var init_funnel_utterances = __esm({
+  "../mcp/dist/src/funnel-utterances.js"() {
+    "use strict";
+    FUNNEL_UTTERANCES = {
+      "sfi.search_components": [
+        "is there a validation rule that stops me from saving a Contact without a Status__c?",
+        "find me a validation rule touching Priority__c",
+        "does a rule exist blocking Case creation if Subject is blank?",
+        "is there a rule that fires when Opportunity.Stage = Closed Lost",
+        "search for anything referencing <PermissionName>",
+        "find a validation rule whose formula checks $Permission.<X>",
+        "what custom permission does <PermSet> do \u2014 sounds like it skips a validation",
+        "I heard we have a flow that assigns Cases to the Support queue \u2014 which one and what's the criteria?",
+        "is there a workflow rule that emails someone when a Lead is converted?",
+        "find anything that references the External_Id__c field on Account",
+        "do we have a duplicate rule on Contact?",
+        "search for all components that touch the Amount__c field",
+        "what validation rules exist on the Order object?",
+        "show me every component that references the <PermSet> permission set",
+        "is there an approval process on Opportunity?",
+        "find me anything that blocks record creation when a required field is empty"
+      ],
+      "sfi.resolve": [
+        "pull the <vague-field-name> field \u2014 <PermSet> implies we have one",
+        "i keep seeing <prefix>__ everywhere \u2014 whats that prefix",
+        "do we have a field for tracking renewal dates?",
+        "find me the field that stores the customer tier",
+        "I think there's a flow called something like case assignment \u2014 look it up",
+        "look up the thing that sounds like external identifier on Account",
+        "we have something called Priority \u2014 is that a field or a picklist value?",
+        "find the object that handles billing addresses",
+        "is there a permission set that sounds like it grants read-only access to financials?",
+        "I keep hearing about a <fuzzy-name> flow \u2014 can you find it?",
+        "what's the canonical name for the field that stores the SLA deadline?",
+        "look up Status__c \u2014 which object is it on?",
+        "do we have anything for tracking escalation dates on Case?"
+      ],
+      "sfi.capabilities": [
+        "what can you actually do?",
+        "what tools do you have available?",
+        "give me a rundown of everything I can ask you about",
+        "what kinds of questions can you answer about this org?",
+        "what's your capability list?",
+        "I'm new here \u2014 what does this thing do?",
+        "show me the full menu of what you support"
+      ],
+      "sfi.list_analyses": [
+        "what analyses have been run on this org?",
+        "show me all saved analyses",
+        "which analysis reports are available?",
+        "list the pre-built analyses I can run",
+        "what analysis types does this support?",
+        "what named analyses can I run against this org?"
+      ],
+      "sfi.describe_analysis": [
+        "what does the tech debt analysis actually check?",
+        "explain what the permission risk analysis looks at",
+        "describe what the coverage report covers",
+        "what does the org risk report measure exactly?",
+        "what inputs does the automation risk analysis need?",
+        "how does the code quality audit work under the hood?"
+      ],
+      "sfi.run_analysis": [
+        "run the tech debt analysis now",
+        "kick off the permission risk report",
+        "execute the automation risk analysis",
+        "can you run the coverage report for me?",
+        "start the org risk report analysis",
+        "go ahead and run the coverage report analysis"
+      ],
+      "sfi.synthesize_answer": [
+        "can you pull together everything you know about how Case assignment works?",
+        "synthesize an answer about our sharing model for Opportunity",
+        "give me a consolidated view of everything touching the Lead conversion process",
+        "piece together what you know about our CPQ setup",
+        "summarize all the relevant metadata about our Account hierarchy",
+        "combine everything you found and give me a clean answer"
+      ],
+      "sfi.route_question": [
+        "I'm not sure which tool to use \u2014 who can edit the Amount__c field?",
+        "figure out the best way to answer: why did this record change?",
+        "where do I even start to understand why a flow failed?",
+        "I have a broad question about our data model \u2014 route me to the right thing",
+        "what's the best tool to find out if a field is used anywhere?",
+        "I'm not sure which tool answers 'what runs on Contact save' \u2014 which one?"
+      ],
+      "sfi.org_pulse": [
+        "give me a quick health snapshot of the org",
+        "what's the current state of this Salesforce instance?",
+        "pulse check \u2014 is this org healthy?",
+        "quick status: how is the org doing right now?",
+        "is there anything alarming about this org at a glance?",
+        "one-liner on org health"
+      ],
+      "sfi.org_card": [
+        "show me the org's basic info \u2014 edition, limits, creation date",
+        "what edition is this org?",
+        "give me the org ID and basic metadata",
+        "what sandbox type is this?",
+        "who's the org admin and what's the org name?",
+        "pull the orientation snapshot for this org"
+      ],
+      "sfi.fleet_find": [
+        "find all orgs in the fleet that have the <Package> package installed",
+        "which orgs in our fleet have Flows on the Case object?",
+        "search across all our orgs for a specific component",
+        "show me which orgs have this permission set configured",
+        "which fleet orgs still have Process Builder active?",
+        "search all registered orgs for a component called <ComponentName>"
+      ],
+      "sfi.fleet_drift_ranking": [
+        "which orgs in our fleet have drifted most from the baseline?",
+        "rank our orgs by how much they've diverged from each other",
+        "show me which fleet orgs are most out of sync",
+        "drift ranking across our sandbox fleet",
+        "which org has changed the most since last baseline?",
+        "which of our orgs is most out of date and needs a refresh first?"
+      ],
+      "sfi.get_component": [
+        "show me the full metadata for the <FlowName> flow",
+        "pull up the <ApexClass> class definition",
+        "get me the raw component data for the Contact validation rule",
+        "fetch the permission set definition for <PermSet>",
+        "show me the layout metadata for Case",
+        "pull the full metadata for <FlowName>"
+      ],
+      "sfi.list_components": [
+        "whats on the Account object \u2014 give me the whole field list",
+        "list all custom fields on Contact",
+        "show me every flow on this org",
+        "what record types exist on Case?",
+        "enumerate all permission sets",
+        "show me all active validation rules on Contact",
+        "Which duplicate matching rules exist but are inactive \u2014 deployed and forgotten?",
+        "list every Apex class in this org",
+        "what custom objects do we have?",
+        "show me all the triggers on Account",
+        "what approval processes are deployed?",
+        "list all custom labels",
+        "give me every email template in the org"
+      ],
+      "sfi.get_edges": [
+        "what are the edges between <ApexClass> and the objects it touches?",
+        "show me all dependency edges for the <FlowName> flow",
+        "what connects to <ComponentName> in the metadata graph?",
+        "enumerate the graph edges for this permission set",
+        "which components does <ApexClass> directly reference?",
+        "list all the outgoing dependencies from Account"
+      ],
+      "sfi.get_subgraph": [
+        "give me the dependency subgraph around the Case object",
+        "show me everything in the graph connected to <ApexClass>",
+        "pull the subgraph for flows touching Opportunity",
+        "what's the local neighborhood of <ComponentName> in the dependency graph?",
+        "give me a slice of the graph centered on <FlowName>",
+        "show me a 2-hop neighborhood around the Contact object"
+      ],
+      "sfi.search_apex_source": [
+        "search the Apex code for any reference to External_Id__c",
+        "find all Apex that calls Database.insert on Contact",
+        "grep the codebase for 'SOQL injection'",
+        "which Apex classes reference the <PermSet> permission?",
+        "find Apex source that contains a hardcoded email address",
+        "search Apex for any class that uses future methods",
+        "look for Apex code that queries the Order object"
+      ],
+      "sfi.search_flow_metadata": [
+        "I heard we have a flow that assigns Cases to the Support queue \u2014 which one and what's the criteria?",
+        "find a flow that references Priority__c",
+        "search flow XML for a specific field value",
+        "which flows contain a Decision element?",
+        "find flows that call the <ApexClass> Apex class",
+        "which flows have a Get Records step on the Account object?",
+        "search for flows that send emails",
+        "find every flow that creates an Opportunity"
+      ],
+      "sfi.get_naming_convention_report": [
+        "do our field names follow any consistent pattern?",
+        "is there a naming convention for our custom objects?",
+        "are our Apex class names consistent?",
+        "what naming patterns do we use for permission sets?",
+        "check if our flow names follow a standard",
+        "are there naming convention violations in our org?"
+      ],
+      "sfi.get_manifest": [
+        "export a package.xml for all our custom components",
+        "give me the manifest of everything in this org",
+        "what's in the deployment manifest?",
+        "show me the package manifest for our custom metadata",
+        "generate a manifest I can use for a deployment",
+        "what's in the current vault manifest?"
+      ],
+      "sfi.coverage_report": [
+        "what's our overall Apex test coverage?",
+        "give me a coverage summary for all Apex classes",
+        "which classes have the lowest test coverage?",
+        "are we above the 75% coverage threshold?",
+        "show me the coverage report",
+        "which triggers have zero test coverage?",
+        "overall code coverage percentage for this org"
+      ],
+      "sfi.retrieve_blindspot_report": [
+        "what metadata types are we NOT tracking in our deployments?",
+        "show me the retrieval blindspots \u2014 what we're missing",
+        "which metadata is deployed but not in our source control?",
+        "what's falling through the cracks in our CI/CD pipeline?",
+        "are there any metadata types we can't retrieve?",
+        "what metadata is referenced but not captured in this vault?"
+      ],
+      "sfi.health_check": [
+        "is this org healthy?",
+        "run a health check on the org",
+        "what's wrong with this org?",
+        "give me a health assessment",
+        "check for obvious issues with this org",
+        "is this org in good shape?"
+      ],
+      "sfi.baseline_acknowledge": [
+        "acknowledge the current baseline",
+        "mark this as the new baseline",
+        "accept the current state as baseline",
+        "set the baseline to today's snapshot",
+        "confirm I've reviewed the baseline findings",
+        "suppress this heuristic finding so it stops showing up"
+      ],
+      "sfi.baseline_status": [
+        "what was the baseline state of the org?",
+        "show me what changed since the baseline",
+        "when was the last baseline taken?",
+        "is the org still at baseline or has it drifted?",
+        "compare current state to baseline",
+        "which findings have been suppressed in the SAST baseline?"
+      ],
+      "sfi.live_describe": [
+        "describe the Case object \u2014 fields, picklists, everything",
+        "what fields does the Contact object have in the live org?",
+        "pull the live object description for Opportunity",
+        "show me the actual picklist values for Status on Case right now",
+        "describe Order to me \u2014 what fields exist in production?",
+        "describe the Account sObject from the live org"
+      ],
+      "sfi.live_stale_check": [
+        "is the vault up to date or stale?",
+        "when was the last refresh?",
+        "how old is the cached metadata?",
+        "is this data current or should I refresh?",
+        "check if the vault needs refreshing",
+        "has the live org changed since the last vault refresh?"
+      ],
+      "sfi.live_count": [
+        "how many Contacts are in the org?",
+        "count all open Cases",
+        "how many Opportunities are in Closed Won stage?",
+        "how many Accounts exist in production?",
+        "total number of active leads",
+        "how many open Cases are there right now?"
+      ],
+      "sfi.live_sample": [
+        "show me a few sample Contact records",
+        "give me some example Cases to look at",
+        "pull a random sample of Opportunity records",
+        "show me what Account data actually looks like",
+        "grab a handful of Order records for me to inspect",
+        "give me a sample of 10 Opportunities with Stage = Prospecting"
+      ],
+      "sfi.live_field_population": [
+        "what percentage of Contacts have the Email field filled in?",
+        "how populated is Priority__c on Case?",
+        "which fields on Account are mostly empty?",
+        "what's the fill rate for Amount__c on Opportunity?",
+        "are users actually filling in the Description field on Case?",
+        "what percentage of Contacts have the Mobile field filled in?"
+      ],
+      "sfi.live_group_count": [
+        "how many users are in the Support group?",
+        "count the members of each public group",
+        "how many people are in the queue right now?",
+        "show me group sizes across all public groups",
+        "how many members does the Sales territory group have?",
+        "how are Cases distributed by Status right now?"
+      ],
+      "sfi.live_stale_records": [
+        "which Cases haven't been updated in over 90 days?",
+        "show me Opportunities that have been sitting in the same stage for months",
+        "find Leads that are more than 6 months old and still open",
+        "which Accounts haven't had any activity in a year?",
+        "stale Contacts \u2014 people we haven't touched in forever",
+        "which Accounts haven't been updated in over 180 days?"
+      ],
+      "sfi.live_recent_activity": [
+        "what's changed in the org in the last week?",
+        "show me recently modified records",
+        "what was last touched on the Contact object?",
+        "recent activity on Opportunity \u2014 who's been updating records?",
+        "what records have been created in the last 24 hours?",
+        "what Leads were created in the last 7 days?"
+      ],
+      "sfi.live_aggregate": [
+        "what's the total pipeline value by stage?",
+        "average Case resolution time",
+        "sum of Amount__c on open Opportunities",
+        "count and sum of Orders by status",
+        "aggregate the revenue by Account region",
+        "what's the average Opportunity Amount across open deals?"
+      ],
+      "sfi.live_duplicate_check": [
+        "do we have duplicate Contacts in the org?",
+        "find duplicate Accounts by name and email",
+        "how many duplicate Lead records do we have?",
+        "show me potential duplicate Opportunities",
+        "run a duplicate check on Contact",
+        "are there any duplicate email addresses on Contact?"
+      ],
+      "sfi.live_owner_breakdown": [
+        "who owns the most Opportunities?",
+        "show me Case distribution by owner",
+        "which reps have the most open Leads?",
+        "breakdown of Accounts by owner",
+        "how are Contacts distributed across sales reps?",
+        "how many Cases does each queue own right now?"
+      ],
+      "sfi.live_storage_by_object": [
+        "which objects are taking up the most storage?",
+        "how much data storage is the Case object using?",
+        "show me storage consumption broken down by object",
+        "which objects have the most records?",
+        "storage breakdown \u2014 where is the data?",
+        "which objects are taking up the most storage?"
+      ],
+      "sfi.live_org_limits": [
+        "are we close to any governor limits?",
+        "how much API call budget do we have left today?",
+        "show me current org limits and usage",
+        "are we near our data storage limit?",
+        "what limits is this org approaching?",
+        "how close are we to hitting any governor limits?"
+      ],
+      "sfi.live_inactive_users": [
+        "which users haven't logged in recently?",
+        "show me inactive Salesforce users",
+        "who hasn't logged in in over 90 days?",
+        "list users that are burning licenses but not active",
+        "find users we should probably deactivate",
+        "who hasn't logged in for more than 60 days?"
+      ],
+      "sfi.live_license_usage": [
+        "how many Salesforce licenses are we using?",
+        "show me license utilization",
+        "how many licenses are available vs consumed?",
+        "are we over or under our license count?",
+        "which license types do we have and how many are used?",
+        "how many Salesforce licenses are actually being used vs assigned?"
+      ],
+      "sfi.live_consent": [
+        "which Contacts have opted out of email?",
+        "show me consent status for marketing contacts",
+        "how many people have unsubscribed?",
+        "what's the email opt-out rate?",
+        "show me GDPR consent flags on Contact",
+        "do I have live org access enabled for this session?"
+      ],
+      "sfi.live_report_usage": [
+        "which reports are actually being run?",
+        "show me report usage stats",
+        "what are the most popular reports?",
+        "which reports have never been run?",
+        "find reports that nobody has opened in 6 months",
+        "which reports haven't been run in over 6 months?"
+      ],
+      "sfi.live_folder_access": [
+        "who has access to the Sales reports folder?",
+        "show me report folder permissions",
+        "which users can see the Executive dashboards folder?",
+        "who can access the shared document library?",
+        "folder-level access for the Finance reports",
+        "are any report or dashboard folders publicly accessible?"
+      ],
+      "sfi.live_email_template_usage": [
+        "which email templates are actually being used?",
+        "show me email template utilization stats",
+        "are there email templates nobody is using?",
+        "what templates are being sent most frequently?",
+        "which email templates are dead \u2014 never triggered?",
+        "which email templates are using Classic format instead of Lightning?"
+      ],
+      "sfi.live_org_health": [
+        "how healthy is this org right now \u2014 live check",
+        "live health status of the org",
+        "run a live health assessment",
+        "anything actively broken in the org right now?",
+        "live org health snapshot",
+        "are there any failed async jobs or paused flow interviews right now?"
+      ],
+      "sfi.live_automation_fired": [
+        "which flows have actually fired recently?",
+        "show me automation execution history",
+        "has the <FlowName> flow run in the last week?",
+        "which triggers fired yesterday?",
+        "what automation has been active recently?",
+        "does the <FlowName> flow actually run in production or is it dead?"
+      ],
+      "sfi.live_picklist_usage": [
+        "which picklist values on Status are actually being used?",
+        "show me picklist value usage for Case.Priority",
+        "which Stage values on Opportunity are most common?",
+        "are there any picklist values that nobody selects?",
+        "picklist value distribution on Contact.LeadSource",
+        "which Stage values on Opportunity are never actually used in production?"
+      ],
+      "sfi.live_budget": [
+        "what's our API call usage vs budget this month?",
+        "show me current spending against limits",
+        "how much of our governor budget are we consuming?",
+        "are we on track to hit any limits this month?",
+        "live budget check \u2014 API, storage, everything",
+        "how many live queries have I used this session?"
+      ],
+      "sfi.org_risk_report": [
+        "Give me the bottom line: three sentences on whether I should be confident or worried about this org going into production.",
+        "I have a leadership offsite next week and I want to tell a clean story about the state of our Salesforce platform \u2014 the good, the bad",
+        "what's the health of this org?",
+        "is this org production-ready?",
+        "what are the biggest risks in this org?",
+        "give me a risk summary for this org",
+        "executive summary of org risk",
+        "what should I be worried about before we go live?",
+        "pull together the top risks I need to present to leadership",
+        "is there anything that would block a production release right now?"
+      ],
+      "sfi.field_cleanup_candidates": [
+        "which fields can we safely delete?",
+        "show me fields that are never populated",
+        "what custom fields are candidates for cleanup?",
+        "find fields that nobody uses and we could remove",
+        "which deprecated fields should we clean up?",
+        "list empty fields on Contact that are safe to remove"
+      ],
+      "sfi.automation_risk_report": [
+        "which of our flows and triggers are high risk?",
+        "show me automation that could cause problems",
+        "what's the riskiest automation in this org?",
+        "find automations that could hit governor limits",
+        "which flows run synchronously and could slow things down?",
+        "automation risk overview \u2014 what should we fix first?"
+      ],
+      "sfi.permission_risk_report": [
+        "who has too much access in this org?",
+        "which users have Modify All permissions they shouldn't?",
+        "show me permission risks \u2014 overprivileged users",
+        "find profiles that have more access than they need",
+        "which permission sets grant dangerous access?",
+        "security risks from permissions \u2014 give me the highlights"
+      ],
+      "sfi.release_readiness_report": [
+        "is this org ready for the next release?",
+        "give me a release readiness assessment",
+        "what blockers exist before we can deploy?",
+        "are we ready to promote to production?",
+        "show me the release readiness checklist",
+        "what do we need to fix before the next release?"
+      ],
+      "sfi.get_impact": [
+        "what's the impact of changing <ComponentName>?",
+        "show me what gets affected if I delete <Field__c>",
+        "impact analysis for modifying the <FlowName> flow",
+        "what would break if I change <ApexClass>?",
+        "downstream impact of removing <ComponentName>",
+        "what breaks if I delete the <Field__c> field on Account?"
+      ],
+      "sfi.blast_radius_live": [
+        "blast radius of changing <Object>.<Field> from currency to text",
+        "live blast radius if I deactivate <FlowName>",
+        "how many records would be affected if I change this field?",
+        "what's the blast radius of making Priority__c required on Case?",
+        "if I change this picklist value, how many records does that hit?",
+        "how many records would be affected if I remove the External_Id__c field?"
+      ],
+      "sfi.find_formula_references": [
+        "which formula fields reference Priority__c?",
+        "find all formulas that use the Amount__c field",
+        "what formulas reference the Status field on Case?",
+        "are there any formulas that read from External_Id__c?",
+        "which roll-up summary fields reference Order.Amount__c?",
+        "which formula fields reference the Amount__c field on Opportunity?"
+      ],
+      "sfi.find_apex_usages": [
+        "where is <ApexClass> used in other Apex code?",
+        "find all callers of the <Method> method",
+        "which Apex classes instantiate <ApexClass>?",
+        "what code calls into the <ApexClass> service class?",
+        "who uses the <UtilityClass> utility class?",
+        "which Apex classes read or write to the Status__c field on Case?"
+      ],
+      "sfi.effective_permissions": [
+        "does the <Profile> profile have access to the Account object?",
+        "Lead convert failed with 'missing Edit permission' \u2014 whose perm is that?",
+        "what can <Profile> actually do \u2014 union of profile plus all their perm sets?",
+        "combine <Profile> and <PermSet> and show me the effective access",
+        "does assigning <PermSet> override the profile restriction on Case?",
+        "what's the max-wins access for this user?",
+        "can the Sales profile create Opportunity records?",
+        "show me the effective field-level security for <Profile> on Contact",
+        "what's the net permission for a user with <Profile> and <PermSet>?",
+        "does this user actually have delete access on Account?",
+        "what objects can the <Profile> profile read?",
+        "effective read/write/delete access for <Profile> on Order"
+      ],
+      "sfi.who_can_run": [
+        "who can run the <Report> report?",
+        "which users are allowed to execute <FlowName>?",
+        "who has permission to run this Apex class?",
+        "which profiles can see the Sales dashboard?",
+        "who can actually execute this scheduled job?",
+        "which profiles have permission to run the <FlowName> flow?"
+      ],
+      "sfi.who_can_access_object": [
+        "who can access the Order object?",
+        "which profiles and perm sets give read access to Case?",
+        "who can see custom object <ObjectName>?",
+        "which users have access to the financial data object?",
+        "show me everyone who can view Account records",
+        "who can see records on the Order object?"
+      ],
+      "sfi.why_cant_user_see_record": [
+        "user can't see the Case record \u2014 why?",
+        "John's not seeing the Account \u2014 what's blocking them?",
+        "a user is getting access denied on Opportunity \u2014 what's wrong?",
+        "why is this record invisible to a specific user?",
+        "I need to figure out why a user can't open this record",
+        "user says they get a 'No access' error on a Contact record \u2014 what gives?"
+      ],
+      "sfi.layout_for_user": [
+        "what page layout does <Profile> see on Case?",
+        "which layout gets shown to the Sales rep on Opportunity?",
+        "show me the layout assignment for the <Profile> profile on Contact",
+        "which record type and layout does this user get on Account?",
+        "what layout will a support agent see on a Case?",
+        "which page layout does the <Profile> profile see on Contact?"
+      ],
+      "sfi.user_ability": [
+        "can <Username> edit Cases?",
+        "does this user have permission to delete Contacts?",
+        "what can a specific user actually do in the org?",
+        "check if <Username> can create Opportunities",
+        "what record types can this user access on Case?",
+        "what flows can users with the <Profile> profile actually run?"
+      ],
+      "sfi.profile_security": [
+        "how locked down is the <Profile> profile?",
+        "show me the security settings for the Sales profile",
+        "does <Profile> have any dangerous permissions like Modify All?",
+        "what system permissions does the <Profile> profile have?",
+        "security review for the support agent profile",
+        "which profiles have Apex execute permissions?"
+      ],
+      "sfi.lightning_pages": [
+        "what Lightning pages exist for the Case object?",
+        "show me all App Builder pages",
+        "which Lightning pages use the <Component> component?",
+        "what's on the Account record page?",
+        "list all Lightning Experience record pages",
+        "which Lightning record pages are assigned to the Case object?"
+      ],
+      "sfi.list_view_sharing": [
+        "who can see the 'My Open Cases' list view?",
+        "which list views on Contact are visible to everyone?",
+        "show me sharing settings for list views on Opportunity",
+        "who has access to the Sales team list view?",
+        "list views on Account \u2014 who can see which ones?",
+        "who can see the 'My Open Cases' list view on Case?"
+      ],
+      "sfi.app_access": [
+        "which users can see the Sales Cloud app?",
+        "who has access to the Service Console?",
+        "what apps is the <Profile> profile allowed to use?",
+        "which Lightning apps are available to the support team?",
+        "show me app access by profile",
+        "which profiles can open the Service app?"
+      ],
+      "sfi.tab_availability": [
+        "which tabs can the <Profile> profile see?",
+        "is the Order tab visible to sales reps?",
+        "which objects have tabs hidden from the support profile?",
+        "show me tab settings for the <Profile> profile",
+        "which tabs are set to 'Default Off' for a specific profile?",
+        "which tabs are visible to users with the <Profile> profile?"
+      ],
+      "sfi.lifecycle_process": [
+        "what's the Case lifecycle \u2014 statuses and transitions?",
+        "show me the Opportunity stage progression",
+        "what are the valid Lead status transitions?",
+        "describe the record lifecycle for Order",
+        "what's the path an Account goes through from creation to active?",
+        "what happens when an Opportunity moves to Closed Won?"
+      ],
+      "sfi.layout_assignments": [
+        "which layouts are assigned to which profiles on Case?",
+        "show me all layout assignments for Contact",
+        "what layout does the admin profile use on Account?",
+        "layout to profile mapping on Opportunity",
+        "which record type gets which layout on Case?",
+        "which profiles are assigned to the Account Layout page layout?"
+      ],
+      "sfi.integration_map": [
+        "what external systems does this org integrate with?",
+        "show me all the integrations in this org",
+        "what APIs does this Salesforce instance call out to?",
+        "which third-party systems are connected?",
+        "integration topology \u2014 what talks to what?",
+        "what external systems is this org connected to?"
+      ],
+      "sfi.event_subscribers": [
+        "what's subscribed to the Case platform event?",
+        "who listens to <PlatformEvent__e>?",
+        "show me all event subscribers in this org",
+        "which flows or Apex classes consume platform events?",
+        "what processes trigger off <EventName__e>?",
+        "who listens to the <Event__e> platform event?"
+      ],
+      "sfi.guidance": [
+        "how should I think about cleaning up this org?",
+        "what's the recommended approach for migrating Process Builder flows?",
+        "guide me through reducing technical debt in our Apex",
+        "what's best practice for permission set management?",
+        "how do I approach a security review in Salesforce?",
+        "what's the recommended approach for building automation on Salesforce \u2014 Flow vs Apex?"
+      ],
+      "sfi.find_code_usages": [
+        "where is <ClassName> referenced in the codebase?",
+        "find all usages of <MethodName>",
+        "which components use <CustomLabel>?",
+        "where is the <ApexClass> class called from?",
+        "find everything that references this utility class",
+        "which LWC components reference the Account.AnnualRevenue field?"
+      ],
+      "sfi.lookup_record": [
+        "look up the Case record with ID 5001234",
+        "find the Account named Acme Corp",
+        "pull up the Contact with this email address",
+        "look up Order number 1234",
+        "fetch the record for this Opportunity",
+        "what are the values in the <MetadataRecord__mdt> custom metadata record?"
+      ],
+      "sfi.explain_field": [
+        "what does the External_Id__c field on Contact mean?",
+        "explain what Priority__c is used for on Case",
+        "what's the purpose of Amount__c on Opportunity?",
+        "what does this custom field do and where does it come from?",
+        "explain the business meaning of Status__c on Order",
+        "what are the picklist values on Opportunity.Stage?"
+      ],
+      "sfi.safe_to_delete_field": [
+        "is it safe to delete Priority__c?",
+        "can I remove this field without breaking anything?",
+        "what would break if I deleted External_Id__c?",
+        "is <Field__c> safe to delete?",
+        "which fields are safe to remove from Contact?",
+        "I want to clean up unused fields \u2014 is this one safe to drop?"
+      ],
+      "sfi.unused_components": [
+        "which components in this org are not used anywhere?",
+        "find all dead code \u2014 Apex classes that are never called",
+        "what custom objects have no records and aren't referenced?",
+        "show me unused permission sets",
+        "which flows are deployed but never run?",
+        "dead components \u2014 Apex, flows, whatever \u2014 give me the list"
+      ],
+      "sfi.find_dependency_cycles": [
+        "whats the dependency cycle situation between the Course objects \u2014 triggers on <Object1>, <Object2>, <Object3>",
+        "we have <Object1> and <Object2> \u2014 are they in a dependency loop with each other through triggers or flows?",
+        "which Apex classes call each other in a circle?",
+        "is there a circular dependency in our trigger code?",
+        "do any triggers chain back into themselves?",
+        "find recursive call chains in Apex",
+        "do we have any circular flow invocations?",
+        "which flows call each other in a loop?",
+        "check for circular dependencies in the automation layer",
+        "are there any infinite loops possible in our trigger/flow setup?"
+      ],
+      "sfi.apex_test_coverage": [
+        "what's the test coverage for <ApexClass>?",
+        "show me line-level coverage for the <TriggerName> trigger",
+        "which lines in <ApexClass> are not covered by tests?",
+        "does <ApexClass> meet the 75% coverage threshold?",
+        "what's the coverage breakdown for the order management class?",
+        "which Apex classes have no test coverage at all?"
+      ],
+      "sfi.automation_build_advisor": [
+        "should I build this as a flow or a trigger?",
+        "what's the recommended automation approach for updating Case on Contact change?",
+        "I need to auto-populate a field on save \u2014 flow or Apex?",
+        "advise me on the best way to automate account territory assignment",
+        "how should I implement this business rule \u2014 flow, trigger, or process builder?",
+        "before I add a new flow on Account, what already runs there?"
+      ],
+      "sfi.apex_build_advisor": [
+        "how should I structure this Apex class?",
+        "best practice for writing a trigger on Case?",
+        "I'm building a batch job \u2014 any guidance?",
+        "recommend an Apex pattern for async processing of Orders",
+        "how do I avoid governor limits in this Apex scenario?",
+        "before I write Apex for Opportunity, what patterns does existing code use?"
+      ],
+      "sfi.field_change_advisor": [
+        "I want to add a new required field to Case \u2014 what should I consider?",
+        "advise me on changing the type of Amount__c",
+        "what do I need to think about before adding a lookup field to Contact?",
+        "guidance on making External_Id__c a unique field",
+        "field change advisory for renaming Status__c",
+        "give me the full risk briefing before I modify the Priority__c field"
+      ],
+      "sfi.what_if_change_field_value": [
+        "what happens if I change the Stage to Closed Won on these records?",
+        "if I bulk-update Priority__c on all open Cases to High, what automation fires?",
+        "what changes downstream when I set Status to Active on an Account?",
+        "what would happen if someone changes the Amount__c to zero on an Opportunity?",
+        "simulate changing Contact.LeadSource from Web to Partner",
+        "if someone changes the External_Id__c value on an Account record, what integration breaks?"
+      ],
+      "sfi.value_change_audit": [
+        "who changed the Status__c field on this Case and when?",
+        "show me the history of changes to Amount__c on Opportunity",
+        "audit trail for Priority__c changes on Case",
+        "which users are changing Stage on Opportunity most frequently?",
+        "show me all the value changes to External_Id__c in the last month",
+        "which fields on Contact are risky to change values on?"
+      ],
+      "sfi.live_drift_check": [
+        "has anything changed in the live org since the last vault refresh?",
+        "check if the live org has drifted from the cached metadata",
+        "are there new fields in production that aren't in our vault?",
+        "live drift check \u2014 anything deployed since the last snapshot?",
+        "compare live org to our stored metadata",
+        "has the live org added or removed fields on Account since the last refresh?"
+      ],
+      "sfi.what_changed_since_refresh": [
+        "what's been deployed since the last refresh?",
+        "show me changes since we last pulled the org metadata",
+        "what metadata has changed since the vault was updated?",
+        "anything new or modified since the last snapshot?",
+        "delta since last refresh \u2014 what changed?",
+        "what types of components changed in the last refresh?"
+      ],
+      "sfi.org_history": [
+        "show me the change history for this org",
+        "what major changes have happened to this org over time?",
+        "org changelog \u2014 what's been modified recently?",
+        "historical view of org changes",
+        "what was deployed to this org in the last quarter?",
+        "show me the refresh history for this org"
+      ],
+      "sfi.diff_snapshots": [
+        "compare the current org snapshot to last month's",
+        "diff between the two most recent vault snapshots",
+        "what changed between snapshot A and snapshot B?",
+        "show me the diff between our production and sandbox snapshots",
+        "compare two org states and tell me what's different",
+        "compare the pre-release snapshot to the post-release snapshot"
+      ],
+      "sfi.churn": [
+        "which components change most frequently?",
+        "show me high-churn metadata \u2014 things we keep modifying",
+        "what parts of the org are in constant flux?",
+        "which Apex classes get touched every sprint?",
+        "high-churn fields on Case \u2014 what keeps changing?",
+        "which components had the most changes between these two snapshots?"
+      ],
+      "sfi.trend": [
+        "how has the number of Cases grown over time?",
+        "show me the trend in Opportunity creation",
+        "is our lead volume increasing or decreasing?",
+        "trend analysis for Account record creation",
+        "how has our automation complexity changed over the last year?",
+        "show me component count growth over time across all snapshots"
+      ],
+      "sfi.compare_components": [
+        "compare the Contact layout between sandbox and production",
+        "show me the diff between <FlowName> v1 and v2",
+        "compare the Case validation rules in two orgs",
+        "what's different between the <Profile> profile in sandbox vs prod?",
+        "compare the <ApexClass> class across environments",
+        "are these two record types actually different or just named differently?"
+      ],
+      "sfi.export_manifest": [
+        "export the full org manifest",
+        "create a package.xml with all custom components",
+        "export a deployment manifest for the custom objects",
+        "give me a manifest I can use to retrieve this org's metadata",
+        "export all custom Apex and flows to a manifest",
+        "generate a package.xml for these components so I can deploy them"
+      ],
+      "sfi.pii_inventory": [
+        "which fields in this org store personally identifiable information?",
+        "show me all PII fields \u2014 SSN, email, phone, etc.",
+        "GDPR compliance \u2014 which fields hold personal data?",
+        "inventory of fields that could contain sensitive customer data",
+        "which objects store PII that we need to mask in sandboxes?",
+        "which fields in this org store personally identifiable information?"
+      ],
+      "sfi.field_access_audit": [
+        "who can read and write the Amount__c field?",
+        "which profiles can edit SSN or sensitive financial fields?",
+        "show me field-level security for Priority__c across all profiles",
+        "who has write access to External_Id__c?",
+        "field access audit for Status__c on Case",
+        "who has read access to the SSN field on Contact?"
+      ],
+      "sfi.object_access_audit": [
+        "which profiles can create, read, edit, delete Order records?",
+        "show me CRUD permissions on Case by profile",
+        "who has delete access to Account?",
+        "object-level permission audit for Contact",
+        "show me which profiles have full CRUD on custom object <ObjectName>",
+        "which profiles have Create access on the Case object?"
+      ],
+      "sfi.recordtype_availability": [
+        "which record types on Case are available to the Support profile?",
+        "which record types does the <Profile> profile have access to on Opportunity?",
+        "show me record type availability on Account by profile",
+        "can the sales rep create a Partner Account record type?",
+        "which record types on Contact are visible to the marketing team?",
+        "which record types can the <Profile> profile create on Case?"
+      ],
+      "sfi.org_overview": [
+        "break down the codebase footprint for me \u2014 LWC vs Aura vs Visualforce, and how much legacy VF debt is there",
+        "how many custom objects does this org have?",
+        "what are the top objects in this org?",
+        "give me a tour of this Salesforce org",
+        "what's in this org?",
+        "quick inventory of the codebase",
+        "org summary \u2014 what are we working with?",
+        "high-level overview of this Salesforce instance",
+        "describe this org to me like I just joined the team",
+        "how big is this org \u2014 fields, flows, classes, the works?",
+        "what's the overall complexity of this org?",
+        "give me a lay of the land for this Salesforce environment"
+      ],
+      "sfi.domain_clusters": [
+        "what functional areas does this org cover?",
+        "show me the business domain clusters in this Salesforce org",
+        "how is the metadata organized by business function?",
+        "what logical groups of objects exist in this org?",
+        "cluster the org's objects by business domain",
+        "can you group the objects in this org into logical domain areas?"
+      ],
+      "sfi.changed_since": [
+        "what changed in the org since last Tuesday?",
+        "show me everything modified after January 1st",
+        "what metadata was updated this week?",
+        "changes since the last release",
+        "what's been modified since the last sprint?",
+        "what components were modified after 2024-01-01?"
+      ],
+      "sfi.last_modified": [
+        "who last modified the <FlowName> flow?",
+        "when was the Case layout last changed?",
+        "who touched the <ApexClass> class most recently?",
+        "when was Priority__c last updated?",
+        "last modified date for all custom fields on Contact",
+        "when was the Account trigger last changed and by whom?"
+      ],
+      "sfi.what_happens_on_save": [
+        "I need everything that touches Case on save \u2014 flows, triggers, PB, validation. Full save cascade please.",
+        "Ugh, we keep hitting record-lock errors \u2014 which of our automations run concurrently on Contact and could be colliding?",
+        "give me a rundown of every automation that involves a Case",
+        "what runs when I create a new Opportunity record?",
+        "what automation fires on Account update?",
+        "what triggers exist on Contact?",
+        "if I save an Opportunity, what order does everything fire in?",
+        "is there any automation on Order I should know about before adding more?",
+        "walk me through everything Salesforce does when I hit Save on a Case",
+        "before I add a new flow to Contact, what else is already running on save?",
+        "which flows fire synchronously on Lead save?",
+        "complete save-event automation inventory for the Account object",
+        "what happens behind the scenes when I create a new Contact?"
+      ],
+      "sfi.why_field_changed": [
+        "which flows write to Contact.Status__c?",
+        "what sets the value of Opportunity.Amount__c?",
+        "who or what writes to Priority__c on Case?",
+        "trace every writer to External_Id__c",
+        "what automation populates the Status field on Order?",
+        "does any trigger or flow update Amount__c?",
+        "We loaded leads from an external system and Converted_from_Lead__c is populated \u2014 what writes it?",
+        "how is Priority__c getting set \u2014 is it a user, a flow, or a trigger?",
+        "the Status field keeps changing on its own \u2014 what's causing it?",
+        "trace all the things that could write to Case.Status__c",
+        "which automation is responsible for populating Amount__c?"
+      ],
+      "sfi.order_of_execution": [
+        "in what order do triggers, flows, and validation rules fire on Case save?",
+        "walk me through the Salesforce order of execution for Opportunity",
+        "when does before-trigger run vs after-trigger vs flow?",
+        "is validation run before or after triggers?",
+        "what's the order of operations when I save a Contact record?",
+        "does the flow run before or after the Apex trigger?"
+      ],
+      "sfi.explain_flow": [
+        "walk me through <FlowName>'s screens and decisions",
+        "walk me thru the <FlowName> fault handling \u2014 if a step fails, does it retry, skip, or halt?",
+        "Does <FlowName> invoke any Apex, and if so which class/method?",
+        "explain the <FlowName> flow end to end \u2014 it's a screen flow, what's the user actually doing in it?",
+        "what is <FlowName> for?",
+        "when does <FlowName> fire and what does it change?",
+        "break down <FlowName> logic",
+        "what records does <FlowName> create or update?",
+        "I inherited this flow and have no idea what it does \u2014 explain it to me",
+        "summarize <FlowName> for a non-technical stakeholder",
+        "what's the happy path through <FlowName>?",
+        "does <FlowName> have any error handling?",
+        "what variables does <FlowName> use?",
+        "which object does <FlowName> primarily operate on?"
+      ],
+      "sfi.explain_apex_method": [
+        "what does the <MethodName> method in <ApexClass> do?",
+        "explain the <MethodName> method \u2014 inputs, outputs, side effects",
+        "walk me through the logic of <ApexClass>.<MethodName>",
+        "what does this method return and what does it modify?",
+        "explain the business logic in the <MethodName> method",
+        "what does the AccountController class do?"
+      ],
+      "sfi.explain_formula": [
+        "what does this formula field actually calculate?",
+        "explain the formula on <Field__c> in plain English",
+        "break down this validation rule formula for me",
+        "what's this formula doing \u2014 it's hard to read",
+        "explain the formula logic on Amount__c",
+        "what does this formula evaluate to and when?"
+      ],
+      "sfi.unused_fields_deep": [
+        "which fields on Case have zero data and aren't referenced by anything?",
+        "deep analysis of unused fields \u2014 both empty and unreferenced",
+        "show me fields that are populated but never read by any automation",
+        "find fields that appear in no layouts, no flows, no Apex",
+        "which custom fields on Account are completely orphaned?",
+        "which fields on Account have zero usage anywhere in the org?"
+      ],
+      "sfi.process_builder_migration_candidates": [
+        "which Process Builder processes should we migrate to Flow?",
+        "show me all Process Builder automations still active",
+        "which processes are candidates for Flow migration?",
+        "what Process Builder is left that we need to retire?",
+        "identify Process Builder processes that would be straightforward to convert",
+        "which Process Builders should we migrate to Flow first?"
+      ],
+      "sfi.unassigned_permission_sets": [
+        "are there permission sets that aren't assigned to anyone?",
+        "which permission sets are deployed but have zero users?",
+        "find permission sets that are effectively dead \u2014 no assignments",
+        "show me unassigned permission sets we could clean up",
+        "permission sets nobody has \u2014 are there any?",
+        "which permission sets aren't assigned to any user?"
+      ],
+      "sfi.empty_queues_and_groups": [
+        "are there any queues with no members?",
+        "show me empty public groups",
+        "which queues have nobody in them?",
+        "find groups and queues that are effectively abandoned",
+        "empty queue check \u2014 anything routing to nowhere?",
+        "which queues have no members assigned to them?"
+      ],
+      "sfi.tech_debt_score": [
+        "what's our overall tech debt score?",
+        "how much technical debt does this org carry?",
+        "give me a technical debt rating for this Salesforce org",
+        "debt score breakdown \u2014 what's contributing most?",
+        "quantify the technical debt in this org",
+        "what's the overall technical debt score for this org?"
+      ],
+      "sfi.code_quality_audit": [
+        "how good is our Apex code quality?",
+        "find code quality issues in our Apex classes",
+        "audit the Apex code for common anti-patterns",
+        "show me code quality violations",
+        "which Apex classes have the most quality issues?",
+        "are there any SOQL queries inside loops in our Apex code?"
+      ],
+      "sfi.governor_limit_risks": [
+        "which parts of our Apex are at risk of hitting governor limits?",
+        "find SOQL queries inside loops",
+        "which triggers could hit DML limits?",
+        "governor limit risk assessment for our Apex",
+        "which batch jobs are close to the 50M record limit?",
+        "find places where we're at risk of CPU timeout"
+      ],
+      "sfi.find_hardcoded_values": [
+        "find hardcoded IDs in the Apex code",
+        "which Apex classes have hardcoded email addresses?",
+        "find hardcoded profile names in our triggers",
+        "are there any hardcoded record type IDs in the code?",
+        "show me hardcoded values in Apex that should be in Custom Settings",
+        "are there hardcoded IDs or email addresses in our Apex code?"
+      ],
+      "sfi.crud_fls_audit": [
+        "are we enforcing FLS in our Apex?",
+        "which Apex classes skip CRUD/FLS checks?",
+        "find Apex that queries without checking field-level security",
+        "CRUD and FLS audit for our triggers",
+        "which classes are vulnerable to privilege escalation via missing FLS?",
+        "which Apex classes skip CRUD or FLS checks?"
+      ],
+      "sfi.test_coverage_gaps": [
+        "where are the gaps in our test coverage?",
+        "which Apex classes have coverage below 75%?",
+        "find untested code paths in our triggers",
+        "coverage gaps across all Apex",
+        "which classes would block a deployment due to low coverage?",
+        "which Apex classes have fake or missing test coverage?"
+      ],
+      "sfi.what_if_change_field_type": [
+        "what happens if I change the type of Case.Priority__c from picklist to text?",
+        "blast radius of changing Opportunity.Amount__c from currency to number",
+        "if I convert Contact.External_Id__c from Text to EncryptedText, what breaks?",
+        "can I safely change <Field> type from Number to Text?",
+        "what downstream impact if I make Status__c a lookup instead of text?",
+        "impact of changing field type on Account.<Field__c>",
+        "I want to change a Text field to a Long Text Area \u2014 what's the risk?",
+        "what breaks if I change the data type of this field?",
+        "if I convert this currency field to a formula field, what automation breaks?",
+        "blast radius of making Amount__c a formula field instead of editable"
+      ],
+      "sfi.what_if_remove_picklist_value": [
+        "what happens if I delete the 'Pending' value from Case.Status?",
+        "if I remove the 'Cold' picklist value from Lead.Rating, what records are affected?",
+        "can I safely remove the 'Legacy' stage from Opportunity.StageName?",
+        "what breaks if I remove a picklist value that records already use?",
+        "impact of removing 'On Hold' from Case.Status picklist",
+        "what breaks if I remove 'Closed - Duplicate' from Case.Status?"
+      ],
+      "sfi.what_if_make_field_required": [
+        "what happens if I make Priority__c required on Case?",
+        "if I make Amount__c required on Opportunity, what existing records would violate that?",
+        "impact of making Contact.External_Id__c required",
+        "can I safely make this field required without breaking flows?",
+        "what automation would break if I make this field mandatory?",
+        "what would break if I made Account.Website required?"
+      ],
+      "sfi.what_if_deactivate_flow": [
+        "what breaks if I deactivate <FlowName>?",
+        "if I turn off this flow, what processes depend on it?",
+        "impact of deactivating the Case assignment flow",
+        "can I safely deactivate <FlowName> without breaking anything?",
+        "what would stop working if I switch off <FlowName>?",
+        "what happens if I deactivate the <FlowName> flow?"
+      ],
+      "sfi.what_if_disable_trigger": [
+        "what breaks if I disable the Contact trigger?",
+        "impact of disabling <TriggerName>",
+        "if I turn off this trigger, what automation stops running?",
+        "can I safely disable the Account trigger?",
+        "what would I lose if the Case trigger was off?",
+        "if I disable the Account trigger, what stops working?"
+      ],
+      "sfi.what_if_change_method_signature": [
+        "what breaks if I change the signature of <MethodName>?",
+        "impact of renaming the <MethodName> method in <ApexClass>",
+        "if I add a parameter to <MethodName>, what callers need updating?",
+        "which classes call <MethodName> and would be affected by signature change?",
+        "can I remove a parameter from <MethodName> without breaking anything?",
+        "what breaks if I rename the calculateTotal() method signature?"
+      ],
+      "sfi.what_if_merge_profiles": [
+        "I want to consolidate the permission set group \u2014 what would break if I merge <PermSetA> and <PermSetB>?",
+        "can I combine the Sales and Sales Manager profiles?",
+        "what conflicts exist between <ProfileA> and <ProfileB>?",
+        "merge <Profile1> into <Profile2> \u2014 what are the collisions?",
+        "what permission conflicts come up if I merge these two profiles?",
+        "impact of combining two permission sets into one",
+        "if I consolidate our three sales profiles into one, what conflicts arise?",
+        "what would I lose or gain by merging <PermSet1> and <PermSet2>?"
+      ],
+      "sfi.what_if_split_profile": [
+        "should I split the Admin profile into two?",
+        "impact of splitting the <Profile> profile by region",
+        "how would I split the Sales profile into read-only and full-access variants?",
+        "what's involved in splitting a monolithic profile into permission sets?",
+        "if I break this profile into two, what do I need to account for?",
+        "how would I split the <Profile> profile into multiple permission sets?"
+      ],
+      "sfi.generate_data_dictionary": [
+        "generate a data dictionary for this org",
+        "create documentation of all our fields and objects",
+        "build a data dictionary I can share with the data team",
+        "export field descriptions and types for all custom objects",
+        "generate a schema reference document",
+        "generate a data dictionary for the Contact object"
+      ],
+      "sfi.generate_admin_handbook": [
+        "write an admin handbook for this org",
+        "generate a guide for onboarding a new Salesforce admin",
+        "create an administrative reference document",
+        "build an ops runbook for our Salesforce configuration",
+        "document the admin processes in this org",
+        "create an admin handbook for this org"
+      ],
+      "sfi.generate_architecture_overview": [
+        "generate an architecture overview for this org",
+        "write a technical architecture document",
+        "create a high-level architecture summary for stakeholders",
+        "document the overall structure of this Salesforce implementation",
+        "generate an architecture diagram description for this org",
+        "write an architecture overview document for this Salesforce org"
+      ],
+      "sfi.generate_sharing_summary": [
+        "generate a sharing model summary for this org",
+        "document how record sharing works in this org",
+        "create a sharing and visibility overview",
+        "write up the sharing architecture \u2014 OWD, roles, sharing rules",
+        "generate a sharing model document I can review with security",
+        "generate a sharing model summary for this org"
+      ],
+      "sfi.generate_compliance_report": [
+        "generate a compliance report for this org",
+        "create a GDPR compliance overview",
+        "document our data handling practices from a compliance perspective",
+        "produce a security and compliance report",
+        "generate a report for an auditor about our data controls",
+        "produce a compliance report for data privacy fields in this org"
+      ],
+      "sfi.generate_onboarding_doc": [
+        "generate an onboarding guide for new users",
+        "create a getting started document for sales reps",
+        "write onboarding documentation for the support team",
+        "generate a new hire guide to our Salesforce org",
+        "create documentation for someone who has never used our Salesforce before",
+        "generate an onboarding document for a new admin joining this org"
+      ],
+      "sfi.call_graph": [
+        "Are there any flows nested inside other flows that make things hard to follow?",
+        "what does <ApexClass> call downstream?",
+        "trace the full call chain from <TriggerName>",
+        "what classes does <ApexClass> depend on transitively?",
+        "upstream callers of <ApexClass>",
+        "what's the call depth on <MethodName>?",
+        "show me the full dependency chain for <ApexClass>",
+        "which flows invoke other flows?",
+        "what's the transitive call graph from <ApexClass>?",
+        "give me all callers and callees for <ApexClass>",
+        "how deep is the call stack for <TriggerName>?",
+        "subflow map \u2014 which flows call other flows?"
+      ],
+      "sfi.downstream_effects": [
+        "what does changing <Field__c> ripple out to?",
+        "show me the downstream effects of modifying <ApexClass>",
+        "if I change <FlowName>, what else is affected?",
+        "downstream impact of updating the Case status picklist",
+        "what does it affect if <ComponentName> changes?",
+        "what side effects does the AccountTrigger handler produce downstream?"
+      ],
+      "sfi.test_coverage_for_method": [
+        "what tests cover the <MethodName> method?",
+        "which test classes exercise <ApexClass>.<MethodName>?",
+        "is there a test for the <MethodName> method?",
+        "show me the test coverage for this specific method",
+        "what unit tests hit <MethodName>?",
+        "which test classes exercise the processPayment() method?"
+      ],
+      "sfi.meaningful_test_audit": [
+        "are our tests actually meaningful or just padding coverage?",
+        "which tests have no real assertions?",
+        "find tests that just inflate coverage without testing anything",
+        "audit our test suite for meaningful assertions",
+        "are these tests actually checking anything useful?",
+        "which of our test classes have no real assertions \u2014 just System.assert(true)?"
+      ],
+      "sfi.method_reachability": [
+        "is <MethodName> reachable from any active flow or trigger?",
+        "can this method actually be called in production?",
+        "which entry points reach <MethodName>?",
+        "is <ApexClass>.<MethodName> dead code?",
+        "what paths lead to <MethodName> being invoked?",
+        "is the AccountService class reachable from any trigger or REST endpoint?"
+      ],
+      "sfi.tests_for_change": [
+        "which tests do I need to run after changing <ApexClass>?",
+        "what test classes cover the code I'm about to modify?",
+        "I changed <FlowName> \u2014 which tests should I run?",
+        "which tests are relevant to my changes in <ApexClass>?",
+        "give me the test suite to run before deploying <ComponentName>",
+        "if I change the AccountService and CaseHandler classes, which tests should I run?"
+      ],
+      "sfi.cdc_subscribers": [
+        "what's subscribed to Change Data Capture events on Contact?",
+        "who listens to CDC events on Account?",
+        "show me all Change Data Capture subscribers",
+        "which flows or external systems consume CDC events?",
+        "what processes react to Account change events?",
+        "which flows or triggers listen to Account CDC change events?"
+      ],
+      "sfi.async_chain_depth": [
+        "how deep is the async chain for <ApexClass>?",
+        "are there chained queueables that go too deep?",
+        "show me the async job chain depth",
+        "how many levels of chained async jobs do we have?",
+        "which async jobs kick off other async jobs?",
+        "how deep is the async call chain from the BatchProcessor class?"
+      ],
+      "sfi.scheduled_job_catalog": [
+        "what scheduled jobs are running in this org?",
+        "show me all the scheduled Apex jobs",
+        "which batch jobs are scheduled?",
+        "list all cron-based jobs in the org",
+        "what's running on a schedule in this org?",
+        "which Apex classes are scheduled to run on a cron schedule?"
+      ],
+      "sfi.outbound_message_catalog": [
+        "what outbound messages are configured?",
+        "show me all outbound SOAP messages",
+        "which workflow rules send outbound messages?",
+        "list all outbound message endpoints",
+        "what external systems do we push data to via outbound messages?",
+        "what outbound messages does this org send and to which endpoints?"
+      ],
+      "sfi.endpoint_catalog": [
+        "what external endpoints does this org call out to?",
+        "show me all named credentials and callout URLs",
+        "which Apex classes make HTTP callouts?",
+        "list all integration endpoints",
+        "what APIs does our Salesforce code talk to?",
+        "list all inbound and outbound API endpoints in this org"
+      ],
+      "sfi.field_meaning": [
+        "what does Priority__c mean in our business context?",
+        "explain the business purpose of External_Id__c",
+        "what's the semantic meaning of Status__c on Order?",
+        "what does Amount__c represent \u2014 is it revenue, cost, or something else?",
+        "in plain English, what does this field track?",
+        "what does the External_Id__c field on Account actually mean in this org?"
+      ],
+      "sfi.disambiguate_concepts": [
+        "we have both Priority__c and Case.Priority \u2014 which one should I use?",
+        "there are three things called Status in this org \u2014 which one matters?",
+        "Amount__c vs Amount \u2014 what's the difference?",
+        "we have External_Id__c on both Contact and Account \u2014 are they related?",
+        "clarify the difference between <ConceptA> and <ConceptB> in this org",
+        "is 'Status' the same concept as 'Stage' in this org or are they different?"
+      ],
+      "sfi.field_provenance": [
+        "<Field__c> is populated but I don't know how \u2014 is it manually entered or automated?",
+        "is Priority__c a formula or is it written by code?",
+        "what's the source of truth for Contact.External_Id__c?",
+        "how does Status__c get its value on Order?",
+        "is Amount__c auto-populated or user-entered?",
+        "where does the data in this field come from?",
+        "is this field set by a trigger, a flow, or does a user type it in?",
+        "trace the origin of values in <Field__c>"
+      ],
+      "sfi.find_field_anywhere": [
+        "find all objects that have a field called External_Id__c",
+        "is there a Priority field on any object in this org?",
+        "search for any field named Status across all objects",
+        "find fields named Amount__ on any object",
+        "which objects have a field called Description?",
+        "where is the Priority__c field used across flows, Apex, and layouts?"
+      ],
+      "sfi.find_semantic_field": [
+        "find me a field that tracks customer churn risk",
+        "is there a field that stores the contract end date?",
+        "find a field related to billing frequency",
+        "what field would hold escalation priority?",
+        "find a field that represents the customer's account tier",
+        "do we have a field that stores the customer's loyalty tier?"
+      ],
+      "sfi.find_hardcoded_values_anywhere": [
+        "find hardcoded values anywhere \u2014 Apex, flows, validation rules, everywhere",
+        "search all metadata types for hardcoded email addresses",
+        "hardcoded IDs anywhere in the org \u2014 not just Apex",
+        "find hardcoded profile names in flows too, not just triggers",
+        "check flows and validation rules for hardcoded values, not just code",
+        "are there hardcoded IDs in our validation rule formulas?"
+      ],
+      "sfi.find_clone_patterns": [
+        "are there Apex classes that look like copy-paste of each other?",
+        "find duplicate code patterns in our Apex",
+        "which classes have very similar logic that should be refactored?",
+        "show me clone candidates in our codebase",
+        "find near-duplicate implementations across Apex classes",
+        "are there Apex classes that look structurally identical to AccountHandler?"
+      ],
+      "sfi.find_dead_code": [
+        "find Apex methods that are never called",
+        "which Apex classes are completely unreferenced?",
+        "show me dead code \u2014 methods, classes, that nothing calls",
+        "find unreachable code paths in our Apex",
+        "which classes can I safely delete because nothing uses them?",
+        "which Apex classes have no callers and look completely dead?"
+      ],
+      "sfi.package_impact": [
+        "I keep hearing '<PackageName>' thrown around. What is it, how deep is it in our org, and are we locked into it?",
+        "how entangled is the <Package> package in our customizations?",
+        "if we uninstall <Package> what breaks?",
+        "what does our org depend on from <Package>?",
+        "impact of removing the <PackageName> managed package",
+        "show me everything we've built on top of <Package>",
+        "how many of our custom components reference <Package> components?"
+      ],
+      "sfi.cpq_rule_chain": [
+        "show me the CPQ pricing rule chain for this product",
+        "what CPQ rules fire when configuring a quote?",
+        "trace the CPQ rule execution for this product bundle",
+        "which CPQ validation and pricing rules apply to Order products?",
+        "show me the CPQ rule dependencies",
+        "what's the order of CPQ product rules that apply to the Bundle product?"
+      ],
+      "sfi.cpq_quote_template_breakdown": [
+        "break down the CPQ quote template structure",
+        "what sections and line items does this quote template include?",
+        "explain the CPQ quote template layout",
+        "show me the components of our primary quote template",
+        "what's in the standard CPQ quote template?",
+        "what sections are in the Standard Quote Template?"
+      ],
+      "sfi.cpq_dependency_map": [
+        "show me the CPQ dependency map",
+        "how do CPQ objects relate to each other?",
+        "map out the CPQ data model in this org",
+        "what CPQ objects and relationships do we have configured?",
+        "dependency graph for our CPQ implementation",
+        "what SBQQ__ field references exist in this org's CPQ configuration?"
+      ],
+      "sfi.field_360": [
+        "give me a 360 view of the Priority__c field",
+        "full profile of External_Id__c \u2014 who uses it, what sets it, where does it appear",
+        "complete field analysis for Amount__c on Opportunity",
+        "everything about Status__c on Case \u2014 definition, usage, writers, layouts",
+        "field 360 for Contact.LeadSource \u2014 the full picture",
+        "give me the complete picture of the Amount__c field on Opportunity \u2014 everything touching it"
+      ],
+      "sfi.field_lineage": [
+        "show me the lineage of Priority__c \u2014 where does it come from and where does it go?",
+        "trace the data lineage for Amount__c from source to destination",
+        "where does External_Id__c originate and how does it flow through the org?",
+        "field lineage for Status__c \u2014 what populates it and what reads it?",
+        "data lineage for a key field on Account",
+        "trace where the Opportunity.Amount__c field gets its value from and what it feeds"
+      ],
+      "sfi.compare_vaults": [
+        "compare our production org to our sandbox",
+        "show me differences between the two vault snapshots",
+        "what's different between our dev sandbox and production?",
+        "compare the two org configurations",
+        "vault diff between production and staging",
+        "how does our sandbox differ from production in terms of metadata?"
+      ],
+      "sfi.promotion_readiness": [
+        "is the sandbox ready to promote to production?",
+        "what's blocking promotion from dev to production?",
+        "promotion readiness check for this sandbox",
+        "are there any conflicts that would prevent a promotion?",
+        "show me what needs to be resolved before we can promote",
+        "what sandbox-only components need to be promoted to production?"
+      ],
+      "sfi.compare_object_across_vaults": [
+        "compare the Case object between sandbox and production",
+        "how does the Contact object differ across our orgs?",
+        "show me differences in the Account schema between two vaults",
+        "compare custom object <ObjectName> across environments",
+        "Case object schema diff between dev and prod",
+        "are the Contact fields the same in sandbox vs production?"
+      ],
+      "sfi.compare_profile_across_vaults": [
+        "compare the Sales profile between sandbox and production",
+        "how does <Profile> differ across our orgs?",
+        "show me profile differences between environments",
+        "compare admin profile between dev and production",
+        "which permissions exist in production that are missing from sandbox?",
+        "does the <Profile> profile have the same grants in sandbox vs prod?"
+      ],
+      "sfi.field_mapping_between_objects": [
+        "how does the Contact object map to Account?",
+        "show me field mappings between Lead and Contact/Account on conversion",
+        "what fields get mapped during Case to Opportunity conversion?",
+        "field mapping between Order and Quote objects",
+        "how do fields on <Object1> map to fields on <Object2>?",
+        "map the Lead fields to Contact fields for conversion \u2014 what would lose data?"
+      ],
+      "sfi.datatransform_field_map": [
+        "show me the DataTransform field mappings",
+        "what field mappings are defined in this DataTransform?",
+        "explain the field mapping configuration for this DataTransform",
+        "what source and target fields does this DataTransform map?",
+        "DataTransform mapping details for the Contact integration",
+        "what field mappings does the <DataRaptorName> DataRaptor define?"
+      ],
+      "sfi.decision_table_browse": [
+        "show me the decision tables in this org",
+        "browse the Decision Table for pricing rules",
+        "what decision tables exist on the Case object?",
+        "list all configured decision tables",
+        "show me the entries in the routing decision table",
+        "what are the input and output parameters of the <DecisionTable> decision table?"
+      ],
+      "sfi.integration_procedure_chain": [
+        "show me the OmniStudio Integration Procedure chain for <IntegrationProcedure>",
+        "what does this Integration Procedure call?",
+        "trace the IP call chain from <IntegrationProcedure>",
+        "which Integration Procedures call each other?",
+        "explain the Integration Procedure flow for this use case",
+        "walk me through the steps in the <IPName> Integration Procedure"
+      ],
+      "sfi.omniscript_flow": [
+        "walk me through the OmniScript flow for <OmniScriptName>",
+        "explain the screens and steps in this OmniScript",
+        "what elements does this OmniScript contain?",
+        "describe the OmniScript user journey for <OmniScriptName>",
+        "what Integration Procedures does this OmniScript call?",
+        "what screens and steps does the <OmniScriptName> OmniScript walk the user through?"
+      ],
+      "sfi.omniuicard_widget_breakdown": [
+        "break down the widgets in this OmniUI Card",
+        "what components make up this FlexCard?",
+        "show me the widget structure of <OmniUiCardName>",
+        "explain the layout of this OmniUI Card",
+        "what data sources does this FlexCard use?",
+        "what widgets are in the <FlexCardName> FlexCard?"
+      ],
+      "sfi.find_component_usages": [
+        "why cant i see the <ComponentName> thing, is it a permission",
+        "who has the <PermSet> perm set",
+        "who's allowed to view the <ComponentName> component?",
+        "what uses the <ComponentName> \u2014 everywhere it's referenced or invoked",
+        "where is this flow referenced?",
+        "what calls into <ComponentName>?",
+        "is <ComponentName> used anywhere?",
+        "does anything still use <ComponentName>?",
+        "find every place <ComponentName> is referenced",
+        "which layouts include the <ComponentName> component?",
+        "which flows invoke <ComponentName>?",
+        "where is this custom label used?",
+        "what uses the <PermSet> permission set \u2014 show me all assignments and references"
+      ],
+      "sfi.installed_package_catalog": [
+        "what managed packages are installed in this org?",
+        "which packages do we rely on?",
+        "i keep seeing <prefix>__ everywhere \u2014 whats that prefix and what owns it?",
+        "show me all installed AppExchange packages",
+        "give me an inventory of all managed packages",
+        "which packages are installed and what version are they on?",
+        "what third-party packages are we running?",
+        "list all packages \u2014 namespace, publisher, version"
+      ],
+      "sfi.annotations": [
+        "show me all annotations for <ComponentName>",
+        "what notes have been added to this component?",
+        "are there any annotations on the <FlowName> flow?",
+        "list component annotations in this org",
+        "show me existing metadata annotations",
+        "what ownership or lifecycle annotations have been added to components?"
+      ],
+      "sfi.propose_annotation": [
+        "suggest an annotation for <ComponentName>",
+        "what annotation would you add to this Apex class?",
+        "propose a description for the <FlowName> flow",
+        "generate an annotation for this component based on what it does",
+        "write a description I can add to <ComponentName>",
+        "flag the Amount__c field as PII-sensitive so this is recorded"
+      ],
+      "sfi.component_history": [
+        "show me the change history for <ComponentName>",
+        "who has modified the <FlowName> flow over time?",
+        "what changes have been made to <ApexClass> historically?",
+        "component changelog for <ComponentName>",
+        "has <ComponentName> changed recently?",
+        "when was the AccountTrigger last changed and what did it look like before?"
+      ],
+      "sfi.component_as_of": [
+        "show me what <ComponentName> looked like last month",
+        "what did the <FlowName> flow look like before the last change?",
+        "show me <ApexClass> as of the January snapshot",
+        "what was the state of <ComponentName> at the time of the release?",
+        "restore view of <ComponentName> from a specific date",
+        "show me what the Account trigger looked like at the v1.0 tag"
+      ]
+    };
+  }
+});
+
 // ../mcp/dist/src/semantic-funnel.js
-var STOPWORDS, SYNONYMS, PHRASE_SYNONYMS3, applyPhraseSynonyms3, tokenize6, TOOL_KEYWORDS, PLANE_OVERRIDES, planeForTool, EXCLUDED_FROM_CANDIDATES, liveRequiredForPlane, buildPlaneByTool, cachedPlanes, getPlaneByTool, resolveCandidatePlane, expand, buildToolDocs, cached, buildIndex, getFunnelIndex, CONF_HIGH_TOP1, CONF_HIGH_MARGIN, CONF_HIGH_COVERAGE, CONF_FLOOR_TOP1, CONF_MIN_COVERAGE, CONF_LOW_MARGIN, CONF_RESCUE_TOP1, CONF_RESCUE_COVERAGE, CONF_LOW_COVERAGE, funnelConfidence, semanticCandidates;
+var STOPWORDS, SYNONYMS, PHRASE_SYNONYMS3, applyPhraseSynonyms3, tokenize6, TOOL_KEYWORDS, PLANE_OVERRIDES, planeForTool, EXCLUDED_FROM_CANDIDATES, liveRequiredForPlane, buildPlaneByTool, cachedPlanes, getPlaneByTool, resolveCandidatePlane, EXPANSION_WEIGHT, expandWeighted, buildToolDocs, cached, buildIndex, getFunnelIndex, CONF_HIGH_TOP1, CONF_HIGH_MARGIN, CONF_HIGH_COVERAGE, CONF_FLOOR_TOP1, CONF_MIN_COVERAGE, CONF_LOW_MARGIN, CONF_RESCUE_TOP1, CONF_RESCUE_COVERAGE, CONF_LOW_COVERAGE, funnelConfidence, semanticCandidates;
 var init_semantic_funnel = __esm({
   "../mcp/dist/src/semantic-funnel.js"() {
     "use strict";
+    init_funnel_utterances();
     init_capabilities();
     init_tools();
     STOPWORDS = /* @__PURE__ */ new Set([
@@ -55236,14 +57168,126 @@ var init_semantic_funnel = __esm({
       blow: ["governor", "limit", "risk", "exceed"],
       populated: ["population", "filled", "fill", "usage"],
       required: ["mandatory", "needed", "blank", "null"],
-      walk: ["explain", "trace", "describe", "order", "execution"]
+      walk: ["explain", "trace", "describe", "order", "execution"],
+      // ---- router-v2 P3 vocabulary bridges (informal → technical). Grown from the
+      // labeled funnel-miss diagnosis; every entry is GENERIC Salesforce vocabulary
+      // (never org-specific) and safe at EXPANSION_WEIGHT (originals always win).
+      // "who has / who's assigned" family → grants & assignment vocabulary
+      assigned: ["permission", "permissionset", "granted", "assignment", "member", "usages"],
+      perm: ["permission", "permissions", "permissionset"],
+      granted: ["permission", "access", "assigned", "effective"],
+      holds: ["assigned", "granted", "permission"],
+      allowed: ["permission", "access", "granted", "effective"],
+      actually: ["effective", "permission", "access"],
+      union: ["effective", "permission", "combined"],
+      combine: ["merge", "effective", "union"],
+      consolidate: ["merge", "combine", "profiles", "permission"],
+      conflicts: ["merge", "conflict", "overlap", "duplicate"],
+      cant: ["access", "permission", "visibility", "see", "blocked"],
+      cannot: ["access", "permission", "visibility", "see", "blocked"],
+      unable: ["access", "permission", "visibility", "see"],
+      // "what writes / what sets" family → writer / provenance vocabulary
+      writes: ["write", "writer", "provenance", "populates", "updates", "changed", "field"],
+      wrote: ["writes", "writer", "provenance", "changed"],
+      writer: ["writes", "provenance", "changed", "flow", "trigger"],
+      sets: ["writes", "populates", "value", "changed"],
+      populates: ["writes", "sets", "provenance", "value", "filled"],
+      updates: ["update", "writes", "changed", "modified"],
+      trace: ["lineage", "provenance", "history", "graph", "walk"],
+      // "do we have / is there / find me" family → search & resolve vocabulary
+      find: ["search", "lookup", "locate", "resolve", "matching", "usages"],
+      lookup: ["find", "resolve", "search", "locate"],
+      locate: ["find", "search", "lookup", "resolve"],
+      called: ["named", "name", "resolve", "find"],
+      named: ["called", "name", "resolve", "find"],
+      anywhere: ["everywhere", "usages", "search", "find", "components"],
+      everywhere: ["anywhere", "usages", "search", "find"],
+      contains: ["references", "includes", "search", "element"],
+      referencing: ["usage", "usages", "references", "used"],
+      points: ["references", "usages", "depends"],
+      // "what is this prefix" family → namespace / package vocabulary
+      prefix: ["namespace", "package", "installed", "managed"],
+      namespace: ["package", "prefix", "installed", "managed"],
+      package: ["namespace", "installed", "managed", "prefix", "dependency"],
+      installed: ["package", "packages", "namespace", "catalog"],
+      managed: ["package", "namespace", "installed"],
+      uninstall: ["package", "impact", "remove", "dependency"],
+      entangled: ["package", "dependency", "impact", "uninstall"],
+      // "what fires / what runs on save" family → save-cascade vocabulary
+      fires: ["fire", "run", "runs", "trigger", "execution", "automation", "save"],
+      fired: ["fire", "run", "trigger", "execution", "automation"],
+      happens: ["fires", "runs", "execution", "automation", "save"],
+      saving: ["save", "automation", "validation", "execution", "trigger"],
+      saved: ["save", "automation", "execution", "trigger"],
+      cascade: ["order", "execution", "save", "automation"],
+      blocks: ["validation", "rule", "save", "required", "error"],
+      blocking: ["validation", "rule", "save", "error"],
+      stops: ["validation", "blocks", "save", "rule", "error"],
+      prevents: ["validation", "blocks", "save", "rule"],
+      automations: ["automation", "flow", "trigger", "workflow", "process", "rule"],
+      lock: ["record", "save", "automation", "contention", "error"],
+      // informal call-topology family → usages / call-graph vocabulary
+      calls: ["call", "invoke", "invokes", "usage", "usages", "graph", "references"],
+      invoke: ["call", "calls", "usage", "references", "apex"],
+      invokes: ["call", "calls", "usage", "references", "apex"],
+      invoked: ["call", "calls", "usage", "references"],
+      nested: ["subflow", "call", "graph", "depth", "invoke"],
+      subflow: ["flow", "call", "graph", "nested", "invoke"],
+      subflows: ["flow", "flows", "call", "graph", "nested"],
+      chain: ["call", "graph", "depth", "dependency", "order"],
+      // dependency loops → cycle vocabulary
+      loop: ["cycle", "cycles", "dependency", "recursion", "circular"],
+      loops: ["cycle", "cycles", "dependency", "recursion", "circular"],
+      circular: ["cycle", "cycles", "dependency", "loop"],
+      recursive: ["cycle", "recursion", "loop", "dependency"],
+      // blast-radius / pre-change safety family → impact vocabulary
+      blast: ["impact", "radius", "breaks", "affected", "change"],
+      radius: ["impact", "blast", "affected"],
+      breaks: ["impact", "affected", "depend", "change", "break"],
+      affected: ["impact", "downstream", "breaks"],
+      downstream: ["impact", "effects", "affected", "dependency"],
+      safe: ["impact", "risk", "change", "delete", "breaks"],
+      safely: ["impact", "risk", "change", "breaks"],
+      // error-driven diagnosis family
+      error: ["failed", "failure", "exception", "validation", "blocked"],
+      failed: ["error", "failure", "exception", "permission"],
+      fault: ["error", "exception", "handling", "flow"],
+      handling: ["fault", "error", "exception", "flow"],
+      // exec-summary / org-tour family → overview & risk vocabulary
+      tour: ["overview", "org", "summary", "inventory"],
+      describe: ["overview", "explain", "summary"],
+      breakdown: ["overview", "explain", "walk", "components", "summary"],
+      big: ["size", "overview", "count", "many", "inventory"],
+      size: ["count", "overview", "many", "storage"],
+      leadership: ["risk", "summary", "overview", "report"],
+      executive: ["risk", "summary", "overview", "report"],
+      worried: ["risk", "report", "health"],
+      confident: ["risk", "report", "health"],
+      shape: ["health", "risk", "overview"],
+      // cleanup / dead-code family
+      unused: ["dead", "usages", "components", "cleanup"],
+      dead: ["unused", "code", "usages"],
+      cleanup: ["unused", "dead", "delete", "candidates"],
+      // freshness / coverage stragglers
+      outdated: ["stale", "fresh", "current"],
+      refresh: ["vault", "stale", "fresh", "current", "health"],
+      tested: ["test", "tests", "coverage"],
+      untested: ["coverage", "gaps", "test", "tests"],
+      // queue / assignment routing family
+      queue: ["assignment", "routing", "owner", "group"],
+      routed: ["assignment", "queue", "rule", "routing"]
     };
     PHRASE_SYNONYMS3 = [
       ["social security number", "ssn"],
       ["social security", "ssn"],
       ["date of birth", "dob"],
       ["postal code", "zip"],
-      ["zip code", "zip"]
+      ["zip code", "zip"],
+      // router-v2 P3: "break down X for me" is an EXPLAIN ask, but token-split it
+      // becomes 'break' (→ impact/dependency synonyms) + 'down' — the impact
+      // expansion hijacks the ranking. Collapse the phrase to the single token
+      // 'breakdown' (whose SYNONYMS entry bridges to explain/overview/walk).
+      ["break down", "breakdown"]
     ].sort((a2, b2) => b2[0].length - a2[0].length);
     applyPhraseSynonyms3 = (lower) => {
       let out = lower;
@@ -55281,7 +57325,12 @@ var init_semantic_funnel = __esm({
       "sfi.layout_for_user": "which layout does the profile user see page on object",
       "sfi.integration_map": "api limits at risk integration volume callout capacity external",
       "sfi.find_apex_usages": "which flows invoke call use apex classes methods from",
-      "sfi.live_folder_access": "who can access report dashboard folder pipeline see view shared"
+      "sfi.live_folder_access": "who can access report dashboard folder pipeline see view shared",
+      // router-v2 P3: the two labeled miss families for this tool are "who has this
+      // permission set" (assignment/grant phrasing) and "what references this
+      // component" — its (long) description dilutes those terms, so the overlay
+      // re-weights them. Referee: funnel-recall blind-spot cases.
+      "sfi.find_component_usages": "who has this permission set assigned granted holds it references referenced still used anywhere"
     };
     PLANE_OVERRIDES = {
       "sfi.blast_radius_live": "live",
@@ -55319,21 +57368,28 @@ var init_semantic_funnel = __esm({
       const plane = planeForTool(toolName);
       return { plane, liveRequired: liveRequiredForPlane(plane) };
     };
-    expand = (tokens) => {
-      const out = [...tokens];
+    EXPANSION_WEIGHT = 0.5;
+    expandWeighted = (tokens) => {
+      const w2 = /* @__PURE__ */ new Map();
+      for (const t2 of tokens)
+        w2.set(t2, (w2.get(t2) ?? 0) + 1);
       for (const t2 of tokens) {
         const syn = SYNONYMS[t2];
-        if (syn !== void 0)
-          out.push(...syn);
+        if (syn !== void 0) {
+          for (const s2 of syn)
+            if (!w2.has(s2))
+              w2.set(s2, EXPANSION_WEIGHT);
+        }
       }
-      return out;
+      return w2;
     };
     buildToolDocs = () => {
       const docs = /* @__PURE__ */ new Map();
       for (const tool of V01_TOOLS) {
         const nameWords = tool.name.replace(/^sfi\./, "").replace(/_/g, " ");
         const keywords = TOOL_KEYWORDS[tool.name] ?? "";
-        docs.set(tool.name, `${nameWords} ${nameWords} ${tool.description} ${keywords}`);
+        const utterances = (FUNNEL_UTTERANCES[tool.name] ?? []).join(" ");
+        docs.set(tool.name, `${nameWords} ${nameWords} ${tool.description} ${keywords} ${utterances}`);
       }
       for (const cat of CATEGORIES) {
         const catText = ` ${cat.title} ${cat.description} ${cat.exampleQuestions.join(" ")}`;
@@ -55415,8 +57471,8 @@ var init_semantic_funnel = __esm({
       const idx = getFunnelIndex();
       const planes = getPlaneByTool();
       const rawQueryTokens = new Set(tokenize6(question, true));
-      const qTokens = expand(tokenize6(question, true));
-      if (qTokens.length === 0)
+      const qWeights = expandWeighted(tokenize6(question, true));
+      if (qWeights.size === 0)
         return [];
       let coverage = 0;
       if (rawQueryTokens.size > 0) {
@@ -55426,13 +57482,10 @@ var init_semantic_funnel = __esm({
             hits += 1;
         coverage = hits / rawQueryTokens.size;
       }
-      const qtf = /* @__PURE__ */ new Map();
-      for (const t2 of qTokens)
-        qtf.set(t2, (qtf.get(t2) ?? 0) + 1);
       const qvec = /* @__PURE__ */ new Map();
       let qnorm = 0;
-      for (const [term, f2] of qtf) {
-        const w2 = f2 / qTokens.length * (idx.idf.get(term) ?? 0);
+      for (const [term, weight] of qWeights) {
+        const w2 = weight * (idx.idf.get(term) ?? 0);
         if (w2 > 0) {
           qvec.set(term, w2);
           qnorm += w2 * w2;
@@ -55453,10 +57506,14 @@ var init_semantic_funnel = __esm({
         if (dot <= 0)
           continue;
         const score = dot / qnorm;
+        const rounded = Math.round(score * 1e3) / 1e3;
         const planeEntry = planes.get(tool) ?? { plane: "vault", liveRequired: false };
         scored.push({
           tool,
-          score: Math.round(score * 1e3) / 1e3,
+          score: rounded,
+          // Pre-fusion semantic evidence — identical to `score` here; preserved
+          // verbatim through route_question's regex-bonus fusion (P2 §4).
+          cosine: rounded,
           category: idx.toolCategory.get(tool) ?? null,
           plane: planeEntry.plane,
           liveRequired: planeEntry.liveRequired
@@ -55506,7 +57563,7 @@ import { createHash as createHash7 } from "node:crypto";
 import { readFile as readFile82 } from "node:fs/promises";
 import { join as join23, resolve as resolve3 } from "node:path";
 import { z as z115 } from "zod";
-var RESOLVE_FALLBACK_MAX_TOKENS, SAVE_ORDER_INTENTS, SINGLE_ENTITY_INTENTS, COMPARISON_ASIDE, stripComparisonAside, tryResolveFallback, routeQuestionInputSchema, routeTrust, clarificationIdFor, selectedEntityArgsForRoute, extractEntityQuery, inferEntityTypes, refineEntityResolution, applyGlossaryAliases, entityAmbiguityRequiresClarification, splitCompoundQuestion, mixedInventoryAndStoragePlan, PLAN_FAMILY, ASSESSMENT_FAMILY, ROUTE_PREAMBLE_TOOLS, TOOL_COMPATIBLE_TYPES, ACCESS_FLAVORED_TOOLS, resolvedTypeForGuard, applyComponentTypeGuard, REGEX_BONUS, resolveActiveVaultAlias, buildRouteToolArgsMap, mergeRouteHintsIntoCandidates, invokeFromArgsMap, rerankForMode, MARGIN, DESTRUCTIVE_TOOL, INFORMATIONAL_IMPACT_TOOL, planesDiverge, risksDiverge, marginClarification, LIVE_DISCLOSURE_LOOKAHEAD, liveConsentDisclosure, guidanceForMode, buildFunnelCandidates, routerMode, routeQuestionHandler;
+var RESOLVE_FALLBACK_MAX_TOKENS, SAVE_ORDER_INTENTS, SINGLE_ENTITY_INTENTS, COMPARISON_ASIDE, stripComparisonAside, tryResolveFallback, routeQuestionInputSchema, routeTrust, clarificationIdFor, selectedEntityArgsForRoute, extractEntityQuery, inferEntityTypes, normLiteral, refineEntityResolution, resolveParentQualifier, applyGlossaryAliases, entityAmbiguityRequiresClarification, hygienicClarificationOptions, splitCompoundQuestion, mixedInventoryAndStoragePlan, PLAN_FAMILY, ASSESSMENT_FAMILY, ROUTE_PREAMBLE_TOOLS, TOOL_COMPATIBLE_TYPES, ACCESS_FLAVORED_TOOLS, resolvedTypeForGuard, applyComponentTypeGuard, REGEX_BONUS, resolveActiveVaultAlias, buildRouteToolArgsMap, mergeRouteHintsIntoCandidates, invokeFromArgsMap, rerankForMode, MARGIN, FUNNEL_PRIMARY_MIN_SCORE, DESTRUCTIVE_TOOL, INFORMATIONAL_IMPACT_TOOL, planesDiverge, LIVE_DATA_SIGNAL, resolvePlaneTie, risksDiverge, marginClarification, LIVE_DISCLOSURE_LOOKAHEAD, liveConsentDisclosure, guidanceForMode, buildFunnelCandidates, routerMode, REFUSAL_INTENT, REFUSAL_GAP, refusalResponse, CONTEXT_SAVE_ORDER_TOOLS, CONTEXT_TOOL_ARG_KEYS, GENERIC_SCHEMA_INTENTS, contextArgsFor, buildContextContinuation, routeQuestionHandler;
 var init_route_question = __esm({
   "../mcp/dist/src/tools/route-question.js"() {
     "use strict";
@@ -55514,7 +57571,9 @@ var init_route_question = __esm({
     init_src2();
     init_src3();
     init_answer_render();
+    init_context_resolution();
     init_intent_router();
+    init_refusal_gates();
     init_semantic_funnel();
     init_resolve2();
     init_tool_profile();
@@ -55549,6 +57608,8 @@ var init_route_question = __esm({
       if (disposition !== "exact" && disposition !== "ambiguous" || candidates.length === 0) {
         return null;
       }
+      const hygienicOptions = disposition === "ambiguous" ? hygienicClarificationOptions(candidates.slice(0, 5)) : [];
+      const effectivelyExact = disposition === "exact" || hygienicOptions.length === 1;
       return {
         question,
         plane: "vault",
@@ -55558,13 +57619,13 @@ var init_route_question = __esm({
         needsResolve: true,
         reason: `Names a component (resolve disposition: ${disposition}) but asks nothing specific yet. Resolve it, then pick the analysis you want.`,
         gap: null,
-        confidence: disposition === "exact" ? "high" : "low",
+        confidence: effectivelyExact ? "high" : "low",
         risk: "informational",
         alternatives: [],
-        clarification: disposition === "ambiguous" ? {
+        clarification: disposition === "ambiguous" && !effectivelyExact ? {
           required: true,
           question: "Several components match. Which component did you mean?",
-          options: candidates.slice(0, 5).map((candidate) => candidate.id)
+          options: hygienicOptions.map((candidate) => candidate.id)
         } : null,
         plan: [{
           stepId: "step-1",
@@ -55602,7 +57663,39 @@ var init_route_question = __esm({
        * coverage tools). When set, toolCandidates + a mode-specific guidance line are
        * always attached, regardless of the deterministic route's confidence.
        */
-      mode: z115.enum(["ask", "plan", "assessment"]).optional()
+      mode: z115.enum(["ask", "plan", "assessment"]).optional(),
+      /**
+       * Router-v2 P5: HOST-PASSED conversation context. The product is STATELESS —
+       * conversation memory belongs to the host, which passes what the PREVIOUS
+       * turn was about so a terse follow-up ("does it fire on delete too?") can be
+       * resolved; nothing is stored server-side. `context` absent ⇒ every code
+       * path is byte-identical to a call without the feature. Value validation is
+       * FAIL-OPEN (an unregistered `tool` / malformed `componentId` is ignored and
+       * noted in `contextApplied.ignored`); shape errors reject normally. Context
+       * strings are NEVER treated as question text — `previous.question` is only
+       * ever re-dispatched through the full handler (refusal gates included) for
+       * clarification continuation. A self-contained question IGNORES context.
+       */
+      context: z115.object({
+        previous: z115.object({
+          /** Canonical id the prior answer was about, e.g. "Flow:Order_Sync". */
+          componentId: z115.string().min(1).max(256).optional(),
+          /** Object api name in focus last turn, e.g. "Contact". */
+          objectApiName: z115.string().min(1).max(256).optional(),
+          /** sfi.* tool that produced the prior answer. */
+          tool: z115.string().regex(/^sfi\.[a-z0-9_]+$/).optional(),
+          /** route.intent of the prior turn (advisory only). */
+          intent: z115.string().min(1).max(64).optional(),
+          plane: z115.enum(["vault", "live", "hybrid"]).optional(),
+          /** Prior turn's question text — required ONLY for clarification continuation. */
+          question: z115.string().min(1).max(2e3).optional(),
+          /** Open disambiguation set from the prior turn's blocking clarification. */
+          clarification: z115.object({
+            clarificationId: z115.string().min(1).max(64),
+            options: z115.array(z115.string().min(1).max(256)).min(1).max(10)
+          }).strict().optional()
+        }).strict()
+      }).strict().optional()
     });
     routeTrust = () => ({
       provenance: "offline_snapshot",
@@ -55645,7 +57738,7 @@ var init_route_question = __esm({
       return null;
     };
     extractEntityQuery = (question, intent) => {
-      const apiReference = question.match(/\b[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)\b|\b[A-Za-z][A-Za-z0-9_]*__(?:c|mdt|e|x|b|kav)\b/)?.[0];
+      const apiReference = question.match(/\b[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)\b|\b[A-Za-z][A-Za-z0-9_]*__(?:c|mdt|e|x|b|kav)\b|\b[A-Za-z][A-Za-z0-9]*(?:_+[A-Za-z0-9]+)+\b/)?.[0];
       if (apiReference !== void 0) {
         if (intent === "what-if-method-signature" && apiReference.includes(".")) {
           return `${apiReference.slice(0, apiReference.indexOf("."))} class`;
@@ -55664,7 +57757,7 @@ var init_route_question = __esm({
       const typedPhrase = typedMatch?.[1];
       if (typedPhrase === void 0)
         return null;
-      const cleaned = typedPhrase.replace(/^(?:(?:what|whatever|which|who|where|when|why|how|is|are|can|does|do|did|show|find|explain|locate|list|calls?|invokes?|references?|owns?|edit|read|view|access|change|delete|remove|possible|values?|apex|api|version|data|type|for|of|the|this|that|in|on|to|used|assigned|set|every|all|each|any|me|a|an)\s+)+/i, "").trim();
+      const cleaned = typedPhrase.replace(/^(?:(?:what|whats|whatever|which|who|whos|where|wheres|when|why|how|hows|is|are|can|does|do|did|show|find|explain|locate|list|walk|through|pull|give|gimme|tell|about|break|down|compare|effective|calls?|invokes?|references?|owns?|edit|read|view|access|change|delete|remove|possible|values?|apex|api|version|data|type|for|of|the|this|that|in|on|to|used|assigned|set|every|all|each|any|me|my|us|a|an)\s+)+/i, "").trim();
       if (/\b(?:and|when|should|use|there|any|that|no|available|tools?|difference|between|required\s+fields?|record\s+types?)\b/i.test(cleaned))
         return null;
       const distinctive = cleaned.replace(/\b(?:object|field|flow|class|trigger|page|layout|profile|permission|set|record|type|validation|rule|report|dashboard|data|logic)\b/gi, "").replace(/[^A-Za-z0-9_]+/g, "");
@@ -55677,8 +57770,6 @@ var init_route_question = __esm({
     inferEntityTypes = (query, intent, question) => {
       if (intent === "what-if-method-signature")
         return ["ApexClass"];
-      if (/\bfield\b/i.test(question))
-        return ["CustomField"];
       if (query.includes(".") && !/\sclass$/i.test(query))
         return ["CustomField"];
       if (/__(?:mdt|e|x|b|kav)$/i.test(query) || /(?:^object\s|\sobject(?:\s+on\s+\w+)?$)/i.test(query))
@@ -55705,18 +57796,40 @@ var init_route_question = __esm({
         return ["Report"];
       if (/(?:^dashboard\s|\sdashboard$)/i.test(query))
         return ["Dashboard"];
+      const escaped = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const qualifier = question.match(new RegExp(`\\b${escaped}\\s+(object|flow|field|trigger|profile|permission\\s+set)\\b`, "i"))?.[1]?.toLowerCase().replace(/\s+/g, " ");
+      if (qualifier === "object")
+        return ["CustomObject"];
+      if (qualifier === "flow")
+        return ["Flow"];
+      if (qualifier === "field")
+        return ["CustomField"];
+      if (qualifier === "trigger")
+        return ["ApexTrigger"];
+      if (qualifier === "profile")
+        return ["Profile"];
+      if (qualifier === "permission set")
+        return ["PermissionSet"];
+      if (/\bfield\b/i.test(question))
+        return ["CustomField"];
       return [];
     };
+    normLiteral = (value) => value.toLowerCase().replace(/[^a-z0-9]/g, "");
     refineEntityResolution = (query, resolution) => {
       if (resolution.disposition !== "ambiguous")
         return resolution;
       const normalized = query.toLowerCase();
-      const exactApi = resolution.candidates.filter((candidate) => candidate.apiName.toLowerCase() === normalized || candidate.id.toLowerCase().endsWith(`:${normalized}`));
+      const looseQuery = normLiteral(query);
+      const queryHasSpace = /\s/.test(query.trim());
+      const exactApi = resolution.candidates.filter((candidate) => candidate.apiName.toLowerCase() === normalized || candidate.id.toLowerCase().endsWith(`:${normalized}`) || normLiteral(candidate.apiName) === looseQuery && looseQuery.length >= 4 && !(candidate.type === "CustomField" && queryHasSpace));
       const parentQualified = query.match(/^(.+?)\s+field\s+on\s+([A-Za-z][A-Za-z0-9_]*)$/i);
       const normalizedName = parentQualified?.[1]?.replace(/[^a-z0-9]/gi, "").toLowerCase();
       const normalizedParent = parentQualified?.[2]?.replace(/[^a-z0-9]/gi, "").toLowerCase();
       const exactParentField = normalizedName === void 0 || normalizedParent === void 0 ? [] : resolution.candidates.filter((candidate) => candidate.type === "CustomField" && candidate.apiName.replace(/__[a-z]+$/i, "").replace(/[^a-z0-9]/gi, "").toLowerCase() === normalizedName && candidate.parentApiName?.replace(/[^a-z0-9]/gi, "").toLowerCase() === normalizedParent);
-      const exact = exactParentField.length === 1 ? exactParentField : exactApi;
+      const parentPlusName = queryHasSpace && looseQuery.length >= 4 ? resolution.candidates.filter((candidate) => candidate.type === "CustomField" && candidate.parentApiName !== null && normLiteral(candidate.parentApiName) + normLiteral(candidate.apiName.replace(/__[a-z]+$/i, "")) === looseQuery) : [];
+      const objectLiteralNames = new Set(exactApi.filter((candidate) => candidate.type === "CustomObject").map((candidate) => normLiteral(candidate.apiName)));
+      const exactApiNoTabTwins = exactApi.filter((candidate) => candidate.type !== "CustomTab" || !objectLiteralNames.has(normLiteral(candidate.apiName)));
+      const exact = exactParentField.length === 1 ? exactParentField : parentPlusName.length === 1 ? parentPlusName : exactApiNoTabTwins.length === 1 ? exactApiNoTabTwins : exactApi;
       if (exact.length !== 1)
         return resolution;
       const winner = exact[0];
@@ -55726,6 +57839,31 @@ var init_route_question = __esm({
         candidates: [winner, ...resolution.candidates.filter((candidate) => candidate.id !== winner.id)]
       };
     };
+    resolveParentQualifier = (question, resolution) => {
+      if (resolution.disposition !== "ambiguous")
+        return resolution;
+      const top = resolution.candidates[0];
+      if (top === void 0)
+        return resolution;
+      const family = resolution.candidates.filter((candidate) => candidate.apiName.toLowerCase() === top.apiName.toLowerCase() && candidate.parentApiName !== null);
+      if (family.length < 2)
+        return resolution;
+      const questionWords = new Set(question.toLowerCase().split(/[^a-z0-9_]+/).filter((word) => word.length > 0));
+      const namesParent = (parentApiName) => {
+        const full = parentApiName.toLowerCase();
+        const bare = full.replace(/__c$/, "").replace(/^[a-z0-9]+__/, "");
+        return questionWords.has(full) || questionWords.has(bare) || questionWords.has(`${bare}s`);
+      };
+      const parentNamed = family.filter((candidate) => namesParent(candidate.parentApiName));
+      if (parentNamed.length !== 1)
+        return resolution;
+      const winner = parentNamed[0];
+      return {
+        ...resolution,
+        disposition: "exact",
+        candidates: [winner, ...resolution.candidates.filter((candidate) => candidate.id !== winner.id)]
+      };
+    };
     applyGlossaryAliases = async (ctx, query, types, resolution) => {
       if (resolution.disposition === "exact")
         return resolution;
@@ -55745,6 +57883,7 @@ var init_route_question = __esm({
             parentApiName: candidate.parentApiName,
             score: candidate.score,
             base: candidate.base,
+            nameCoverage: 1,
             matchKind: "exact",
             evidence: candidate.evidence
           })),
@@ -55762,7 +57901,15 @@ var init_route_question = __esm({
       if (/[A-Za-z0-9_]__(?:c|mdt|e|x|b|kav)\b|\w+\.\w+/.test(query))
         return false;
       const [top, second] = resolution.candidates;
-      return top.base >= 0.92 && second.base >= 0.92 && second.score >= top.score * 0.97;
+      const looksLikeNamedComponent = (candidate) => candidate.matchKind !== "fuzzy" && (candidate.nameCoverage ?? 1) >= 0.5;
+      return top.base >= 0.92 && second.base >= 0.92 && second.score >= top.score * 0.97 && looksLikeNamedComponent(top) && looksLikeNamedComponent(second);
+    };
+    hygienicClarificationOptions = (candidates) => {
+      const top = candidates[0];
+      if (top === void 0)
+        return [];
+      const kept = candidates.filter((candidate) => candidate.matchKind !== "fuzzy" && candidate.base >= top.base * 0.9);
+      return kept.length > 0 && kept[0] === top ? kept : [top, ...kept.filter((c2) => c2 !== top)];
     };
     splitCompoundQuestion = (question) => {
       const parts = question.split(/(\?|;|\band\s+then\b|\bthen\b|\band\s+(?=who|what|which|how|where|when|why|is|are|can|should|does|do)\b)/i);
@@ -55940,6 +58087,7 @@ var init_route_question = __esm({
           byTool.set(tool, {
             tool,
             score: fuse(0),
+            cosine: 0,
             category: null,
             plane,
             liveRequired,
@@ -55964,12 +58112,30 @@ var init_route_question = __esm({
       return [...lead, ...rest].slice(0, 8);
     };
     MARGIN = 0.05;
+    FUNNEL_PRIMARY_MIN_SCORE = 0.26;
     DESTRUCTIVE_TOOL = /^sfi\.(safe_to_delete_field|what_if_)/;
     INFORMATIONAL_IMPACT_TOOL = /^sfi\.(get_impact|get_edges|get_subgraph|downstream_effects|find_[a-z_]*usages|find_formula_references|field_lineage)$/;
     planesDiverge = (a2, b2) => {
       const planes = /* @__PURE__ */ new Set([a2.plane, b2.plane]);
       return planes.has("vault") && (planes.has("live") || planes.has("hybrid"));
     };
+    LIVE_DATA_SIGNAL = /\bhow\s+many\b|\bcounts?\b|\bfill\s+rate\b|\bpopulat(?:ed|ion)\b|\bstorage\b|\bdata\s+volume\b|\blog(?:ged)?\s?in(?:to)?\b|\blast\s+login\b|\bright\s+now\b|\bcurrently\b|\bas\s+of\s+(?:now|today)\b|\bin\s+prod(?:uction)?\b|\bsample\s+records?\b|\brows?\b|\brecord\s+data\b|\bactual(?:ly)?\s+(?:records?|values?|data|used?|runs?)\b|\bapi\s+usage\b|\blimits?\s+headroom\b/i;
+    resolvePlaneTie = (cands, question) => {
+      const [top, second] = cands;
+      if (top === void 0 || second === void 0)
+        return [...cands];
+      if (top.score - second.score > MARGIN)
+        return [...cands];
+      if (!planesDiverge(top, second))
+        return [...cands];
+      if (top.fromRoute === true && second.fromRoute === true)
+        return [...cands];
+      const wantsLive = LIVE_DATA_SIGNAL.test(question);
+      const topReachesOrg = top.plane === "live" || top.plane === "hybrid";
+      if (wantsLive === topReachesOrg)
+        return [...cands];
+      return [second, top, ...cands.slice(2)];
+    };
     risksDiverge = (a2, b2) => DESTRUCTIVE_TOOL.test(a2.tool) && INFORMATIONAL_IMPACT_TOOL.test(b2.tool) || DESTRUCTIVE_TOOL.test(b2.tool) && INFORMATIONAL_IMPACT_TOOL.test(a2.tool);
     marginClarification = (cands, existingClarification) => {
       if (existingClarification !== null)
@@ -55981,10 +58147,9 @@ var init_route_question = __esm({
         return null;
       if (top.fromRoute === true && second.fromRoute === true)
         return null;
-      const axis = planesDiverge(top, second) ? "plane" : risksDiverge(top, second) ? "risk" : null;
-      if (axis === null)
+      if (!risksDiverge(top, second))
         return null;
-      const question = axis === "plane" ? `These two tools are equally likely but answer from DIFFERENT planes \u2014 \`${top.tool}\` (${top.plane}) vs \`${second.tool}\` (${second.plane}). A ${top.plane === "vault" ? second.plane : top.plane} answer queries the org at call time (needs the opt-in live plane); a vault answer is the offline catalog. Which did you mean?` : `These two tools are equally likely but one is DESTRUCTIVE and one is read-only \u2014 \`${top.tool}\` vs \`${second.tool}\`. Do you want the read-only impact/usage readout, or the change/delete simulation? Which did you mean?`;
+      const question = `These two tools are equally likely but one is DESTRUCTIVE and one is read-only \u2014 \`${top.tool}\` vs \`${second.tool}\`. Do you want the read-only impact/usage readout, or the change/delete simulation? Which did you mean?`;
       return {
         required: true,
         question,
@@ -56014,10 +58179,197 @@ var init_route_question = __esm({
     };
     buildFunnelCandidates = (route, question, routeToolArgs, mode) => {
       const funnelLimit = mode !== void 0 ? 12 : 8;
-      return rerankForMode(mergeRouteHintsIntoCandidates(route, semanticCandidates(question, funnelLimit), routeToolArgs, funnelLimit), mode);
+      return resolvePlaneTie(rerankForMode(mergeRouteHintsIntoCandidates(route, semanticCandidates(question, funnelLimit), routeToolArgs, funnelLimit), mode), question);
     };
     routerMode = () => (process.env.SFI_ROUTER_MODE ?? "").trim().toLowerCase() === "offline" ? "offline" : "hybrid";
+    REFUSAL_INTENT = {
+      "write-imperative": "refused-write",
+      "injection-exfiltration": "refused-injection",
+      "runtime-analytics": "honest-gap-runtime",
+      "out-of-scope": "out-of-scope"
+    };
+    REFUSAL_GAP = {
+      "write-imperative": {
+        category: "write-request",
+        note: "org mutation requested; refused (read-only product)"
+      },
+      "injection-exfiltration": {
+        category: "injection",
+        note: "prompt-injection/exfiltration shape refused"
+      },
+      "runtime-analytics": {
+        category: "runtime-analytics",
+        note: "runtime/ops telemetry the product does not model; honest gap disclosed"
+      },
+      "out-of-scope": {
+        category: "out-of-scope",
+        note: "outside the Salesforce-metadata boundary; refused"
+      }
+    };
+    refusalResponse = async (ctx, input2, shape) => {
+      const wantCands = routerMode() === "hybrid" && shape.kind !== "injection-exfiltration";
+      const cands = wantCands ? rerankForMode(semanticCandidates(input2.question, input2.mode !== void 0 ? 12 : 8), input2.mode) : [];
+      const disclosure = shape.kind === "runtime-analytics" && cands.length > 0 ? `${shape.disclosure} Nearest reads: ${cands.slice(0, 3).map((c2) => c2.tool).join(", ")}.` : shape.disclosure;
+      const refusal = { ...shape, disclosure };
+      const route = {
+        question: input2.question,
+        plane: "unknown",
+        intent: REFUSAL_INTENT[shape.kind],
+        tools: [],
+        liveRequired: false,
+        needsResolve: false,
+        reason: disclosure,
+        gap: REFUSAL_GAP[shape.kind],
+        confidence: "high",
+        // confident IN the refusal, not in any tool
+        risk: "informational",
+        alternatives: [],
+        clarification: null,
+        plan: [],
+        refusal
+      };
+      const logged = input2.logGap === true ? await logGapIfAny(route, void 0, ctx.vaultRoot) : null;
+      const guidance = wantCands ? `${disclosure} Do not execute any tool to satisfy the refused action.` : void 0;
+      return ok({
+        data: {
+          route,
+          executionBlocked: false,
+          gapLogged: logged !== null,
+          rendered: cands.length > 0 ? `${renderRouteMarkdown(route)}
+
+**Candidate tools (transparency only \u2014 the request itself is refused/gapped; do not execute them to satisfy it):** ${cands.map((c2) => c2.tool).join(", ")}` : renderRouteMarkdown(route),
+          trust: routeTrust(),
+          ...cands.length > 0 ? { toolCandidates: cands } : {},
+          ...guidance !== void 0 ? { guidance } : {}
+        },
+        vaultState: {
+          sourceTreeHash: ctx.manifest.sourceTreeHash,
+          refreshedAt: ctx.manifest.refreshedAt
+        }
+      });
+    };
+    CONTEXT_SAVE_ORDER_TOOLS = /* @__PURE__ */ new Set([
+      "sfi.what_happens_on_save",
+      "sfi.order_of_execution"
+    ]);
+    CONTEXT_TOOL_ARG_KEYS = /* @__PURE__ */ new Map([
+      ["sfi.field_access_audit", "fieldId"],
+      ["sfi.safe_to_delete_field", "fieldId"],
+      ["sfi.field_360", "fieldId"],
+      ["sfi.field_lineage", "fieldId"],
+      ["sfi.explain_field", "fieldId"],
+      ["sfi.explain_flow", "flowId"]
+    ]);
+    GENERIC_SCHEMA_INTENTS = /* @__PURE__ */ new Set([
+      "schema",
+      "metadata-count",
+      "component-lookup"
+    ]);
+    contextArgsFor = (route, winner) => {
+      const primary = route.tools.find((tool) => !ROUTE_PREAMBLE_TOOLS.has(tool));
+      if (primary === void 0)
+        return null;
+      if (SAVE_ORDER_INTENTS.has(route.intent) || CONTEXT_SAVE_ORDER_TOOLS.has(primary)) {
+        const objectApiName = winner.type === "CustomObject" ? winner.apiName : winner.parentApiName;
+        if (objectApiName === null || objectApiName === void 0)
+          return null;
+        return { ...route.suggestedArgs ?? {}, objectApiName };
+      }
+      const key = CONTEXT_TOOL_ARG_KEYS.get(primary) ?? "componentId";
+      return { ...route.suggestedArgs ?? {}, [key]: winner.id };
+    };
+    buildContextContinuation = (question, inheritedTool, winner, anaphor, prependResolve) => {
+      const entry = resolveCandidatePlane(inheritedTool);
+      const tools = prependResolve ? ["sfi.resolve", inheritedTool] : [inheritedTool];
+      const base = {
+        question,
+        plane: entry.plane,
+        intent: "context-continuation",
+        tools,
+        liveRequired: entry.liveRequired,
+        needsResolve: prependResolve,
+        reason: `CONTEXT-DERIVED (advisory): no deterministic intent matched this follow-up on its own; '${anaphor}' was resolved from host-passed conversation context` + (winner !== null ? ` to ${winner.id}` : "") + `, and the previous turn's tool ${inheritedTool} was inherited. Verify the pick, resolve any named component first, and ground with sfi.synthesize_answer.`,
+        gap: null,
+        confidence: "low",
+        risk: DESTRUCTIVE_TOOL.test(inheritedTool) ? "destructive" : "informational",
+        alternatives: [],
+        clarification: null,
+        plan: [{
+          stepId: "step-1",
+          dependsOn: [],
+          question,
+          intent: "context-continuation",
+          plane: entry.plane,
+          tools
+        }]
+      };
+      const boundArgs = winner !== null ? contextArgsFor(base, winner) : null;
+      const withArgs = boundArgs !== null ? { ...base, suggestedArgs: boundArgs } : base;
+      const guarded = applyComponentTypeGuard(withArgs, winner?.type ?? null);
+      const primary = guarded.tools.find((tool) => !ROUTE_PREAMBLE_TOOLS.has(tool));
+      if (primary === void 0)
+        return null;
+      if (winner !== null && !continuationToolCompatible(primary, winner.type)) {
+        return null;
+      }
+      const passedGuardUnchanged = primary === inheritedTool;
+      const finalEntry = resolveCandidatePlane(primary);
+      return {
+        ...guarded,
+        plane: finalEntry.plane,
+        liveRequired: finalEntry.liveRequired,
+        confidence: winner !== null && passedGuardUnchanged ? "medium" : "low",
+        risk: DESTRUCTIVE_TOOL.test(primary) ? "destructive" : "informational",
+        plan: guarded.plan.map((step3) => ({ ...step3, plane: finalEntry.plane }))
+      };
+    };
     routeQuestionHandler = async (ctx, input2) => {
+      const refusalShape = detectRefusalShape(input2.question);
+      if (refusalShape !== null) {
+        if (input2.clarificationResponse !== void 0) {
+          return err({
+            kind: "invalid-query",
+            message: "clarificationResponse was supplied, but this question has no active clarification challenge. Route the question again without a response.",
+            path: "clarificationResponse"
+          });
+        }
+        return refusalResponse(ctx, input2, refusalShape);
+      }
+      const contextInput = input2.context;
+      const validatedContext = contextInput !== void 0 ? validatePreviousContext(contextInput.previous, (tool) => getPlaneByTool().has(tool)) : null;
+      if (validatedContext !== null && validatedContext.previous.clarification !== void 0 && validatedContext.previous.question !== void 0 && input2.clarificationResponse === void 0) {
+        const selected = detectClarificationSelection(input2.question, validatedContext.previous.clarification.options);
+        if (selected !== null) {
+          const inner = selected.kind === "selected" ? await routeQuestionHandler(ctx, {
+            question: validatedContext.previous.question,
+            clarificationResponse: {
+              clarificationId: validatedContext.previous.clarification.clarificationId,
+              selection: selected.selection
+            }
+          }) : await routeQuestionHandler(ctx, {
+            question: validatedContext.previous.question
+          });
+          if (!inner.ok)
+            return inner;
+          const contextApplied2 = {
+            kind: "clarification-selection",
+            anaphor: selected.anaphor,
+            from: "previous.clarification",
+            ...selected.kind === "selected" ? { selection: selected.selection } : {},
+            ...validatedContext.ignored.length > 0 ? { ignored: validatedContext.ignored } : {}
+          };
+          return ok({
+            ...inner.value,
+            data: {
+              ...inner.value.data,
+              route: { ...inner.value.data.route, contextApplied: contextApplied2 },
+              rendered: `${inner.value.data.rendered}
+
+${renderContextApplied(contextApplied2)}`
+            }
+          });
+        }
+      }
       let route = classifyQuestion(input2.question);
       if (route.plane === "unknown" && route.intent === "unrouted") {
         const upgraded = await tryResolveFallback(ctx, input2.question);
@@ -56073,14 +58425,52 @@ var init_route_question = __esm({
       const saveOrderIntent = SAVE_ORDER_INTENTS.has(route.intent);
       const suggestedObject = route.suggestedArgs?.["objectApiName"];
       const entityExtractionSource = stripComparisonAside(input2.question, route.intent);
-      const entityQuery = !route.needsResolve ? null : saveOrderIntent ? typeof suggestedObject === "string" ? suggestedObject : null : extractEntityQuery(entityExtractionSource, route.intent);
-      const entityTypes = entityQuery === null ? [] : saveOrderIntent ? ["CustomObject"] : inferEntityTypes(entityQuery, route.intent, input2.question);
-      const entityResolution = entityQuery !== null ? await resolveComponents(ctx.graph, entityQuery, {
+      let entityQuery = !route.needsResolve ? null : saveOrderIntent ? typeof suggestedObject === "string" ? suggestedObject : null : extractEntityQuery(entityExtractionSource, route.intent);
+      let entityTypes = entityQuery === null ? [] : saveOrderIntent ? ["CustomObject"] : inferEntityTypes(entityQuery, route.intent, input2.question);
+      const pronounAnchor = validatedContext !== null ? detectPronounAnchor(input2.question) : null;
+      let contextExactResolution = null;
+      let contextSubstitution = null;
+      let contextGhostComponentId = null;
+      if (pronounAnchor !== null && validatedContext !== null && (entityQuery === null || isAnaphorOnly(entityQuery))) {
+        const previous = validatedContext.previous;
+        if (saveOrderIntent && previous.objectApiName !== void 0) {
+          entityQuery = previous.objectApiName;
+          entityTypes = ["CustomObject"];
+          contextSubstitution = { anaphor: pronounAnchor, from: "previous.objectApiName" };
+        } else if (!saveOrderIntent && previous.componentId !== void 0) {
+          const carried = await getNodeById(ctx.graph, previous.componentId);
+          if (carried.ok && carried.value !== null) {
+            const node = carried.value;
+            contextExactResolution = {
+              disposition: "exact",
+              candidates: [{
+                id: node.id,
+                type: node.type,
+                apiName: node.apiName,
+                label: node.label,
+                parentApiName: node.parentId === null ? null : node.parentId.slice(node.parentId.indexOf(":") + 1),
+                score: 1,
+                base: 1,
+                matchKind: "exact",
+                nameCoverage: 1,
+                evidence: `context: exact id carried from the previous turn (${node.id})`
+              }],
+              queryTokens: []
+            };
+            entityQuery = node.apiName;
+            entityTypes = [node.type];
+            contextSubstitution = { anaphor: pronounAnchor, from: "previous.componentId" };
+          } else if (carried.ok) {
+            contextGhostComponentId = previous.componentId;
+          }
+        }
+      }
+      const entityResolution = entityQuery !== null && contextExactResolution === null ? await resolveComponents(ctx.graph, entityQuery, {
         limit: 5,
         ...entityTypes.length > 0 ? { types: entityTypes } : {}
       }) : null;
       const glossaryAwareEntityResolution = entityQuery !== null && entityResolution?.ok === true ? await applyGlossaryAliases(ctx, entityQuery, entityTypes, entityResolution.value) : null;
-      const refinedEntityResolution = entityQuery !== null && glossaryAwareEntityResolution !== null ? refineEntityResolution(entityQuery, glossaryAwareEntityResolution) : null;
+      const refinedEntityResolution = contextExactResolution ?? (entityQuery !== null && glossaryAwareEntityResolution !== null ? resolveParentQualifier(input2.question, refineEntityResolution(entityQuery, glossaryAwareEntityResolution)) : null);
       const entityClarificationRequired = entityQuery !== null && refinedEntityResolution !== null && entityAmbiguityRequiresClarification(entityQuery, refinedEntityResolution);
       let entityEvidence = refinedEntityResolution !== null && refinedEntityResolution.disposition !== "none" ? {
         query: entityQuery,
@@ -56107,13 +58497,37 @@ var init_route_question = __esm({
           clarification: {
             required: true,
             question: "Several components match the named entity. Which component did you mean?",
-            options: entityEvidence?.candidates.map((candidate) => candidate.componentId) ?? []
+            // P4 option hygiene: fuzzy grazes and far-below-top rivals are junk,
+            // not options — offer only the plausible candidates.
+            options: hygienicClarificationOptions(entityEvidence?.candidates ?? []).map((candidate) => candidate.componentId)
           }
         };
       } else if (entityEvidence?.disposition === "ambiguous" && route.clarification === null) {
         route = { ...route, confidence: "medium" };
+      } else if (route.intent === "component-lookup" && route.clarification !== null && refinedEntityResolution?.disposition === "exact") {
+        const winner = refinedEntityResolution.candidates[0];
+        route = {
+          ...route,
+          confidence: "high",
+          clarification: null,
+          suggestedArgs: { ...route.suggestedArgs ?? {}, componentId: winner.id }
+        };
       }
       route = applyComponentTypeGuard(route, resolvedTypeForGuard(route, refinedEntityResolution));
+      let contextEntityApplied = null;
+      if (contextSubstitution !== null && route.intent !== "unrouted" && refinedEntityResolution?.disposition === "exact") {
+        const winner = refinedEntityResolution.candidates[0];
+        const bound = contextArgsFor(route, winner);
+        if (bound !== null) {
+          route = { ...route, suggestedArgs: bound };
+          contextEntityApplied = {
+            kind: "entity-substitution",
+            anaphor: contextSubstitution.anaphor,
+            substitutedComponentId: winner.id,
+            from: contextSubstitution.from
+          };
+        }
+      }
       const marginRouteToolArgs = await buildRouteToolArgsMap(route, ctx);
       if (routerMode() === "hybrid" && route.confidence !== "high") {
         const gateCandidates = buildFunnelCandidates(route, input2.question, marginRouteToolArgs, input2.mode);
@@ -56122,6 +58536,7 @@ var init_route_question = __esm({
           route = { ...route, confidence: "low", clarification: marginClar };
         }
       }
+      let premiseFlagged = false;
       if (entityQuery !== null && refinedEntityResolution !== null && refinedEntityResolution.disposition === "none") {
         const bareQuery = entityQuery.replace(/^(?:the|a|an)\s+/i, "").replace(/\s+(?:class(?:es)?|trigger(?:s)?|field(?:s)?|object(?:s)?|flow(?:s)?|component(?:s)?|layout(?:s)?|profile(?:s)?|report(?:s)?|dashboard(?:s)?|rule(?:s)?)$/i, "");
         const bareRetry = bareQuery !== entityQuery && bareQuery.length > 0 ? await resolveComponents(ctx.graph, bareQuery, {
@@ -56149,6 +58564,7 @@ var init_route_question = __esm({
             }))
           };
         } else {
+          premiseFlagged = true;
           const premiseWarning = `PREMISE CHECK: no component matching '${entityQuery}' exists in the vault \u2014 verify the name (a typo, or metadata newer than the last refresh; /sfi-refresh may help). The routed tool fails closed on an unknown component; do not present its error as an answer about a real component.`;
           route = {
             ...route,
@@ -56165,6 +58581,7 @@ var init_route_question = __esm({
           };
         }
       } else if (entityQuery !== null && refinedEntityResolution !== null && refinedEntityResolution.disposition === "ambiguous" && (/__(?:c|mdt|e|x|b|kav)\b/i.test(entityQuery) || entityQuery.includes(".")) && !refinedEntityResolution.candidates.some((candidate) => candidate.apiName.toLowerCase() === entityQuery.toLowerCase() || candidate.id.toLowerCase().endsWith(`:${entityQuery.toLowerCase()}`))) {
+        premiseFlagged = true;
         const premiseWarning = `PREMISE CHECK: no component named '${entityQuery}' exists in the vault \u2014 the listed candidates are fuzzy lookalikes, not the component you named. Verify the name (a typo, or metadata newer than the last refresh; /sfi-refresh may help). The routed tool fails closed on an unknown component; do not present its error as an answer about a real component.`;
         route = {
           ...route,
@@ -56175,6 +58592,146 @@ var init_route_question = __esm({
           entityEvidence = { ...entityEvidence, warning: premiseWarning };
         }
       }
+      if (contextGhostComponentId !== null) {
+        premiseFlagged = true;
+        const premiseWarning = `PREMISE CHECK: the component carried from the previous turn (${contextGhostComponentId}) no longer exists in the vault (deleted, renamed, or newer than the last refresh; /sfi-refresh may help). Do not answer as if it exists \u2014 re-ask with the component named explicitly.`;
+        route = {
+          ...route,
+          confidence: "low",
+          reason: `${route.reason} ${premiseWarning}`
+        };
+        entityEvidence = {
+          query: contextGhostComponentId,
+          typeHints: [],
+          disposition: "none",
+          clarificationRequired: false,
+          warning: premiseWarning,
+          candidates: []
+        };
+      }
+      let contextRouteApplied = null;
+      if (validatedContext !== null && route.clarification === null && !premiseFlagged) {
+        const previous = validatedContext.previous;
+        const stillUnrouted = route.intent === "unrouted" && route.plane === "unknown";
+        const reparamAnchor = detectReparamAnchor(input2.question);
+        const ownRouteWeak = stillUnrouted || GENERIC_SCHEMA_INTENTS.has(route.intent) && route.confidence !== "high";
+        if (reparamAnchor !== null && ownRouteWeak && previous.tool !== void 0) {
+          let target = contextSubstitution === null && refinedEntityResolution?.disposition === "exact" ? refinedEntityResolution.candidates[0] : null;
+          let newEntityBlocked = false;
+          if (target === null) {
+            const phrase = extractReparamTarget(input2.question);
+            if (phrase !== null) {
+              const resolvedTarget = await resolveComponents(ctx.graph, phrase, { limit: 5 });
+              if (resolvedTarget.ok) {
+                const refinedTarget = refineEntityResolution(phrase, resolvedTarget.value);
+                if (refinedTarget.disposition === "exact") {
+                  target = refinedTarget.candidates[0];
+                } else if (refinedTarget.disposition === "ambiguous" && entityAmbiguityRequiresClarification(phrase, refinedTarget)) {
+                  route = {
+                    ...route,
+                    confidence: "low",
+                    clarification: {
+                      required: true,
+                      question: "Several components match the named entity. Which component did you mean?",
+                      options: hygienicClarificationOptions(refinedTarget.candidates.slice(0, 5)).map((candidate) => candidate.id)
+                    }
+                  };
+                  newEntityBlocked = true;
+                }
+              }
+            }
+          }
+          if (!newEntityBlocked && target !== null) {
+            const continuation = buildContextContinuation(input2.question, previous.tool, target, reparamAnchor, false);
+            if (continuation !== null) {
+              route = continuation;
+              contextRouteApplied = {
+                kind: "reparameterization",
+                anaphor: reparamAnchor,
+                substitutedComponentId: target.id,
+                inheritedTool: previous.tool
+              };
+            }
+          }
+        }
+        if (contextRouteApplied === null && route.clarification === null && stillUnrouted && route.intent === "unrouted" && previous.tool !== void 0) {
+          const anchor = pronounAnchor ?? reparamAnchor;
+          const substitutedExact = contextSubstitution !== null && refinedEntityResolution?.disposition === "exact";
+          if (anchor !== null && (substitutedExact || previous.componentId === void 0)) {
+            const winner = substitutedExact ? refinedEntityResolution.candidates[0] : null;
+            const newEntityAppeared = contextSubstitution === null && entityQuery !== null && !isAnaphorOnly(entityQuery);
+            const continuation = buildContextContinuation(input2.question, previous.tool, winner, anchor, newEntityAppeared);
+            if (continuation !== null) {
+              route = continuation;
+              contextRouteApplied = {
+                kind: "continuation",
+                anaphor: anchor,
+                ...winner !== null ? {
+                  substitutedComponentId: winner.id,
+                  from: contextSubstitution.from
+                } : {},
+                inheritedTool: previous.tool
+              };
+            }
+          }
+        }
+      }
+      let advisoryCandidates = null;
+      if (route.intent === "unrouted" && route.plane === "unknown" && route.clarification === null && !premiseFlagged) {
+        const cands = buildFunnelCandidates(route, input2.question, marginRouteToolArgs, input2.mode);
+        advisoryCandidates = cands;
+        const resolvedExact = refinedEntityResolution?.disposition === "exact" ? refinedEntityResolution.candidates[0] : void 0;
+        const usable = resolvedExact === void 0 ? cands : cands.filter((candidate) => {
+          const compatible = TOOL_COMPATIBLE_TYPES.get(candidate.tool);
+          return compatible === void 0 || compatible.has(resolvedExact.type);
+        });
+        const top = usable[0];
+        if (top !== void 0 && top.score >= FUNNEL_PRIMARY_MIN_SCORE && top.fromRoute !== true && top.score > 0.25) {
+          const tools = usable.slice(0, 3).map((candidate) => candidate.tool);
+          let advisoryArgs = null;
+          if (resolvedExact !== void 0) {
+            const compatible = TOOL_COMPATIBLE_TYPES.get(top.tool);
+            if (compatible !== void 0 && compatible.has(resolvedExact.type)) {
+              advisoryArgs = top.tool === "sfi.field_access_audit" ? { fieldId: resolvedExact.id } : { componentId: resolvedExact.id };
+            } else if (compatible === void 0 && /get_impact|get_edges|component/.test(top.tool)) {
+              advisoryArgs = { componentId: resolvedExact.id };
+            }
+          }
+          route = {
+            question: input2.question,
+            plane: top.plane,
+            intent: "funnel-advisory",
+            tools,
+            liveRequired: top.liveRequired,
+            needsResolve: entityQuery !== null,
+            reason: "No deterministic intent matched. This route is FUNNEL-DERIVED (advisory): the semantic funnel ranked these tools by meaning alone. Confidence is low by construction \u2014 verify the pick, resolve any named component first, and ground with sfi.synthesize_answer.",
+            gap: null,
+            confidence: "low",
+            risk: DESTRUCTIVE_TOOL.test(top.tool) ? "destructive" : "informational",
+            alternatives: [],
+            clarification: null,
+            plan: [{
+              stepId: "step-1",
+              dependsOn: [],
+              question: input2.question,
+              intent: "funnel-advisory",
+              plane: top.plane,
+              tools
+            }],
+            ...advisoryArgs !== null ? { suggestedArgs: advisoryArgs } : {}
+          };
+        }
+      }
+      const contextApplied = contextRouteApplied ?? contextEntityApplied;
+      if (contextApplied !== null) {
+        route = {
+          ...route,
+          contextApplied: {
+            ...contextApplied,
+            ...validatedContext !== null && validatedContext.ignored.length > 0 ? { ignored: validatedContext.ignored } : {}
+          }
+        };
+      }
       const clarificationId = clarificationIdFor(ctx.manifest.sourceTreeHash, route);
       if (clarificationId !== null && route.clarification !== null) {
         route = {
@@ -56281,7 +58838,7 @@ var init_route_question = __esm({
       const routeToolArgs = await buildRouteToolArgsMap(route, ctx);
       const invoke = toolProfile() === "core" && !executionBlocked ? invokeFromArgsMap(route, routeToolArgs) : void 0;
       const wantCandidates = routerMode() === "hybrid";
-      const toolCandidates = wantCandidates ? buildFunnelCandidates(route, input2.question, routeToolArgs, input2.mode) : [];
+      const toolCandidates = wantCandidates ? advisoryCandidates ?? buildFunnelCandidates(route, input2.question, routeToolArgs, input2.mode) : [];
       const guidance = toolCandidates.length > 0 ? guidanceForMode(input2.mode, toolCandidates) : void 0;
       return ok({
         data: {
@@ -65497,6 +68054,40 @@ var init_tools = __esm({
             clarificationId: { type: "string", minLength: 1 },
             selection: { type: "string", minLength: 1 }
           }
+        },
+        mode: { type: "string", enum: ["ask", "plan", "assessment"] },
+        context: {
+          type: "object",
+          required: ["previous"],
+          additionalProperties: false,
+          properties: {
+            previous: {
+              type: "object",
+              additionalProperties: false,
+              properties: {
+                componentId: { type: "string", minLength: 1, maxLength: 256 },
+                objectApiName: { type: "string", minLength: 1, maxLength: 256 },
+                tool: { type: "string", pattern: "^sfi\\.[a-z0-9_]+$" },
+                intent: { type: "string", minLength: 1, maxLength: 64 },
+                plane: { type: "string", enum: ["vault", "live", "hybrid"] },
+                question: { type: "string", minLength: 1, maxLength: 2e3 },
+                clarification: {
+                  type: "object",
+                  required: ["clarificationId", "options"],
+                  additionalProperties: false,
+                  properties: {
+                    clarificationId: { type: "string", minLength: 1, maxLength: 64 },
+                    options: {
+                      type: "array",
+                      items: { type: "string", minLength: 1, maxLength: 256 },
+                      minItems: 1,
+                      maxItems: 10
+                    }
+                  }
+                }
+              }
+            }
+          }
         }
       }
     });
@@ -66886,7 +69477,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.resolve",
-        description: "Typo-tolerant resolver: messy/misspelled text -> ranked candidate components with a disposition (exact|ambiguous|none) + per-candidate evidence. Call FIRST when the user names a component informally; tolerates typos, filler, and the org's own misspellings that search_components cannot. Leading/trailing schema nouns are TYPE hints, not name content: 'SSN field' scores exactly like bare 'SSN' (the noun is stripped from fuzzy matching and instead prefers candidates of the hinted type among equally-confident matches \u2014 it never floats a weak fuzzy match of that type over an exact-name match of another). A dotted 'Object.Field' query is a definitive parent-scoped hit. CONFIRMED glossary annotations act as curated synonyms (candidates marked `glossary-alias`) \u2014 an alias never shadows an exact api-name match, and a synonym shared by two components yields `ambiguous` + clarification. Heuristic; never silently picks.",
+        description: "Typo-tolerant resolver: messy/misspelled text -> ranked candidate components with a disposition (exact|ambiguous|none) + per-candidate evidence. Call FIRST when the user names a component informally; tolerates typos, filler, and the org's own misspellings that search_components cannot. Also the answer to informal lookup asks \u2014 'find / look up / locate the X', 'do we have a field for tracking Y?', 'I think there's a flow called something like Z' \u2014 whenever the user only half-remembers a name or describes the thing instead of naming it. Leading/trailing schema nouns are TYPE hints, not name content: 'SSN field' scores exactly like bare 'SSN' (the noun is stripped from fuzzy matching and instead prefers candidates of the hinted type among equally-confident matches \u2014 it never floats a weak fuzzy match of that type over an exact-name match of another). A dotted 'Object.Field' query is a definitive parent-scoped hit. CONFIRMED glossary annotations act as curated synonyms (candidates marked `glossary-alias`) \u2014 an alias never shadows an exact api-name match, and a synonym shared by two components yields `ambiguous` + clarification. Heuristic; never silently picks.",
         inputSchema: RESOLVE_INPUT_SCHEMA
       },
       {
@@ -66916,7 +69507,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.route_question",
-        description: "Front-door router: for a plain-language question, surface a meaning-ranked shortlist of the sfi.* tools that can answer it \u2014 your host LLM picks which to run \u2014 plus the plane it belongs to (vault | live | hybrid | unknown), so the user never types a tool name. Read-only; it advises, it does not answer. Compound questions carry step ids and `dependsOn` edges: independent steps may run in parallel; a `then`-linked step waits for its prerequisite. On GENUINE ambiguity it fails closed with `executionBlocked`, a clarification id, and offered options; resume deterministically by calling again with the exact same question plus `clarificationResponse: { clarificationId, selection }`. Stale ids and invented selections are rejected. Bare schema nouns in the question (trigger/flow/field/object/profile/permission set/record type) are INTENT vocabulary, never named-entity lookups \u2014 'the Contact trigger' scopes a save-order question to the Contact OBJECT, it does not shop 'trigger' to the resolver; an object-qualified field ('Status__c on Case') is resolved parent-scoped; and an entity the resolver reports `exact` never raises the components-match menu \u2014 that menu is reserved for two genuinely competing components. The resolved TYPE also gates the routed tools: when the named entity resolves to a FLOW, tools that hard-error on a Flow id (call_graph / method_reachability / explain_apex_method, and the object/field access audits) are SWAPPED for the Flow-appropriate ones (who_can_run for access asks, explain_flow \u2014 which narrates the Apex the Flow invokes \u2014 plus get_impact) instead of routing into a guaranteed error. Qualifier words never outrank the HEAD question: 'bulk'/'load' on a save-order or test-coverage ask, 'seats'/'license' on a permission-set-assignment ask, and 'integration'/vendor words on a field-write / profile-security / what-if ask all stay on the head intent (never forced onto governor_limit_risks / live_license_usage / integration_map); field_lineage is reserved for explicit lineage/provenance questions ('where does this data come from'), never a field-adjacent default. FALSE PREMISE: when the question names a component the resolver cannot find \u2014 disposition `none`, or a literal API reference (dotted / __c-suffixed) that none of the fuzzy candidates actually match \u2014 the route is STILL returned (the routed tool fails closed on the unknown id) but its confidence is downgraded and `entityEvidence.warning` carries a premise disclosure (no component matching '<name>' exists in the vault \u2014 verify the name), so a nonexistent component is never answered as if it were real. Honesty routes: asks the surface genuinely cannot answer route to an explicit gap, never a lookalike tool \u2014 e.g. 'which USERS hold permission set X' (PermissionSetAssignment is not modeled; effective_permissions describes GRANTS, not holders); profile user-roster asks route live (live_group_count over User by ProfileId) with a partial-answer disclosure; and cross-vault compare routes carry a disclosure that a SECOND registered vault is required, so a single-vault install is never routed confident-clean into vault-not-found. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, surfaces `suggestedArgs` (heuristic per-intent hints \u2014 e.g. `event: 'update'` for a save-order question so you can call `what_happens_on_save` without guessing the DML event), and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap instead of fabricating (set `logGap: true` to also append the gap to the local backlog; off by default, privacy-first per CR-16); under `SFI_TOOL_PROFILE=core` the response also carries `invoke`: the routed tools as EXECUTABLE calls (core tools direct, everything else as the byte-identical `sfi.run_analysis` gateway envelope, suggestedArgs threaded) (a short phrase that merely NAMES a real vault component, with no question, is instead routed to sfi.resolve rather than 'unknown'). In the default hybrid mode the meaning-ranked `toolCandidates` are PRIMARY: every routable question carries the shortlist (offline TF-IDF over the capability map, no neural model, no network) plus a `guidance` line stating the loop YOU own \u2014 read the candidates \u2192 resolve any named component \u2192 pick/sequence the tool(s) \u2192 run them \u2192 ground via sfi.synthesize_answer. YOU decide which to run; the deterministic `route` rides along only as a non-authoritative HINT (suggested tool order + any resolved entity / suggestedArgs). Set `SFI_ROUTER_MODE=offline` for a deterministic, no-LLM route (Design A) where the route is authoritative and candidates are omitted \u2014 for CI / air-gapped hosts. An optional `mode` ('ask' | 'plan' | 'assessment') tailors the guidance and reranks the candidates toward that mode's family \u2014 'plan' favors the what_if_* / impact tools (an ordered change plan), 'assessment' favors the *_risk_report / readiness / coverage tools (a full evaluation), 'ask' is a quick grounded answer. Call this first on a vague/broad question to decide which tool(s) to run.",
+        description: "Front-door router: for a plain-language question, surface a meaning-ranked shortlist of the sfi.* tools that can answer it \u2014 your host LLM picks which to run \u2014 plus the plane it belongs to (vault | live | hybrid | unknown), so the user never types a tool name. Read-only; it advises, it does not answer. Compound questions carry step ids and `dependsOn` edges: independent steps may run in parallel; a `then`-linked step waits for its prerequisite. On GENUINE ambiguity it fails closed with `executionBlocked`, a clarification id, and offered options; resume deterministically by calling again with the exact same question plus `clarificationResponse: { clarificationId, selection }`. Stale ids and invented selections are rejected. CLARIFICATIONS ARE A LAST RESORT (router-v2 P4): a qualifier already in the question pre-answers the menu \u2014 an object word next to a same-named field ('\u2026saving a CASE without a Resolution_Code__c'), a type word after the name ('the X OBJECT/FLOW'), an underscored/dotted literal api name, or a component mention on a who-last-modified ask all AUTO-RESOLVE instead of blocking; a CustomTab twin of a CustomObject never counts as a rival; complementary readings (who-can-access grantors vs CRUD matrix, impact readout vs change/delete simulation on the same ask) STACK their tools in one route instead of asking which-first; a vault-vs-live candidate near-tie is decided by the question's own runtime-data language (live leads WITH the consent disclosure, vault otherwise) rather than blocking \u2014 only the DESTRUCTIVE-vs-read-only tool tie still stops execution; and offered options are HYGIENIC \u2014 fuzzy acronym-graze rivals (SSN vs {A,B,M}SN_*) and far-below-top junk never appear as options. Bare schema nouns in the question (trigger/flow/field/object/profile/permission set/record type) are INTENT vocabulary, never named-entity lookups \u2014 'the Contact trigger' scopes a save-order question to the Contact OBJECT, it does not shop 'trigger' to the resolver; an object-qualified field ('Status__c on Case') is resolved parent-scoped; and an entity the resolver reports `exact` never raises the components-match menu \u2014 that menu is reserved for two genuinely competing components. The resolved TYPE also gates the routed tools: when the named entity resolves to a FLOW, tools that hard-error on a Flow id (call_graph / method_reachability / explain_apex_method, and the object/field access audits) are SWAPPED for the Flow-appropriate ones (who_can_run for access asks, explain_flow \u2014 which narrates the Apex the Flow invokes \u2014 plus get_impact) instead of routing into a guaranteed error. Qualifier words never outrank the HEAD question: 'bulk'/'load' on a save-order or test-coverage ask, 'seats'/'license' on a permission-set-assignment ask, and 'integration'/vendor words on a field-write / profile-security / what-if ask all stay on the head intent (never forced onto governor_limit_risks / live_license_usage / integration_map); field_lineage is reserved for explicit lineage/provenance questions ('where does this data come from'), never a field-adjacent default. FALSE PREMISE: when the question names a component the resolver cannot find \u2014 disposition `none`, or a literal API reference (dotted / __c-suffixed) that none of the fuzzy candidates actually match \u2014 the route is STILL returned (the routed tool fails closed on the unknown id) but its confidence is downgraded and `entityEvidence.warning` carries a premise disclosure (no component matching '<name>' exists in the vault \u2014 verify the name), so a nonexistent component is never answered as if it were real. Honesty routes: asks the surface genuinely cannot answer route to an explicit gap, never a lookalike tool \u2014 e.g. 'which USERS hold permission set X' (PermissionSetAssignment is not modeled; effective_permissions describes GRANTS, not holders); profile user-roster asks route live (live_group_count over User by ProfileId) with a partial-answer disclosure; and cross-vault compare routes carry a disclosure that a SECOND registered vault is required, so a single-vault install is never routed confident-clean into vault-not-found. Tells you when to sfi.resolve a named component first, whether the opt-in live plane is required, surfaces `suggestedArgs` (heuristic per-intent hints \u2014 e.g. `event: 'update'` for a save-order question so you can call `what_happens_on_save` without guessing the DML event), and \u2014 when the question hits a capability we lack \u2014 returns an honest 'unknown'/gap instead of fabricating (set `logGap: true` to also append the gap to the local backlog; off by default, privacy-first per CR-16); under `SFI_TOOL_PROFILE=core` the response also carries `invoke`: the routed tools as EXECUTABLE calls (core tools direct, everything else as the byte-identical `sfi.run_analysis` gateway envelope, suggestedArgs threaded) (a short phrase that merely NAMES a real vault component, with no question, is instead routed to sfi.resolve rather than 'unknown'). In the default hybrid mode the meaning-ranked `toolCandidates` are PRIMARY: every routable question carries the shortlist (offline TF-IDF over the capability map, no neural model, no network) plus a `guidance` line stating the loop YOU own \u2014 read the candidates \u2192 resolve any named component \u2192 pick/sequence the tool(s) \u2192 run them \u2192 ground via sfi.synthesize_answer. YOU decide which to run; the deterministic `route` rides along only as a non-authoritative HINT (suggested tool order + any resolved entity / suggestedArgs). Set `SFI_ROUTER_MODE=offline` for a deterministic, no-LLM route (Design A) where the route is authoritative and candidates are omitted \u2014 for CI / air-gapped hosts. An optional `mode` ('ask' | 'plan' | 'assessment') tailors the guidance and reranks the candidates toward that mode's family \u2014 'plan' favors the what_if_* / impact tools (an ordered change plan), 'assessment' favors the *_risk_report / readiness / coverage tools (a full evaluation), 'ask' is a quick grounded answer. REFUSAL SHAPES (score-independent, evaluated BEFORE any intent, in both router modes): a write/mutation imperative aimed at the agent ('delete the X field for me', 'go ahead and merge\u2026') returns intent `refused-write` with EMPTY tools, a 'REFUSED (read-only boundary)' disclosure, and a read-side alternative to offer instead (safe_to_delete_field / what_if_deactivate_flow / what_if_disable_trigger / what_if_change_field_type / what_if_merge_profiles / get_impact by verb family); prompt-injection or record-value exfiltration ('ignore your previous instructions\u2026', 'dump all SSN values') returns `refused-injection` with toolCandidates AND guidance suppressed entirely; runtime/ops telemetry no tool models (login history, adoption metrics, endpoint errors 'this week', running-user context) returns `honest-gap-runtime` with an 'HONEST GAP' disclosure naming the nearest reads; and non-Salesforce asks (SharePoint/Jira subjects, org-policy authorship, 'email me\u2026' delivery, write-me-code) return `out-of-scope`. Every refusal is NON-EXECUTABLE by shape \u2014 `tools: []`, the structured `route.refusal` field carries { kind, disclosure, readOnlyAlternative? }, `executionBlocked` stays false \u2014 and legitimate permission/hypothetical READS ('am I allowed to edit\u2026', 'who can delete\u2026', 'is it safe to\u2026', 'what would happen if\u2026') are explicit excluders that route normally. FUNNEL-PRIMARY (advisory): when NO deterministic intent matches and nothing else stopped the route (no clarification, and a clean premise \u2014 a question naming a component the resolver cannot find gets the premise disclosure, never an advisory route), a pure-semantic top candidate scoring \u2265 0.26 upgrades the dead 'unrouted' to intent `funnel-advisory`: the top-3 funnel tools, confidence LOW by construction, reason flagged FUNNEL-DERIVED \u2014 treat it as the funnel's advisory pick to verify (resolve the named component, then ground), never a command. Candidate rows also carry `cosine`, the raw pre-fusion semantic score (0 for rows inserted purely from the regex route hint), so a host can tell real semantic support from regex assertion. CONVERSATION CONTEXT (stateless, host-passed \u2014 router-v2 P5): the product stores NO conversation memory; the HOST may pass optional `context.previous` per call ({ componentId, objectApiName, tool, intent, plane, question, clarification }) describing what the PRIOR turn was about, and nothing is stored server-side. With it, terse follow-ups resolve: (1) a pronoun/ellipsis follow-up whose own extraction finds no entity ('does it fire on delete too?') substitutes `previous.componentId` as the entity \u2014 an EXACT-id lookup, never fuzzy \u2014 and, when still unrouted, inherits `previous.tool` as an advisory `context-continuation` route (confidence capped at `medium`, never high; plane/liveRequired always from the live tool registry, never `previous.plane`; the resolved TYPE still gates the inherited tool \u2014 a type-incompatible inheritance is swapped or dropped to funnel-primary, never an executable tool bound to an id that guarantees a hard error); (2) a re-parameterization follow-up ('what about on Contact?') re-runs `previous.tool` against the NEW target from the question itself \u2014 an ambiguous new entity still blocks with a clarification; (3) an ordinal/descriptor pick ('the second one', 'the Contact one') against `previous.clarification` + `previous.question` re-dispatches through the full clarification-continuation contract (stale ids rejected exactly as usual; 0 or \u22652 descriptor matches, or an out-of-range ordinal, re-ask instead of guessing). HONESTY UNDER CONTEXT: refusal gates run on the RAW question BEFORE any context logic \u2014 context never bypasses them and adds no executable path to a refused turn; a carried componentId that no longer resolves gets a context-specific PREMISE disclosure and never advisory-routes; value validation is FAIL-OPEN (an unregistered `tool` / malformed `componentId` is skipped and noted in `contextApplied.ignored`, never a hard error \u2014 shape errors still reject). A SELF-CONTAINED question IGNORES context: no anaphor, or a confident own route, returns a response identical to the no-context call, and omitting `context` keeps behavior byte-identical. When (and only when) context changes the route, the response disclosure `route.contextApplied` carries { kind: 'entity-substitution' | 'continuation' | 'reparameterization' | 'clarification-selection', anaphor, substitutedComponentId?, from?, inheritedTool?, selection?, ignored? } and the rendered text appends a 'Context applied: \u2026' line \u2014 mere presence of the param never emits it. Call this first on a vague/broad question to decide which tool(s) to run.",
         inputSchema: ROUTE_QUESTION_INPUT_SCHEMA
       },
       {
@@ -67386,7 +69977,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.what_happens_on_save",
-        description: "What ALREADY runs when a record on this object is created or updated \u2014 every existing automation (flows, triggers, validation rules, workflow, approvals, assignment rules) that fires on save, in the order it fires. Use it before building a new automation to check what's already there and whether your new process would duplicate or collide with an existing one. Produce the documented Salesforce order-of-execution (SOE) instantiated for THIS org and the given DML event on the target object. Walks the canonical SOE phases in order \u2014 before-save-flows (before-save record-triggered Flows \u2014 `triggersOn` edge `triggerType` RecordBeforeSave \u2014 which run FIRST, ahead of before-triggers; insert/update only), pre-save-validation (ValidationRules), pre-save-triggers + after-triggers (ApexTriggers whose `events` includes a matching `before <event>` / `after <event>` lifecycle entry), save (a documented placeholder for system validation + DB write), post-save-flows (record-triggered AFTER-save Flows whose `recordTriggerType` matches the event), post-save-workflows (WorkflowRules whose `triggerType` matches), post-save-assignment (Lead/Case AssignmentRules + AutoResponseRules + EscalationRules parented to the object), post-save-approval (ApprovalProcesses parented to the object), and post-save-async (ApexClasses dispatched via `dispatchesAsync` from any trigger above). Only ACTIVE automation is listed as execution steps \u2014 Draft/Obsolete Flows and active:false rules/processes are omitted from `soe` and surfaced in `inactiveConfigured` when present. Each step carries the firer's id/type/apiName, the gating `firesWhen` ConditionalContext when one exists, and an actions array enumerating the firer's outgoing edges (excluding structural parentOf/triggersOn/firesWhen). Honesty axis (verbatim): conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether the runtime record satisfies them. Workflow field updates can re-fire before/after-update triggers (a second pass); the composition lists each automation once. A workflow rule's time-dependent actions (workflowTimeTriggers) are SCHEDULED for a record-level offset the offline vault cannot evaluate; the rule is listed once in the synchronous post-save-workflows phase and its time-delayed actions are NOT claimed to fire at save. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.",
+        description: "What ALREADY runs when a record on this object is created or updated \u2014 every existing automation (flows, triggers, validation rules, workflow, approvals, assignment rules) that fires on save, in the order it fires. Use it before building a new automation to check what's already there and whether your new process would duplicate or collide with an existing one. Also the answer to informal asks like 'what fires / runs when I save an Account', 'everything that touches X on save', 'we keep hitting record-lock errors \u2014 what's colliding on this object', 'any automation on X I should know about before adding more' (for WHICH automation is risky, use automation_risk_report instead). Produce the documented Salesforce order-of-execution (SOE) instantiated for THIS org and the given DML event on the target object. Walks the canonical SOE phases in order \u2014 before-save-flows (before-save record-triggered Flows \u2014 `triggersOn` edge `triggerType` RecordBeforeSave \u2014 which run FIRST, ahead of before-triggers; insert/update only), pre-save-validation (ValidationRules), pre-save-triggers + after-triggers (ApexTriggers whose `events` includes a matching `before <event>` / `after <event>` lifecycle entry), save (a documented placeholder for system validation + DB write), post-save-flows (record-triggered AFTER-save Flows whose `recordTriggerType` matches the event), post-save-workflows (WorkflowRules whose `triggerType` matches), post-save-assignment (Lead/Case AssignmentRules + AutoResponseRules + EscalationRules parented to the object), post-save-approval (ApprovalProcesses parented to the object), and post-save-async (ApexClasses dispatched via `dispatchesAsync` from any trigger above). Only ACTIVE automation is listed as execution steps \u2014 Draft/Obsolete Flows and active:false rules/processes are omitted from `soe` and surfaced in `inactiveConfigured` when present. Each step carries the firer's id/type/apiName, the gating `firesWhen` ConditionalContext when one exists, and an actions array enumerating the firer's outgoing edges (excluding structural parentOf/triggersOn/firesWhen). Honesty axis (verbatim): conditions ARE listed but NOT EVALUATED \u2014 the tool does not know whether the runtime record satisfies them. Workflow field updates can re-fire before/after-update triggers (a second pass); the composition lists each automation once. A workflow rule's time-dependent actions (workflowTimeTriggers) are SCHEDULED for a record-level offset the offline vault cannot evaluate; the rule is listed once in the synchronous post-save-workflows phase and its time-delayed actions are NOT claimed to fire at save. Manual sharing, sharing sets, account teams, and Apex callouts after save are out of scope.",
         inputSchema: WHAT_HAPPENS_ON_SAVE_INPUT_SCHEMA
       },
       {
@@ -67775,7 +70366,7 @@ var init_tools = __esm({
       },
       {
         name: "sfi.find_component_usages",
-        description: 'The universal "where is this component used?" answer for ANY canonical component type (`componentId`) \u2014 one entry point instead of fanning out across find_field_anywhere / find_code_usages / get_impact / grep. Composes two evidence tiers: (1) GRAPH \u2014 incoming dependency edges to the target, grouped by referrer type, each carrying edge `confidence`, EXCLUDING access grants (`grantedBy`) and structural `parentOf` (access is not usage); (2) GREP supplement (`text-match` tier, `includeGrep` default true) \u2014 a literal search of Apex AND frontend bundle source (LWC/Aura/Visualforce \u2014 `$Label`/`$Resource`/`@salesforce` module references) for the api name, catching references the graph does not model (dynamic SOQL, reflective access, CustomMetadataType / CustomLabel / StaticResource refs). `graphReferrers[]` (type + count + sample), `grepSupplement` (matches with path/line/snippet), `summary` (counts + `hasStaticEvidence`), `boundaries[]`, `truncated`. ACCESS-GRANT section: grants stay OUT of `graphReferrers`, but a separate `grantedBy` section (`{count, granters[{id,type}]}`) surfaces the granting containers when the target is a `CustomPermission` (its only incoming edges ARE grants \u2014 this answers "which Profiles / PermissionSets grant it?"; always present for that type, count 0 = no container grants it) or when the target has zero usage edges but incoming `grantedBy` edges; absent otherwise. HONESTY: empty graph + empty grep = "no static evidence in the vault" (in `boundaries`), NEVER "nothing uses this" \u2014 dynamic constructs, un-modeled families (reports/dashboards/list-views), and managed packages are invisible; grants are NOT usage, so `grantedBy` never counts toward `hasStaticEvidence`. Phantom-aware (a referenced-but-not-retrieved target still answers from its edges, including a granted-but-undefined managed-package CustomPermission). Specialized tools (find_field_anywhere, layout_assignments, \u2026) stay for a deeper single-family answer; this unifies the common case. Non-canonical id \u2192 `invalid-query`; an id with no node, no referrers AND no grants \u2192 `component-not-found`.',
+        description: 'The universal "where is this component used?" answer for ANY canonical component type (`componentId`) \u2014 one entry point instead of fanning out across find_field_anywhere / find_code_usages / get_impact / grep. Also the answer to informal asks like \'who has this permission set / which profiles grant it\', \'what references / calls into this component\', \'is this still used anywhere\' \u2014 it answers what points TO a named component (use search_components to find components MATCHING a description). Composes two evidence tiers: (1) GRAPH \u2014 incoming dependency edges to the target, grouped by referrer type, each carrying edge `confidence`, EXCLUDING access grants (`grantedBy`) and structural `parentOf` (access is not usage); (2) GREP supplement (`text-match` tier, `includeGrep` default true) \u2014 a literal search of Apex AND frontend bundle source (LWC/Aura/Visualforce \u2014 `$Label`/`$Resource`/`@salesforce` module references) for the api name, catching references the graph does not model (dynamic SOQL, reflective access, CustomMetadataType / CustomLabel / StaticResource refs). `graphReferrers[]` (type + count + sample), `grepSupplement` (matches with path/line/snippet), `summary` (counts + `hasStaticEvidence`), `boundaries[]`, `truncated`. ACCESS-GRANT section: grants stay OUT of `graphReferrers`, but a separate `grantedBy` section (`{count, granters[{id,type}]}`) surfaces the granting containers when the target is a `CustomPermission` (its only incoming edges ARE grants \u2014 this answers "which Profiles / PermissionSets grant it?"; always present for that type, count 0 = no container grants it) or when the target has zero usage edges but incoming `grantedBy` edges; absent otherwise. HONESTY: empty graph + empty grep = "no static evidence in the vault" (in `boundaries`), NEVER "nothing uses this" \u2014 dynamic constructs, un-modeled families (reports/dashboards/list-views), and managed packages are invisible; grants are NOT usage, so `grantedBy` never counts toward `hasStaticEvidence`. Phantom-aware (a referenced-but-not-retrieved target still answers from its edges, including a granted-but-undefined managed-package CustomPermission). Specialized tools (find_field_anywhere, layout_assignments, \u2026) stay for a deeper single-family answer; this unifies the common case. Non-canonical id \u2192 `invalid-query`; an id with no node, no referrers AND no grants \u2192 `component-not-found`.',
         inputSchema: FIND_COMPONENT_USAGES_INPUT_SCHEMA
       },
       {
@@ -69855,7 +72446,7 @@ var init_package_version = __esm({
     "use strict";
     readCliPackageVersion = () => {
       if (true)
-        return "0.1.21";
+        return "0.1.22";
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
           const raw = readFileSync3(fileURLToPath(new URL(rel, import.meta.url)), "utf8");
@@ -136983,10 +139574,10 @@ var init_refresh = __esm({
         progress(`Incremental: reused ${walked.reusedCount} unchanged file(s) from cache.`);
       }
       if (!opts.noPull && (requestedTypes === null || requestedTypes.has("CustomObject"))) {
-        const expand2 = objectsToExpandManifest(walked.results);
-        if (expand2.length > 0) {
-          progress(`Auto-expanding retrieve: ${expand2.length} object(s) your automation references but the wildcard excluded...`);
-          const pulled2 = await runSfRetrieveObjects(targetOrg, paths.source, expand2);
+        const expand = objectsToExpandManifest(walked.results);
+        if (expand.length > 0) {
+          progress(`Auto-expanding retrieve: ${expand.length} object(s) your automation references but the wildcard excluded...`);
+          const pulled2 = await runSfRetrieveObjects(targetOrg, paths.source, expand);
           if (pulled2.ok) {
             walked = await walkAndExtract(paths.source, requestedTypes, prevCache);
           } else {
@@ -139779,7 +142370,7 @@ var makeShutdownOnce = (ctx) => {
 
 // dist/src/commands/demo.js
 init_refresh();
-var buildVersion = () => true ? "0.1.21" : "dev";
+var buildVersion = () => true ? "0.1.22" : "dev";
 var SHUTDOWN_SIGNALS2 = ["SIGINT", "SIGTERM"];
 var resolveDemoSource = () => {
   let dir = dirname21(fileURLToPath2(import.meta.url));
@@ -140764,7 +143355,7 @@ init_vault_git();
 init_watch();
 var readVersion = () => {
   if (true)
-    return "0.1.21";
+    return "0.1.22";
   const pkgUrl = new URL("../../package.json", import.meta.url);
   const raw = readFileSync6(fileURLToPath3(pkgUrl), "utf8");
   const parsed = JSON.parse(raw);