sf-intelligence 0.2.4 → 0.2.5

package/dist/index.js

@@ -357,12 +357,163 @@ var init_src = __esm({
   }
 });
 
+// ../graph/dist/src/relationship-refs.js
+var objectApiNameOf, AMBIGUOUS, buildRelationshipMaps, resolveTraversalTarget, RELATIONSHIP_RESOLVER_SOURCE, mintRelationshipTraversalEdges;
+var init_relationship_refs = __esm({
+  "../graph/dist/src/relationship-refs.js"() {
+    "use strict";
+    objectApiNameOf = (parentId) => {
+      if (parentId === null)
+        return null;
+      const prefix = "CustomObject:";
+      return parentId.startsWith(prefix) ? parentId.slice(prefix.length) : null;
+    };
+    AMBIGUOUS = /* @__PURE__ */ Symbol("ambiguous");
+    buildRelationshipMaps = (nodes) => {
+      const parentward = /* @__PURE__ */ new Map();
+      const childward = /* @__PURE__ */ new Map();
+      for (const node of nodes) {
+        if (node.type !== "CustomField")
+          continue;
+        const owningObject = objectApiNameOf(node.parentId);
+        if (owningObject === null)
+          continue;
+        const referenceTo = node.properties["referenceTo"];
+        if (typeof referenceTo !== "string" || referenceTo.length === 0)
+          continue;
+        const fieldApiName = node.apiName;
+        const traversal = fieldApiName.endsWith("__c") ? `${fieldApiName.slice(0, -3)}__r` : fieldApiName.replace(/Id$/, "");
+        if (traversal.length > 0) {
+          const key = `${owningObject.toLowerCase()}|${traversal.toLowerCase()}`;
+          const existing = parentward.get(key);
+          if (existing === void 0) {
+            parentward.set(key, referenceTo);
+          } else if (existing !== referenceTo) {
+            parentward.set(key, AMBIGUOUS);
+          }
+        }
+        const relationshipName = node.properties["relationshipName"];
+        if (typeof relationshipName === "string" && relationshipName.length > 0) {
+          for (const key of [relationshipName, `${relationshipName}__r`]) {
+            const lower = key.toLowerCase();
+            const existing = childward.get(lower);
+            if (existing === void 0) {
+              childward.set(lower, owningObject);
+            } else if (existing !== owningObject) {
+              childward.set(lower, AMBIGUOUS);
+            }
+          }
+        }
+      }
+      const resolve18 = (raw) => {
+        const out = /* @__PURE__ */ new Map();
+        for (const [key, value] of raw) {
+          if (value !== AMBIGUOUS)
+            out.set(key, value);
+        }
+        return out;
+      };
+      return { parentward: resolve18(parentward), childward: resolve18(childward) };
+    };
+    resolveTraversalTarget = (path2, owningObject, maps) => {
+      const segments = path2.split(".");
+      if (segments.length < 2)
+        return null;
+      let current = owningObject;
+      for (const hop of segments.slice(0, -1)) {
+        const next = maps.parentward.get(`${current.toLowerCase()}|${hop.toLowerCase()}`);
+        if (next === void 0)
+          return null;
+        current = next;
+      }
+      const field = segments[segments.length - 1];
+      if (field === void 0 || field.length === 0)
+        return null;
+      return `CustomField:${current}.${field}`;
+    };
+    RELATIONSHIP_RESOLVER_SOURCE = "relationship-resolver";
+    mintRelationshipTraversalEdges = (nodes, edges) => {
+      const maps = buildRelationshipMaps(nodes);
+      const fieldIds = /* @__PURE__ */ new Set();
+      for (const node of nodes) {
+        if (node.type === "CustomField")
+          fieldIds.add(node.id);
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const edge of edges) {
+        seen.add(`${edge.fromId}\0${edge.toId}\0${edge.edgeType}`);
+      }
+      const emit = (fromId, toId, confidence, properties) => {
+        if (!fieldIds.has(toId))
+          return;
+        const key = `${fromId}\0${toId}\0references`;
+        if (seen.has(key))
+          return;
+        seen.add(key);
+        edges.push({
+          fromId,
+          toId,
+          edgeType: "references",
+          confidence,
+          source: RELATIONSHIP_RESOLVER_SOURCE,
+          properties
+        });
+      };
+      for (const node of nodes) {
+        if (node.type === "CustomField") {
+          const refs = node.properties["formulaRelationshipRefs"];
+          const owningObject = objectApiNameOf(node.parentId);
+          if (Array.isArray(refs) && owningObject !== null) {
+            for (const ref of refs) {
+              if (typeof ref !== "string")
+                continue;
+              const toId = resolveTraversalTarget(ref, owningObject, maps);
+              if (toId === null)
+                continue;
+              emit(node.id, toId, "parsed", {
+                referenceKind: "formulaRelationshipTraversal",
+                traversalPath: ref
+              });
+            }
+          }
+        }
+        if (node.type === "FlexiPage") {
+          const related = node.properties["relatedListFieldRefs"];
+          if (!Array.isArray(related))
+            continue;
+          for (const entry of related) {
+            if (typeof entry !== "object" || entry === null)
+              continue;
+            const { relatedListApiName, fields } = entry;
+            if (typeof relatedListApiName !== "string")
+              continue;
+            const childObject = maps.childward.get(relatedListApiName.toLowerCase());
+            if (childObject === void 0 || !Array.isArray(fields))
+              continue;
+            for (const field of fields) {
+              if (typeof field !== "string" || field.length === 0)
+                continue;
+              if (field.includes("."))
+                continue;
+              emit(node.id, `CustomField:${childObject}.${field}`, "parsed", {
+                referenceKind: "relatedListFieldAlias",
+                relatedListApiName
+              });
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // ../graph/dist/src/import.js
 var IMPORT_BATCH_SIZE, INSERT_NODE_SQL, INSERT_EDGE_SQL, NODE_COLUMN_COUNT, EDGE_COLUMN_COUNT, buildMultiRowUpsertSql, canonicalJson, relativizeSourcePath, nodeRowParams, edgeRowParams, insertNode, insertEdge, commitBatched, canonicalizeApexCallEdgeTargets, canonicalizeEdgeTargetsByCase, CUSTOM_FIELD_PREFIX, ACTIVITY_OBJECT_LOWER, ACTIVITY_CHILD_OBJECTS_LOWER, splitFieldId, canonicalizeActivityPolymorphicFieldEdgeTargets, ACTIVITY_POLYMORPHIC_SLOTS, POLYMORPHIC_MIRROR_EDGE_TYPES, ACTIVITY_POLYMORPHIC_SOURCE, mintPolymorphicActivityFieldEdges, canonicalizeFieldEdgeTargets, canonicalizeObjectEdgeTargets, canonicalizeLabelEdgeTargets, canonicalizeResourceEdgeTargets, mintFutureDispatchEdges, importExtractionResults;
 var init_import = __esm({
   "../graph/dist/src/import.js"() {
     "use strict";
     init_src();
+    init_relationship_refs();
     IMPORT_BATCH_SIZE = 500;
     INSERT_NODE_SQL = `INSERT OR REPLACE INTO nodes (
   id, type, api_name, label, parent_id, source_path,
@@ -738,6 +889,7 @@ var init_import = __esm({
       canonicalizeLabelEdgeTargets(allNodes, allEdges);
       canonicalizeResourceEdgeTargets(allNodes, allEdges);
       mintFutureDispatchEdges(allNodes, allEdges);
+      mintRelationshipTraversalEdges(allNodes, allEdges);
       const nodeOutcome = await commitBatched(connection, allNodes, insertNode);
       if (!nodeOutcome.ok) {
         return err({
@@ -772,12 +924,19 @@ var init_import = __esm({
 });
 
 // ../graph/dist/src/apply-change-set.js
-var componentTypeFromNodeId, INCREMENTAL_DELTA_CAP, changeSetSize, DELETE_NODE_SQL, DELETE_EDGE_SQL, PK_SEP, edgePk, rowKey, readNodeRowKeys, readEdgeRowKeys, computeChangeSet, upsertRowsChunked, scalarCount, applyChangeSet, pruneStaleNodes;
+var SYNTHETIC_MINT_SOURCES, componentTypeFromNodeId, INCREMENTAL_DELTA_CAP, changeSetSize, DELETE_NODE_SQL, DELETE_EDGE_SQL, PK_SEP, edgePk, rowKey, readNodeRowKeys, readEdgeRowKeys, computeChangeSet, upsertRowsChunked, scalarCount, applyChangeSet, pruneStaleNodes;
 var init_apply_change_set = __esm({
   "../graph/dist/src/apply-change-set.js"() {
     "use strict";
     init_src();
     init_import();
+    init_relationship_refs();
+    SYNTHETIC_MINT_SOURCES = /* @__PURE__ */ new Set([
+      RELATIONSHIP_RESOLVER_SOURCE,
+      // mintFutureDispatchEdges (import.ts) — same hazard, mirrored earlier without
+      // the exclusion; correcting both together keeps the two passes consistent.
+      "graph-future-dispatch"
+    ]);
     componentTypeFromNodeId = (id) => {
       const sep6 = id.indexOf(":");
       if (sep6 < 0)
@@ -854,6 +1013,7 @@ var init_apply_change_set = __esm({
       canonicalizeLabelEdgeTargets([...desiredNodes.values()], desiredEdgeList);
       canonicalizeResourceEdgeTargets([...desiredNodes.values()], desiredEdgeList);
       mintFutureDispatchEdges([...desiredNodes.values()], desiredEdgeList);
+      mintRelationshipTraversalEdges([...desiredNodes.values()], desiredEdgeList);
       const desiredEdges = /* @__PURE__ */ new Map();
       for (const edge of desiredEdgeList) {
         const pk = edgePk(edge.fromId, edge.toId, edge.edgeType, edge.source);
@@ -862,8 +1022,11 @@ var init_apply_change_set = __esm({
       }
       const finalNodeIds = new Set(desiredNodes.keys());
       const reRanSources = /* @__PURE__ */ new Set();
-      for (const e of desiredEdges.values())
+      for (const e of desiredEdges.values()) {
+        if (SYNTHETIC_MINT_SOURCES.has(e.source))
+          continue;
         reRanSources.add(e.source);
+      }
       let currentNodeKeys;
       let currentEdges;
       try {
@@ -3426,6 +3589,7 @@ var init_src2 = __esm({
   "../graph/dist/src/index.js"() {
     "use strict";
     init_import();
+    init_relationship_refs();
     init_apply_change_set();
     init_migrations();
     init_queries();
@@ -8612,6 +8776,27 @@ var init_condition_extractor = __esm({
           conditionIndex: index
         }
       };
+      const isWellFormedFieldId = (id) => {
+        const body = id.startsWith("CustomField:") ? id.slice("CustomField:".length) : "";
+        if (body.length === 0 || body.startsWith("$"))
+          return false;
+        const parts = body.split(".");
+        return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;
+      };
+      const fieldEdges = fieldRefs.filter(isWellFormedFieldId).map((toId) => ({
+        fromId: conditionContextId,
+        toId,
+        edgeType: "readsFrom",
+        confidence,
+        source: EXTRACTOR_SOURCE,
+        properties: {
+          kind,
+          conditionIndex: index,
+          // The firer the condition belongs to, so a consumer reading the field's
+          // incoming edges can name the Flow / rule without a second hop.
+          firerId: parentId
+        }
+      }));
       const mirror = {
         kind,
         conditionContextId,
@@ -8619,13 +8804,14 @@ var init_condition_extractor = __esm({
         fieldRefs,
         ...sourceName !== null ? { sourceName } : {}
       };
-      return { node, edge, mirror };
+      return { node, edge, fieldEdges, mirror };
     };
     extractConditions = (options) => {
       const { parentId, sources, parentSourcePath, parentApiVersion = null, parentObjectApiName = null, indexOffset = 0 } = options;
       const conditionNodes = [];
       const firesWhenEdges = [];
       const conditionsMirror = [];
+      const conditionFieldEdges = [];
       for (let i = 0; i < sources.length; i += 1) {
         const source = sources[i];
         const index = indexOffset + i;
@@ -8693,8 +8879,14 @@ var init_condition_extractor = __esm({
         conditionNodes.push(triple.node);
         firesWhenEdges.push(triple.edge);
         conditionsMirror.push(triple.mirror);
+        conditionFieldEdges.push(...triple.fieldEdges);
       }
-      return { conditionNodes, firesWhenEdges, conditionsMirror };
+      return {
+        conditionNodes,
+        firesWhenEdges,
+        conditionsMirror,
+        conditionFieldEdges
+      };
     };
   }
 });
@@ -9157,7 +9349,7 @@ var init_workflow_rule = __esm({
         actions.push(resolved.value);
       }
       const conditionSources = collectWorkflowRuleConditionSources(rule);
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: ruleId,
         sources: conditionSources,
         parentSourcePath: path2,
@@ -9227,7 +9419,7 @@ var init_workflow_rule = __esm({
       for (const action of actions) {
         edges.push(...edgesForAction(action, ruleId, objectApiName, alertTemplateMap, fieldUpdateMap, seen));
       }
-      edges.push(...firesWhenEdges);
+      edges.push(...firesWhenEdges, ...conditionFieldEdges);
       return ok({ node, edges, conditionNodes });
     };
     extractWorkflowRule = async (path2) => {
@@ -9775,7 +9967,7 @@ var init_approval_process = __esm({
           }
         }
       }
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: processId,
         sources: entryConditionSources,
         parentSourcePath: path2,
@@ -9899,7 +10091,7 @@ var init_approval_process = __esm({
           properties: { referenceKind: "allowedSubmitter", submitterType }
         });
       }
-      edges.push(...firesWhenEdges);
+      edges.push(...firesWhenEdges, ...conditionFieldEdges);
       return ok({ nodes: [node, ...conditionNodes], edges });
     };
   }
@@ -10161,7 +10353,7 @@ var init_assignment_rule = __esm({
         conditionSources.push(source);
         conditionEntryIndices.push(entryIndex);
       }
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: ruleId,
         sources: conditionSources,
         parentSourcePath: path2,
@@ -10245,7 +10437,7 @@ var init_assignment_rule = __esm({
           });
         }
       }
-      edges.push(...firesWhenEdges);
+      edges.push(...firesWhenEdges, ...conditionFieldEdges);
       return ok({ node, edges, conditionNodes });
     };
     extractAssignmentRule = async (path2) => {
@@ -10906,7 +11098,7 @@ var init_auto_response_rule = __esm({
           conditionSources.push(entry.conditionSource);
         }
       }
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: ruleId,
         sources: conditionSources,
         parentSourcePath: path2,
@@ -10957,7 +11149,7 @@ var init_auto_response_rule = __esm({
           }
         });
       }
-      edges.push(...firesWhenEdges);
+      edges.push(...firesWhenEdges, ...conditionFieldEdges);
       return ok({ node, edges, conditionNodes });
     };
     extractAutoResponseRule = async (path2) => {
@@ -12676,13 +12868,27 @@ var init_custom_application = __esm({
 });
 
 // ../extractors/dist/src/formula-references.js
-var TOKENIZER_SOURCE, PERMISSION_GLOBAL_REFERENCE, buildReferencesEdges;
+var TOKENIZER_SOURCE, PERMISSION_GLOBAL_REFERENCE, collectRelationshipRefs, buildReferencesEdges;
 var init_formula_references = __esm({
   "../extractors/dist/src/formula-references.js"() {
     "use strict";
     init_src5();
     TOKENIZER_SOURCE = "formula-tokenizer";
     PERMISSION_GLOBAL_REFERENCE = /^\$Permission\.([A-Za-z_][A-Za-z_0-9]*)$/i;
+    collectRelationshipRefs = (formula) => {
+      const tokenized = tokenizeFormula(formula);
+      if (!tokenized.ok)
+        return [];
+      const seen = /* @__PURE__ */ new Set();
+      for (const ref of tokenized.value.references) {
+        if (!ref.path.includes("."))
+          continue;
+        if (ref.path.startsWith("$"))
+          continue;
+        seen.add(ref.path);
+      }
+      return [...seen].sort();
+    };
     buildReferencesEdges = (formula, fromId, parentObjectApiName, tokenizedFromField) => {
       const tokenized = tokenizeFormula(formula);
       if (!tokenized.ok)
@@ -12742,7 +12948,7 @@ var init_formula_references = __esm({
 import { readFile as readFile26 } from "node:fs/promises";
 import { basename as basename4, dirname as dirname11 } from "node:path";
 import { XMLParser as XMLParser17, XMLValidator as XMLValidator17 } from "fast-xml-parser";
-var FIELD_FILE_SUFFIX, ROOT_ELEMENT16, FIELDS_DIR_NAME, PICKLIST_TYPES, FORMULA_ELEMENT_NAME, STANDARD_FIELD_TYPES, unwrapSingle17, coerceBoolean11, toNullableString, toNullableNumber, toBooleanWithDefault, coerceIsActiveDefaultTrue, readAndValidateXml16, validateRoot12, derivePathParts3, extractPicklistValues, extractControllingFieldInfo, extractValueSetName, SUMMARY_DATA_TYPE, extractSummaryInfo, buildProperties, extractCustomField;
+var FIELD_FILE_SUFFIX, ROOT_ELEMENT16, FIELDS_DIR_NAME, PICKLIST_TYPES, FORMULA_ELEMENT_NAME, ROLLUP_SUMMARY_SOURCE, STANDARD_FIELD_TYPES, unwrapSingle17, coerceBoolean11, toNullableString, toNullableNumber, toBooleanWithDefault, coerceIsActiveDefaultTrue, readAndValidateXml16, validateRoot12, derivePathParts3, extractPicklistValues, extractControllingFieldInfo, extractValueSetName, SUMMARY_DATA_TYPE, extractSummaryInfo, extractSummaryFilterFields, buildProperties, extractCustomField;
 var init_custom_field = __esm({
   "../extractors/dist/src/custom-field.js"() {
     "use strict";
@@ -12754,6 +12960,7 @@ var init_custom_field = __esm({
     FIELDS_DIR_NAME = "fields";
     PICKLIST_TYPES = ["Picklist", "MultiselectPicklist"];
     FORMULA_ELEMENT_NAME = "formula";
+    ROLLUP_SUMMARY_SOURCE = "rollup-summary";
     STANDARD_FIELD_TYPES = {
       Email: "Email",
       Phone: "Phone",
@@ -12932,6 +13139,26 @@ var init_custom_field = __esm({
         summaryOperation: toNullableString(rootObj["summaryOperation"])
       };
     };
+    extractSummaryFilterFields = (rootObj) => {
+      const raw = rootObj["summaryFilterItems"];
+      if (raw === void 0 || raw === null)
+        return [];
+      const items = Array.isArray(raw) ? raw : [raw];
+      const seen = /* @__PURE__ */ new Set();
+      const out = [];
+      for (const item of items) {
+        if (typeof item !== "object" || item === null)
+          continue;
+        const field = toNullableString(item["field"]);
+        if (field === null || field.length === 0)
+          continue;
+        if (seen.has(field))
+          continue;
+        seen.add(field);
+        out.push(field);
+      }
+      return out;
+    };
     buildProperties = (rootObj, dataType) => {
       const isPicklist = PICKLIST_TYPES.includes(dataType);
       const formula = toNullableString(rootObj["formula"]);
@@ -12971,6 +13198,15 @@ var init_custom_field = __esm({
         // `true` keeps stored fields byte-identical while making formula fields
         // self-describing.
         ...isFormula ? { isFormula: true } : {},
+        // OMIT-when-empty: the cross-object traversals in this formula, verbatim
+        // (`Parent__r.Field__c`). Only the import-time relationship resolver can
+        // turn these into edges — it is the only layer that can see the lookup
+        // fields of every OTHER object. Stored rather than dropped so a field read
+        // exclusively through a traversal stops looking orphaned.
+        ...(() => {
+          const relationshipRefs = isFormula ? collectRelationshipRefs(formula ?? "") : [];
+          return relationshipRefs.length > 0 ? { formulaRelationshipRefs: relationshipRefs } : {};
+        })(),
         // OMIT-when-null (unlike the fixed keys above): only GlobalValueSet-driven
         // picklists carry a value-set name, and a `valueSetName: null` row on every
         // CustomField would churn every rendered markdown file in every vault
@@ -13075,6 +13311,28 @@ var init_custom_field = __esm({
         source: "custom-field-extractor",
         properties: { relationshipType }
       }));
+      const summaryInfo = extractSummaryInfo(rootObj, dataType);
+      const rollupTargets = [
+        ["summarizedField", summaryInfo.summarizedField],
+        ["summaryForeignKey", summaryInfo.summaryForeignKey],
+        // A roll-up's FILTER also names child fields, and the platform refuses to
+        // delete those too — the filter would no longer compile. Same file, same
+        // parent-side invisibility as the two above.
+        ...dataType === SUMMARY_DATA_TYPE ? extractSummaryFilterFields(rootObj).map((field) => ["summaryFilterItem", field]) : []
+      ];
+      const rollupEdges = rollupTargets.filter((entry) => entry[1] !== null && entry[1].length > 0).map(([rollupRole, target]) => ({
+        fromId: nodeId,
+        toId: `CustomField:${target}`,
+        edgeType: "references",
+        confidence: "declared",
+        source: ROLLUP_SUMMARY_SOURCE,
+        properties: {
+          rollupRole,
+          // OMIT-when-null so a `count` roll-up (no operation recorded) does not
+          // carry a null row into every stored edge.
+          ...summaryInfo.summaryOperation !== null ? { summaryOperation: summaryInfo.summaryOperation } : {}
+        }
+      }));
       const valueSetName = extractValueSetName(rootObj);
       const valueSetEdges = valueSetName !== null ? [
         {
@@ -13088,7 +13346,13 @@ var init_custom_field = __esm({
       ] : [];
       return ok({
         nodes: [node],
-        edges: [parentEdge, ...referencesEdges, ...lookupEdges, ...valueSetEdges]
+        edges: [
+          parentEdge,
+          ...referencesEdges,
+          ...lookupEdges,
+          ...rollupEdges,
+          ...valueSetEdges
+        ]
       });
     };
   }
@@ -14639,7 +14903,7 @@ var init_sharing_rules = __esm({
 
 // ../extractors/dist/src/enterprise-metadata.js
 import { readFile as readFile34 } from "node:fs/promises";
-var EXTRACTOR_SOURCE14, readText, extractXmlValues, USER_CRITERIA_PROFILE_ID_RE, UNRESOLVED_PROFILE_PREFIX, extractUserCriteriaProfileIds, inferReportObjectApiName, RECORD_CONTEXT_PREFIX, rescopeRecordContextField, extractFieldRefs, LIST_VIEW_FILTER_PSEUDO_FIELDS, isLegacyDottedAddress, isWellFormedColumnField, isWellFormedFilterField, extractListViewFilterRefs, REPORT_DETAIL_LIST_CAP, extractReportCriteriaItems, parseReportGroupingBlock, resolveReportFieldToken, extractReportDetail, extractReportTypeDetail, extractTransactionSecurityAction, extractMilestoneDetails, readListViewSharedTo, makeNode2, extractEnterpriseMetadata, extractReport, extractDashboard, extractListView, extractReportType, extractCustomPermission, extractCertificate, extractTransactionSecurityPolicy, FLEXIPAGE_PAGE_TYPES, extractFlexiPagePermissionRefs, extractFlexiPageEmbeddedFlows, extractFlexiPage, extractPermissionSetGroup, extractRestrictionRule, extractScopingRule, extractEntitlementProcess, extractMilestoneType, extractServiceChannel, extractQueueRoutingConfig, extractPresenceUserConfig;
+var EXTRACTOR_SOURCE14, readText, extractXmlValues, USER_CRITERIA_PROFILE_ID_RE, UNRESOLVED_PROFILE_PREFIX, extractUserCriteriaProfileIds, inferReportObjectApiName, RECORD_CONTEXT_PREFIX, rescopeRecordContextField, extractFieldRefs, LIST_VIEW_FILTER_PSEUDO_FIELDS, isLegacyDottedAddress, isWellFormedColumnField, isWellFormedFilterField, extractListViewFilterRefs, REPORT_DETAIL_LIST_CAP, extractReportCriteriaItems, parseReportGroupingBlock, resolveReportFieldToken, extractReportDetail, extractReportTypeDetail, extractTransactionSecurityAction, extractMilestoneDetails, readListViewSharedTo, makeNode2, extractEnterpriseMetadata, extractReport, extractDashboard, extractListView, extractReportType, extractCustomPermission, extractCertificate, extractTransactionSecurityPolicy, FLEXIPAGE_PAGE_TYPES, extractFlexiPagePermissionRefs, extractFlexiPageEmbeddedFlows, RELATED_LIST_BLOCK_RE, RELATED_LIST_API_NAME_RE, RELATED_LIST_ALIASES_RE, VALUE_RE, extractFlexiPageRelatedListFieldRefs, extractFlexiPage, extractPermissionSetGroup, extractRestrictionRule, extractScopingRule, extractEntitlementProcess, extractMilestoneType, extractServiceChannel, extractQueueRoutingConfig, extractPresenceUserConfig;
 var init_enterprise_metadata = __esm({
   "../extractors/dist/src/enterprise-metadata.js"() {
     "use strict";
@@ -15284,6 +15548,27 @@ var init_enterprise_metadata = __esm({
       }
       return [...seen].sort();
     };
+    RELATED_LIST_BLOCK_RE = /<componentInstance>[\s\S]*?<\/componentInstance>/g;
+    RELATED_LIST_API_NAME_RE = /<name>relatedListApiName<\/name>\s*<value>([^<]+)<\/value>/;
+    RELATED_LIST_ALIASES_RE = /<name>relatedListFieldAliases<\/name>\s*<valueList>([\s\S]*?)<\/valueList>/;
+    VALUE_RE = /<value>([^<]+)<\/value>/g;
+    extractFlexiPageRelatedListFieldRefs = (xml) => {
+      const out = [];
+      for (const block of xml.match(RELATED_LIST_BLOCK_RE) ?? []) {
+        const relatedListApiName = RELATED_LIST_API_NAME_RE.exec(block)?.[1]?.trim();
+        const aliasList = RELATED_LIST_ALIASES_RE.exec(block)?.[1];
+        if (relatedListApiName === void 0 || relatedListApiName.length === 0 || aliasList === void 0) {
+          continue;
+        }
+        const fields = [
+          ...new Set([...aliasList.matchAll(VALUE_RE)].map((m) => m[1]?.trim() ?? "").filter((v) => v.length > 0))
+        ].sort();
+        if (fields.length === 0)
+          continue;
+        out.push({ relatedListApiName, fields });
+      }
+      return out;
+    };
     extractFlexiPage = async (path2) => {
       const text = await readText(path2);
       if (!text.ok)
@@ -15296,6 +15581,7 @@ var init_enterprise_metadata = __esm({
       const fieldRefs = extractFieldRefs(text.value, sobjectType).refs;
       const permissionRefs = extractFlexiPagePermissionRefs(text.value);
       const embeddedFlows = extractFlexiPageEmbeddedFlows(text.value);
+      const relatedListFieldRefs = extractFlexiPageRelatedListFieldRefs(text.value);
       const edges = fieldRefs.map((fieldId) => ({
         fromId: nodeId,
         toId: fieldId,
@@ -15342,7 +15628,8 @@ var init_enterprise_metadata = __esm({
         fieldRefs,
         rawReferenceCount: fieldRefs.length,
         permissionRefs,
-        embeddedFlows
+        embeddedFlows,
+        ...relatedListFieldRefs.length > 0 ? { relatedListFieldRefs } : {}
       });
       return ok({ nodes: [node], edges });
     };
@@ -16376,7 +16663,7 @@ var init_escalation_rule = __esm({
           conditionSources.push(entry.conditionSource);
         }
       }
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: ruleId,
         sources: conditionSources,
         parentSourcePath: path2,
@@ -16445,7 +16732,7 @@ var init_escalation_rule = __esm({
           }
         }
       }
-      edges.push(...firesWhenEdges);
+      edges.push(...firesWhenEdges, ...conditionFieldEdges);
       return ok({ node, edges, conditionNodes });
     };
     extractEscalationRule = async (path2) => {
@@ -17427,7 +17714,7 @@ var init_flow_dataflow = __esm({
 // ../extractors/dist/src/flow.js
 import { readFile as readFile43 } from "node:fs/promises";
 import { XMLParser as XMLParser33, XMLValidator as XMLValidator33 } from "fast-xml-parser";
-var FLOW_FILE_SUFFIX, ROOT_ELEMENT32, FLOW_XML_PARSER_OPTIONS, REQUIRED_ELEMENTS11, ALLOWED_STATUS, EDGE_SOURCE3, RECORD_TRIGGER_TYPES, RECORD_SCOPED_TRIGGER_TYPES, unwrapSingle34, toArray18, toNullableString3, toNonEmptyString2, readAndValidateXml32, validateRoot23, extractStartProperties, ASYNC_AFTER_COMMIT_PATH, extractScheduledPathTypes, buildStartEdge, buildPlatformEventListensToEdge, buildActionCallEdges, buildSubflowEdges, collectActionCallSummaries, buildRecordLookupEdges, ASSIGNED_VALUE_LITERAL_WRAPPERS, parseAssignedValue, attachDataflowTrace, buildInputAssignmentEdges, buildDataflowReadEdges, buildRecordCreateEdges, WHOLE_RECORD_DISCLOSURE, resolveInputReferenceObject, buildObjectDmlProps, buildRecordUpdateEdges, buildRecordDeleteEdges, BEFORE_SAVE_TRIGGER_TYPE, asRecord, stripMergeWrapper, parseRecordFieldAssignTarget, buildBeforeSaveFieldAssignmentEdges, parseFlowConditionTriplet, buildFlowDecisionSourceName, collectFlowConditionSources, edgeOperation, dedupeAndSortEdges, FAULTABLE_ELEMENTS, analyzeFaultCoverage, FLOW_LABEL_REF_PATTERN, buildLabelReferenceEdges, extractFlow;
+var FLOW_FILE_SUFFIX, ROOT_ELEMENT32, FLOW_XML_PARSER_OPTIONS, REQUIRED_ELEMENTS11, ALLOWED_STATUS, EDGE_SOURCE3, RECORD_TRIGGER_TYPES, RECORD_SCOPED_TRIGGER_TYPES, unwrapSingle34, toArray18, toNullableString3, toNonEmptyString2, readAndValidateXml32, validateRoot23, extractStartProperties, ASYNC_AFTER_COMMIT_PATH, extractScheduledPathTypes, buildStartEdge, buildPlatformEventListensToEdge, buildActionCallEdges, buildSubflowEdges, collectActionCallSummaries, buildRecordLookupEdges, ASSIGNED_VALUE_LITERAL_WRAPPERS, parseAssignedValue, attachDataflowTrace, buildInputAssignmentEdges, buildDataflowReadEdges, buildRecordCreateEdges, WHOLE_RECORD_DISCLOSURE, resolveInputReferenceObject, buildObjectDmlProps, buildRecordUpdateEdges, buildRecordDeleteEdges, BEFORE_SAVE_TRIGGER_TYPE, asRecord, stripMergeWrapper, parseRecordFieldAssignTarget, buildBeforeSaveFieldAssignmentEdges, pickTripletMember, parseFlowConditionTriplet, buildFlowDecisionSourceName, collectFlowConditionSources, edgeOperation, dedupeAndSortEdges, FAULTABLE_ELEMENTS, analyzeFaultCoverage, FLOW_LABEL_REF_PATTERN, buildLabelReferenceEdges, extractFlow;
 var init_flow = __esm({
   "../extractors/dist/src/flow.js"() {
     "use strict";
@@ -18078,19 +18365,27 @@ var init_flow = __esm({
       }
       return edges;
     };
+    pickTripletMember = (obj, keys) => {
+      for (const key of keys) {
+        const v = unwrapSingle34(obj[key]);
+        if (v !== void 0 && v !== null && v !== "")
+          return v;
+      }
+      return null;
+    };
     parseFlowConditionTriplet = (raw) => {
       if (typeof raw !== "object" || raw === null)
         return null;
       const obj = raw;
-      const fieldRaw = unwrapSingle34(obj["leftValueReference"]);
-      if (fieldRaw === void 0 || fieldRaw === null || fieldRaw === "") {
+      const fieldRaw = pickTripletMember(obj, ["leftValueReference", "field"]);
+      if (fieldRaw === null) {
         return null;
       }
       const operatorRaw = unwrapSingle34(obj["operator"]);
       if (operatorRaw === void 0 || operatorRaw === null || operatorRaw === "") {
         return null;
       }
-      const rightValueRaw = unwrapSingle34(obj["rightValue"]);
+      const rightValueRaw = pickTripletMember(obj, ["rightValue", "value"]);
       let value = null;
       if (typeof rightValueRaw === "object" && rightValueRaw !== null) {
         const wrapper = rightValueRaw;
@@ -18327,14 +18622,14 @@ var init_flow = __esm({
       rawEdges.push(...buildLabelReferenceEdges(flowId, xmlResult.value));
       const edges = dedupeAndSortEdges(rawEdges);
       const conditionSources = collectFlowConditionSources(rootObj);
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: flowId,
         sources: conditionSources,
         parentSourcePath: path2,
         parentApiVersion: apiVersion,
         parentObjectApiName: startProps.triggerObject
       });
-      const allEdges = [...edges, ...firesWhenEdges];
+      const allEdges = [...edges, ...firesWhenEdges, ...conditionFieldEdges];
       const node = {
         id: flowId,
         type: "Flow",
@@ -25530,7 +25825,7 @@ var init_validation_rule = __esm({
       const errorMessage = String(unwrapSingle66(rootObj["errorMessage"]));
       const active = coerceBoolean40(unwrapSingle66(rootObj["active"]));
       const conditionSources = errorConditionFormula.length === 0 ? [] : [{ kind: "formula", expression: errorConditionFormula }];
-      const { conditionNodes, firesWhenEdges, conditionsMirror } = extractConditions({
+      const { conditionNodes, firesWhenEdges, conditionsMirror, conditionFieldEdges } = extractConditions({
         parentId: nodeId,
         sources: conditionSources,
         parentSourcePath: path2,
@@ -25566,7 +25861,7 @@ var init_validation_rule = __esm({
       const referencesEdges = buildReferencesEdges(errorConditionFormula, nodeId, objectApiName, FORMULA_ELEMENT_NAME2);
       return ok({
         nodes: [node, ...conditionNodes],
-        edges: [parentEdge, ...referencesEdges, ...firesWhenEdges]
+        edges: [parentEdge, ...referencesEdges, ...firesWhenEdges, ...conditionFieldEdges]
       });
     };
   }
@@ -26564,7 +26859,7 @@ var init_src6 = __esm({
 
 // ../mcp/dist/src/prompts.js
 import { ErrorCode, GetPromptRequestSchema, ListPromptsRequestSchema, McpError } from "@modelcontextprotocol/sdk/types.js";
-var userMessage, GENERATOR_PREAMBLE, PLAYBOOK_PREAMBLE, PROMPTS, PROMPT_BY_NAME, MCP_PROMPTS, getMcpPrompt, registerPrompts;
+var userMessage, GENERATOR_PREAMBLE, PLAYBOOK_PREAMBLE, FIELD_AUDIT_PREAMBLE, PROMPTS, PROMPT_BY_NAME, MCP_PROMPTS, getMcpPrompt, registerPrompts;
 var init_prompts = __esm({
   "../mcp/dist/src/prompts.js"() {
     "use strict";
@@ -26583,6 +26878,9 @@ var init_prompts = __esm({
 2. Live steps need the opt-in live plane. If off, run offline steps, then offer \`sfi.live_consent { grant: true }\` and re-run live steps \u2014 never infer live facts from the vault.
 3. Cite canonical component ids; stamp provenance (\`offline_snapshot\` / \`live_org\`) and confidence. Use any tool's \`rendered\` field verbatim when present.
 4. Single-fact questions belong on \`sfi.route_question\`, not a playbook.`;
+    FIELD_AUDIT_PREAMBLE = `You are running an sf-intelligence FIELD AUDIT \u2014 deciding whether fields can be deleted, and what must happen first. This is a document that authorises destruction, so its value is entirely a function of whether the reader can tell your evidence apart from your inference.
+
+The one principle everything else follows from: **population tells you how much data is in a field; it never tells you what depends on it.** The two agree on busy, obviously-live fields and diverge everywhere else \u2014 formula fields, transient state flags, integration keys, anything frozen. Every serious error in this kind of analysis comes from substituting one for the other.`;
     PROMPTS = [
       {
         meta: {
@@ -26831,6 +27129,66 @@ Playbook \`health\` \u2014 operational pulse (mostly live):
 Report: red/amber/green pulse with specific failing signals named.`)
           ]
         })
+      },
+      {
+        meta: {
+          name: "sfi.field_audit",
+          description: "Field-deletion audit: decide Keep / Review / Deprecate-then-Remove / Remove for a field or an object\u2019s fields, tracing every dependency first. Also validates an existing field-cleanup analysis.",
+          arguments: [
+            {
+              name: "objectApiName",
+              description: "The object whose fields are under audit (e.g. Account or MyObject__c).",
+              required: true
+            },
+            {
+              name: "fieldApiNames",
+              description: "Optional comma-separated field api names to scope the audit. Omit to assess the whole object.",
+              required: false
+            }
+          ]
+        },
+        build: (args) => ({
+          description: "Field-deletion audit with dependency tracing.",
+          messages: [
+            userMessage(`${FIELD_AUDIT_PREAMBLE}
+
+Object under audit: \`${args?.["objectApiName"] ?? "<objectApiName>"}\`${args?.["fieldApiNames"] !== void 0 && args["fieldApiNames"].length > 0 ? `
+Fields scoped to: ${args["fieldApiNames"]}` : "\nScope: every custom field on the object."}
+
+Run in this order. Do not skip step 0 \u2014 it is what makes the rest trustworthy.
+
+0. **Orient and calibrate.**
+   - \`sfi.org_card\` for component counts and DECLARED coverage gaps.
+   - \`sfi.coverage_report\`. If Report/Dashboard reads \`pending\`, the report pull was capped (default \`SFI_REPORTS_CAP\`=500, ranked by usage) \u2014 say so, and treat every report count as a floor, not a total.
+   - **Positive control:** pick a field you can already prove is referenced, run the same tools against it, and confirm they return something. A zero from an uncalibrated method is not a finding.
+
+1. **Per field, gather \u2014 do not judge yet.**
+   - \`sfi.field_360\` \u2014 full profile across validation, formulas, writers, readers, UI, integrations.
+   - \`sfi.find_field_anywhere\` \u2014 every incoming edge grouped by component type.
+   - \`sfi.safe_to_delete_field\` \u2014 the verdict with its reasoning chain. Use \`format: 'checklist'\` when you want ordered pre-work.
+   - \`sfi.find_formula_references\` for formula referrers.
+
+2. **Read the structure before any number.** \`required\` + \`unique\` + \`externalId\` with no in-org writer is an integration upsert key \u2014 the strongest possible Keep, and the exact shape a naive "nothing writes it" reading calls dead. \`trackHistory: true\` means deleting the field destroys history rows permanently; no export of current values recovers them.
+
+3. **A formula field has no population figure.** If the body references \`$User\`, \`$UserRole\`, \`$Profile\` or \`TODAY()\`, the percentage measures who ran the query. If it returns \`IF(...,1,0)\` or \`CASESAFEID(Id)\` it can never be null and measures arithmetic. Read the body; strike the number.
+
+4. **Measure flow, not just stock** (live plane only, and only with consent): \`sfi.live_field_population\`, then \`MAX(field)\` and a future-dated count via \`sfi.live_aggregate\`. A field with 750,000 values can be frozen; a field at 0% can be load-bearing. Watch \`sfi.live_budget\`; when it runs out, say which figures are carried forward UNVERIFIED.
+
+5. **Record ROLE, never count.** For each consumer, what would it do if the field vanished? A field used as a report or list-view **filter** does not empty the report when deleted \u2014 it silently WIDENS it. Nothing errors, so nobody reports it. That is strictly more dangerous than a lost display column.
+
+Verdict vocabulary \u2014 four values, not three:
+- **Keep** \u2014 live dependency, integration contract, or clear business value. Name the blocker, never the population.
+- **Review** \u2014 genuinely ambiguous. INCOMPLETE unless it names the exact question and the named human who answers it.
+- **Deprecate-then-Remove** \u2014 dead in practice but holds data, history, or cosmetic references. Needs staged retirement.
+- **Remove** \u2014 no data of value, no live dependency, every surface checked-negative with a proven method.
+
+Honesty rules, non-negotiable:
+- Render any \`coverageCaveat\` BEFORE the verdict, never as a footnote.
+- Separate "checked and found nothing" from "could not check". They look identical in a report and mean opposite things.
+- Name the blind spots no static analysis closes: dynamically-built SOQL, reflective \`.get('Field__c')\`, field lists stored as ORG DATA in custom settings or custom metadata (invisible to metadata retrieval AND to this vault \u2014 they fail at runtime, not at deploy), external ETL job definitions, managed-package internals, private report folders, and email-template merge fields.
+- Never present an \`sfi.safe_to_delete_field\` verdict of \`safe\` as permission to delete. It means no modelled dependency was found, which is a statement about coverage as much as about the field.`)
+          ]
+        })
       }
     ];
     PROMPT_BY_NAME = new Map(PROMPTS.map((p) => [p.meta.name, p]));
@@ -38280,6 +38638,15 @@ var init_coverage_trust = __esm({
         "VisualforceComponent",
         "QuickAction",
         "WorkflowRule",
+        // The remaining condition firers wired to extractConditions. Their
+        // ConditionalContext nodes now emit `readsFrom` edges to the fields their
+        // criteria TEST, so a field can carry a `condition` blocker hiding behind
+        // any of these families — and without them listed, buildCoverageCaveat
+        // stayed silent on an unretrieved family while the verdict read clean.
+        "ApprovalProcess",
+        "AssignmentRule",
+        "AutoResponseRule",
+        "EscalationRule",
         "SharingRule",
         "Report",
         "Dashboard",
@@ -42302,7 +42669,7 @@ var init_roster = __esm({
       },
       {
         name: "sfi.safe_to_delete_field",
-        description: "Is this field safe to delete, and what's the evidence? The BA's due-diligence check before retiring a field \"no one uses\" \u2014 it gathers every dependency (validation rules, flows, formulas, layouts, Apex, LWC) so you can prove whether anything still relies on it before signing off. Given a CustomField canonical id (`CustomField:{Object}.{Field}`), composes every incoming dependency edge into a confidence-weighted deletion verdict: `safe` (no incoming edges), `risky` (Apex/LWC references that need spot-checking \u2014 Apex evidence includes parsed-confidence AST edges covering dot-access AND fields referenced only inside inline static SOQL or constant-string Database.query literals, plus heuristic regex-scanner matches; string-BUILT dynamic SOQL stays invisible), `blocking` (declared Flow/ValidationRule/Layout/formula dependencies the platform will refuse to drop), `unknown` (only unrecognised edges), or `review` (NOT proven safe \u2014 incomplete coverage, OR a standard / managed-package field with no node of its own but referenced by edges: it is reviewed from those edges with a not-modeled caveat instead of returning component-not-found; B12). Each category in the `reasoning` array carries its referrer count, up to 5 example referrers (full list via `sfi.get_impact`), and a per-category note explaining the honesty boundary. When an incoming edge carries `properties.confirmedByApi` (stamped by `sfi refresh --with-tooling-api` MetadataComponentDependency enrichment), reasoning entries/examples surface `apiConfirmed: true` as additive evidence \u2014 it does not change the verdict cascade; the tool never calls the Tooling API at query time. Pass `format: 'checklist'` to also get a `checklist` \u2014 a \"before you delete X\" Markdown checklist rendered from the verdict + reasoning, with the `coverageCaveat` surfaced FIRST (never footnoted) and removal steps ordered most-severe-first. It PROPOSES a checklist for a human and never deletes or writes to the org. Pass `format: 'proposal'` (Finding #35) to also get a `proposal` \u2014 a deploy-ready, LOCAL artifact for the field: a populated `destructiveChanges.xml` (the field) + an empty `package.xml`, each led by an evidence comment carrying the verdict, every dependency finding, the vault `sourceTreeHash`, and a REVIEW-before-deploy banner. sfi returns the file STRINGS only \u2014 it NEVER deploys, writes, or connects to the org; a human feeds the files to their own deploy tool (Gearset / Copado / `sf project deploy`). Validated against `docs/schemas/proposal.schema.json`. Emitted for EVERY verdict (a `blocking` field's proposal leads with `verdict: blocking` so it never reads as safe). When the vault holds captured data-shape facts, the response embeds the field's sampled fill rate as a stamped `data_snapshot` `dataShape` block \u2014 CONTEXT ONLY: the verdict is computed purely from the metadata graph and never moves toward safe on a sampled observation. When the heuristic PII recognizer classifies the field pii/sensitive, the response carries a `piiCompliance` block (non-verdict-lowering compliance escalation, with classification/category/message) and the checklist surfaces it FIRST, above the coverage caveat and verdict; a PII field never reads as a bland safe. Heuristic \u2014 absence of the block is NOT a clearance. HYBRID (CR-CAP-L5): when the static verdict would be `safe`, pass `liveEnabled: true` (or grant consent) to cross-check the field's LIVE production population before trusting that verdict \u2014 real data despite zero static references may be written by dynamic Apex, an integration, or another blind spot the scanner cannot see. A `populatedCount > 0` DOWNGRADES the verdict from `safe` to `review` and attaches a `livePopulation` evidence block (`objectApiName`/`fieldApiName`/`totalCount`/`populatedCount`/`populationRate`/`liveQueriedAt`); a zero-population result leaves `safe` standing but still attaches the evidence block, confirming the cross-check ran. The live plane is NEVER a hard dependency \u2014 offline stays fully functional; when it is off, unavailable, or the query errors (budget exhausted, org unreachable), the response fails soft to the disclosed static verdict with a `trust.limitations` line naming the missing evidence ('static-only verdict; live population not checked').",
+        description: "Is this field safe to delete, and what's the evidence? The BA's due-diligence check before retiring a field \"no one uses\" \u2014 it gathers every dependency (validation rules, flows, formulas, roll-up summaries, automation conditions, layouts, Apex, LWC) so you can prove whether anything still relies on it before signing off. Given a CustomField canonical id (`CustomField:{Object}.{Field}`), composes every incoming dependency edge into a confidence-weighted deletion verdict: `safe` (no incoming edges), `risky` (Apex/LWC references that need spot-checking \u2014 Apex evidence includes parsed-confidence AST edges covering dot-access AND fields referenced only inside inline static SOQL or constant-string Database.query literals, plus heuristic regex-scanner matches; string-BUILT dynamic SOQL stays invisible), `blocking` (declared Flow/ValidationRule/formula dependencies the platform will refuse to drop, plus two coupling classes declared on OTHER components: `rollup` \u2014 a roll-up summary on the PARENT object that aggregates, anchors on, or filters by this field, with each example naming its own `rollupRole` (`summarizedField` / `summaryForeignKey` / `summaryFilterItem`) so the citation is the coupling that actually exists; and `condition` \u2014 a criterion that TESTS this field, minted from any of the seven wired firer families: Flow entry criteria, Flow decisions, validation-rule conditions, workflow-rule criteria, and approval-process, assignment-rule, auto-response-rule and escalation-rule criteria. Each condition example carries the `firerId` of the component whose criteria it is (the example `id` is a synthetic ConditionalContext node), so an approval-process blocker is cited as an approval process rather than as a Flow. Conditions are listed, never evaluated: the vault does not know whether a runtime record satisfies them. ONE REFERRER IS COUNTED ONCE: a validation rule whose `errorConditionFormula` both references and tests a field reaches it by TWO edges tokenized from that one string, so it is reported once under `validation` (the truthful label \u2014 not `formula`, which means \"another formula FIELD references this\") and the folded row is disclosed on that example as `alsoVia: ['condition']` rather than counted again. Additive conditions never fold: a rule testing a field its direct reference could not resolve, or a Flow that WRITES and separately TESTS one field, each keep their own category, count and citation. Formula examples likewise carry the `traversalPath` (`Parent__r.Field__c`) when the reference was resolved through a cross-object relationship rather than tokenized directly), `unknown` (only unrecognised edges), or `review` (NOT proven safe \u2014 incomplete coverage, OR a standard / managed-package field with no node of its own but referenced by edges: it is reviewed from those edges with a not-modeled caveat instead of returning component-not-found; B12). Each category in the `reasoning` array carries its referrer count, up to 5 example referrers (full list via `sfi.get_impact`), and a per-category note explaining the honesty boundary. When an incoming edge carries `properties.confirmedByApi` (stamped by `sfi refresh --with-tooling-api` MetadataComponentDependency enrichment), reasoning entries/examples surface `apiConfirmed: true` as additive evidence \u2014 it does not change the verdict cascade; the tool never calls the Tooling API at query time. Pass `format: 'checklist'` to also get a `checklist` \u2014 a \"before you delete X\" Markdown checklist rendered from the verdict + reasoning, with the `coverageCaveat` surfaced FIRST (never footnoted) and removal steps ordered most-severe-first. It PROPOSES a checklist for a human and never deletes or writes to the org. Pass `format: 'proposal'` (Finding #35) to also get a `proposal` \u2014 a deploy-ready, LOCAL artifact for the field: a populated `destructiveChanges.xml` (the field) + an empty `package.xml`, each led by an evidence comment carrying the verdict, every dependency finding, the vault `sourceTreeHash`, and a REVIEW-before-deploy banner. sfi returns the file STRINGS only \u2014 it NEVER deploys, writes, or connects to the org; a human feeds the files to their own deploy tool (Gearset / Copado / `sf project deploy`). Validated against `docs/schemas/proposal.schema.json`. Emitted for EVERY verdict (a `blocking` field's proposal leads with `verdict: blocking` so it never reads as safe). When the vault holds captured data-shape facts, the response embeds the field's sampled fill rate as a stamped `data_snapshot` `dataShape` block \u2014 CONTEXT ONLY: the verdict is computed purely from the metadata graph and never moves toward safe on a sampled observation. When the heuristic PII recognizer classifies the field pii/sensitive, the response carries a `piiCompliance` block (non-verdict-lowering compliance escalation, with classification/category/message) and the checklist surfaces it FIRST, above the coverage caveat and verdict; a PII field never reads as a bland safe. Heuristic \u2014 absence of the block is NOT a clearance. HYBRID (CR-CAP-L5): when the static verdict would be `safe`, pass `liveEnabled: true` (or grant consent) to cross-check the field's LIVE production population before trusting that verdict \u2014 real data despite zero static references may be written by dynamic Apex, an integration, or another blind spot the scanner cannot see. A `populatedCount > 0` DOWNGRADES the verdict from `safe` to `review` and attaches a `livePopulation` evidence block (`objectApiName`/`fieldApiName`/`totalCount`/`populatedCount`/`populationRate`/`liveQueriedAt`); a zero-population result leaves `safe` standing but still attaches the evidence block, confirming the cross-check ran. The live plane is NEVER a hard dependency \u2014 offline stays fully functional; when it is off, unavailable, or the query errors (budget exhausted, org unreachable), the response fails soft to the disclosed static verdict with a `trust.limitations` line naming the missing evidence ('static-only verdict; live population not checked'). UPGRADE PATH: the roll-up coupling, condition and resolved formula-traversal edge families were added in 0.3.0, so a vault BUILT by an older sf-intelligence does not hold them and their absence proves nothing. When `manifest.version` is older than the running plugin the response carries a `builderVersionCaveat` (also mirrored into `trust.limitations` and surfaced above the verdict in the checklist) and an otherwise-`safe` verdict is reported as `review` \u2014 NOT proven safe \u2014 until `sfi refresh` rebuilds the vault. The coverage caveat cannot catch this: those metadata families WERE retrieved; the extractor that reads them did not exist yet.",
         inputSchema: SAFE_TO_DELETE_FIELD_INPUT_SCHEMA
       },
       {
@@ -42780,7 +43147,7 @@ var init_roster = __esm({
       // cross-tier field-forensics questions.
       {
         name: "sfi.field_360",
-        description: "A complete 360 profile of a single FIELD \u2014 everything that touches that field across validation, formulas, automation, code, UI, integrations, and emails, in one place. (Field forensics \u2014 this is about a field, NOT a user Profile or permissions.) The go-to answer for \"give me the full profile of this field\", \"the full picture of {Object}.{Field}\", \"everything that uses {Object}.{Field}\", \"what touches this field across automation and code\", or a BA's field impact assessment before a change. v3.0 unified field-forensics synthesis tool. Given a CustomField canonical id (or short `<Object>.<Field>` form), composes every prior tier's reads of the field into one structured response with ten optional content sections (`validates`, `formulas`, `writers`, `readers`, `ui`, `integrations`, `automations`, `emails`, `dependencies`, `summary`) plus the v3.0 constitutional honesty axis. Optional `includeSections` narrows the response; `maxRowsPerSection` (default 50, max 200) bounds per-section row counts; `groupBy` (default `'source'`) reshuffles the rendering hint. The `summary` carries per-section unfiltered counts AND a `riskLevel` (`'low' | 'medium' | 'high'`) computed per PLAN-v3.0 \xA74.1 with the specific `riskFactors[]` enumerated; PII risk factors are computed live via the heuristic pii recognizer (EncryptedText / SSN / financial names), not read from a stamped property. The `boundaries[]` array carries the verbatim Q165 disclosure naming which surfaces are composed vs folded elsewhere (list views, reports, dashboards); `dataNotAvailable: ['list-view-filters', 'reports', 'dashboards']` surfaces verbatim regardless of section filter. D3: a Flow decision / record-trigger filter that references this field carries NO `readsFrom` edge (it is a `firesWhen` edge to a ConditionalContext), so such Flow reads are RECONSTRUCTED from the graph's ConditionalContext `fieldRefs` and surfaced in `readers` as heuristic-confidence rows (`source: flow-condition-reads-scan:*`, deduped against real `readsFrom` readers) \u2014 otherwise `readers` would read 0 for a field several Flows filter on; `boundaries[]` also names the referrer classes still NOT composed into any section (roll-up source coupling, layout related-list placement). Top-level `confidence` reports `'mixed'` when sections span tiers (the typical case for any real-org field). Honesty axis (verbatim, ALWAYS): synthesis without omission disclosure is a contract violation; the report is the COMPLETE answer ONLY for extracted axes. Invalid prefix surfaces as `invalid-query`; unknown ids surface as `component-not-found`. When the vault holds captured data-shape facts (`refresh --with-data-shape`), the response embeds a `dataShape` block \u2014 the field's sampled fill rate as a stamped `data_snapshot` (sampled + TTL-checked; context, never a live read).",
+        description: "A complete 360 profile of a single FIELD \u2014 everything that touches that field across validation, formulas, automation, code, UI, integrations, and emails, in one place. (Field forensics \u2014 this is about a field, NOT a user Profile or permissions.) The go-to answer for \"give me the full profile of this field\", \"the full picture of {Object}.{Field}\", \"everything that uses {Object}.{Field}\", \"what touches this field across automation and code\", or a BA's field impact assessment before a change. v3.0 unified field-forensics synthesis tool. Given a CustomField canonical id (or short `<Object>.<Field>` form), composes every prior tier's reads of the field into one structured response with ten optional content sections (`validates`, `formulas`, `writers`, `readers`, `ui`, `integrations`, `automations`, `emails`, `dependencies`, `summary`) plus the v3.0 constitutional honesty axis. A validation rule that reaches the field BOTH ways (a direct `references` edge and its own condition's `readsFrom`, both tokenized from one `errorConditionFormula`) is listed ONCE under `validates` \u2014 `validates` and `automations` never both hold one rule \u2014 with the fold named in `boundaries[]`; the folded rows still count on the automation RISK axis, so `riskLevel` is unaffected by the collapse. Optional `includeSections` narrows the response; `maxRowsPerSection` (default 50, max 200) bounds per-section row counts; `groupBy` (default `'source'`) reshuffles the rendering hint. The `summary` carries per-section unfiltered counts AND a `riskLevel` (`'low' | 'medium' | 'high'`) computed per PLAN-v3.0 \xA74.1 with the specific `riskFactors[]` enumerated; PII risk factors are computed live via the heuristic pii recognizer (EncryptedText / SSN / financial names), not read from a stamped property. The `boundaries[]` array carries the verbatim Q165 disclosure naming which surfaces are composed vs folded elsewhere (list views, reports, dashboards); `dataNotAvailable: ['list-view-filters', 'reports', 'dashboards']` surfaces verbatim regardless of section filter. D3: a Flow decision / record-trigger filter that references this field carries NO `readsFrom` edge (it is a `firesWhen` edge to a ConditionalContext), so such Flow reads are RECONSTRUCTED from the graph's ConditionalContext `fieldRefs` and surfaced in `readers` as heuristic-confidence rows (`source: flow-condition-reads-scan:*`, deduped against real `readsFrom` readers) \u2014 otherwise `readers` would read 0 for a field several Flows filter on; `boundaries[]` also names the referrer classes still NOT composed into any section (roll-up source coupling, layout related-list placement). Top-level `confidence` reports `'mixed'` when sections span tiers (the typical case for any real-org field). Honesty axis (verbatim, ALWAYS): synthesis without omission disclosure is a contract violation; the report is the COMPLETE answer ONLY for extracted axes. Invalid prefix surfaces as `invalid-query`; unknown ids surface as `component-not-found`. When the vault holds captured data-shape facts (`refresh --with-data-shape`), the response embeds a `dataShape` block \u2014 the field's sampled fill rate as a stamped `data_snapshot` (sampled + TTL-checked; context, never a live read).",
         inputSchema: FIELD_360_INPUT_SCHEMA
       },
       {
@@ -56209,18 +56576,35 @@ var init_concept_model = __esm({
       }
     });
     EDGE_SEMANTICS = Object.freeze({
-      formulaTokenizer: {
-        edgeType: "references",
-        source: "formula-tokenizer",
-        category: "formula",
-        verdict: "blocking"
-      },
+      bySource: [
+        {
+          source: "formula-tokenizer",
+          edgeType: "references",
+          fromType: "CustomField",
+          category: "formula",
+          verdict: "blocking"
+        },
+        {
+          source: "rollup-summary",
+          edgeType: "references",
+          category: "rollup",
+          verdict: "blocking"
+        },
+        {
+          source: "relationship-resolver",
+          edgeType: "references",
+          fromType: "CustomField",
+          category: "formula",
+          verdict: "blocking"
+        }
+      ],
       byEdgeType: {
         readsFrom: {
           bySourceType: {
             ApexClass: { category: "apex", verdict: "risky" },
             ApexTrigger: { category: "apex", verdict: "risky" },
             Flow: { category: "flow", verdict: "blocking" },
+            ConditionalContext: { category: "condition", verdict: "blocking" },
             LightningComponentBundle: { category: "frontend", verdict: "risky" },
             AuraDefinitionBundle: { category: "frontend", verdict: "risky" }
           },
@@ -61578,6 +61962,60 @@ var init_flow_field_writers_scan = __esm({
   }
 });
 
+// ../mcp/dist/src/tools/restated-condition-edges.js
+var FORMULA_TOKENIZER_SOURCE, CONDITION_EXTRACTOR_SOURCE, FORMULA_CONDITION_KIND, stringProp, isDirectFormulaReference, isFormulaConditionEdge, EMPTY_INDEX, indexRestatedConditionEdges;
+var init_restated_condition_edges = __esm({
+  "../mcp/dist/src/tools/restated-condition-edges.js"() {
+    "use strict";
+    FORMULA_TOKENIZER_SOURCE = "formula-tokenizer";
+    CONDITION_EXTRACTOR_SOURCE = "condition-extractor";
+    FORMULA_CONDITION_KIND = "formula";
+    stringProp = (edge, key) => {
+      const raw = edge.properties[key];
+      return typeof raw === "string" && raw.length > 0 ? raw : null;
+    };
+    isDirectFormulaReference = (edge) => edge.edgeType === "references" && edge.source === FORMULA_TOKENIZER_SOURCE;
+    isFormulaConditionEdge = (edge) => edge.edgeType === "readsFrom" && edge.source === CONDITION_EXTRACTOR_SOURCE && edge.properties["kind"] === FORMULA_CONDITION_KIND;
+    EMPTY_INDEX = Object.freeze({
+      isRestatingCondition: () => false,
+      isRestatedDirectReference: () => false,
+      suppressedConditionCount: 0
+    });
+    indexRestatedConditionEdges = (edges) => {
+      const directReferrers = /* @__PURE__ */ new Set();
+      for (const edge of edges) {
+        if (isDirectFormulaReference(edge))
+          directReferrers.add(edge.fromId);
+      }
+      if (directReferrers.size === 0)
+        return EMPTY_INDEX;
+      const restatingFirers = /* @__PURE__ */ new Set();
+      let suppressedConditionCount = 0;
+      for (const edge of edges) {
+        if (!isFormulaConditionEdge(edge))
+          continue;
+        const firerId = stringProp(edge, "firerId");
+        if (firerId === null || !directReferrers.has(firerId))
+          continue;
+        restatingFirers.add(firerId);
+        suppressedConditionCount += 1;
+      }
+      if (restatingFirers.size === 0)
+        return EMPTY_INDEX;
+      return {
+        isRestatingCondition: (edge) => {
+          if (!isFormulaConditionEdge(edge))
+            return false;
+          const firerId = stringProp(edge, "firerId");
+          return firerId !== null && restatingFirers.has(firerId);
+        },
+        isRestatedDirectReference: (edge) => isDirectFormulaReference(edge) && restatingFirers.has(edge.fromId),
+        suppressedConditionCount
+      };
+    };
+  }
+});
+
 // ../mcp/dist/src/tools/field-360.js
 import { z as z52 } from "zod";
 var CUSTOM_FIELD_PREFIX7, DEFAULT_MAX_ROWS_PER_SECTION, HARD_CAP_MAX_ROWS_PER_SECTION, FIELD_360_BYTE_BUDGET, FIELD_360_Q165_DISCLOSURE, SECTION_NAMES, GROUP_BY_VALUES, field360InputSchema, normalizeFieldId, AUTOMATION_NODE_TYPES, INTEGRATION_NODE_TYPES, UI_NODE_TYPES, CODE_NODE_TYPES, buildRow, compareRows, buildSection, resolveEdgeSource, detectIsFormula, extractFieldType, extractReferenceTo, computeOverallConfidence, computeRisk, detectIsPii, emptyBuckets, classifyIncomingEdge, field360Handler;
@@ -61598,6 +62036,7 @@ var init_field_360 = __esm({
     init_phantom_node();
     init_report_dashboard_usage();
     init_resolve_field_or_suggest();
+    init_restated_condition_edges();
     CUSTOM_FIELD_PREFIX7 = "CustomField:";
     DEFAULT_MAX_ROWS_PER_SECTION = 50;
     HARD_CAP_MAX_ROWS_PER_SECTION = 200;
@@ -61606,6 +62045,7 @@ var init_field_360 = __esm({
     SECTION_NAMES = [
       "validates",
       "formulas",
+      "rollups",
       "writers",
       "readers",
       "ui",
@@ -61753,12 +62193,12 @@ var init_field_360 = __esm({
         return "mixed";
       return [...seen][0];
     };
-    computeRisk = (perSectionCounts, isPii, isFormula, dependenciesCount) => {
+    computeRisk = (perSectionCounts, isPii, isFormula, dependenciesCount, foldedConditionCount) => {
       const writers = perSectionCounts["writers"] ?? 0;
       const readers = perSectionCounts["readers"] ?? 0;
       const integrations = perSectionCounts["integrations"] ?? 0;
       const emails = perSectionCounts["emails"] ?? 0;
-      const automations = perSectionCounts["automations"] ?? 0;
+      const automations = (perSectionCounts["automations"] ?? 0) + foldedConditionCount;
       const factors = [];
       if (integrations >= 2) {
         factors.push(`${integrations}-integrations-exceeds-threshold-2`);
@@ -61802,6 +62242,7 @@ var init_field_360 = __esm({
     emptyBuckets = () => ({
       validates: [],
       formulas: [],
+      rollups: [],
       writers: [],
       readers: [],
       ui: [],
@@ -61817,10 +62258,14 @@ var init_field_360 = __esm({
         buckets.validates.push(row);
         return;
       }
-      if (edge.edgeType === "references" && edge.source === "formula-tokenizer") {
+      if (edge.edgeType === "references" && (edge.source === "formula-tokenizer" || edge.source === "relationship-resolver" && source.type === "CustomField")) {
         buckets.formulas.push(row);
         return;
       }
+      if (edge.edgeType === "references" && edge.source === "rollup-summary") {
+        buckets.rollups.push(row);
+        return;
+      }
       if (edge.edgeType === "references" && source.type === "EmailTemplate" && edge.properties["role"] === "body-merge") {
         buckets.emails.push(row);
         return;
@@ -61830,6 +62275,10 @@ var init_field_360 = __esm({
         return;
       }
       if (edge.edgeType === "readsFrom") {
+        if (source.type === "ConditionalContext") {
+          buckets.automations.push(row);
+          return;
+        }
         if (UI_NODE_TYPES.has(source.type) && CODE_NODE_TYPES.has(source.type)) {
           buckets.ui.push(row);
           return;
@@ -61907,6 +62356,7 @@ var init_field_360 = __esm({
       }
       const incoming = incomingResult.value;
       const buckets = emptyBuckets();
+      const resolvedIncoming = [];
       for (const edge of incoming) {
         if (edge.edgeType === "parentOf")
           continue;
@@ -61915,7 +62365,13 @@ var init_field_360 = __esm({
           return sr;
         if (sr.value === null)
           continue;
-        classifyIncomingEdge(edge, sr.value, buckets);
+        resolvedIncoming.push({ edge, source: sr.value });
+      }
+      const restated = indexRestatedConditionEdges(resolvedIncoming.map((r) => r.edge));
+      for (const { edge, source } of resolvedIncoming) {
+        if (restated.isRestatingCondition(edge))
+          continue;
+        classifyIncomingEdge(edge, source, buckets);
       }
       const parentObjectApi = fieldNode.parentId !== null && fieldNode.parentId.startsWith("CustomObject:") ? fieldNode.parentId.slice("CustomObject:".length) : fieldId.slice("CustomField:".length).split(".")[0] ?? "";
       const supplementalWriters = await scanSupplementalFlowFieldWriters(ctx, parentObjectApi, fieldNode.apiName);
@@ -61936,6 +62392,11 @@ var init_field_360 = __esm({
       }
       const flowConditionScan = await scanFlowConditionFieldReaders(ctx, fieldId);
       const readerIds = new Set(buckets.readers.map((r) => r.componentId));
+      for (const row of buckets.automations) {
+        const firer = row.properties?.["firerId"];
+        if (typeof firer === "string")
+          readerIds.add(firer);
+      }
       let flowConditionReaderCount = 0;
       for (const fc of flowConditionScan.readers) {
         if (readerIds.has(fc.flowId))
@@ -61986,6 +62447,7 @@ var init_field_360 = __esm({
       const allBuckets = [
         ["validates", buckets.validates],
         ["formulas", buckets.formulas],
+        ["rollups", buckets.rollups],
         ["writers", buckets.writers],
         ["readers", buckets.readers],
         ["ui", buckets.ui],
@@ -62072,7 +62534,7 @@ var init_field_360 = __esm({
         perSectionCounts[name] = rows.length;
       }
       const isPii = detectIsPii(fieldNode);
-      const risk = computeRisk(perSectionCounts, isPii, isFormula, buckets.dependencies.length);
+      const risk = computeRisk(perSectionCounts, isPii, isFormula, buckets.dependencies.length, restated.suppressedConditionCount);
       const grantedByCount = incoming.filter((e) => e.edgeType === "grantedBy").length;
       const summary = {
         perSectionCounts,
@@ -62086,6 +62548,9 @@ var init_field_360 = __esm({
         FIELD_360_Q165_DISCLOSURE,
         "list view column AND filter field IDENTITY are composed into the `listViews` section (heuristic regex; a row's `referenceKind` is `fieldRef` for a column, `filterRef` for a filter predicate, or `columnAndFilter` for both) \u2014 but the saved view's runtime filter PREDICATE EVALUATION (whether a given record passes the filter) stays unmodeled and remains in dataNotAvailable as `list-view-filters`"
       ];
+      if (restated.suppressedConditionCount > 0) {
+        boundaries.push(`${restated.suppressedConditionCount} ConditionalContext \`readsFrom\` row(s) were FOLDED into \`validates\`: each restates a validation rule already listed there (the rule's errorConditionFormula is tokenized into BOTH a direct \`references\` edge and a condition edge, so counting both would report one rule as two referrers). Both edges remain in the graph \u2014 query them with sfi.get_edges \u2014 and the folded rows still count toward the automation risk axis, so \`riskLevel\` is unaffected. Conditions are listed but NOT evaluated: sfi does not know whether any record satisfies them.`);
+      }
       const analytics = reportDashboardUsageDetail(fieldNode);
       const analyticsCoverage = summarizeCoverage(ctx.manifest, [
         "Report",
@@ -62637,7 +63102,7 @@ ${comment}
 
 // ../mcp/dist/src/tools/safe-to-delete-field.js
 import { z as z54 } from "zod";
-var CUSTOM_FIELD_PREFIX9, EXAMPLES_PER_CATEGORY_LIMIT, CATEGORY_ORDER, safeToDeleteFieldInputSchema, classifyEdge, CATEGORY_NOTES, compareExamples, buildReasoning, promoteVerdict, aggregateVerdict, buildCoverageCaveat2, applyCoverageToVerdict2, buildPiiCompliance, VERDICT_ORDER, renderDeleteChecklist, buildSafeToDeleteFieldProposal, coreSafeToDeleteFieldHandler, safeToDeleteFieldHandler;
+var CUSTOM_FIELD_PREFIX9, EXAMPLES_PER_CATEGORY_LIMIT, CATEGORY_ORDER, safeToDeleteFieldInputSchema, classifyEdge, CATEGORY_NOTES, formatExampleCitation, compareExamples, buildReasoning, promoteVerdict, aggregateVerdict, buildCoverageCaveat2, applyCoverageToVerdict2, EDGE_FAMILIES_ADDED_IN, buildBuilderVersionCaveat, buildPiiCompliance, VERDICT_ORDER, renderDeleteChecklist, buildSafeToDeleteFieldProposal, coreSafeToDeleteFieldHandler, safeToDeleteFieldHandler;
 var init_safe_to_delete_field = __esm({
   "../mcp/dist/src/tools/safe-to-delete-field.js"() {
     "use strict";
@@ -62656,15 +63121,18 @@ var init_safe_to_delete_field = __esm({
     init_proposal_artifact();
     init_report_dashboard_usage();
     init_resolve_field_or_suggest();
+    init_restated_condition_edges();
     CUSTOM_FIELD_PREFIX9 = "CustomField:";
     EXAMPLES_PER_CATEGORY_LIMIT = 5;
     CATEGORY_ORDER = [
       "apex",
       "flow",
+      "condition",
       "workflow",
       "validation",
       "layout",
       "formula",
+      "rollup",
       "integration",
       "permission",
       "sharing",
@@ -62702,10 +63170,16 @@ var init_safe_to_delete_field = __esm({
       path: ["fieldId"]
     });
     classifyEdge = (edge, fromNode) => {
-      if (edge.edgeType === EDGE_SEMANTICS.formulaTokenizer.edgeType && edge.source === EDGE_SEMANTICS.formulaTokenizer.source) {
+      for (const rule2 of EDGE_SEMANTICS.bySource) {
+        if (edge.edgeType !== rule2.edgeType)
+          continue;
+        if (edge.source !== rule2.source)
+          continue;
+        if (rule2.fromType !== void 0 && fromNode.type !== rule2.fromType)
+          continue;
         return {
-          category: EDGE_SEMANTICS.formulaTokenizer.category,
-          verdict: EDGE_SEMANTICS.formulaTokenizer.verdict
+          category: rule2.category,
+          verdict: rule2.verdict
         };
       }
       const rule = EDGE_SEMANTICS.byEdgeType[edge.edgeType];
@@ -62718,10 +63192,12 @@ var init_safe_to_delete_field = __esm({
     CATEGORY_NOTES = Object.freeze({
       apex: "Apex classes and triggers reference this field. Parsed-confidence matches (the default-on Apex AST pass \u2014 dot-access plus inline static SOQL SELECT/WHERE/ORDER BY/GROUP BY fields and constant-string Database.query literals) are real references; heuristic-confidence matches (apex-scanner regex fallback) may include false positives \u2014 spot-check those before deleting. String-BUILT dynamic SOQL remains invisible either way.",
       flow: "Flow definitions read or write this field. The Flow XML names the field literally; deleting the field will break the Flow at runtime.",
+      condition: "A condition EVALUATES this field. Seven firer families mint these: Flow entry criteria, Flow decisions, validation-rule conditions, workflow-rule criteria, and approval-process, assignment-rule, auto-response-rule and escalation-rule criteria. Each example carries the `firerId` of the component whose criteria it is, so the citation names the actual rule to go change rather than the family list (the example `id` itself is a synthetic ConditionalContext node). Salesforce refuses to delete a field a live condition tests, so this is a hard blocker even when the field appears on no layout and in no formula. The condition is listed but NOT evaluated: sfi does not know whether any record satisfies it.",
       workflow: "A WorkflowRule field-update action writes this field. The action will fail at runtime if the field is removed.",
-      validation: "A Validation Rule formula references this field. The Validation Rule will fail to compile if the field is removed.",
+      validation: 'A Validation Rule formula references this field. The Validation Rule will fail to compile if the field is removed, and Salesforce refuses the delete while the rule is live. The rule\u2019s `errorConditionFormula` is BOTH a formula reference and a condition that evaluates this field; those are two edges from one tokenized string, so the rule is counted ONCE here and the folded row is disclosed on the example as `alsoVia: ["condition"]` rather than reported as a second referrer. As with any condition, it is listed but NOT evaluated: sfi does not know whether any record satisfies it.',
       layout: "This field is placed on one or more page layouts (deleting the field auto-removes it from them \u2014 Salesforce does not block the delete and the layouts keep working, but users of those layouts will no longer see the field) or referenced by a QuickAction (whose create/edit form is affected). Review the UI impact before deleting.",
-      formula: "Another formula field references this field via its formula tokenizer. The referencing formula will fail to compile if this field is removed.",
+      formula: "Another formula field references this field \u2014 either directly (tokenized from the formula body) or through a cross-object relationship traversal (`Parent__r.Field__c`) resolved against the org\u2019s lookup fields. Each EXAMPLE carries the referring field id, and a traversal-derived one also carries the `traversalPath` it was resolved from. The referencing formula will fail to compile if this field is removed.",
+      rollup: "A roll-up summary field on the PARENT object depends on this field in one of three declared roles: `summarizedField` (the roll-up aggregates this field), `summaryForeignKey` (the roll-up is anchored on this master-detail field), or `summaryFilterItem` (the roll-up\u2019s filter tests this field). Each example carries its own `rollupRole`, so the citation names the coupling that actually exists rather than listing the possibilities. Salesforce REFUSES the delete outright while the roll-up exists \u2014 delete or repoint the roll-up first. The coupling is declared in the parent object\u2019s metadata, not this field\u2019s, so a search restricted to this object cannot find it.",
       integration: "An integration surface (external data source, external service) references this field. Removing it may break the outbound or inbound contract.",
       permission: "A Profile or Permission Set grants access to this field. Removing the field will drop the permission grant but is not blocked.",
       sharing: "A SharingRule, Restriction Rule, or Scoping Rule criterion references this field. Deleting the field will break the rule.",
@@ -62730,6 +63206,21 @@ var init_safe_to_delete_field = __esm({
       frontend: "A Lightning Web Component, Aura bundle, Visualforce page, or Visualforce component references this field. Heuristic-confidence matches (LWC/Aura scanners) may include false positives; spot-check the bundle source before deleting.",
       unknown: "An incoming dependency edge was found whose source/type combination is not in the v2.0b classification table. Review the impact via sfi.get_impact before deleting."
     });
+    formatExampleCitation = (e) => {
+      const qualifiers = [];
+      if (e.rollupRole !== void 0)
+        qualifiers.push(`as ${e.rollupRole}`);
+      if (e.traversalPath !== void 0)
+        qualifiers.push(`via ${e.traversalPath}`);
+      if (e.firerId !== void 0)
+        qualifiers.push(`fired by ${e.firerId}`);
+      if (e.alsoVia !== void 0 && e.alsoVia.length > 0) {
+        qualifiers.push(`also via ${[...e.alsoVia].join(", ")}`);
+      }
+      if (e.apiConfirmed === true)
+        qualifiers.push("API-confirmed");
+      return qualifiers.length === 0 ? e.id : `${e.id} (${qualifiers.join(", ")})`;
+    };
     compareExamples = (a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0;
     buildReasoning = (buckets) => {
       const out = [];
@@ -62796,6 +63287,19 @@ var init_safe_to_delete_field = __esm({
       fireOnUnknownCoverage: true
     });
     applyCoverageToVerdict2 = (verdict, caveat) => applyCoverageToVerdict(verdict, caveat, "safe", "review");
+    EDGE_FAMILIES_ADDED_IN = "0.3.0";
+    buildBuilderVersionCaveat = (ctx) => {
+      const runningVersion = process.env["SFI_PLUGIN_VERSION"];
+      const builtByVersion = ctx.manifest.version;
+      if (runningVersion === void 0 || runningVersion === "")
+        return void 0;
+      if (typeof builtByVersion !== "string" || builtByVersion === "") {
+        return void 0;
+      }
+      if (!compareVersions(builtByVersion, runningVersion))
+        return void 0;
+      return `This vault was built by sf-intelligence ${builtByVersion}; you are running ${runningVersion}. Roll-up coupling, condition (Flow / validation-rule / workflow-rule / approval-process / assignment-rule / auto-response-rule / escalation-rule criteria) and resolved formula-traversal dependency edges were added in ${EDGE_FAMILIES_ADDED_IN} and are ABSENT until you re-run \`sfi refresh\` \u2014 a field whose only dependency is one of those cannot be seen here. A verdict of "safe" is therefore reported as "review" (NOT proven safe) on this vault.`;
+    };
     buildPiiCompliance = (node) => {
       const { piiClassification, piiCategory } = detectPiiClassification(node);
       if (!isRegulatedPiiClassification(piiClassification)) {
@@ -62822,6 +63326,9 @@ var init_safe_to_delete_field = __esm({
       if (out.coverageCaveat !== void 0) {
         lines.push(`> \u26A0\uFE0F **Coverage caveat (${out.coverageCaveat.status}):** ${out.coverageCaveat.message}`, "");
       }
+      if (out.builderVersionCaveat !== void 0) {
+        lines.push(`> \u26A0\uFE0F **Stale vault:** ${out.builderVersionCaveat}`, "");
+      }
       lines.push(`**Verdict: ${out.verdict.toUpperCase()}**`, "");
       const ordered = [...out.reasoning].sort((a, b) => VERDICT_ORDER[a.verdict] - VERDICT_ORDER[b.verdict]);
       if (ordered.length === 0) {
@@ -62836,7 +63343,7 @@ var init_safe_to_delete_field = __esm({
           r.category,
           r.verdict,
           r.count,
-          r.examples.map((e) => e.apiConfirmed === true ? `${e.id} (API-confirmed)` : e.id).join(", ") || "\u2014"
+          r.examples.map(formatExampleCitation).join("; ") || "\u2014"
         ])));
       }
       lines.push("", "_Proposed from the vault's last refresh \u2014 verify against your org before deleting. This never deploys or modifies the org._");
@@ -62850,7 +63357,7 @@ var init_safe_to_delete_field = __esm({
         }));
       }
       reasons.push(...out.reasoning.map((r) => {
-        const examples = r.examples.map((e) => e.apiConfirmed === true ? `${e.id} (API-confirmed)` : e.id).join(", ");
+        const examples = r.examples.map(formatExampleCitation).join("; ");
         const apiTag = r.apiConfirmed === true ? ", API-confirmed" : "";
         return `${r.category} (${r.verdict}, ${r.count}${apiTag})${examples ? `: ${examples}` : ""} \u2014 ${r.note}`;
       }));
@@ -63011,6 +63518,7 @@ var init_safe_to_delete_field = __esm({
       }
       const buckets = /* @__PURE__ */ new Map();
       let flsGrantCount = 0;
+      const resolvedEdges = [];
       for (const edge of edgesResult.value) {
         if (edge.edgeType === "parentOf")
           continue;
@@ -63029,13 +63537,31 @@ var init_safe_to_delete_field = __esm({
         if (fromNode === null) {
           continue;
         }
+        resolvedEdges.push({ edge, fromNode });
+      }
+      const restated = indexRestatedConditionEdges(resolvedEdges.map((r) => r.edge));
+      for (const { edge, fromNode } of resolvedEdges) {
+        if (restated.isRestatingCondition(edge))
+          continue;
         const { category, verdict: verdict2 } = classifyEdge(edge, fromNode);
         const apiConfirmed = edge.properties["confirmedByApi"] === true;
+        const edgeString = (key) => {
+          const raw = edge.properties[key];
+          return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+        };
+        const traversalPath = edgeString("traversalPath");
+        const rollupRole = edgeString("rollupRole");
+        const firerId = edgeString("firerId");
+        const alsoVia = restated.isRestatedDirectReference(edge) ? ["condition"] : void 0;
         const example = {
           id: fromNode.id,
           type: fromNode.type,
           apiName: fromNode.apiName,
-          ...apiConfirmed ? { apiConfirmed: true } : {}
+          ...apiConfirmed ? { apiConfirmed: true } : {},
+          ...traversalPath !== void 0 ? { traversalPath } : {},
+          ...rollupRole !== void 0 ? { rollupRole } : {},
+          ...firerId !== void 0 ? { firerId } : {},
+          ...alsoVia !== void 0 ? { alsoVia } : {}
         };
         const existing = buckets.get(category);
         if (existing === void 0) {
@@ -63077,7 +63603,9 @@ var init_safe_to_delete_field = __esm({
       const reasoning = buildReasoning(buckets);
       const coverageCaveat = buildCoverageCaveat2(ctx);
       const piiCompliance = buildPiiCompliance(nodeResult.value);
-      const staticVerdict = applyCoverageToVerdict2(aggregateVerdict(reasoning), coverageCaveat);
+      const builderVersionCaveat = buildBuilderVersionCaveat(ctx);
+      const coverageVerdict = applyCoverageToVerdict2(aggregateVerdict(reasoning), coverageCaveat);
+      const staticVerdict = builderVersionCaveat !== void 0 && coverageVerdict === "safe" ? "review" : coverageVerdict;
       const dataShape = await readFactBlock(ctx, fieldId, "fillRate");
       const baseConfidence = reasoning.some((r) => r.verdict === "risky") ? "heuristic" : "declared";
       const baseCompleteness = {
@@ -63087,6 +63615,10 @@ var init_safe_to_delete_field = __esm({
       const baseLimitations = [
         "Dependency evidence comes from the last offline vault refresh. String-built dynamic SOQL, reflective Apex, and runtime metadata access remain invisible to static analysis; inline static SOQL and constant-string Database.query field references ARE resolved (parsed-confidence Apex AST edges). A dot-access read/write to a shared Activity custom field through a Task or Event receiver (someTask.Field__c) is NOT a direct parsed edge on the Activity field \u2014 it is attached by a name-based polymorphic import alias (see next limitation).",
         "Polymorphic Activity attribution: a shared Activity custom field can appear as up to three nodes (CustomField:Activity/Task/Event.<field>) that are ONE physical field. A read/write keyed on one representation is attached to the others at import by a name-based alias \u2014 re-pointed onto the Activity base when it exists, otherwise mirrored across the Task/Event describe-snapshot siblings (Task and Event share the custom fields defined on Activity). This is a heuristic name match applied at import, not a declared parent relationship \u2014 an admin should still confirm the referrer before deleting.",
+        // Unconditional when it fires — a `blocking` verdict on a stale vault is
+        // still a verdict computed from incomplete edge families, so the reader is
+        // told even though the verdict did not move.
+        ...builderVersionCaveat !== void 0 ? [builderVersionCaveat] : [],
         REPORT_DASHBOARD_USAGE_CAVEAT,
         ...flsGrantCount > 0 ? [
           `${flsGrantCount} Profile/PermissionSet FLS grant(s) exist on this field (access, not usage) \u2014 excluded from the verdict; see \`sfi.field_access_audit\` or \`sfi.unused_fields_deep\`. Deleting the field drops grants automatically.`
@@ -63130,6 +63662,7 @@ var init_safe_to_delete_field = __esm({
           ...dataShape !== void 0 ? { dataShape } : {},
           reasoning,
           ...coverageCaveat !== void 0 ? { coverageCaveat } : {},
+          ...builderVersionCaveat !== void 0 ? { builderVersionCaveat } : {},
           ...piiCompliance !== void 0 ? { piiCompliance } : {},
           ...flsGrantCount > 0 ? { flsGrantCount } : {},
           ...livePopulation !== void 0 ? { livePopulation } : {},
@@ -68795,7 +69328,7 @@ var init_fleet_find = __esm({
 
 // ../mcp/dist/src/tools/generate-data-dictionary.js
 import { z as z76 } from "zod";
-var Q125_FRESHNESS_DISCLOSURE, STRUCTURAL_DISCLOSURE, INHERITED_CONFIDENCE_DISCLOSURE, ERD_SCOPE_DISCLOSURE, CUSTOM_OBJECT_PREFIX6, generateDataDictionaryInputSchema, stringProp, boolProp, escapeCell, renderFieldRow, compareByApiName, FIELDS_CSV_HEADER, csvRowForField, renderFieldsSection, renderRelationshipsSection, collectOutgoingErdRelationships, CUSTOM_FIELD_PREFIX18, parseCustomFieldId, renderErdSection, renderValidationRulesSection, renderPageLayoutsSection, renderTriggersAndFlowsSection, renderFooter, GENERATED_DOC_ENVELOPE_RESERVE_BYTES, GENERATED_DOC_BUDGET_FLOOR_BYTES, COMPONENT_IDS_SAMPLE_KEEP, GENERATED_DOC_MAX_RESPONSE_BYTES, GENERATED_DOC_RESPONSE_BUDGET_DEFAULT_BYTES, resolveResponseBudgetBytes, generatedDocByteBudget, byteLenOf, splitBodyIntoSections, sectionHeading, renderTruncationNote, fitDocumentToBudget, generateDataDictionaryHandler;
+var Q125_FRESHNESS_DISCLOSURE, STRUCTURAL_DISCLOSURE, INHERITED_CONFIDENCE_DISCLOSURE, ERD_SCOPE_DISCLOSURE, CUSTOM_OBJECT_PREFIX6, generateDataDictionaryInputSchema, stringProp2, boolProp, escapeCell, renderFieldRow, compareByApiName, FIELDS_CSV_HEADER, csvRowForField, renderFieldsSection, renderRelationshipsSection, collectOutgoingErdRelationships, CUSTOM_FIELD_PREFIX18, parseCustomFieldId, renderErdSection, renderValidationRulesSection, renderPageLayoutsSection, renderTriggersAndFlowsSection, renderFooter, GENERATED_DOC_ENVELOPE_RESERVE_BYTES, GENERATED_DOC_BUDGET_FLOOR_BYTES, COMPONENT_IDS_SAMPLE_KEEP, GENERATED_DOC_MAX_RESPONSE_BYTES, GENERATED_DOC_RESPONSE_BUDGET_DEFAULT_BYTES, resolveResponseBudgetBytes, generatedDocByteBudget, byteLenOf, splitBodyIntoSections, sectionHeading, renderTruncationNote, fitDocumentToBudget, generateDataDictionaryHandler;
 var init_generate_data_dictionary = __esm({
   "../mcp/dist/src/tools/generate-data-dictionary.js"() {
     "use strict";
@@ -68813,19 +69346,19 @@ var init_generate_data_dictionary = __esm({
       objectId: z76.string().min(1),
       format: z76.enum(["markdown", "csv"]).optional()
     });
-    stringProp = (properties, key, fallback) => {
+    stringProp2 = (properties, key, fallback) => {
       const v = properties[key];
       return typeof v === "string" && v.length > 0 ? v : fallback;
     };
     boolProp = (properties, key) => properties[key] === true;
     escapeCell = (raw) => raw.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
     renderFieldRow = (field) => {
-      const label = escapeCell(stringProp(field.properties, "label", field.label ?? field.apiName));
+      const label = escapeCell(stringProp2(field.properties, "label", field.label ?? field.apiName));
       const apiName = escapeCell(field.apiName);
-      const dataType = stringProp(field.properties, "dataType", "Unknown");
-      const isFormula = stringProp(field.properties, "formula", "") !== "";
+      const dataType = stringProp2(field.properties, "dataType", "Unknown");
+      const isFormula = stringProp2(field.properties, "formula", "") !== "";
       const type = escapeCell(isFormula ? `${dataType} (formula)` : dataType);
-      const description = escapeCell(stringProp(field.properties, "description", ""));
+      const description = escapeCell(stringProp2(field.properties, "description", ""));
       const required = boolProp(field.properties, "required") ? "yes" : "no";
       return `| ${label} | \`${apiName}\` | ${type} | ${description} | ${required} |`;
     };
@@ -68840,10 +69373,10 @@ var init_generate_data_dictionary = __esm({
       "required"
     ];
     csvRowForField = (objectApiName, field) => {
-      const label = stringProp(field.properties, "label", field.label ?? field.apiName);
-      const dataType = stringProp(field.properties, "dataType", "Unknown");
-      const isFormula = stringProp(field.properties, "formula", "") !== "";
-      const description = stringProp(field.properties, "description", "");
+      const label = stringProp2(field.properties, "label", field.label ?? field.apiName);
+      const dataType = stringProp2(field.properties, "dataType", "Unknown");
+      const isFormula = stringProp2(field.properties, "formula", "") !== "";
+      const description = stringProp2(field.properties, "description", "");
       const required = boolProp(field.properties, "required");
       return [objectApiName, label, field.apiName, dataType, isFormula, description, required];
     };
@@ -68863,10 +69396,10 @@ var init_generate_data_dictionary = __esm({
     renderRelationshipsSection = (fields) => {
       const rels = [];
       for (const field of fields) {
-        const dataType = stringProp(field.properties, "dataType", "");
+        const dataType = stringProp2(field.properties, "dataType", "");
         if (dataType !== "Lookup" && dataType !== "MasterDetail")
           continue;
-        const referenceTo = stringProp(field.properties, "referenceTo", "Unknown");
+        const referenceTo = stringProp2(field.properties, "referenceTo", "Unknown");
         rels.push({
           fieldApiName: field.apiName,
           relationshipType: dataType,
@@ -68889,7 +69422,7 @@ var init_generate_data_dictionary = __esm({
     collectOutgoingErdRelationships = (objectApiName, fields) => {
       const rels = [];
       for (const field of fields) {
-        const dataType = stringProp(field.properties, "dataType", "");
+        const dataType = stringProp2(field.properties, "dataType", "");
         if (dataType !== "Lookup" && dataType !== "MasterDetail")
           continue;
         const referenceTo = field.properties["referenceTo"];
@@ -68931,7 +69464,7 @@ var init_generate_data_dictionary = __esm({
       }
       const sorted = [...rules].sort(compareByApiName);
       const items = sorted.map((r) => {
-        const description = stringProp(r.properties, "description", stringProp(r.properties, "errorMessage", ""));
+        const description = stringProp2(r.properties, "description", stringProp2(r.properties, "errorMessage", ""));
         const desc = description.length > 0 ? ` \u2014 ${escapeCell(description)}` : "";
         return `- \`${escapeCell(r.apiName)}\`${desc}`;
       });
@@ -73819,7 +74352,7 @@ var init_role_hierarchy = __esm({
 
 // ../mcp/dist/src/tools/generate-sharing-summary.js
 import { z as z90 } from "zod";
-var OBJECT_SCAN_CAP, TYPE_SCAN_CAP2, UNMODELED_SHARING_DIMENSIONS_DISCLOSURE, generateSharingSummaryInputSchema, CUSTOM_OBJECT_ID_PREFIX, objectApiNameFromComponentId, escapeCell6, stringProp2, criteriaPredicate, PREDICATE_RULE_TYPES, ruleCriteriaCell, buildRecipientCell, renderObjectSection, renderRoleHierarchySection, sharingRuleObjectApiName, buildSharingRulesIndex, tallyGrants, generateSharingSummaryHandler;
+var OBJECT_SCAN_CAP, TYPE_SCAN_CAP2, UNMODELED_SHARING_DIMENSIONS_DISCLOSURE, generateSharingSummaryInputSchema, CUSTOM_OBJECT_ID_PREFIX, objectApiNameFromComponentId, escapeCell6, stringProp3, criteriaPredicate, PREDICATE_RULE_TYPES, ruleCriteriaCell, buildRecipientCell, renderObjectSection, renderRoleHierarchySection, sharingRuleObjectApiName, buildSharingRulesIndex, tallyGrants, generateSharingSummaryHandler;
 var init_generate_sharing_summary = __esm({
   "../mcp/dist/src/tools/generate-sharing-summary.js"() {
     "use strict";
@@ -73850,7 +74383,7 @@ var init_generate_sharing_summary = __esm({
       return componentId.startsWith(CUSTOM_OBJECT_ID_PREFIX) ? componentId.slice(CUSTOM_OBJECT_ID_PREFIX.length) : componentId;
     };
     escapeCell6 = (raw) => raw.replace(/\|/g, "\\|").replace(/\r?\n/g, " ");
-    stringProp2 = (properties, key, fallback) => {
+    stringProp3 = (properties, key, fallback) => {
       const v = properties[key];
       return typeof v === "string" && v.length > 0 ? v : fallback;
     };
@@ -73938,8 +74471,8 @@ var init_generate_sharing_summary = __esm({
         lines.push("| --- | --- | --- | --- | --- |");
         const sorted = [...entry.sharingRules].sort((a, b) => a.apiName < b.apiName ? -1 : a.apiName > b.apiName ? 1 : 0);
         for (const rule of sorted) {
-          const ruleType = stringProp2(rule.properties, "ruleType", "unknown");
-          const access = stringProp2(rule.properties, "accessLevel", "Unknown");
+          const ruleType = stringProp3(rule.properties, "ruleType", "unknown");
+          const access = stringProp3(rule.properties, "accessLevel", "Unknown");
           const criteria = ruleCriteriaCell(ruleType, rule.properties);
           const recipient = entry.ruleRecipients.get(rule.id) ?? "\u2014";
           lines.push(`| \`${escapeCell6(rule.apiName)}\` | ${escapeCell6(ruleType)} | ${escapeCell6(recipient)} | ${escapeCell6(access)} | ${escapeCell6(criteria)} |`);
@@ -73953,9 +74486,9 @@ var init_generate_sharing_summary = __esm({
         lines.push("| --- | --- | --- | --- | --- |");
         const sortedRr = [...entry.restrictionRules].sort((a, b) => a.apiName < b.apiName ? -1 : a.apiName > b.apiName ? 1 : 0);
         for (const rule of sortedRr) {
-          const enforcement = stringProp2(rule.properties, "enforcementType", "Unknown");
-          const active = stringProp2(rule.properties, "active", "unknown");
-          const recordFilter = stringProp2(rule.properties, "recordFilter", "\u2014");
+          const enforcement = stringProp3(rule.properties, "enforcementType", "Unknown");
+          const active = stringProp3(rule.properties, "active", "unknown");
+          const recordFilter = stringProp3(rule.properties, "recordFilter", "\u2014");
           lines.push(`| \`${escapeCell6(rule.apiName)}\` | ${escapeCell6(rule.type)} | ${escapeCell6(enforcement)} | ${escapeCell6(active)} | ${escapeCell6(recordFilter)} |`);
         }
       }
@@ -73976,7 +74509,7 @@ var init_generate_sharing_summary = __esm({
         lines.push(`  ${safe}["${escapeCell6(role.apiName)}"]`);
       }
       for (const role of sorted) {
-        const parent = stringProp2(role.properties, "parentRoleId", "");
+        const parent = stringProp3(role.properties, "parentRoleId", "");
         if (parent.length === 0)
           continue;
         const safeChild = role.apiName.replace(/[^A-Za-z0-9_]/g, "_");
@@ -73995,7 +74528,7 @@ var init_generate_sharing_summary = __esm({
       const dot = rule.apiName.indexOf(".");
       if (dot > 0)
         return rule.apiName.slice(0, dot);
-      return stringProp2(rule.properties, "sObjectType", "");
+      return stringProp3(rule.properties, "sObjectType", "");
     };
     buildSharingRulesIndex = (rules) => {
       const index = /* @__PURE__ */ new Map();
@@ -74109,7 +74642,7 @@ var init_generate_sharing_summary = __esm({
         const grantsResult = await tallyGrants(ctx, object);
         if (!grantsResult.ok)
           return err(grantsResult.error);
-        const owd = stringProp2(object.properties, "sharingModel", "Unknown");
+        const owd = stringProp3(object.properties, "sharingModel", "Unknown");
         const externalOwdRaw = object.properties["externalSharingModel"];
         const externalOwd = typeof externalOwdRaw === "string" && externalOwdRaw.length > 0 ? externalOwdRaw : null;
         const rules = sharingIndex.get(object.apiName) ?? [];
@@ -74750,7 +75283,7 @@ var init_get_subgraph = __esm({
 
 // ../mcp/dist/src/tools/guest-exposure-report.js
 import { z as z94 } from "zod";
-var CUSTOM_SITE_PREFIX, NETWORK_PREFIX, PROFILE_PREFIX, OBJECT_PREFIX, FIELD_PREFIX, APEX_PREFIX2, SHARING_RULE_PREFIX, DEFAULT_LIMIT13, MAX_LIMIT14, FINDINGS_BYTE_BUDGET, SCAN_PAGE_SIZE3, guestExposureReportInputSchema, SEVERITY_RANK2, OBJECT_FLAGS3, flag, stringProp3, boolProp2, objectOfFieldId2, findingObjectApiName, drainType, guestProfileIdForSite, guestExposureReportHandler;
+var CUSTOM_SITE_PREFIX, NETWORK_PREFIX, PROFILE_PREFIX, OBJECT_PREFIX, FIELD_PREFIX, APEX_PREFIX2, SHARING_RULE_PREFIX, DEFAULT_LIMIT13, MAX_LIMIT14, FINDINGS_BYTE_BUDGET, SCAN_PAGE_SIZE3, guestExposureReportInputSchema, SEVERITY_RANK2, OBJECT_FLAGS3, flag, stringProp4, boolProp2, objectOfFieldId2, findingObjectApiName, drainType, guestProfileIdForSite, guestExposureReportHandler;
 var init_guest_exposure_report = __esm({
   "../mcp/dist/src/tools/guest-exposure-report.js"() {
     "use strict";
@@ -74831,7 +75364,7 @@ var init_guest_exposure_report = __esm({
       "modifyAllRecords"
     ];
     flag = (p, k) => p[k] === true;
-    stringProp3 = (p, k) => typeof p[k] === "string" && p[k].length > 0 ? p[k] : null;
+    stringProp4 = (p, k) => typeof p[k] === "string" && p[k].length > 0 ? p[k] : null;
     boolProp2 = (p, k) => typeof p[k] === "boolean" ? p[k] : null;
     objectOfFieldId2 = (fieldId) => {
       if (!fieldId.startsWith(FIELD_PREFIX))
@@ -74867,8 +75400,8 @@ var init_guest_exposure_report = __esm({
       return ok(all);
     };
     guestProfileIdForSite = (site) => {
-      const declared = stringProp3(site.properties, "guestProfileName");
-      const label = stringProp3(site.properties, "masterLabel") ?? site.apiName;
+      const declared = stringProp4(site.properties, "guestProfileName");
+      const label = stringProp4(site.properties, "masterLabel") ?? site.apiName;
       return `${PROFILE_PREFIX}${declared ?? guestProfileNameForSite(label)}`;
     };
     guestExposureReportHandler = async (ctx, input2) => {
@@ -74990,7 +75523,7 @@ var init_guest_exposure_report = __esm({
       }
       const networkBySiteApiName = /* @__PURE__ */ new Map();
       for (const net of allNetworks) {
-        const siteName = stringProp3(net.properties, "site");
+        const siteName = stringProp4(net.properties, "site");
         if (siteName !== null)
           networkBySiteApiName.set(siteName, net);
       }
@@ -75000,7 +75533,7 @@ var init_guest_exposure_report = __esm({
           scopedSites = allSites.filter((s) => s.id === communityId);
         } else {
           const net = allNetworks.find((n) => n.id === communityId);
-          const siteName = net !== void 0 ? stringProp3(net.properties, "site") : null;
+          const siteName = net !== void 0 ? stringProp4(net.properties, "site") : null;
           scopedSites = siteName !== null ? allSites.filter((s) => s.apiName === siteName) : [];
         }
         if (scopedSites.length === 0) {
@@ -75029,9 +75562,9 @@ var init_guest_exposure_report = __esm({
         scanTruncated = true;
       const guestRulesBySite = /* @__PURE__ */ new Map();
       for (const rule of rulesResult.value) {
-        if (stringProp3(rule.properties, "ruleType") !== "guest")
+        if (stringProp4(rule.properties, "ruleType") !== "guest")
           continue;
-        const siteName = stringProp3(rule.properties, "siteName");
+        const siteName = stringProp4(rule.properties, "siteName");
         if (siteName === null)
           continue;
         const bucket = guestRulesBySite.get(siteName) ?? [];
@@ -75045,7 +75578,7 @@ var init_guest_exposure_report = __esm({
       for (const site of scopedSites) {
         const network = networkBySiteApiName.get(site.apiName) ?? null;
         const guestProfileId = guestProfileIdForSite(site);
-        const siteLabel = stringProp3(site.properties, "masterLabel") ?? site.apiName;
+        const siteLabel = stringProp4(site.properties, "masterLabel") ?? site.apiName;
         const profileResult = await getNodeById(ctx.graph, guestProfileId);
         if (!profileResult.ok) {
           return err({ kind: "internal", message: `graph query failed: ${profileResult.error.message}` });
@@ -75053,7 +75586,7 @@ var init_guest_exposure_report = __esm({
         const guestProfileResolved = profileResult.value !== null;
         if (guestProfileResolved)
           guestProfilesResolved += 1;
-        const experienceBundleId = network !== null && stringProp3(network.properties, "picassoSite") !== null ? `ExperienceBundle:${stringProp3(network.properties, "picassoSite")}` : null;
+        const experienceBundleId = network !== null && stringProp4(network.properties, "picassoSite") !== null ? `ExperienceBundle:${stringProp4(network.properties, "picassoSite")}` : null;
         const communityFindings = [];
         if (guestProfileResolved) {
           const edgesResult = await listEdges(ctx.graph, guestProfileId, {
@@ -75192,7 +75725,7 @@ var init_guest_exposure_report = __esm({
               severity: "low",
               nodeId: rule.id,
               label: rule.apiName,
-              detail: `guest sharing rule ${rule.id} (accessLevel ${stringProp3(rule.properties, "accessLevel") ?? "Read"}) shares records with the '${name}' site guest user \u2014 record-level applicability requires org data`,
+              detail: `guest sharing rule ${rule.id} (accessLevel ${stringProp4(rule.properties, "accessLevel") ?? "Read"}) shares records with the '${name}' site guest user \u2014 record-level applicability requires org data`,
               grantConfidence: "declared",
               guestLinkageConfidence: "heuristic"
             });
@@ -75205,10 +75738,10 @@ var init_guest_exposure_report = __esm({
         communities.push({
           communityId: site.id,
           label: siteLabel,
-          siteType: stringProp3(site.properties, "siteType"),
+          siteType: stringProp4(site.properties, "siteType"),
           active: boolProp2(site.properties, "active"),
           networkId: network?.id ?? null,
-          status: network !== null ? stringProp3(network.properties, "status") : null,
+          status: network !== null ? stringProp4(network.properties, "status") : null,
           selfRegistration: network !== null ? boolProp2(network.properties, "selfRegistration") : null,
           enableGuestFileAccess: network !== null ? boolProp2(network.properties, "enableGuestFileAccess") : null,
           experienceBundleId,
@@ -75223,7 +75756,7 @@ var init_guest_exposure_report = __esm({
       if (communityId === void 0) {
         const modeledSiteApiNames = new Set(allSites.map((s) => s.apiName));
         for (const net of allNetworks) {
-          const siteName = stringProp3(net.properties, "site");
+          const siteName = stringProp4(net.properties, "site");
           if (siteName !== null && !modeledSiteApiNames.has(siteName))
             orphanNetworks.push(net.id);
         }
@@ -101960,7 +102493,7 @@ var init_group_membership = __esm({
 
 // ../mcp/dist/src/tools/who-can-access-object.js
 import { z as z162 } from "zod";
-var CUSTOM_OBJECT_PREFIX10, GROUP_MEMBER_PREFIX, DEFAULT_LIMIT25, MAX_LIMIT25, PUBLIC_OWD_READ, whoCanAccessObjectInputBaseSchema, whoCanAccessObjectInputSchema, BLIND_SPOTS, flag3, stringProp4, sharingRuleObjectApiName2, ruleAccessToOp, whoCanAccessObjectHandler;
+var CUSTOM_OBJECT_PREFIX10, GROUP_MEMBER_PREFIX, DEFAULT_LIMIT25, MAX_LIMIT25, PUBLIC_OWD_READ, whoCanAccessObjectInputBaseSchema, whoCanAccessObjectInputSchema, BLIND_SPOTS, flag3, stringProp5, sharingRuleObjectApiName2, ruleAccessToOp, whoCanAccessObjectHandler;
 var init_who_can_access_object = __esm({
   "../mcp/dist/src/tools/who-can-access-object.js"() {
     "use strict";
@@ -102002,7 +102535,7 @@ var init_who_can_access_object = __esm({
       "Manual sharing, Apex-managed sharing, account/opportunity/case teams, and sharing sets are record/runtime-level and are not modeled."
     ]);
     flag3 = (p, k) => p[k] === true;
-    stringProp4 = (p, k) => typeof p[k] === "string" ? p[k] : "";
+    stringProp5 = (p, k) => typeof p[k] === "string" ? p[k] : "";
     sharingRuleObjectApiName2 = (rule) => {
       const parentId = rule.parentId;
       if (typeof parentId === "string" && parentId.startsWith("CustomObject:")) {
@@ -102011,7 +102544,7 @@ var init_who_can_access_object = __esm({
       const dot = rule.apiName.indexOf(".");
       if (dot > 0)
         return rule.apiName.slice(0, dot);
-      return stringProp4(rule.properties, "sObjectType");
+      return stringProp5(rule.properties, "sObjectType");
     };
     ruleAccessToOp = (accessLevel) => accessLevel === "Edit" || accessLevel === "ReadWrite" ? "edit" : "read";
     whoCanAccessObjectHandler = async (ctx, input2) => {
@@ -102036,9 +102569,9 @@ var init_who_can_access_object = __esm({
         });
       }
       const objectNode = objectResult.value;
-      const owd = stringProp4(objectNode.properties, "sharingModel") || "Unknown";
+      const owd = stringProp5(objectNode.properties, "sharingModel") || "Unknown";
       const owdGrantsAllInternalUsers = PUBLIC_OWD_READ.has(owd);
-      const externalOwd = stringProp4(objectNode.properties, "externalSharingModel") ?? null;
+      const externalOwd = stringProp5(objectNode.properties, "externalSharingModel") ?? null;
       const restrictionRulesResult = await listNodesByType(ctx.graph, "RestrictionRule", {
         limit: 500
       });
@@ -102128,11 +102661,11 @@ var init_who_can_access_object = __esm({
       for (const rule of rulesResult.value) {
         if (sharingRuleObjectApiName2(rule) !== objectApiName)
           continue;
-        const ruleType = stringProp4(rule.properties, "ruleType");
-        const accessLevel = stringProp4(rule.properties, "accessLevel") || "Read";
+        const ruleType = stringProp5(rule.properties, "ruleType");
+        const accessLevel = stringProp5(rule.properties, "accessLevel") || "Read";
         const via = ruleType === "criteria" ? "criteria-sharing-rule" : ruleType === "guest" ? "guest-sharing-rule" : ruleType === "territory" || ruleType === "territoryGroup" ? "territory-sharing-rule" : "owner-sharing-rule";
-        const predicate = ruleType === "owner" ? "" : stringProp4(rule.properties, "booleanFilter");
-        const siteName = ruleType === "guest" ? stringProp4(rule.properties, "siteName") : "";
+        const predicate = ruleType === "owner" ? "" : stringProp5(rule.properties, "booleanFilter");
+        const siteName = ruleType === "guest" ? stringProp5(rule.properties, "siteName") : "";
         const targetsResult = await listEdges(ctx.graph, rule.id, {
           direction: "out",
           edgeType: "sharedWith"
@@ -102401,7 +102934,7 @@ var init_who_can_run = __esm({
 
 // ../mcp/dist/src/tools/why-cant-user-see-record.js
 import { z as z164 } from "zod";
-var OWD_RESTRICTED, ACCESS_RANK, owdRank, grantSatisfiesObjectRead, grantSatisfiesObjectLevel, grantSatisfiesRecordVisible, systemPermsForLevel, ruleAccessSatisfiesLevel, ALL_INTERNAL_USERS_GROUP_ID, ROLE_HIERARCHY_MAX_DEPTH, whyCantUserSeeRecordInputSchema, LIVE_ACCESS_RESOLVER_NOTE, step2, evaluateOWD, evaluatePermissionGrants, noObjectFlags, SYSTEM_BYPASS_PERMS, objectFlagsSatisfyLevel, systemPermsSatisfyLevel, levelRelevantObjectFlags, computeMutedObjectAccess, evaluateSystemPermissions, walkRoleHierarchy, evaluateRoleHierarchy, buildUserMembership, fetchSharingRules, SHARED_TO_ROLE_PREFIX, SUBORDINATE_INHERITANCE, ownerRuleMatches, evaluateOwnerSharingRules, evaluateCriteriaSharingRules, TERRITORY_GUEST_RULE_TYPES, evaluateTerritoryAndGuestRules, listObjectChildRules, evaluateRestrictionRules, evaluateScopingRules, evaluatePermissionSetGroups, UNKNOWN_TAIL, aggregateVerdict8, CUSTOM_OBJECT_PREFIX11, PROFILE_PREFIX6, PERMISSION_SET_PREFIX5, PERMISSION_SET_GROUP_PREFIX2, ROLE_PREFIX2, GROUP_PREFIX2, QUEUE_PREFIX, coerceGroupId, coerceUserContext, evaluateModifyAllDataForCreate, objectApiNameOf, evaluateRecordTypeForCreate, evaluateCreateAccess, whyCantUserSeeRecordHandler;
+var OWD_RESTRICTED, ACCESS_RANK, owdRank, grantSatisfiesObjectRead, grantSatisfiesObjectLevel, grantSatisfiesRecordVisible, systemPermsForLevel, ruleAccessSatisfiesLevel, ALL_INTERNAL_USERS_GROUP_ID, ROLE_HIERARCHY_MAX_DEPTH, whyCantUserSeeRecordInputSchema, LIVE_ACCESS_RESOLVER_NOTE, step2, evaluateOWD, evaluatePermissionGrants, noObjectFlags, SYSTEM_BYPASS_PERMS, objectFlagsSatisfyLevel, systemPermsSatisfyLevel, levelRelevantObjectFlags, computeMutedObjectAccess, evaluateSystemPermissions, walkRoleHierarchy, evaluateRoleHierarchy, buildUserMembership, fetchSharingRules, SHARED_TO_ROLE_PREFIX, SUBORDINATE_INHERITANCE, ownerRuleMatches, evaluateOwnerSharingRules, evaluateCriteriaSharingRules, TERRITORY_GUEST_RULE_TYPES, evaluateTerritoryAndGuestRules, listObjectChildRules, evaluateRestrictionRules, evaluateScopingRules, evaluatePermissionSetGroups, UNKNOWN_TAIL, aggregateVerdict8, CUSTOM_OBJECT_PREFIX11, PROFILE_PREFIX6, PERMISSION_SET_PREFIX5, PERMISSION_SET_GROUP_PREFIX2, ROLE_PREFIX2, GROUP_PREFIX2, QUEUE_PREFIX, coerceGroupId, coerceUserContext, evaluateModifyAllDataForCreate, objectApiNameOf2, evaluateRecordTypeForCreate, evaluateCreateAccess, whyCantUserSeeRecordHandler;
 var init_why_cant_user_see_record = __esm({
   "../mcp/dist/src/tools/why-cant-user-see-record.js"() {
     "use strict";
@@ -103231,7 +103764,7 @@ var init_why_cant_user_see_record = __esm({
       }
       return ok(step2("SystemPermission", "visible", `Modify All Data grants create on every object: ${holders.join(", ")}`));
     };
-    objectApiNameOf = (objectNode, componentId) => typeof objectNode.apiName === "string" && objectNode.apiName.length > 0 ? objectNode.apiName : componentId.replace(/^CustomObject:/, "");
+    objectApiNameOf2 = (objectNode, componentId) => typeof objectNode.apiName === "string" && objectNode.apiName.length > 0 ? objectNode.apiName : componentId.replace(/^CustomObject:/, "");
     evaluateRecordTypeForCreate = async (ctx, componentId, objectNode, userContext) => {
       const edgesResult = await listEdges(ctx.graph, componentId, {
         direction: "out",
@@ -103243,7 +103776,7 @@ var init_why_cant_user_see_record = __esm({
       if (objectRecordTypes.length === 0) {
         return ok(step2("RecordType", "visible", "object has no record types; create is not record-type-gated"));
       }
-      const objectApiName = objectApiNameOf(objectNode, componentId);
+      const objectApiName = objectApiNameOf2(objectNode, componentId);
       const granterIds = [];
       if (userContext.profileId !== void 0)
         granterIds.push(userContext.profileId);
@@ -103387,7 +103920,7 @@ var init_why_cant_user_see_record = __esm({
         const createProfileOrPermSet = rawUserContext.profileId !== void 0 || rawUserContext.permissionSetIds !== void 0 && rawUserContext.permissionSetIds.length > 0;
         let createNetAccess = null;
         if (createProfileOrPermSet) {
-          const objApi = objectApiNameOf(nodeResult.value, componentId);
+          const objApi = objectApiNameOf2(nodeResult.value, componentId);
           const naResult = await computeMutedObjectAccess(ctx, componentId, objApi, rawUserContext, "create");
           if (!naResult.ok) {
             return err({ kind: "internal", message: `graph query failed: ${naResult.error}` });
@@ -103436,7 +103969,7 @@ var init_why_cant_user_see_record = __esm({
       let mutedByForDeny = [];
       let netAccess = null;
       if (profileOrPermSetSupplied) {
-        const objectApiName = objectApiNameOf(nodeResult.value, componentId);
+        const objectApiName = objectApiNameOf2(nodeResult.value, componentId);
         const netAccessResult = await computeMutedObjectAccess(ctx, componentId, objectApiName, rawUserContext, level);
         if (!netAccessResult.ok) {
           return err({
@@ -104833,8 +105366,8 @@ var init_server = __esm({
     init_tools();
     SERVER_NAME = "sf-intelligence";
     resolveServerVersion = () => {
-      if ("0.2.4") {
-        return "0.2.4";
+      if ("0.2.5") {
+        return "0.2.5";
       }
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
@@ -105700,7 +106233,7 @@ var init_package_version = __esm({
     "use strict";
     readCliPackageVersion = () => {
       if (true)
-        return "0.2.4";
+        return "0.2.5";
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
           const raw = readFileSync6(fileURLToPath4(new URL(rel, import.meta.url)), "utf8");
@@ -106648,7 +107181,7 @@ var init_setup_audit_trail = __esm({
 // dist/src/source-reconcile.js
 import { cp, readdir as readdir7, rm as rm3, stat as stat8 } from "node:fs/promises";
 import { basename as basename16, join as join38, relative as relative3, sep as sep4 } from "node:path";
-var BUNDLE_PARENT_DIRS2, KNOWN_SIDECAR_SUFFIXES2, isKnownSidecar2, primaryRelPathForSidecar, walkSourceEntries, authoritativePathSet, reconcileSourceDeletions, syncAuthoritativeRetrieveIntoSource;
+var BUNDLE_PARENT_DIRS2, KNOWN_SIDECAR_SUFFIXES2, isKnownSidecar2, primaryRelPathForSidecar, walkSourceEntries, DISPATCH_PROBE_ROOT, dispatchTailLength, strippedDxWrapper, comparisonKey, authoritativeIndex, RECONCILE_MAX_DELETE_FRACTION, RECONCILE_GUARD_MIN_CONSIDERED, layoutMismatchRefusal, reconcileSourceDeletions, syncAuthoritativeRetrieveIntoSource;
 var init_source_reconcile = __esm({
   "dist/src/source-reconcile.js"() {
     "use strict";
@@ -106723,43 +107256,103 @@ var init_source_reconcile = __esm({
       };
       await walkDir2(sourceRoot);
     };
-    authoritativePathSet = async (authoritativeRoot) => {
+    DISPATCH_PROBE_ROOT = join38(sep4, "__sfi-reconcile-dispatch-probe__");
+    dispatchTailLength = (segments, isDirectory) => {
+      for (let length = 1; length <= segments.length; length += 1) {
+        const tail = segments.slice(segments.length - length);
+        const type = componentTypeFromSourcePath(DISPATCH_PROBE_ROOT, join38(DISPATCH_PROBE_ROOT, ...tail), isDirectory);
+        if (type !== null)
+          return length;
+      }
+      return null;
+    };
+    strippedDxWrapper = (segments) => {
+      for (let i = 0; i <= 1 && i + 1 < segments.length; i += 1) {
+        if (segments[i] === "main" && segments[i + 1] === "default")
+          return segments.slice(i + 2);
+      }
+      return segments;
+    };
+    comparisonKey = (relPath, isDirectory) => {
+      const segments = relPath.split(sep4);
+      const fileName = segments[segments.length - 1] ?? relPath;
+      const primaryRel = primaryRelPathForSidecar(relPath, fileName);
+      const probeSegments = primaryRel === null ? segments : primaryRel.split(sep4);
+      const length = dispatchTailLength(probeSegments, isDirectory);
+      const tail = length === null ? strippedDxWrapper(segments) : segments.slice(segments.length - length);
+      return tail.join("/");
+    };
+    authoritativeIndex = async (authoritativeRoot, typesToReconcile) => {
       const entries = [];
       await walkSourceEntries(authoritativeRoot, entries);
-      return new Set(entries.map((entry) => entry.relPath));
+      const keys = /* @__PURE__ */ new Set();
+      let inScopeCount = 0;
+      for (const entry of entries) {
+        keys.add(comparisonKey(entry.relPath, entry.isDirectory));
+        if (typesToReconcile.has(entry.type))
+          inScopeCount += 1;
+      }
+      return { keys, inScopeCount };
+    };
+    RECONCILE_MAX_DELETE_FRACTION = 0.5;
+    RECONCILE_GUARD_MIN_CONSIDERED = 20;
+    layoutMismatchRefusal = (deleteCount, consideredCount, authoritative) => {
+      if (deleteCount === 0 || consideredCount === 0)
+        return null;
+      const reason = (detail) => `Refusing to reconcile source deletions: ${detail}. This is the signature of a source-layout mismatch between the vault tree and the authoritative retrieve output, not of components deleted in the org \u2014 a reconcile that misreads the layout finds nothing in common and proposes to delete everything. The vault was left untouched; re-run the refresh once the layouts agree, or delete the stale files deliberately if the org really did lose them.`;
+      if (deleteCount === consideredCount && authoritative.inScopeCount > 0) {
+        return reason(`all ${consideredCount} in-scope vault file(s) would be deleted even though the retrieve returned ${authoritative.inScopeCount} component file(s) of those same types`);
+      }
+      if (consideredCount >= RECONCILE_GUARD_MIN_CONSIDERED && deleteCount > consideredCount * RECONCILE_MAX_DELETE_FRACTION) {
+        return reason(`${deleteCount} of ${consideredCount} in-scope vault file(s) would be deleted, over the ${Math.round(RECONCILE_MAX_DELETE_FRACTION * 100)}% ceiling for a single refresh`);
+      }
+      return null;
     };
     reconcileSourceDeletions = async (sourceDir, authoritativeDir, typesToReconcile) => {
       if (typesToReconcile.size === 0) {
-        return { deletedPaths: [], deletedCount: 0 };
+        return { deletedPaths: [], deletedCount: 0, consideredCount: 0, refused: false };
       }
-      const authoritative = await authoritativePathSet(authoritativeDir);
+      const authoritative = await authoritativeIndex(authoritativeDir, typesToReconcile);
       const sourceEntries = [];
       await walkSourceEntries(sourceDir, sourceEntries);
-      const deletedPaths = [];
-      const deletedBundleDirs = /* @__PURE__ */ new Set();
-      for (const entry of sourceEntries) {
-        if (!typesToReconcile.has(entry.type))
-          continue;
+      const considered = sourceEntries.filter((entry) => typesToReconcile.has(entry.type));
+      const candidates = [];
+      const candidateBundleDirs = /* @__PURE__ */ new Set();
+      for (const entry of considered) {
         const fileName = basename16(entry.absPath);
         const primaryRel = primaryRelPathForSidecar(entry.relPath, fileName);
-        const authoritativeKey = primaryRel ?? entry.relPath;
-        if (authoritative.has(authoritativeKey) || authoritative.has(entry.relPath))
+        const ownKey = comparisonKey(entry.relPath, entry.isDirectory);
+        const primaryKey = primaryRel === null ? null : comparisonKey(primaryRel, entry.isDirectory);
+        if (authoritative.keys.has(ownKey))
           continue;
-        if (entry.isDirectory) {
-          deletedBundleDirs.add(entry.absPath);
-          deletedPaths.push(entry.relPath);
+        if (primaryKey !== null && authoritative.keys.has(primaryKey))
           continue;
-        }
-        const parentBundle = [...deletedBundleDirs].find((dir) => entry.absPath.startsWith(`${dir}${sep4}`));
-        if (parentBundle !== void 0)
-          continue;
-        await rm3(entry.absPath, { force: true });
-        deletedPaths.push(entry.relPath);
+        if (entry.isDirectory)
+          candidateBundleDirs.add(entry.absPath);
+        candidates.push(entry);
       }
-      for (const bundleDir of deletedBundleDirs) {
-        await rm3(bundleDir, { recursive: true, force: true });
+      const doomed = candidates.filter((entry) => entry.isDirectory || ![...candidateBundleDirs].some((dir) => entry.absPath.startsWith(`${dir}${sep4}`)));
+      const refusalReason = layoutMismatchRefusal(doomed.length, considered.length, authoritative);
+      if (refusalReason !== null) {
+        return {
+          deletedPaths: [],
+          deletedCount: 0,
+          consideredCount: considered.length,
+          refused: true,
+          refusalReason
+        };
+      }
+      const deletedPaths = [];
+      for (const entry of doomed) {
+        await rm3(entry.absPath, { recursive: entry.isDirectory, force: true });
+        deletedPaths.push(entry.relPath);
       }
-      return { deletedPaths, deletedCount: deletedPaths.length };
+      return {
+        deletedPaths,
+        deletedCount: deletedPaths.length,
+        consideredCount: considered.length,
+        refused: false
+      };
     };
     syncAuthoritativeRetrieveIntoSource = async (sourceDir, authoritativeDir) => {
       try {
@@ -107934,19 +108527,26 @@ var init_staged_refresh = __esm({
 // dist/src/commands/refresh.js
 var refresh_exports = {};
 __export(refresh_exports, {
+  FOLD_ERASED_COVERAGE_TYPES: () => FOLD_ERASED_COVERAGE_TYPES,
   PROFILE_COBATCH_GROUP: () => PROFILE_COBATCH_GROUP,
   PROFILE_GRANT_DISCLOSURE: () => PROFILE_GRANT_DISCLOSURE,
+  REPORT_PULL_DISCLOSURE: () => REPORT_PULL_DISCLOSURE,
+  REPORT_RETRIEVE_BATCH_SIZE: () => REPORT_RETRIEVE_BATCH_SIZE,
   appendStandardObjectDescribeFields: () => appendStandardObjectDescribeFields,
   assessProfileGrantIntegrity: () => assessProfileGrantIntegrity,
+  buildCoverageEntries: () => buildCoverageEntries2,
   buildFolderedReportManifest: () => buildFolderedReportManifest,
   buildPackageXml: () => buildPackageXml,
   buildRefreshPulse: () => buildRefreshPulse,
+  chunkFolderedReportManifest: () => chunkFolderedReportManifest,
   classifyForDemandRetrieve: () => classifyForDemandRetrieve,
   classifyRetrieveError: () => classifyRetrieveError,
   computeChangeSummary: () => computeChangeSummary,
   computeProfileGrantStats: () => computeProfileGrantStats,
   countLandedReportMembers: () => countLandedReportMembers,
   decorateProfileGrantCoverage: () => decorateProfileGrantCoverage,
+  decorateReportPullCoverage: () => decorateReportPullCoverage,
+  decorateReportsCapCoverage: () => decorateReportsCapCoverage,
   formatDemandRetrieveSummary: () => formatDemandRetrieveSummary,
   formatRefreshSummary: () => formatRefreshSummary,
   formatReportsCapSummary: () => formatReportsCapSummary,
@@ -107971,7 +108571,7 @@ __export(refresh_exports, {
 import { appendFile as appendFile6, mkdir as mkdir15, readdir as readdir9, readFile as readFile109, rename as rename6, rm as rm5, stat as stat10, writeFile as writeFile14 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join43, resolve as resolve8 } from "node:path";
-var SF_API_VERSION3, EMPTY_COUNTS, EMPTY_SKIPPED, failed, PACKAGE_VERSION, extractCachePath, loadExtractCache, saveExtractCache, applyApexAstEdges, runRefresh, preserveFactsForSideBuild, aggregateFailuresByType, computeProfileGrantStats, PROFILE_GRANT_DISCLOSURE, PRIOR_GRANTED_BY_FLOOR, assessProfileGrantIntegrity, decorateProfileGrantCoverage, buildCoverageEntries2, decoratePendingCoverage, decorateReportsCapCoverage, countGraphTotals, fullRebuild, importGraph, persistResolveIndexBestEffort, runWithOpenGraph, appendRefreshHistory, appendRiskScores, writeOnboardingDoc, writeOrgCard, diffCounts, sumCounts, metricCounts, signedDelta, findAnnotationOrphans, buildRefreshPulse, computeChangeSummary, TOOLING_API_ENRICHED_TYPES, ENRICH_CANDIDATE_PAGE_SIZE, runToolingApiEnrichment, loadVaultConfig, METADATA_API_NAME2, toApiName, SF_MAX_BUFFER, SF_RETRIEVE_TIMEOUT_MS, SF_QUERY_TIMEOUT_MS, runSf, STANDARD_OBJECTS_TO_MODEL, manifestMembersForType, appendStandardObjectDescribeFields, AUTOMATION_EDGE_TYPES, objectsToExpandManifest, buildPackageXml, getOrgSupportedTypes, getOrgObjectNames, selectManifestTypes, classifyRetrieveError, PROFILE_COBATCH_GROUP, NO_ATOMIC_GROUP, toAtomicUnits, splitTypeBatch, salientErrorLine, summarizeRetrieveFailures, retrieveWithFallback, retrieveTypeBatch, runSfRetrieve, computeReconciledTypes, retrieveAdditiveManifest, runSfRetrieveObjects, buildFolderedReportManifest, REPORT_META_SUFFIXES, REPORT_DIR_MARKERS, countLandedReportMembers, collectReportMetaFiles, runSfRetrieveFolderedReports, reportsCap, runSfRetrieveSmartReports, formatFailure, formatBlock, formatChangeSummary, formatRefreshSummary, formatReportsCapSummary, SKIPPED_TOP_N, KNOWN_UNMODELED_SKIP_DIRS, formatSkippedWarning, formatToolingApiSummary, demandCoverageStatusOf, DEMAND_REFUSAL_REASON, classifyForDemandRetrieve, markDemandQueueDrains, runDemandRetrieve, formatDemandRetrieveSummary, registerRefreshCommand;
+var SF_API_VERSION3, REPORT_PULL_DISCLOSURE, EMPTY_COUNTS, EMPTY_SKIPPED, failed, PACKAGE_VERSION, extractCachePath, loadExtractCache, saveExtractCache, applyApexAstEdges, runRefresh, preserveFactsForSideBuild, aggregateFailuresByType, computeProfileGrantStats, PROFILE_GRANT_DISCLOSURE, PRIOR_GRANTED_BY_FLOOR, assessProfileGrantIntegrity, decorateProfileGrantCoverage, FOLD_ERASED_COVERAGE_TYPES, buildCoverageEntries2, decoratePendingCoverage, decorateReportsCapCoverage, decorateReportPullCoverage, countGraphTotals, fullRebuild, importGraph, persistResolveIndexBestEffort, runWithOpenGraph, appendRefreshHistory, appendRiskScores, writeOnboardingDoc, writeOrgCard, diffCounts, sumCounts, metricCounts, signedDelta, findAnnotationOrphans, buildRefreshPulse, computeChangeSummary, TOOLING_API_ENRICHED_TYPES, ENRICH_CANDIDATE_PAGE_SIZE, runToolingApiEnrichment, loadVaultConfig, METADATA_API_NAME2, toApiName, SF_MAX_BUFFER, SF_RETRIEVE_TIMEOUT_MS, SF_QUERY_TIMEOUT_MS, runSf, STANDARD_OBJECTS_TO_MODEL, manifestMembersForType, appendStandardObjectDescribeFields, AUTOMATION_EDGE_TYPES, objectsToExpandManifest, buildPackageXml, getOrgSupportedTypes, getOrgObjectNames, selectManifestTypes, classifyRetrieveError, PROFILE_COBATCH_GROUP, NO_ATOMIC_GROUP, toAtomicUnits, splitTypeBatch, salientErrorLine, summarizeRetrieveFailures, retrieveWithFallback, retrieveTypeBatch, runSfRetrieve, computeReconciledTypes, retrieveAdditiveManifest, runSfRetrieveObjects, buildFolderedReportManifest, REPORT_RETRIEVE_BATCH_SIZE, folderedReportPackageXml, chunkFolderedReportManifest, retrieveFolderedReportBatches, REPORT_META_SUFFIXES, REPORT_DIR_MARKERS, countLandedReportMembers, collectReportMetaFiles, runSfRetrieveFolderedReports, reportsCap, runSfRetrieveSmartReports, formatFailure, formatBlock, formatChangeSummary, formatRefreshSummary, formatReportsCapSummary, SKIPPED_TOP_N, KNOWN_UNMODELED_SKIP_DIRS, formatSkippedWarning, formatToolingApiSummary, demandCoverageStatusOf, DEMAND_REFUSAL_REASON, classifyForDemandRetrieve, markDemandQueueDrains, runDemandRetrieve, formatDemandRetrieveSummary, registerRefreshCommand;
 var init_refresh = __esm({
   "dist/src/commands/refresh.js"() {
     "use strict";
@@ -107994,6 +108594,7 @@ var init_refresh = __esm({
     init_refresh_preflight();
     init_snapshot2();
     SF_API_VERSION3 = "62.0";
+    REPORT_PULL_DISCLOSURE = "report/dashboard pull did not complete \u2014 Report/Dashboard coverage is UNPROVEN, not empty";
     EMPTY_COUNTS = { components: {}, edges: {} };
     EMPTY_SKIPPED = Object.freeze({});
     failed = (startedMs, fatalError, errors, counts = EMPTY_COUNTS, skippedDirectories = EMPTY_SKIPPED) => ({
@@ -108205,6 +108806,7 @@ var init_refresh = __esm({
       let pullManifestTypes = null;
       let confirmedTypes = null;
       let sourceReconcileDeleted = 0;
+      let reconcileRefusals = [];
       let retrieveFailures = [];
       if (!opts.noPull) {
         const priorManifest = await loadManifest(configResult.value.vaultRoot);
@@ -108227,6 +108829,18 @@ var init_refresh = __esm({
         if (sourceReconcileDeleted > 0) {
           progress(`Reconciled source: removed ${sourceReconcileDeleted} stale file(s) deleted in the org.`);
         }
+        reconcileRefusals = pulled.value.reconcileRefusals ?? [];
+        if (reconcileRefusals.length > 0) {
+          process.stdout.write(`
+SOURCE RECONCILE REFUSED (${reconcileRefusals.length}) \u2014 stale files were KEPT, not deleted.
+This is the layout-mismatch guard: a deletion set that large is far more likely to mean the
+retrieve layout changed than that the org really dropped that much metadata. The vault is
+SAFE but may now carry entries for components that no longer exist.
+` + reconcileRefusals.map((r) => `  - ${r}
+`).join("") + `If the org genuinely purged this much, re-run after confirming; otherwise this is a bug.
+
+`);
+        }
         if (retrieveFailures.length > 0) {
           progress(`Partial retrieve: ${retrieveFailures.length} metadata type(s) failed and were skipped \u2014 the vault is built from what landed. ${summarizeRetrieveFailures(retrieveFailures)}`);
         }
@@ -108250,14 +108864,32 @@ var init_refresh = __esm({
         }
       }
       let reportsCapStats;
+      let reportPull;
       if (opts.withReports === true && !opts.noPull) {
         progress("Pulling ALL folder-based Reports / Dashboards (--with-reports)...");
         const pulledReports = await runSfRetrieveFolderedReports(targetOrg, paths.source);
         if (!pulledReports.ok) {
-          progress(`--with-reports pull skipped (non-fatal): ${pulledReports.error}`);
-        } else if (pulledReports.value.reports + pulledReports.value.dashboards > 0) {
-          progress(`Requested ${pulledReports.value.reports} report(s) + ${pulledReports.value.dashboards} dashboard(s); re-extracting...`);
-          walked = await walkAndExtract(paths.source, requestedTypes, prevCache);
+          reportPull = {
+            mode: "full",
+            outcome: "failed",
+            error: pulledReports.error,
+            attemptedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+          progress(`--with-reports pull FAILED (non-fatal, recorded): ${pulledReports.error}`);
+        } else {
+          if (pulledReports.value.batchErrors.length > 0) {
+            reportPull = {
+              mode: "full",
+              outcome: "partial",
+              error: pulledReports.value.batchErrors.join("; "),
+              attemptedAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            progress(`--with-reports pull lost ${pulledReports.value.batchErrors.length} batch(es) (non-fatal, recorded): ${pulledReports.value.batchErrors[0] ?? ""}`);
+          }
+          if (pulledReports.value.reports + pulledReports.value.dashboards > 0) {
+            progress(`Requested ${pulledReports.value.reports} report(s) + ${pulledReports.value.dashboards} dashboard(s); re-extracting...`);
+            walked = await walkAndExtract(paths.source, requestedTypes, prevCache);
+          }
         }
       } else if (opts.withReports === void 0 && !opts.noPull && requestedTypes === null) {
         const cap2 = reportsCap();
@@ -108265,8 +108897,23 @@ var init_refresh = __esm({
           progress(`Pulling top ${cap2} Reports / Dashboards by usage (default; --no-reports to skip)...`);
           const smart = await runSfRetrieveSmartReports(targetOrg, paths.source, cap2);
           if (!smart.ok) {
-            progress(`smart report pull skipped (non-fatal): ${smart.error}`);
+            reportPull = {
+              mode: "smart",
+              outcome: "failed",
+              error: smart.error,
+              attemptedAt: (/* @__PURE__ */ new Date()).toISOString()
+            };
+            progress(`smart report pull FAILED (non-fatal, recorded): ${smart.error}`);
           } else {
+            if (smart.value.batchErrors.length > 0) {
+              reportPull = {
+                mode: "smart",
+                outcome: "partial",
+                error: smart.value.batchErrors.join("; "),
+                attemptedAt: (/* @__PURE__ */ new Date()).toISOString()
+              };
+              progress(`smart report pull lost ${smart.value.batchErrors.length} batch(es) (non-fatal, recorded): ${smart.value.batchErrors[0] ?? ""}`);
+            }
             reportsCapStats = {
               reports: { total: smart.value.totals.reports, requested: smart.value.reports, retrieved: smart.value.landed.reports },
               dashboards: { total: smart.value.totals.dashboards, requested: smart.value.dashboards, retrieved: smart.value.landed.dashboards }
@@ -108331,7 +108978,8 @@ var init_refresh = __esm({
         retrieveFailures,
         ...reconciledTypes !== null ? { reconciledTypes } : {},
         ...apexAstStats !== void 0 ? { apexAstStats } : {},
-        ...reportsCapStats !== void 0 ? { reportsCapStats } : {}
+        ...reportsCapStats !== void 0 ? { reportsCapStats } : {},
+        ...reportPull !== void 0 ? { reportPull } : {}
       };
       if (!renameOver) {
         try {
@@ -108455,6 +109103,10 @@ var init_refresh = __esm({
         return { ...rest, errored: true, errorReason: disclosure };
       });
     };
+    FOLD_ERASED_COVERAGE_TYPES = /* @__PURE__ */ new Set([
+      "Report",
+      "Dashboard"
+    ]);
     buildCoverageEntries2 = (counts, skippedDirectories, requestedTypes, sourceRoot, failures, confirmedTypes) => {
       const failuresByType = aggregateFailuresByType(sourceRoot, failures);
       const entries = [];
@@ -108462,7 +109114,8 @@ var init_refresh = __esm({
         const requested = requestedTypes === null || requestedTypes.has(type);
         const failureInfo = failuresByType.get(type);
         const errored = failureInfo !== void 0 && failureInfo.count > 0;
-        const retrieveConfirmed = confirmedTypes !== null && confirmedTypes.has(type) && !errored;
+        const foldErased = FOLD_ERASED_COVERAGE_TYPES.has(type);
+        const retrieveConfirmed = confirmedTypes !== null && confirmedTypes.has(type) && !errored && !foldErased;
         entries.push({
           type,
           requested,
@@ -108470,6 +109123,7 @@ var init_refresh = __esm({
           errored,
           ...errored ? { errorReason: failureInfo.sampleReason } : {},
           neverModeled: false,
+          ...foldErased ? { pending: true } : {},
           ...retrieveConfirmed ? { retrieveConfirmed: true } : {}
         });
       }
@@ -108493,21 +109147,44 @@ var init_refresh = __esm({
     decorateReportsCapCoverage = (entries, stats) => {
       if (stats === void 0)
         return entries;
-      const capped = /* @__PURE__ */ new Map();
-      if (stats.reports.total > stats.reports.retrieved)
-        capped.set("Report", stats.reports);
-      if (stats.dashboards.total > stats.dashboards.retrieved)
-        capped.set("Dashboard", stats.dashboards);
-      if (capped.size === 0)
-        return entries;
-      const out = entries.map((entry) => capped.has(entry.type) ? { ...entry, requested: true, pending: true } : entry);
-      for (const [type, c] of capped) {
-        if (!out.some((entry) => entry.type === type)) {
-          out.push({ type, requested: true, retrieved: c.retrieved, errored: false, neverModeled: false, pending: true });
+      const landed = /* @__PURE__ */ new Map([
+        ["Report", stats.reports],
+        ["Dashboard", stats.dashboards]
+      ]);
+      const proven = (c) => c.retrieved > 0 && c.total <= c.retrieved;
+      const decorated = (c) => ({
+        requested: true,
+        // This is the ONLY place a fold-erased row gets a truthful `retrieved`:
+        // the files the retrieve actually landed on disk. Overwriting the
+        // structurally-zero node count is the point (FOLD_ERASED_COVERAGE_TYPES).
+        retrieved: c.retrieved,
+        ...proven(c) ? { retrieveConfirmed: true } : { pending: true }
+      });
+      const out = entries.map((entry) => {
+        const c = landed.get(entry.type);
+        if (c === void 0 || entry.neverModeled)
+          return entry;
+        const { pending: _wasPending, retrieveConfirmed: _wasConfirmed, ...rest } = entry;
+        return { ...rest, ...decorated(c) };
+      });
+      for (const [type, c] of landed) {
+        if (!out.some((entry) => entry.type === type && !entry.neverModeled)) {
+          out.push({ type, errored: false, neverModeled: false, ...decorated(c) });
         }
       }
       return [...out].sort((a, b) => a.type < b.type ? -1 : a.type > b.type ? 1 : 0);
     };
+    decorateReportPullCoverage = (entries, disclosure) => {
+      if (disclosure === void 0)
+        return entries;
+      const reason = `${REPORT_PULL_DISCLOSURE} (${disclosure.mode} pull, ${disclosure.outcome} at ${disclosure.attemptedAt}): ${disclosure.error}`;
+      return entries.map((entry) => {
+        if (!FOLD_ERASED_COVERAGE_TYPES.has(entry.type) || entry.neverModeled)
+          return entry;
+        const { retrieveConfirmed: _dropped, ...rest } = entry;
+        return { ...rest, requested: true, pending: true, errored: true, errorReason: reason };
+      });
+    };
     countGraphTotals = async (store) => {
       try {
         const components = {};
@@ -108649,14 +109326,18 @@ var init_refresh = __esm({
           return failed(started, `countGraphTotals: ${counted.error}`, walked.failures, EMPTY_COUNTS, walked.skippedDirectories);
         }
         return {
-          status: walked.failures.length === 0 && args.retrieveFailures.length === 0 ? "success" : "partial",
+          // A report-pull failure forces `partial` for the same reason a
+          // profile-grant disclosure does: the vault built, but a coverage axis it
+          // attempted is unproven. `success` here is what let the failure vanish.
+          status: walked.failures.length === 0 && args.retrieveFailures.length === 0 && args.reportPull === void 0 ? "success" : "partial",
           counts: counted.value,
           skippedDirectories: walked.skippedDirectories,
           errors: walked.failures,
           durationMs: Date.now() - started,
           ...args.retrieveFailures.length > 0 ? { retrieveFailures: args.retrieveFailures } : {},
           ...toolingApiSummary !== void 0 ? { toolingApi: toolingApiSummary } : {},
-          ...args.reportsCapStats !== void 0 ? { reportsCap: args.reportsCapStats } : {}
+          ...args.reportsCapStats !== void 0 ? { reportsCap: args.reportsCapStats } : {},
+          ...args.reportPull !== void 0 ? { reportPull: args.reportPull } : {}
         };
       }
       const midBuild = opts.stagedMarker !== void 0;
@@ -108696,7 +109377,7 @@ var init_refresh = __esm({
         profileGrantStats = computeProfileGrantStats(walked.results);
         profileGrantDisclosure = assessProfileGrantIntegrity(profileGrantStats, previousManifest?.edges["grantedBy"] ?? null, counts.edges["grantedBy"] ?? 0);
       }
-      const coverage = decorateProfileGrantCoverage(decorateReportsCapCoverage(decoratePendingCoverage(buildCoverageEntries2(counts, walked.skippedDirectories, requestedTypes, paths.source, walked.failures, confirmedTypes), opts.stagedMarker), args.reportsCapStats), profileGrantDisclosure);
+      const coverage = decorateProfileGrantCoverage(decoratePendingCoverage(decorateReportPullCoverage(decorateReportsCapCoverage(buildCoverageEntries2(counts, walked.skippedDirectories, requestedTypes, paths.source, walked.failures, confirmedTypes), args.reportsCapStats), args.reportPull), opts.stagedMarker), profileGrantDisclosure);
       let phantomSummary;
       if (!midBuild && opts.stagedMarker === void 0) {
         try {
@@ -108722,6 +109403,7 @@ var init_refresh = __esm({
         ...opts.stagedMarker !== void 0 ? { staged: opts.stagedMarker } : {},
         ...args.apexAstStats !== void 0 ? { apexAst: args.apexAstStats } : {},
         ...args.reportsCapStats !== void 0 ? { reportsCap: args.reportsCapStats } : {},
+        ...args.reportPull !== void 0 ? { reportPull: args.reportPull } : {},
         ...profileGrantDisclosure !== null && profileGrantStats !== null ? {
           profileGrantIntegrity: {
             degraded: true,
@@ -108847,7 +109529,11 @@ var init_refresh = __esm({
       return {
         // A profile-grant integrity disclosure forces `partial`: the vault built,
         // but its permission graph is untrustworthy — never report clean success.
-        status: walked.failures.length === 0 && args.retrieveFailures.length === 0 && profileGrantDisclosure === null ? "success" : "partial",
+        // A report-pull failure forces it for the same reason: the pull was
+        // attempted and did not deliver, so Report/Dashboard coverage is unproven.
+        // (`sfi refresh` exits non-zero on non-success, which is the point — the
+        // shipped defect was a clean exit over a pull that had errored.)
+        status: walked.failures.length === 0 && args.retrieveFailures.length === 0 && profileGrantDisclosure === null && args.reportPull === void 0 ? "success" : "partial",
         counts,
         skippedDirectories: walked.skippedDirectories,
         errors: walked.failures,
@@ -108858,6 +109544,7 @@ var init_refresh = __esm({
         ...pulse !== void 0 ? { pulse } : {},
         ...toolingApiSummary !== void 0 ? { toolingApi: toolingApiSummary } : {},
         ...args.reportsCapStats !== void 0 ? { reportsCap: args.reportsCapStats } : {},
+        ...args.reportPull !== void 0 ? { reportPull: args.reportPull } : {},
         ...auditTrailSummary !== void 0 ? { auditTrail: auditTrailSummary } : {}
       };
     };
@@ -109554,6 +110241,7 @@ ${card.body}
       const succeeded = [];
       const failures = [];
       let deletedCount = 0;
+      const reconcileRefusals = [];
       const attempt = async (types) => {
         if (types.length === 0)
           return;
@@ -109561,6 +110249,9 @@ ${card.body}
         if (result.ok) {
           succeeded.push(...types);
           deletedCount += result.value.deletedCount;
+          if (result.value.reconcileRefused === true) {
+            reconcileRefusals.push(result.value.reconcileRefusalReason ?? `reconcile refused for ${types.join(", ")} (suspected layout mismatch)`);
+          }
           return;
         }
         if (toAtomicUnits(types, atomicGroup).length <= 1 || classifyRetrieveError(result.error) === "global") {
@@ -109573,7 +110264,7 @@ ${card.body}
         await attempt(right);
       };
       await attempt(allTypes);
-      return { succeeded, deletedCount, failures };
+      return { succeeded, deletedCount, failures, reconcileRefusals };
     };
     retrieveTypeBatch = async (targetOrg, sourceDir, types, orgObjects) => {
       const stamp = `${Date.now()}-${types.length}-${types[0] ?? "batch"}`;
@@ -109588,7 +110279,13 @@ ${card.body}
         await runSf(["project", "retrieve", "start", "--manifest", manifestPath, "--target-org", targetOrg], { maxBuffer: SF_MAX_BUFFER, cwd: projectDir, timeout: SF_RETRIEVE_TIMEOUT_MS });
         const reconcile2 = await reconcileSourceDeletions(sourceDir, pkgDir, new Set(types));
         await syncAuthoritativeRetrieveIntoSource(sourceDir, pkgDir);
-        return ok({ deletedCount: reconcile2.deletedCount });
+        return ok({
+          deletedCount: reconcile2.deletedCount,
+          ...reconcile2.refused === true ? {
+            reconcileRefused: true,
+            ...reconcile2.refusalReason !== void 0 ? { reconcileRefusalReason: reconcile2.refusalReason } : {}
+          } : {}
+        });
       } catch (cause) {
         return err(cause instanceof Error ? cause.message : String(cause));
       } finally {
@@ -109646,6 +110343,7 @@ ${card.body}
       await writeFile14(join43(projectDir, "sfdx-project.json"), `{"packageDirectories":[{"path":"force-app","default":true}],"sourceApiVersion":"${SF_API_VERSION3}"}
 `, "utf8");
       await writeFile14(manifestPath, args.manifestXml, "utf8");
+      const pkgDir = join43(projectDir, "force-app");
       try {
         await runSfFn([
           "project",
@@ -109654,10 +110352,9 @@ ${card.body}
           "--manifest",
           manifestPath,
           "--target-org",
-          args.targetOrg,
-          "--output-dir",
-          args.outputDir
+          args.targetOrg
         ], { maxBuffer: SF_MAX_BUFFER, cwd: projectDir, timeout: SF_RETRIEVE_TIMEOUT_MS });
+        await syncAuthoritativeRetrieveIntoSource(args.outputDir, pkgDir);
       } finally {
         await rm5(manifestPath, { force: true }).catch(() => {
         });
@@ -109728,6 +110425,45 @@ ${typesXml}
 `;
       return { membersByType, reports, dashboards, manifestXml };
     };
+    REPORT_RETRIEVE_BATCH_SIZE = 500;
+    folderedReportPackageXml = (type, members) => `<?xml version="1.0" encoding="UTF-8"?>
+<Package xmlns="http://soap.sforce.com/2006/04/metadata">
+  <types>
+${members.map((m) => `    <members>${m}</members>`).join("\n")}
+    <name>${type}</name>
+  </types>
+  <version>${SF_API_VERSION3}</version>
+</Package>
+`;
+    chunkFolderedReportManifest = (membersByType, size = REPORT_RETRIEVE_BATCH_SIZE) => {
+      const batchSize = Number.isFinite(size) && size > 0 ? Math.floor(size) : REPORT_RETRIEVE_BATCH_SIZE;
+      const out = [];
+      for (const type of ["Report", "Dashboard"]) {
+        const members = membersByType[type];
+        for (let i = 0; i < members.length; i += batchSize) {
+          const slice = members.slice(i, i + batchSize);
+          out.push({ type, members: slice, manifestXml: folderedReportPackageXml(type, slice) });
+        }
+      }
+      return out;
+    };
+    retrieveFolderedReportBatches = async (args, runSfFn = runSf) => {
+      const batches = chunkFolderedReportManifest(args.membersByType);
+      const batchErrors = [];
+      for (const [index, batch] of batches.entries()) {
+        try {
+          await retrieveAdditiveManifest({
+            targetOrg: args.targetOrg,
+            outputDir: args.outputDir,
+            manifestXml: batch.manifestXml,
+            tempLabel: `${args.tempLabel}-${index + 1}`
+          }, runSfFn);
+        } catch (cause) {
+          batchErrors.push(`${batch.type} batch ${index + 1}/${batches.length} (${batch.members.length} member(s)) failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
+      }
+      return { batches: batches.length, batchErrors };
+    };
     REPORT_META_SUFFIXES = {
       Report: ".report-meta.xml",
       Dashboard: ".dashboard-meta.xml"
@@ -109794,19 +110530,18 @@ ${typesXml}
           return [];
         }
       };
-      const { reports, dashboards, manifestXml } = buildFolderedReportManifest({
+      const { reports, dashboards, manifestXml, membersByType } = buildFolderedReportManifest({
         folders,
         reports: await queryRecords("Report"),
         dashboards: await queryRecords("Dashboard")
       });
       if (manifestXml === null)
-        return ok({ reports: 0, dashboards: 0 });
-      try {
-        await retrieveAdditiveManifest({ targetOrg, outputDir: sourceDir, manifestXml, tempLabel: "reports" }, runSfFn);
-        return ok({ reports, dashboards });
-      } catch (cause) {
-        return err(`report/dashboard retrieve failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+        return ok({ reports: 0, dashboards: 0, batchErrors: [] });
+      const outcome = await retrieveFolderedReportBatches({ targetOrg, outputDir: sourceDir, tempLabel: "reports", membersByType }, runSfFn);
+      if (outcome.batches > 0 && outcome.batchErrors.length === outcome.batches) {
+        return err(`report/dashboard retrieve failed: all ${outcome.batches} batch(es) errored \u2014 ${outcome.batchErrors[0] ?? ""}`);
       }
+      return ok({ reports, dashboards, batchErrors: outcome.batchErrors });
     };
     reportsCap = () => {
       const raw = Number(process.env["SFI_REPORTS_CAP"]);
@@ -109854,24 +110589,31 @@ ${typesXml}
         dashboards: await ranked("Dashboard", "LastViewedDate")
       });
       if (manifestXml === null) {
-        return ok({ reports: 0, dashboards: 0, totals, landed: { reports: 0, dashboards: 0 }, missing: [] });
-      }
-      try {
-        await retrieveAdditiveManifest({ targetOrg, outputDir: sourceDir, manifestXml, tempLabel: "smart-reports" }, runSfFn);
-        const fidelity = countLandedReportMembers(membersByType, await collectReportMetaFiles(sourceDir));
         return ok({
-          reports,
-          dashboards,
+          reports: 0,
+          dashboards: 0,
           totals,
-          landed: { reports: fidelity.Report.landed, dashboards: fidelity.Dashboard.landed },
-          missing: [
-            ...fidelity.Report.missing.map((m) => `Report:${m}`),
-            ...fidelity.Dashboard.missing.map((m) => `Dashboard:${m}`)
-          ]
+          landed: { reports: 0, dashboards: 0 },
+          missing: [],
+          batchErrors: []
         });
-      } catch (cause) {
-        return err(`smart report retrieve failed: ${cause instanceof Error ? cause.message : String(cause)}`);
       }
+      const outcome = await retrieveFolderedReportBatches({ targetOrg, outputDir: sourceDir, tempLabel: "smart-reports", membersByType }, runSfFn);
+      if (outcome.batches > 0 && outcome.batchErrors.length === outcome.batches) {
+        return err(`smart report retrieve failed: all ${outcome.batches} batch(es) errored \u2014 ${outcome.batchErrors[0] ?? ""}`);
+      }
+      const fidelity = countLandedReportMembers(membersByType, await collectReportMetaFiles(sourceDir));
+      return ok({
+        reports,
+        dashboards,
+        totals,
+        landed: { reports: fidelity.Report.landed, dashboards: fidelity.Dashboard.landed },
+        missing: [
+          ...fidelity.Report.missing.map((m) => `Report:${m}`),
+          ...fidelity.Dashboard.missing.map((m) => `Dashboard:${m}`)
+        ],
+        batchErrors: outcome.batchErrors
+      });
     };
     formatFailure = (failure) => `  ${failure.path}: ${failure.error.kind} \u2014 ${failure.error.message}`;
     formatBlock = (label, counts) => {
@@ -109942,6 +110684,9 @@ ${typesXml}
       if (result.reportsCap !== void 0) {
         lines.push("", ...formatReportsCapSummary(result.reportsCap));
       }
+      if (result.reportPull !== void 0) {
+        lines.push("", `WARNING \u2014 ${REPORT_PULL_DISCLOSURE}.`, `  ${result.reportPull.mode} pull ${result.reportPull.outcome} at ${result.reportPull.attemptedAt}: ${result.reportPull.error}`, "  Report/Dashboard coverage rows are marked errored + pending, and this run is recorded on the manifest as `reportPull`.", '  A "0 reports" answer from this vault means NOT CHECKED, not none. Re-run `sfi refresh` (or `--with-reports`) to prove coverage.');
+      }
       const skippedWarning = formatSkippedWarning(result.skippedDirectories);
       if (skippedWarning !== null) {
         lines.push("", ...skippedWarning);
@@ -110155,7 +110900,7 @@ ${typesXml}
 `;
     };
     registerRefreshCommand = (program) => {
-      program.command("refresh").description("Refresh the vault from a live Salesforce org").option("--target-org <alias>", "Salesforce org alias to retrieve from (overrides config.json)").option("--no-pull", "Skip `sf project retrieve` and use the existing source tree").option("--types <list>", "Comma-separated metadata types to restrict the refresh to").option("--with-data-shape", "After the refresh, capture a small budgeted set of record-DATA observations (approximate per-object record counts + recent-sample field fill rates) into the graph facts table. OPT-IN twice over: requires live consent for the org (sfi.live_consent / SFI_LIVE_PLANE_ENABLED) \u2014 without it the capture skips honestly and the refresh stays offline. Read-only; at most SFI_DATA_SHAPE_BUDGET (default 60) API calls.").option("--with-tooling-api", "After the offline refresh completes, run the v1.7 Tooling API enrichment pass to hydrate `lastModifiedDate` / `lastModifiedBy` / `apiVersion` on enrichable nodes, and now also confirms declared dependencies (stamps `confirmedByApi` on matching edges and appends `dependsOnFromApi` edges from MetadataComponentDependency). Requires `sf` CLI installed and the target org alias authenticated.").option("--with-audit-trail", "During refresh, query SetupAuditTrail and append new rows (deduped by Id) to meta/setup-audit-trail.jsonl so sfi.component_change_attribution can answer who-changed-this offline. Opt-in \u2014 touches the org and adds latency. First run pulls LAST_N_DAYS:180; later runs are incremental. Additive-only: persisted history survives after Salesforce drops rows from the live 180-day window.").option("--incremental", "Reuse the previous refresh's per-file extraction cache (`meta/extract-cache.json`): source files whose mtime + size are unchanged skip re-extraction. The graph is still rebuilt in full, so results are identical to a cold refresh \u2014 only faster. The cache is invalidated automatically on a version upgrade.").option("--incremental-graph", "Re-import ONLY the changed nodes/edges into the graph (a transactional change-set diff against the current graph) instead of rebuilding it in full, when a prior non-empty graph exists. Provably byte-identical to a cold rebuild; falls back to a full rebuild on an empty/largely-changed graph or any apply error. Independent of `--incremental` (the parse cache); combine both for the largest win. Off by default.").option("--components <list>", "Demand-retrieve: comma-separated component ids (e.g. `CustomObject:Foo__c`) to pull on demand. Only AUTOMATION-CRITICAL phantoms are retrieved; grant-only / managed / standard / blindspot ids are refused with the reason. Generalizes the automatic B29 expansion to a user-triggered pull.").option("--no-reports", "Skip the report/dashboard pull entirely. DEFAULT (neither flag): pull the top SFI_REPORTS_CAP (500) reports+dashboards ranked by actual usage (LastRunDate / LastViewedDate, fallback LastModifiedDate) and fold their field references onto fields; when the org holds more than the cap, Report/Dashboard coverage reads `pending` so absence claims stay qualified.").option("--with-reports", "Also pull folder-based Report / Dashboard metadata and fold their field usage onto the referenced fields, so a field used only in a report column / dashboard component stops reading as unused. Off by default \u2014 slow on large orgs (enumerates folders + pulls every report/dashboard).").option("--staged", "Build the vault in tiers for fast time-to-first-insight: T0 skeleton (read-only COUNT queries, no retrieve) \u2192 T1 priority types (objects/fields/automation/Apex/permissions; Markdown render deferred) \u2192 T2 full refresh (transactional side-build \u2014 a mid-tier failure leaves the prior state servable) \u2192 optional T3 with --with-reports. Mid-build, health_check reports degraded (building tier i/n) and queued types read as pending coverage, so absence claims stay qualified. Resumable: a re-run skips completed tiers. The final tier is a plain monolithic refresh, so the end state is identical to a non-staged run.").option("--no-apex-ast", "Skip the parser-grade Apex pass (ON by default): every class/trigger is re-parsed with the vendored ANTLR grammar adding `confidence: 'parsed'`, `source: 'apex-ast'` readsFrom/writesTo/callsApex edges \u2014 including SOQL field-level reads and constant-string Database.query literals. Exact-duplicate heuristic scanner edges are dropped (no double-counting); scanner-only edges are kept. A file that fails to parse falls back to scanner-only (counted in the manifest's apexAst block).").option("--drain-demand-queue", "Drain the phantom demand queue (`meta/demand-queue.jsonl`): retrieve every QUEUED automation-critical component that MCP consumers hit as phantoms (recorded by sfi.get_component), through the same gate as --components \u2014 grant-only / managed / standard / blindspot ids are refused with the reason. Dedup and idempotency are structural: N hits on one id drain once, and a re-drain of an already-drained id is a no-op. Drained entries are marked in the queue with their outcome.").action(async (flags) => {
+      program.command("refresh").description("Refresh the vault from a live Salesforce org").option("--target-org <alias>", "Salesforce org alias to retrieve from (overrides config.json)").option("--no-pull", "Skip `sf project retrieve` and use the existing source tree").option("--types <list>", "Comma-separated metadata types to restrict the refresh to").option("--with-data-shape", "After the refresh, capture a small budgeted set of record-DATA observations (approximate per-object record counts + recent-sample field fill rates) into the graph facts table. OPT-IN twice over: requires live consent for the org (sfi.live_consent / SFI_LIVE_PLANE_ENABLED) \u2014 without it the capture skips honestly and the refresh stays offline. Read-only; at most SFI_DATA_SHAPE_BUDGET (default 60) API calls.").option("--with-tooling-api", "After the offline refresh completes, run the v1.7 Tooling API enrichment pass to hydrate `lastModifiedDate` / `lastModifiedBy` / `apiVersion` on enrichable nodes, and now also confirms declared dependencies (stamps `confirmedByApi` on matching edges and appends `dependsOnFromApi` edges from MetadataComponentDependency). Requires `sf` CLI installed and the target org alias authenticated.").option("--with-audit-trail", "During refresh, query SetupAuditTrail and append new rows (deduped by Id) to meta/setup-audit-trail.jsonl so sfi.component_change_attribution can answer who-changed-this offline. Opt-in \u2014 touches the org and adds latency. First run pulls LAST_N_DAYS:180; later runs are incremental. Additive-only: persisted history survives after Salesforce drops rows from the live 180-day window.").option("--incremental", "Reuse the previous refresh's per-file extraction cache (`meta/extract-cache.json`): source files whose mtime + size are unchanged skip re-extraction. The graph is still rebuilt in full, so results are identical to a cold refresh \u2014 only faster. The cache is invalidated automatically on a version upgrade.").option("--incremental-graph", "Re-import ONLY the changed nodes/edges into the graph (a transactional change-set diff against the current graph) instead of rebuilding it in full, when a prior non-empty graph exists. Provably byte-identical to a cold rebuild; falls back to a full rebuild on an empty/largely-changed graph or any apply error. Independent of `--incremental` (the parse cache); combine both for the largest win. Off by default.").option("--components <list>", "Demand-retrieve: comma-separated component ids (e.g. `CustomObject:Foo__c`) to pull on demand. Only AUTOMATION-CRITICAL phantoms are retrieved; grant-only / managed / standard / blindspot ids are refused with the reason. Generalizes the automatic B29 expansion to a user-triggered pull.").option("--no-reports", "Skip the report/dashboard pull entirely. DEFAULT (neither flag): pull the top SFI_REPORTS_CAP (500) reports+dashboards ranked by actual usage (LastRunDate / LastViewedDate, fallback LastModifiedDate) and fold their field references onto fields; when the org holds more than the cap, Report/Dashboard coverage reads `pending` so absence claims stay qualified. Report/Dashboard nodes are folded onto fields and never persisted, so their coverage row can only ever be proven by the pull itself \u2014 it reads `pending` (not checked), never a confirmed zero. A pull that errors is non-fatal but NOT silent: it is recorded on the manifest as `reportPull`, marks those rows errored, and exits non-zero.").option("--with-reports", "Also pull folder-based Report / Dashboard metadata and fold their field usage onto the referenced fields, so a field used only in a report column / dashboard component stops reading as unused. Off by default \u2014 slow on large orgs (enumerates folders + pulls every report/dashboard).").option("--staged", "Build the vault in tiers for fast time-to-first-insight: T0 skeleton (read-only COUNT queries, no retrieve) \u2192 T1 priority types (objects/fields/automation/Apex/permissions; Markdown render deferred) \u2192 T2 full refresh (transactional side-build \u2014 a mid-tier failure leaves the prior state servable) \u2192 optional T3 with --with-reports. Mid-build, health_check reports degraded (building tier i/n) and queued types read as pending coverage, so absence claims stay qualified. Resumable: a re-run skips completed tiers. The final tier is a plain monolithic refresh, so the end state is identical to a non-staged run.").option("--no-apex-ast", "Skip the parser-grade Apex pass (ON by default): every class/trigger is re-parsed with the vendored ANTLR grammar adding `confidence: 'parsed'`, `source: 'apex-ast'` readsFrom/writesTo/callsApex edges \u2014 including SOQL field-level reads and constant-string Database.query literals. Exact-duplicate heuristic scanner edges are dropped (no double-counting); scanner-only edges are kept. A file that fails to parse falls back to scanner-only (counted in the manifest's apexAst block).").option("--drain-demand-queue", "Drain the phantom demand queue (`meta/demand-queue.jsonl`): retrieve every QUEUED automation-critical component that MCP consumers hit as phantoms (recorded by sfi.get_component), through the same gate as --components \u2014 grant-only / managed / standard / blindspot ids are refused with the reason. Dedup and idempotency are structural: N hits on one id drain once, and a re-drain of an already-drained id is a no-op. Drained entries are marked in the queue with their outcome.").action(async (flags) => {
         if (flags.drainDemandQueue === true) {
           const configResult = await loadVaultConfig(process.cwd());
           if (!configResult.ok) {
@@ -111357,7 +112102,7 @@ var makeShutdownOnce = (ctx) => {
 
 // dist/src/commands/demo.js
 init_refresh();
-var buildVersion = () => true ? "0.2.4" : "dev";
+var buildVersion = () => true ? "0.2.5" : "dev";
 var SHUTDOWN_SIGNALS2 = ["SIGINT", "SIGTERM"];
 var resolveDemoSource = () => {
   let dir = dirname25(fileURLToPath5(import.meta.url));
@@ -112812,7 +113557,7 @@ init_vault_git();
 init_watch();
 var readVersion = () => {
   if (true)
-    return "0.2.4";
+    return "0.2.5";
   const pkgUrl = new URL("../../package.json", import.meta.url);
   const raw = readFileSync10(fileURLToPath6(pkgUrl), "utf8");
   const parsed = JSON.parse(raw);