sf-intelligence 0.3.1 → 0.3.2

package/dist/index.js

@@ -86,6 +86,35 @@ var init_exec_helper = __esm({
   }
 });
 
+// ../core/dist/src/path-portable.js
+import { isAbsolute as nodeIsAbsolute, posix, relative as nodeRelative, sep } from "node:path";
+var PATH_SEPARATORS, toPosixPath, splitPathSegments, toRelativePosix, collapseHome;
+var init_path_portable = __esm({
+  "../core/dist/src/path-portable.js"() {
+    "use strict";
+    PATH_SEPARATORS = /[\\/]+/;
+    toPosixPath = (p) => p.replace(/\\/g, "/");
+    splitPathSegments = (p) => p.split(PATH_SEPARATORS).filter((s) => s.length > 0);
+    toRelativePosix = (root, abs) => {
+      const rel = nodeRelative(root, abs);
+      if (rel === "" || rel.startsWith("..") || nodeIsAbsolute(rel)) {
+        return toPosixPath(abs);
+      }
+      return sep === posix.sep ? rel : rel.split(sep).join(posix.sep);
+    };
+    collapseHome = (abs, home) => {
+      if (home.length === 0)
+        return abs;
+      const rel = nodeRelative(home, abs);
+      if (rel === "")
+        return "~";
+      if (rel.startsWith("..") || nodeIsAbsolute(rel))
+        return abs;
+      return `~/${toPosixPath(rel)}`;
+    };
+  }
+});
+
 // ../core/dist/src/network-policy.js
 import { AsyncLocalStorage } from "node:async_hooks";
 var MODE_OVERRIDE, VALID_MODES, getNetworkMode, withNetworkMode, isUpdateCheckOptedIn, CI_ENV_MARKERS, isUpdateCheckForcedOff, purposeAllowed, assertNetworkAllowed, describeNetworkPolicy;
@@ -464,6 +493,7 @@ var init_src = __esm({
     init_result();
     init_api_names();
     init_exec_helper();
+    init_path_portable();
     init_update_notifier();
     init_network_policy();
   }
@@ -494,6 +524,7 @@ var SOURCE_CONFLICT_PROPERTY, isDxCanonicalPath, chooseSourcePath, stableJson, c
 var init_duplicate_source = __esm({
   "../graph/dist/src/duplicate-source.js"() {
     "use strict";
+    init_src();
     init_relativize();
     SOURCE_CONFLICT_PROPERTY = "sourceConflict";
     isDxCanonicalPath = (path2) => /(?:^|\/)main\/default\//.test(path2);
@@ -534,7 +565,7 @@ var init_duplicate_source = __esm({
       })).sort()
     });
     commonSuffixSegments = (paths) => {
-      const split = paths.map((p) => p.split("/"));
+      const split = paths.map((p) => splitPathSegments(p));
       const shortest = Math.min(...split.map((s) => s.length));
       let n = 0;
       while (n < shortest) {
@@ -548,7 +579,7 @@ var init_duplicate_source = __esm({
     layoutRoots = (paths) => {
       const tail = commonSuffixSegments(paths);
       const roots = paths.map((p) => {
-        const segs = p.split("/");
+        const segs = splitPathSegments(p);
         const head = segs.slice(0, Math.max(0, segs.length - tail));
         return head.length === 0 ? "(source tree root)" : `${head.join("/")}/`;
       });
@@ -1248,10 +1279,10 @@ var init_apply_change_set = __esm({
       "graph-future-dispatch"
     ]);
     componentTypeFromNodeId = (id) => {
-      const sep6 = id.indexOf(":");
-      if (sep6 < 0)
+      const sep5 = id.indexOf(":");
+      if (sep5 < 0)
         return null;
-      return id.slice(0, sep6);
+      return id.slice(0, sep5);
     };
     INCREMENTAL_DELTA_CAP = 2e3;
     changeSetSize = (cs) => cs.upsertNodes.length + cs.deleteNodeIds.length + cs.upsertEdges.length + cs.deleteEdgeKeys.length;
@@ -1788,9 +1819,9 @@ var init_queries = __esm({
       message: `${label}: ${e.message}`
     });
     makeUnresolvedStubNode = (id) => {
-      const sep6 = id.indexOf(":");
-      const type = sep6 > 0 ? id.slice(0, sep6) : "";
-      const apiName = sep6 >= 0 ? id.slice(sep6 + 1) : id;
+      const sep5 = id.indexOf(":");
+      const type = sep5 > 0 ? id.slice(0, sep5) : "";
+      const apiName = sep5 >= 0 ? id.slice(sep5 + 1) : id;
       return {
         id,
         type,
@@ -3634,9 +3665,13 @@ var init_store = __esm({
     init_migrations();
     isLockConflict = (message) => {
       const m = message.toLowerCase();
-      return m.includes("could not set lock") || m.includes("conflicting lock");
+      return m.includes("could not set lock") || m.includes("conflicting lock") || // Windows (ERROR_SHARING_VIOLATION, surfaced through DuckDB's IO Error).
+      m.includes("being used by another process") || m.includes("sharing violation");
+    };
+    lockConflictMessage = (path2, cause) => {
+      const remedy = process.platform === "win32" ? "On Windows the running server must be stopped first: Windows will not let `sfi refresh` replace a database file while another process holds it open, so close your MCP client (or stop `sfi mcp`), re-run the refresh, then reopen the client and retry." : "`sfi refresh` handles this AUTOMATICALLY (it rebuilds into a side file and atomically swaps it in; an open MCP server picks up the new vault on its next call via the refresh epoch \u2014 no restart needed). Any OTHER writer should stop the holding process and retry.";
+      return `vault database at ${path2} is locked by another process \u2014 most likely a running \`sfi mcp\` server (your IDE's MCP integration) or a concurrent \`sfi refresh\`. DuckDB allows only one writer at a time. ${remedy} Underlying error: ${cause}`;
     };
-    lockConflictMessage = (path2, cause) => `vault database at ${path2} is locked by another process \u2014 most likely a running \`sfi mcp\` server (your IDE's MCP integration) or a concurrent \`sfi refresh\`. DuckDB allows only one writer at a time. \`sfi refresh\` handles this AUTOMATICALLY (it rebuilds into a side file and atomically swaps it in; an open MCP server picks up the new vault on its next call via the refresh epoch \u2014 no restart needed). Any OTHER writer should stop the holding process and retry. Underlying error: ${cause}`;
     isNativeBindingFailure = (message) => {
       const m = message.toLowerCase();
       return m.includes("dlopen") || m.includes("err_dlopen_failed") || m.includes("cannot open shared object") || m.includes("library not loaded") || m.includes("image not found") || m.includes("invalid elf header") || m.includes("not a valid win32 application") || m.includes("was compiled against a different node") || m.includes("no native build was found") || m.includes("could not locate the bindings") || m.includes("cannot find module") && m.includes("duckdb") || m.includes("cannot find package") && m.includes("duckdb");
@@ -4033,10 +4068,12 @@ var init_family_freshness = __esm({
         }
         if (prev === void 0)
           return entry;
+        const carryConfirmed = entry.retrieveConfirmed !== true && entry.errored !== true && entry.pending !== true && prev.retrieveConfirmed === true;
         return {
           ...entry,
           ...prev.retrievedAt !== void 0 ? { retrievedAt: prev.retrievedAt } : {},
-          ...prev.epoch !== void 0 ? { epoch: prev.epoch } : {}
+          ...prev.epoch !== void 0 ? { epoch: prev.epoch } : {},
+          ...carryConfirmed ? { retrieveConfirmed: true } : {}
         };
       });
     };
@@ -4158,7 +4195,7 @@ var init_tombstones = __esm({
 // ../vault/dist/src/hash.js
 import { createHash } from "node:crypto";
 import { readdir, readFile as readFile4, stat } from "node:fs/promises";
-import { join as join4, relative, sep } from "node:path";
+import { join as join4 } from "node:path";
 var RECORD_SEPARATOR, RECORD_TERMINATOR, computeSourceTreeHash, walkAndHash, hashFile;
 var init_hash = __esm({
   "../vault/dist/src/hash.js"() {
@@ -4221,8 +4258,7 @@ var init_hash = __esm({
       return ok(void 0);
     };
     hashFile = async (rootDir, absolutePath, hash) => {
-      const rawRel = relative(rootDir, absolutePath);
-      const relPath = sep === "/" ? rawRel : rawRel.split(sep).join("/");
+      const relPath = toRelativePosix(rootDir, absolutePath);
       let bytes;
       try {
         bytes = await readFile4(absolutePath);
@@ -4282,7 +4318,7 @@ var init_layout = __esm({
 
 // ../vault/dist/src/source-path.js
 import { readdir as readdir2, stat as stat2 } from "node:fs/promises";
-import { isAbsolute, join as join6, posix, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute, join as join6, posix as posix2, relative, sep as sep2 } from "node:path";
 var resolveVaultSourcePath, toVaultRelativePosix, matchesAnySuffix, isDxCanonicalPath2, logicalSourceKey, dedupeDuplicateLayouts, collectVaultSourceFiles;
 var init_source_path = __esm({
   "../vault/dist/src/source-path.js"() {
@@ -4295,8 +4331,8 @@ var init_source_path = __esm({
       return join6(vaultRoot, sourcePath);
     };
     toVaultRelativePosix = (vaultRoot, fileAbsPath) => {
-      const rel = relative2(vaultRoot, fileAbsPath);
-      return sep2 === posix.sep ? rel : rel.split(sep2).join(posix.sep);
+      const rel = relative(vaultRoot, fileAbsPath);
+      return sep2 === posix2.sep ? rel : rel.split(sep2).join(posix2.sep);
     };
     matchesAnySuffix = (name, suffixes) => suffixes.some((suffix) => name.endsWith(suffix));
     isDxCanonicalPath2 = (path2) => /(?:^|\/)main\/default\//.test(path2);
@@ -4505,10 +4541,12 @@ var init_manifest = __esm({
       const confirmedEmpty = (entry) => entry.requested && entry.retrieved === 0 && entry.retrieveConfirmed === true && !entry.errored && !entry.neverModeled && entry.pending !== true;
       const retrievedNotParsed = filtered.filter((entry) => confirmedEmpty(entry) && unparsedContainerTypes.has(entry.type)).map((entry) => entry.type);
       const retrievedNotParsedSet = new Set(retrievedNotParsed);
-      const coveredTypes = filtered.filter((entry) => entry.requested && (entry.retrieved > 0 || entry.retrieveConfirmed === true) && !entry.errored && !entry.neverModeled && entry.pending !== true && !retrievedNotParsedSet.has(entry.type)).map((entry) => entry.type);
+      const coveredTypes = filtered.filter((entry) => entry.requested && (entry.retrieved > 0 || entry.retrieveConfirmed === true) && !entry.errored && !entry.neverModeled && entry.pending !== true && // FIX-2: a `capped` row is real, attempted, ATTEMPTED-BUT-PARTIAL
+      // evidence — never `covered`, same as `pending`. See CoverageEntry.capped.
+      entry.capped !== true && !retrievedNotParsedSet.has(entry.type)).map((entry) => entry.type);
       const emptyTypes = filtered.filter((entry) => entry.requested && entry.retrieved === 0 && entry.retrieveConfirmed !== true && !entry.errored && !entry.neverModeled && entry.pending !== true).map((entry) => entry.type);
       const partialTypes = [
-        ...filtered.filter((entry) => (entry.errored || entry.pending === true) && !entry.neverModeled).map((entry) => entry.type),
+        ...filtered.filter((entry) => (entry.errored || entry.pending === true || entry.capped === true) && !entry.neverModeled).map((entry) => entry.type),
         ...emptyTypes
       ];
       const notModeledTypes = filtered.filter((entry) => entry.neverModeled).map((entry) => entry.type);
@@ -5908,7 +5946,7 @@ var init_naming_convention = __esm({
 });
 
 // ../patterns/dist/src/pii-detection.js
-var ENCRYPTED_TEXT_DATA_TYPE, EMAIL_DATA_TYPE, CONTACT_INCAPABLE_DATA_TYPES, CUSTOM_FIELD_SUFFIX2, CLASSIFICATION_RANK, SECURITY_CLASSIFICATION_TIERS, getDeclaredSecurityTier, getDeclaredSecurityRaw, toWordSegments, hasRaceSegment, PHI_ACRONYM_RE, hasPhiAcronym, NAME_PATTERNS, MONEY_AMOUNT_TOKENS, MONEY_CAPABLE_DATA_TYPES, GENERIC_CATALOG_PRICE_MARKERS, GENERIC_CATALOG_PARENT_MARKERS, ORGANIZATIONAL_OBJECT_MARKERS, NAME_PATTERNS_LOWERCASED, DESCRIPTION_RULES, stripCustomFieldSuffix2, normalizeDataType, getDataType, parentObjectApiNameLower, isOrganizationalParentObject, isMoneyAmountField, isVenueOrUrlFieldName, getDescriptionLower, matchNamePattern, matchDescriptionRule, stricterClassification, detectHeuristic, detectPiiClassificationWithReason, detectPiiClassification, isRegulatedPiiClassification;
+var ENCRYPTED_TEXT_DATA_TYPE, EMAIL_DATA_TYPE, CONTACT_INCAPABLE_DATA_TYPES, CUSTOM_FIELD_SUFFIX2, CLASSIFICATION_RANK, SECURITY_CLASSIFICATION_TIERS, getDeclaredSecurityTier, getDeclaredSecurityRaw, toWordSegments, WHOLE_WORD_ONLY_TOKENS, hasRaceSegment, PHI_ACRONYM_RE, hasPhiAcronym, NAME_PATTERNS, MONEY_AMOUNT_TOKENS, MONEY_CAPABLE_DATA_TYPES, GENERIC_CATALOG_PRICE_MARKERS, GENERIC_CATALOG_PARENT_MARKERS, ORGANIZATIONAL_OBJECT_MARKERS, NAME_PATTERNS_LOWERCASED, DESCRIPTION_RULES, stripCustomFieldSuffix2, normalizeDataType, getDataType, parentObjectApiNameLower, isOrganizationalParentObject, isMoneyAmountField, isVenueOrUrlFieldName, getDescriptionLower, matchNamePattern, matchDescriptionRule, stricterClassification, detectHeuristic, detectPiiClassificationWithReason, detectPiiClassification, isRegulatedPiiClassification;
 var init_pii_detection = __esm({
   "../patterns/dist/src/pii-detection.js"() {
     "use strict";
@@ -5948,6 +5986,11 @@ var init_pii_detection = __esm({
       return typeof raw === "string" && raw.length > 0 ? raw.trim() : null;
     };
     toWordSegments = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").split(/[^A-Za-z0-9]+/).filter((s) => s.length > 0).map((s) => s.toLowerCase());
+    WHOLE_WORD_ONLY_TOKENS = /* @__PURE__ */ new Set([
+      "city",
+      "phone",
+      "street"
+    ]);
     hasRaceSegment = (rawApiName) => toWordSegments(rawApiName).includes("race");
     PHI_ACRONYM_RE = /(?<![A-Za-z])PHI(?![A-Za-z])/;
     hasPhiAcronym = (rawText) => PHI_ACRONYM_RE.test(rawText);
@@ -6028,6 +6071,7 @@ var init_pii_detection = __esm({
           "email",
           "mobile",
           "phone",
+          "telephone",
           "fax",
           "address",
           "street",
@@ -6177,7 +6221,8 @@ var init_pii_detection = __esm({
     matchNamePattern = (apiNameLower, apiNameRaw) => {
       for (const rule of NAME_PATTERNS_LOWERCASED) {
         for (const token of rule.tokensLower) {
-          if (apiNameLower.includes(token)) {
+          const matched = WHOLE_WORD_ONLY_TOKENS.has(token) ? toWordSegments(apiNameRaw).includes(token) : apiNameLower.includes(token);
+          if (matched) {
             return {
               classification: rule.classification,
               category: rule.category,
@@ -6309,7 +6354,7 @@ var init_pii_detection = __esm({
 });
 
 // ../patterns/dist/src/code-quality-patterns.js
-var COMMENT_OR_STRING_PATTERN, blankOut, stripCommentsAndStrings, offsetToLine, ASSERTION_PATTERN, countAssertions, findMatchingBrace, enclosingBlockStart, APEX_NON_TYPE_KEYWORDS, enclosingMethodStart, matchOpenParenBackward, LOOP_KEYWORD_PATTERN, skipLoopHeader, findBodyOpenBrace, findLoopBodies, SOQL_IN_LOOP_PATTERN, detectSoqlInLoop, DML_IN_LOOP_PATTERN, detectDmlInLoop, KNOWN_KEY_PREFIXES, STRING_LITERAL_PATTERN, ID_15_OR_18_PATTERN, detectHardcodedIds, EMAIL_LITERAL_PATTERN, USERNAME_LITERAL_PATTERN, detectHardcodedEmails, detectHardcodedUsernames, URL_LITERAL_PATTERN, SALESFORCE_DOMAIN_SUFFIXES, isSalesforcePlatformHost, detectHardcodedUrls, DYNAMIC_APEX_PATTERNS, detectDynamicApex, DML_STATEMENT_PATTERN, DML_DATABASE_CALL_PATTERN, CRUD_HINT_PATTERNS, writeCheckedSObjects, hasAnyWriteGate, hasNonTypedWriteGate, COLLECTION_WRAPPER, unwrapType, resolveVarSObjectType, detectMissingCrudCheck, INLINE_SOQL_PATTERN, QUERY_ASSIGN_LHS, readStripFor, detectMissingFlsCheck, DATABASE_QUERY_CALL_START_PATTERN, escapeForRegex, findMatchingParen, findVarAssignment, tokenizeConcatExpr, tokenIsSafe, detectSoqlInjection, WITHOUT_SHARING_CLASS_PATTERN, hasPrecedingComment, detectWithoutSharingNoComment, TRIGGER_HEADER_PATTERN, RECURSION_GUARD_PATTERNS, detectTriggerNoRecursionGuard, detectOldApiVersion, DATABASE_UPSERT_PATTERN, detectDatabaseUpsertNoOptions, FAKE_ASSERT_BOOL_PATTERN, FAKE_ASSERTEQUALS_SELF_PATTERN, FAKE_ASSERTEQUALS_LITERAL_PATTERN, detectFakeAssertion, SANDBOX_LITERAL_PATTERN, detectHardcodedSandboxData, CATCH_HEADER_PATTERN, stripBalancedCalls, SYSTEM_DEBUG_CALL_START, LOGGER_CALL_START, isLogOnlyOrEmpty, detectSwallowedException, detectCodeQualityIssues, LINE_LOCATION_PATTERN, parseLineFromLocation;
+var COMMENT_OR_STRING_PATTERN, blankOut, stripCommentsAndStrings, offsetToLine, ASSERTION_PATTERN, countAssertions, findMatchingBrace, enclosingBlockStart, APEX_NON_TYPE_KEYWORDS, enclosingMethodStart, matchOpenParenBackward, LOOP_KEYWORD_PATTERN, skipLoopHeader, findBodyOpenBrace, findLoopBodies, SOQL_IN_LOOP_PATTERN, detectSoqlInLoop, DML_IN_LOOP_PATTERN, detectDmlInLoop, KNOWN_KEY_PREFIXES, STRING_LITERAL_PATTERN, ID_15_OR_18_PATTERN, isKnownSalesforceIdLiteral, detectHardcodedIds, EMAIL_LITERAL_PATTERN, USERNAME_LITERAL_PATTERN, detectHardcodedEmails, detectHardcodedUsernames, URL_LITERAL_PATTERN, SALESFORCE_DOMAIN_SUFFIXES, isSalesforcePlatformHost, detectHardcodedUrls, DYNAMIC_APEX_PATTERNS, detectDynamicApex, DML_STATEMENT_PATTERN, DML_DATABASE_CALL_PATTERN, CRUD_HINT_PATTERNS, writeCheckedSObjects, hasAnyWriteGate, hasNonTypedWriteGate, COLLECTION_WRAPPER, unwrapType, resolveVarSObjectType, detectMissingCrudCheck, INLINE_SOQL_PATTERN, QUERY_ASSIGN_LHS, readStripFor, detectMissingFlsCheck, DATABASE_QUERY_CALL_START_PATTERN, escapeForRegex, findMatchingParen, findVarAssignment, tokenizeConcatExpr, tokenIsSafe, detectSoqlInjection, WITHOUT_SHARING_CLASS_PATTERN, hasPrecedingComment, detectWithoutSharingNoComment, TRIGGER_HEADER_PATTERN, RECURSION_GUARD_PATTERNS, detectTriggerNoRecursionGuard, detectOldApiVersion, DATABASE_UPSERT_PATTERN, detectDatabaseUpsertNoOptions, FAKE_ASSERT_BOOL_PATTERN, FAKE_ASSERTEQUALS_SELF_PATTERN, FAKE_ASSERTEQUALS_LITERAL_PATTERN, detectFakeAssertion, SANDBOX_LITERAL_PATTERN, detectHardcodedSandboxData, CATCH_HEADER_PATTERN, stripBalancedCalls, SYSTEM_DEBUG_CALL_START, LOGGER_CALL_START, isLogOnlyOrEmpty, detectSwallowedException, detectCodeQualityIssues, LINE_LOCATION_PATTERN, parseLineFromLocation;
 var init_code_quality_patterns = __esm({
   "../patterns/dist/src/code-quality-patterns.js"() {
     "use strict";
@@ -6589,6 +6634,7 @@ var init_code_quality_patterns = __esm({
     ]);
     STRING_LITERAL_PATTERN = /'((?:\\[\s\S]|[^'\\])*)'/g;
     ID_15_OR_18_PATTERN = /^[a-zA-Z0-9]{15}(?:[a-zA-Z0-9]{3})?$/;
+    isKnownSalesforceIdLiteral = (value) => ID_15_OR_18_PATTERN.test(value) && KNOWN_KEY_PREFIXES.has(value.slice(0, 3));
     detectHardcodedIds = (source) => {
       const issues = [];
       const re = new RegExp(STRING_LITERAL_PATTERN.source, "g");
@@ -9579,7 +9625,7 @@ var init_formula_tokenizer = __esm({
     IDENTIFIER_PATH = /[A-Za-z_][A-Za-z_0-9]*(?:\.[A-Za-z_][A-Za-z_0-9]*)*/g;
     SPECIAL_VARIABLE_PATH = /\$[A-Za-z_][A-Za-z_0-9]*(?:\.[A-Za-z_][A-Za-z_0-9]*)*/g;
     MALFORMED_NUMERIC = /\d+\.\d+\.\d+/;
-    NUMERIC_LITERAL = /\d+(?:\.\d+)?/g;
+    NUMERIC_LITERAL = /(?<![A-Za-z0-9_])\d+(?:\.\d+)?(?![A-Za-z0-9_])/g;
     blankOut4 = (text) => text.replace(/[^\n]/g, " ");
     tokenizeFormula = (formula) => {
       if (formula.trim().length === 0) {
@@ -10407,8 +10453,10 @@ var deriveComponentApiName, deriveEntityVariant, deriveParentApiName, deriveNest
 var init_path_utils = __esm({
   "../extractors/dist/src/path-utils.js"() {
     "use strict";
+    init_src();
     deriveComponentApiName = (filePath, suffix) => {
-      const base = basename(filePath);
+      const segments = splitPathSegments(filePath);
+      const base = segments[segments.length - 1] ?? "";
       if (suffix.length > 0 && base.endsWith(suffix)) {
         return base.slice(0, base.length - suffix.length);
       }
@@ -10433,16 +10481,9 @@ var init_path_utils = __esm({
       if (parentDirLevel < 1) {
         return "";
       }
-      let current = dirname10(filePath);
-      for (let step3 = 1; step3 < parentDirLevel; step3 += 1) {
-        const next = dirname10(current);
-        if (next === current) {
-          return "";
-        }
-        current = next;
-      }
-      const name = basename(current);
-      if (name.length === 0 || name === ".") {
+      const segments = splitPathSegments(filePath);
+      const name = segments[segments.length - 1 - parentDirLevel];
+      if (name === void 0 || name.length === 0 || name === ".") {
         return "";
       }
       return name;
@@ -10458,11 +10499,11 @@ var init_path_utils = __esm({
     };
     deriveEmailTemplateFolderAndName = (filePath, suffix) => {
       const templateName = deriveComponentApiName(filePath, suffix);
-      const dir = dirname10(filePath);
-      if (dir === "" || dir === "." || dir === "/") {
+      const allSegments = splitPathSegments(filePath);
+      if (allSegments.length < 2) {
         return null;
       }
-      const segments = dir.split("/").filter((s) => s.length > 0);
+      const segments = allSegments.slice(0, -1);
       let emailIndex = -1;
       for (let i = segments.length - 1; i >= 0; i -= 1) {
         if (segments[i] === "email") {
@@ -17378,7 +17419,7 @@ var init_enterprise_metadata = __esm({
     EXTRACTOR_SOURCE14 = "enterprise-metadata-extractor";
     deriveFolderedApiName = (filePath, suffix, folderRoot) => {
       const bare = deriveComponentApiName(filePath, suffix);
-      const segments = filePath.replace(/\\/g, "/").split("/").filter((s) => s.length > 0);
+      const segments = splitPathSegments(filePath);
       const anchor = Math.max(segments.lastIndexOf("unpackaged"), segments.lastIndexOf("source"));
       const anchored = anchor === -1 ? -1 : segments.indexOf(folderRoot, anchor + 1);
       const rootIndex = anchored !== -1 ? anchored : segments.lastIndexOf(folderRoot);
@@ -31568,10 +31609,10 @@ var init_answer_render = __esm({
       if (rows.length === 0)
         return "";
       const head = `| ${headers.map(cell).join(" | ")} |`;
-      const sep6 = `| ${headers.map(() => "---").join(" | ")} |`;
+      const sep5 = `| ${headers.map(() => "---").join(" | ")} |`;
       const body = rows.map((r) => `| ${headers.map((_, i) => cell(r[i])).join(" | ")} |`).join("\n");
       return `${head}
-${sep6}
+${sep5}
 ${body}`;
     };
     renderInterpretationsMarkdown = (data) => {
@@ -43128,7 +43169,7 @@ var init_live_capability = __esm({
 });
 
 // ../mcp/dist/src/tools/apex-reachability.js
-var NOT_USAGE_EDGE_TYPES, USAGE_EDGE_TYPES, UNPROVEN_REGISTRATION_KINDS, CALLABLE_INTERFACE, isFrameworkSubclass, isCallableDispatch, ASYNC_DISPATCH_PROPERTY_KEYS, UI_CONTROLLER_SOURCE_PREFIXES, isTestClassNode, entryKindsFor, isUnprovenRegistrationKind, UNPROVEN_REGISTRATION_DISCLOSURE, isUiControllerEdge, CONFIDENCE_RANK2, weakerConfidence, walkUpstreamUsage, countUnwalkedUsageInEdges;
+var NOT_USAGE_EDGE_TYPES, USAGE_EDGE_TYPES, UNPROVEN_REGISTRATION_KINDS, CALLABLE_INTERFACE, isFrameworkSubclass, isCallableDispatch, isNamespacedInterfaceImplementation, ASYNC_DISPATCH_PROPERTY_KEYS, UI_CONTROLLER_SOURCE_PREFIXES, isTestClassNode, entryKindsFor, isUnprovenRegistrationKind, UNPROVEN_REGISTRATION_DISCLOSURE, isUiControllerEdge, CONFIDENCE_RANK2, weakerConfidence, walkUpstreamUsage, countUnwalkedUsageInEdges;
 var init_apex_reachability = __esm({
   "../mcp/dist/src/tools/apex-reachability.js"() {
     "use strict";
@@ -43140,6 +43181,7 @@ var init_apex_reachability = __esm({
     UNPROVEN_REGISTRATION_KINDS = [
       "framework-subclass",
       "callable-dispatch",
+      "namespaced-interface",
       // ASYNC-DISPATCH REGISTRATION IS ALSO UNPROVABLE OFFLINE. Added after 16 of
       // 18 org-wide `likely_dead` classes turned out to be Schedulable or Batchable
       // — see `isAsyncDispatchRegistration` for the platform reason.
@@ -43156,6 +43198,10 @@ var init_apex_reachability = __esm({
       const impl = node.properties["implements"];
       return Array.isArray(impl) && impl.includes(CALLABLE_INTERFACE);
     };
+    isNamespacedInterfaceImplementation = (node) => {
+      const impl = node.properties["implements"];
+      return Array.isArray(impl) && impl.some((i) => typeof i === "string" && i.includes("."));
+    };
     ASYNC_DISPATCH_PROPERTY_KEYS = [
       "isQueueable",
       "isBatchable",
@@ -43190,10 +43236,12 @@ var init_apex_reachability = __esm({
         kinds.push("framework-subclass");
       if (isCallableDispatch(node))
         kinds.push("callable-dispatch");
+      if (isNamespacedInterfaceImplementation(node))
+        kinds.push("namespaced-interface");
       return kinds;
     };
     isUnprovenRegistrationKind = (kind) => UNPROVEN_REGISTRATION_KINDS.includes(kind);
-    UNPROVEN_REGISTRATION_DISCLOSURE = 'A class that extends a base class from ANOTHER namespace (a managed package or platform framework instantiates its own subclasses), declares the Callable dynamic-invocation interface, or implements Queueable / Database.Batchable / Schedulable is registered OUTSIDE the metadata a vault holds: in a string literal, a Custom Metadata record, managed-package code, anonymous Apex run from the Developer Console or a deployment script, or a CronTrigger record written by Setup > Schedule Apex. CronTrigger is DATA, not metadata \u2014 it is never retrieved, so no refresh can close that gap. None of those registrations mints an edge, so such a class has zero incoming edges by construction. Every one of these signals says the class is BUILT to be invoked from outside this vault; NONE of them proves the registration is live. Treat it as "not dead", never as "proven reachable" \u2014 confirm the registration in the org before relying on it.';
+    UNPROVEN_REGISTRATION_DISCLOSURE = 'A class that extends a base class from ANOTHER namespace (a managed package or platform framework instantiates its own subclasses), declares the Callable dynamic-invocation interface, implements an interface QUALIFIED by another namespace (an AuthProvider record names an Auth.RegistrationHandler implementation by type; a managed package registers its own plugin interface the same way), or implements Queueable / Database.Batchable / Schedulable is registered OUTSIDE the metadata a vault holds: in a string literal, a Custom Metadata record, managed-package code, anonymous Apex run from the Developer Console or a deployment script, or a CronTrigger record written by Setup > Schedule Apex. CronTrigger is DATA, not metadata \u2014 it is never retrieved, so no refresh can close that gap. None of those registrations mints an edge, so such a class has zero incoming edges by construction. Every one of these signals says the class is BUILT to be invoked from outside this vault; NONE of them proves the registration is live. Treat it as "not dead", never as "proven reachable" \u2014 confirm the registration in the org before relying on it.';
     isUiControllerEdge = (edge) => edge.edgeType === "references" && UI_CONTROLLER_SOURCE_PREFIXES.some((p) => edge.fromId.startsWith(p));
     CONFIDENCE_RANK2 = {
       declared: 0,
@@ -49865,7 +49913,7 @@ var init_concept_reasoning = __esm({
         return { envelope: envelope2, reservedBytes: bytes, reservationCapped: true };
       }
       let claimCap = envelope2.claims.length;
-      while (bytes > hardMax && claimCap > 1) {
+      while (bytes > hardMax && claimCap > 0) {
         claimCap = Math.floor(claimCap / 2);
         envelope2 = projectConceptReasoning(ctx, reasoned.value, { listCap: 0, maxClaims: claimCap });
         bytes = sizeOf2(envelope2);
@@ -50195,10 +50243,13 @@ var init_coverage_trust = __esm({
       "ApexClass",
       "ApexTrigger",
       "WorkflowRule",
+      "ApprovalProcess",
+      "AutoResponseRule",
+      "AssignmentRule",
+      "EscalationRule",
       "Layout",
       "SharingRule",
       "DuplicateRule",
-      "ConditionalContext",
       "Report",
       "Dashboard",
       "ListView",
@@ -53907,8 +53958,7 @@ var init_roster = __esm({
         // knob on the Zod schema; unadvertised it was unreachable from a
         // schema-driven host, which is the same as not shipping it.
         includeConceptReasoning: { type: "boolean" }
-      },
-      required: ["id"]
+      }
     });
     GET_EDGES_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -53991,6 +54041,12 @@ var init_roster = __esm({
         hasInvocableMethod: { type: "boolean" },
         hasAuraEnabledMethod: { type: "boolean" },
         isTest: { type: "boolean" },
+        // Flow metadata: exact match on `properties.triggerObject`.
+        triggerObject: { type: "string", minLength: 1 },
+        // Flow metadata: exact match on `properties.status` (e.g. Active).
+        status: { type: "string", minLength: 1 },
+        // Flow metadata: keep only record-triggered flows (`triggerType` starts with Record).
+        recordTriggered: { type: "boolean" },
         // Description-presence filters. Answer "which <type> have no description".
         // Only meaningful for a type whose extractor captures `<description>`.
         missingDescription: { type: "boolean" },
@@ -54019,9 +54075,12 @@ var init_roster = __esm({
       properties: {
         query: { type: "string", minLength: 1 },
         regex: { type: "boolean" },
-        limit: { type: "integer", minimum: 1, maximum: 200 }
-      },
-      required: ["query"]
+        limit: { type: "integer", minimum: 1, maximum: 200 },
+        // Flow metadata: exact match on `properties.triggerObject`.
+        triggerObject: { type: "string", minLength: 1 },
+        // Return a digest instead of full matches.
+        summarize: { type: "boolean" }
+      }
     });
     NAMING_CONVENTION_REPORT_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54480,24 +54539,32 @@ var init_roster = __esm({
       properties: {
         staleDays: { type: "integer", minimum: 1, maximum: 3650 },
         limit: { type: "integer", minimum: 1, maximum: 500 },
+        nameContains: { type: "string", minLength: 1 },
+        folderName: { type: "string", minLength: 1 },
         ...LIVE_ENABLED_PROPERTY
-      }
+      },
+      additionalProperties: false
     });
     LIVE_FOLDER_ACCESS_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
         folderType: { type: "string", enum: ["Report", "Dashboard", "Email", "Document", "all"] },
         limit: { type: "integer", minimum: 1, maximum: 500 },
+        nameContains: { type: "string", minLength: 1 },
         ...LIVE_ENABLED_PROPERTY
-      }
+      },
+      additionalProperties: false
     });
     LIVE_EMAIL_TEMPLATE_USAGE_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
         staleDays: { type: "integer", minimum: 1, maximum: 3650 },
         limit: { type: "integer", minimum: 1, maximum: 500 },
+        nameContains: { type: "string", minLength: 1 },
+        folderName: { type: "string", minLength: 1 },
         ...LIVE_ENABLED_PROPERTY
-      }
+      },
+      additionalProperties: false
     });
     LIVE_ORG_HEALTH_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54742,12 +54809,19 @@ var init_roster = __esm({
       type: "object",
       properties: {
         componentId: { type: "string", minLength: 1 },
+        object: { type: "string", minLength: 1 },
+        objectApiName: { type: "string", minLength: 1 },
+        objectId: { type: "string", minLength: 1 },
+        sharedWithRoleApiName: { type: "string", minLength: 1 },
+        sharedToId: { type: "string", minLength: 1 },
+        sharedTo: { type: "string", minLength: 1 },
+        groupId: { type: "string", minLength: 1 },
+        nameContains: { type: "string", minLength: 1 },
         limit: { type: "number", minimum: 1, maximum: 120 },
         offset: { type: "number", minimum: 0 },
         // CR-22 continuation cursor: opaque token from a prior page's nextCursor.
         cursor: { type: "string", minLength: 1 }
-      },
-      required: ["componentId"]
+      }
     });
     WHO_CAN_RUN_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54769,8 +54843,7 @@ var init_roster = __esm({
         errorMessage: { type: "string", minLength: 1 },
         text: { type: "string", minLength: 1 },
         object: { type: "string", minLength: 1 }
-      },
-      required: ["errorText"]
+      }
     });
     EXPLAIN_DEBUG_LOG_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54781,8 +54854,7 @@ var init_roster = __esm({
         text: { type: "string", minLength: 1 },
         content: { type: "string", minLength: 1 },
         object: { type: "string", minLength: 1 }
-      },
-      required: ["logText"]
+      }
     });
     TRACE_DEBUG_LOG_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54849,6 +54921,7 @@ var init_roster = __esm({
       type: "object",
       properties: {
         componentId: { type: "string", minLength: 1 },
+        objectApiName: { type: "string", minLength: 1 },
         accessLevel: { type: "string", enum: ["read", "edit", "delete", "create"] },
         userContext: {
           type: "object",
@@ -54866,7 +54939,7 @@ var init_roster = __esm({
           }
         }
       },
-      required: ["componentId", "userContext"]
+      required: ["userContext"]
     });
     LAYOUT_FOR_USER_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54887,12 +54960,14 @@ var init_roster = __esm({
       type: "object",
       properties: {
         componentId: { type: "string", minLength: 1 },
+        object: { type: "string", minLength: 1, description: "Object name (alias for object scoping)" },
+        objectApiName: { type: "string", minLength: 1, description: "Object API name" },
+        objectId: { type: "string", minLength: 1, description: "Object id" },
         limit: { type: "number", minimum: 1, maximum: 250 },
         offset: { type: "number", minimum: 0 },
         // CR-22 continuation cursor: opaque token from a prior page's nextCursor.
         cursor: { type: "string", minLength: 1 }
-      },
-      required: ["componentId"]
+      }
     });
     USER_ABILITY_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -54932,12 +55007,18 @@ var init_roster = __esm({
       type: "object",
       properties: {
         componentId: { type: "string", minLength: 1 },
+        object: { type: "string", minLength: 1 },
+        objectApiName: { type: "string", minLength: 1 },
+        objectId: { type: "string", minLength: 1 },
+        profile: { type: "string", minLength: 1 },
+        profileApiName: { type: "string", minLength: 1 },
+        profileId: { type: "string", minLength: 1 },
+        profileName: { type: "string", minLength: 1 },
         limit: { type: "number", minimum: 1, maximum: 250 },
         offset: { type: "number", minimum: 0 },
         // CR-22 continuation cursor (object mode): opaque token from a prior page's nextCursor.
         cursor: { type: "string", minLength: 1 }
-      },
-      required: ["componentId"]
+      }
     });
     PERMISSION_SET_CONSOLIDATION_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -55064,6 +55145,7 @@ var init_roster = __esm({
       type: "object",
       properties: {
         eventId: { type: "string", minLength: 1 },
+        eventApiName: { type: "string", minLength: 1, description: "Platform Event API name" },
         limit: { type: "integer", minimum: 1, maximum: 500 }
       }
     });
@@ -55091,9 +55173,9 @@ var init_roster = __esm({
       type: "object",
       properties: {
         fieldId: { type: "string", minLength: 1 },
+        componentId: { type: "string", minLength: 1, description: "Field id (alias for fieldId)" },
         includeRecordValues: { type: "boolean" }
-      },
-      required: ["fieldId"]
+      }
     });
     SAFE_TO_DELETE_FIELD_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -55199,12 +55281,12 @@ var init_roster = __esm({
       type: "object",
       properties: {
         fieldId: { type: "string", minLength: 1 },
+        componentId: { type: "string", minLength: 1, description: "Field id (alias for fieldId)" },
         permissionType: {
           type: "string",
           enum: ["read", "edit", "all"]
         }
-      },
-      required: ["fieldId"]
+      }
     });
     OBJECT_ACCESS_AUDIT_INPUT_SCHEMA = Object.freeze({
       type: "object",
@@ -55558,6 +55640,7 @@ var init_roster = __esm({
         parentObjectFilter: { type: "string", minLength: 1 },
         excludeManagedPackage: { type: "boolean" },
         excludeStandardFields: { type: "boolean" },
+        staticOnly: { type: "boolean", description: "Skip dynamic-usage pass" },
         limit: { type: "integer", minimum: 1, maximum: 500 },
         offset: { type: "integer", minimum: 0 },
         cursor: { type: "string", minLength: 1 },
@@ -55849,6 +55932,9 @@ var init_roster = __esm({
     GOVERNOR_LIMIT_RISKS_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
+        componentId: { type: "string", minLength: 1 },
+        classApiName: { type: "string", minLength: 1 },
+        apiName: { type: "string", minLength: 1 },
         limit: { type: "integer", minimum: 1, maximum: 500 },
         offset: { type: "integer", minimum: 0 },
         // CR-22 continuation cursor: opaque token from a prior page's nextCursor.
@@ -56086,7 +56172,9 @@ var init_roster = __esm({
     GENERATE_SHARING_SUMMARY_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
-        objectFilter: { type: "string", minLength: 1 }
+        objectFilter: { type: "string", minLength: 1 },
+        objectApiName: { type: "string", minLength: 1 },
+        componentId: { type: "string", minLength: 1 }
       }
     });
     GENERATE_COMPLIANCE_REPORT_INPUT_SCHEMA = Object.freeze({
@@ -56252,7 +56340,8 @@ var init_roster = __esm({
     CDC_SUBSCRIBERS_INPUT_SCHEMA = Object.freeze({
       type: "object",
       properties: {
-        sObjectFilter: { type: "string", minLength: 1 }
+        sObjectFilter: { type: "string", minLength: 1 },
+        objectApiName: { type: "string", minLength: 1 }
       }
     });
     EVENT_TOPOLOGY_INPUT_SCHEMA = Object.freeze({
@@ -56554,6 +56643,11 @@ var init_roster = __esm({
       properties: {
         classApiName: { type: "string", minLength: 1 },
         apexClass: { type: "string", minLength: 1 },
+        className: { type: "string", minLength: 1 },
+        apiName: { type: "string", minLength: 1 },
+        componentId: { type: "string", minLength: 1 },
+        classId: { type: "string", minLength: 1 },
+        apexClassId: { type: "string", minLength: 1 },
         limit: { type: "integer", minimum: 1, maximum: 500 },
         offset: { type: "integer", minimum: 0 },
         cursor: { type: "string", minLength: 1 }
@@ -56574,9 +56668,11 @@ var init_roster = __esm({
       type: "object",
       properties: {
         object: { type: "string", minLength: 1 },
+        componentId: { type: "string", minLength: 1, description: "CustomObject id (alias for object)" },
+        objectApiName: { type: "string", minLength: 1, description: "Object API name" },
+        objectId: { type: "string", minLength: 1, description: "Object id" },
         limit: { type: "integer", minimum: 1, maximum: 200 }
       },
-      required: ["object"],
       additionalProperties: false
     });
     AI_EXPOSURE_REPORT_INPUT_SCHEMA = Object.freeze({
@@ -56753,7 +56849,7 @@ var init_roster = __esm({
       },
       {
         name: "sfi.coverage_report",
-        description: "Report the vault's self-assessed metadata coverage: covered, partial, not-modeled, and \u2014 during a staged refresh \u2014 pending families (queued by the in-progress tiered build, with `stagedBuild` tier progress; pending types count as missing coverage, so absence answers about them must stay qualified). Use before absence-based or destructive answers. A fourth bucket, `retrievedNotParsed`, is emitted ONLY when a type dispatched by exact filename out of a SHARED retrieve container (today only `settings`) parsed nothing because that container came back WITHOUT its member file \u2014 its row reads `retrieved: 0` alongside `retrieveConfirmed: true`, which would otherwise read as a confirmed-empty org. The container WAS requested and DID return (its other members are the family ranked in `topUncoveredFamilies`) and the refresh DOES parse this type's filename, so nothing was read for it \u2014 whether the org lacks the feature or the file did not come back CANNOT be told from the vault, so treat it as NOT CHECKED rather than as an org fact. Those types leave `covered`, are named in `summary.retrievedNotParsedTypes`, and are folded into `summary.missingCoverage`. Re-running the retrieve cannot close that particular gap \u2014 the container already returned without the member; for `SessionSettings` it never can, because Salesforce emits no `Session.settings-meta.xml` at all (session settings are nested inside `Security.settings-meta.xml`), so closing it is a product change, not an operator action. The disclosure states the per-type reason. The `assignmentData` section covers runtime assignment data (User / PermissionSetAssignment / GroupMember): NOT in the vault by design (a runtime data object, not a retrieve gap) \u2014 it names the consent-gated live tools that answer those questions (sfi.live_permset_holders, sfi.live_user_permsets, sfi.live_group_members, sfi.live_zombie_accounts), whether live consent is currently granted, and whether/when a counts-only facts snapshot (`sfi refresh --with-data-shape`) was captured.",
+        description: "Report the vault's self-assessed metadata coverage: covered, partial, not-modeled, and \u2014 during a staged refresh \u2014 pending families (queued by the in-progress tiered build, with `stagedBuild` tier progress; pending types count as missing coverage, so absence answers about them must stay qualified). A `capped` bucket lists families that WERE attempted and landed a real, non-zero, partial result under a known volume cap (the usage-ranked report/dashboard pull, or its node-persistence ceiling) \u2014 distinct from `pending` (\"not yet attempted at all\"); capped types also count as missing coverage. Use before absence-based or destructive answers. A further bucket, `retrievedNotParsed`, is emitted ONLY when a type dispatched by exact filename out of a SHARED retrieve container (today only `settings`) parsed nothing because that container came back WITHOUT its member file \u2014 its row reads `retrieved: 0` alongside `retrieveConfirmed: true`, which would otherwise read as a confirmed-empty org. The container WAS requested and DID return (its other members are the family ranked in `topUncoveredFamilies`) and the refresh DOES parse this type's filename, so nothing was read for it \u2014 whether the org lacks the feature or the file did not come back CANNOT be told from the vault, so treat it as NOT CHECKED rather than as an org fact. Those types leave `covered`, are named in `summary.retrievedNotParsedTypes`, and are folded into `summary.missingCoverage`. Re-running the retrieve cannot close that particular gap \u2014 the container already returned without the member; for `SessionSettings` it never can, because Salesforce emits no `Session.settings-meta.xml` at all (session settings are nested inside `Security.settings-meta.xml`), so closing it is a product change, not an operator action. The disclosure states the per-type reason. The `assignmentData` section covers runtime assignment data (User / PermissionSetAssignment / GroupMember): NOT in the vault by design (a runtime data object, not a retrieve gap) \u2014 it names the consent-gated live tools that answer those questions (sfi.live_permset_holders, sfi.live_user_permsets, sfi.live_group_members, sfi.live_zombie_accounts), whether live consent is currently granted, and whether/when a counts-only facts snapshot (`sfi refresh --with-data-shape`) was captured.",
         inputSchema: COVERAGE_REPORT_INPUT_SCHEMA
       },
       {
@@ -57340,7 +57436,7 @@ var init_roster = __esm({
       },
       {
         name: "sfi.unused_fields_deep",
-        description: "Optional `objectId` narrows the scan to one CustomObject \u2014 accepts the canonical id (`CustomObject:Account`) or a bare api name (`Account`); without it the scan is org-wide. Legacy `parentObjectFilter` (bare api name) is still accepted for back-compat. Scans every CustomField in scope with an eight-tier cross-walk before flagging it as unused: (1) zero incoming usage edges (excluding parentOf containment and grantedBy FLS grants \u2014 access is not usage), (2) no formula-text reference in another CustomField / ValidationRule / WorkflowRule, (3) no layout placement (layoutSections + relatedLists), (4) no SOQL-string match in an ApexClass / ApexTrigger source byproduct, (5) no apex-scanner unresolvedFieldReferences match, (6) no incoming LWC/Aura/VF `references` edge, (7) no ConditionalContext expression-text reference, (8) no `exposes` integration edge. Returns per-field checks, a per-tier invisibility warning list, a confidence tier (`high` for clean+custom+non-managed; `low` for standard/managed), and a recommendedAction. `limit` (default 100, max 500) caps the rows; because each carries the full eight-tier detail, a per-response ~36 KB byte budget trims the page further when it would exceed the global ~45 KB MCP response limit (`truncated` + a `note`), while `totalCount` / `byParentObject` / `byConfidence` keep the UNFILTERED counts; a truncated page returns a `nextCursor` to resume. Pass `format: 'csv'` (, default `'json'`) to get `csv` (this page's rows as CSV \u2014 the eight `checks.*` booleans flattened into `checks_*` columns, with the boundary + freshness disclosures embedded as `#`-prefixed comment lines) instead of `fields` (`fields` is `[]` on a csv page); `totalCount`/`byParentObject`/`byConfidence`/pagination fields are unchanged. Pass `format: 'cleanup'` (, the folded-in `field_cleanup_candidates` view) to additionally get a ranked `findings[]` roster (severity from each field's `confidence`, `summary` = `\"{id} \u2014 {recommendedAction}\"`) parallel to `fields`, plus a `disclosure` carrying the report/dashboard usage caveat (a report-only field reads as unused without `--with-reports`); findings + fields are trimmed TOGETHER to the ~36 KB budget with a `note`. Pass `format: 'proposal'` (Finding #35) to additionally get a `proposal` \u2014 a deploy-ready, LOCAL artifact: a populated `destructiveChanges.xml` bundle of THIS PAGE's `high`-confidence unused fields (+ an empty `package.xml`), each led by an evidence comment carrying per-field recommended actions, the boundary disclosures verbatim, the vault `sourceTreeHash`, and a REVIEW-before-deploy banner. `medium`/`low`-confidence and protected (standard/managed) fields are EXCLUDED from the delete set and their counts disclosed in the evidence; the bundle is capped at 200 members. sfi returns the file STRINGS only \u2014 it NEVER deploys, writes, or connects to the org; a human feeds the files to Gearset / Copado / `sf project deploy`. Validated against `docs/schemas/proposal.schema.json`. Honesty axis (verbatim): string-BUILT dynamic SOQL, LWC dynamic field access, Apex reflective access, and runtime metadata references remain invisible \u2014 inline static SOQL and constant-string Database.query field references ARE resolved (parsed-confidence Apex AST edges counted by tier 1, with the tier-4 soqlStrings text-match as backstop) \u2014 a 'high-confidence unused' flag means 'no static evidence of use', not 'definitely unused'. Fields the heuristic recognizer classifies pii/sensitive carry a machine-readable `piiClassification` field and a compliance escalation PREPENDED to `recommendedAction` (deletion may be irreversible / FERPA-GDPR-PCI-relevant, require data-retention sign-off). Heuristic \u2014 absence is NOT a clearance. Honesty axis (verbatim): string-BUILT dynamic SOQL, LWC dynamic field access, Apex reflective access, and runtime metadata references remain invisible \u2014 inline static SOQL and constant-string Database.query field references ARE resolved (parsed-confidence Apex AST edges counted by tier 1, with the tier-4 soqlStrings text-match as backstop) \u2014 a 'high-confidence unused' flag means 'no static evidence of use', not 'definitely unused'. Fields the heuristic recognizer classifies pii/sensitive carry a machine-readable `piiClassification` field and a compliance escalation PREPENDED to `recommendedAction` (deletion may be irreversible / FERPA-GDPR-PCI-relevant, require data-retention sign-off). Heuristic \u2014 absence is NOT a clearance. HYBRID: pass `liveEnabled: true` (or grant consent) to cross-check every `confidence: 'high'` field ON THE RETURNED PAGE against its live production population before trusting that tier \u2014 real data despite zero static references across all eight tiers may be written by dynamic Apex, an integration, or another blind spot the scanner cannot see. A `populatedCount > 0` DOWNGRADES that field's `confidence` from `high` to `medium` (the tier `medium` already means: no static evidence, but a blind spot could hide a reference) and attaches a `livePopulation` evidence block (`objectApiName`/`fieldApiName`/`totalCount`/`populatedCount`/`populationRate`/`liveQueriedAt`); a zero-population result leaves `high` standing but still attaches the evidence block, confirming the cross-check ran. Bounded to the page (never the full unfiltered scan) so live-query cost tracks `limit`, not `totalCount`, AND further capped to at most the first 3 high-confidence fields per page \u2014 a live wall-clock bound so a large consented org (hundreds of high-confidence unused fields) can never fire hundreds of serial live COUNTs and blow the MCP 60s client timeout; the remaining high-confidence fields keep their STATIC verdict and a `boundaries` line names the cap ('live population checked for the first N of M high-confidence fields on this page \u2026 raise the page or narrow the object to check the rest'). `byConfidence` / `totalCount` stay the STATIC pre-cross-check totals regardless (disclosed in `boundaries` when a downgrade occurs). The live plane is NEVER a hard dependency \u2014 offline stays fully functional; when it is off, unavailable, or a query errors (budget exhausted, org unreachable), the response fails soft to the disclosed static tiers with a `boundaries` line naming the missing evidence ('static-only verdict; live population not checked').",
+        description: "Optional `objectId` narrows the scan to one CustomObject \u2014 accepts the canonical id (`CustomObject:Account`) or a bare api name (`Account`), matched case-insensitively against the vault and echoed back as `appliedScope`; without it the scan is org-wide. An object name that matches nothing in the vault is refused with `invalid-query` rather than silently returning `{fields: [], totalCount: 0}`. Legacy `parentObjectFilter` (bare api name) is still accepted for back-compat. Scans every CustomField in scope with an eight-tier cross-walk before flagging it as unused: (1) zero incoming usage edges (excluding parentOf containment and grantedBy FLS grants \u2014 access is not usage), (2) no formula-text reference in another CustomField / ValidationRule / WorkflowRule, (3) no layout placement (layoutSections + relatedLists), (4) no SOQL-string match in an ApexClass / ApexTrigger source byproduct, (5) no apex-scanner unresolvedFieldReferences match, (6) no incoming LWC/Aura/VF `references` edge, (7) no ConditionalContext expression-text reference, (8) no `exposes` integration edge. Returns per-field checks, a per-tier invisibility warning list, a confidence tier (`high` for clean+custom+non-managed; `low` for standard/managed), and a recommendedAction. `limit` (default 100, max 500) caps the rows; because each carries the full eight-tier detail, a per-response ~36 KB byte budget trims the page further when it would exceed the global ~45 KB MCP response limit (`truncated` + a `note`), while `totalCount` / `byParentObject` / `byConfidence` keep the UNFILTERED counts; a truncated page returns a `nextCursor` to resume. Pass `format: 'csv'` (, default `'json'`) to get `csv` (this page's rows as CSV \u2014 the eight `checks.*` booleans flattened into `checks_*` columns, with the boundary + freshness disclosures embedded as `#`-prefixed comment lines) instead of `fields` (`fields` is `[]` on a csv page); `totalCount`/`byParentObject`/`byConfidence`/pagination fields are unchanged. Pass `format: 'cleanup'` (, the folded-in `field_cleanup_candidates` view) to additionally get a ranked `findings[]` roster (severity from each field's `confidence`, `summary` = `\"{id} \u2014 {recommendedAction}\"`) parallel to `fields`, plus a `disclosure` carrying the report/dashboard usage caveat (a report-only field reads as unused without `--with-reports`); findings + fields are trimmed TOGETHER to the ~36 KB budget with a `note`. Pass `format: 'proposal'` (Finding #35) to additionally get a `proposal` \u2014 a deploy-ready, LOCAL artifact: a populated `destructiveChanges.xml` bundle of THIS PAGE's `high`-confidence unused fields (+ an empty `package.xml`), each led by an evidence comment carrying per-field recommended actions, the boundary disclosures verbatim, the vault `sourceTreeHash`, and a REVIEW-before-deploy banner. `medium`/`low`-confidence and protected (standard/managed) fields are EXCLUDED from the delete set and their counts disclosed in the evidence; the bundle is capped at 200 members. sfi returns the file STRINGS only \u2014 it NEVER deploys, writes, or connects to the org; a human feeds the files to Gearset / Copado / `sf project deploy`. Validated against `docs/schemas/proposal.schema.json`. Honesty axis (verbatim): string-BUILT dynamic SOQL, LWC dynamic field access, Apex reflective access, and runtime metadata references remain invisible \u2014 inline static SOQL and constant-string Database.query field references ARE resolved (parsed-confidence Apex AST edges counted by tier 1, with the tier-4 soqlStrings text-match as backstop) \u2014 a 'high-confidence unused' flag means 'no static evidence of use', not 'definitely unused'. Fields the heuristic recognizer classifies pii/sensitive carry a machine-readable `piiClassification` field and a compliance escalation PREPENDED to `recommendedAction` (deletion may be irreversible / FERPA-GDPR-PCI-relevant, require data-retention sign-off). Heuristic \u2014 absence is NOT a clearance. Honesty axis (verbatim): string-BUILT dynamic SOQL, LWC dynamic field access, Apex reflective access, and runtime metadata references remain invisible \u2014 inline static SOQL and constant-string Database.query field references ARE resolved (parsed-confidence Apex AST edges counted by tier 1, with the tier-4 soqlStrings text-match as backstop) \u2014 a 'high-confidence unused' flag means 'no static evidence of use', not 'definitely unused'. Fields the heuristic recognizer classifies pii/sensitive carry a machine-readable `piiClassification` field and a compliance escalation PREPENDED to `recommendedAction` (deletion may be irreversible / FERPA-GDPR-PCI-relevant, require data-retention sign-off). Heuristic \u2014 absence is NOT a clearance. HYBRID: pass `liveEnabled: true` (or grant consent) to cross-check every `confidence: 'high'` field ON THE RETURNED PAGE against its live production population before trusting that tier \u2014 real data despite zero static references across all eight tiers may be written by dynamic Apex, an integration, or another blind spot the scanner cannot see. A `populatedCount > 0` DOWNGRADES that field's `confidence` from `high` to `medium` (the tier `medium` already means: no static evidence, but a blind spot could hide a reference) and attaches a `livePopulation` evidence block (`objectApiName`/`fieldApiName`/`totalCount`/`populatedCount`/`populationRate`/`liveQueriedAt`); a zero-population result leaves `high` standing but still attaches the evidence block, confirming the cross-check ran. Bounded to the page (never the full unfiltered scan) so live-query cost tracks `limit`, not `totalCount`, AND further capped to at most the first 3 high-confidence fields per page \u2014 a live wall-clock bound so a large consented org (hundreds of high-confidence unused fields) can never fire hundreds of serial live COUNTs and blow the MCP 60s client timeout; the remaining high-confidence fields keep their STATIC verdict and a `boundaries` line names the cap ('live population checked for the first N of M high-confidence fields on this page \u2026 raise the page or narrow the object to check the rest'). `byConfidence` / `totalCount` stay the STATIC pre-cross-check totals regardless (disclosed in `boundaries` when a downgrade occurs). The live plane is NEVER a hard dependency \u2014 offline stays fully functional; when it is off, unavailable, or a query errors (budget exhausted, org unreachable), the response fails soft to the disclosed static tiers with a `boundaries` line naming the missing evidence ('static-only verdict; live population not checked').",
         inputSchema: UNUSED_FIELDS_DEEP_INPUT_SCHEMA
       },
       {
@@ -57499,7 +57595,7 @@ var init_roster = __esm({
       },
       {
         name: "sfi.method_reachability",
-        description: 'Given an ApexClass / ApexTrigger (`classApiName` / `componentId` / `apiName` \u2014 a bare name or an `ApexClass:` / `ApexTrigger:` id, interchangeable, resolved + echoed as `appliedScope`), walks upstream USAGE-edge BFS (capped at depth 3) and classifies the reachable upstream set against the entry-point taxonomy: `ApexTrigger` (any), `ApexClass` with `properties.isRestResource === true` (REST), `properties.hasAuraEnabledMethod === true` (Aura), `properties.hasInvocableMethod === true` (Flow / Process Builder), any of `properties.isQueueable` / `properties.isBatchable` / `properties.isSchedulable` (async dispatch), the TARGET ITSELF carrying `properties.isTest === true` (`test-class` \u2014 the test runner is its entry point, so a test class is never dead code), or a `references` in-edge from a VisualforcePage / VisualforceComponent / Aura bundle (`ui-controller` \u2014 the `controller=` binding). Two further kinds cover components registered OUTSIDE Apex, where zero in-edges is expected rather than damning: `framework-subclass` (the class extends a base class in another namespace, so that package or the platform instantiates it) and `callable-dispatch` (it declares the `Callable` dynamic-invocation interface). Neither is PROVEN: each says the class was BUILT for external invocation, not that any wiring is live, and the wiring lives somewhere no edge can reach it. So their hits are floored at `heuristic` confidence, and when they are the ONLY entry points found the disclosure says the class is "not dead" rather than "proven reachable". The walk follows EVERY edge type except `parentOf` (structural containment) and `grantedBy` (a permission grant \u2014 access is not usage), so a class reached only by `dispatchesAsync` or a static-type `references` is no longer reported dead; `walkedEdgeTypes` echoes the traversed set on every response and each hit carries the WEAKEST per-edge `confidence` along its path plus the `viaEdgeTypes` it travelled. Verdict cascade: `entry-point-reachable` (at least one entry point reaches the target), else `test-only-reachable` (at least one test class reaches it), else `likely-dead-code` (neither). Honesty axis (verbatim): dynamic dispatch (Type.forName) and reflective invocation are invisible \u2014 a class genuinely invoked at runtime via reflection will surface as `likely-dead-code`. Trigger framework base classes (TriggerHandler, fflib) may be partially invisible. Invalid prefix surfaces as `invalid-query`; unknown target surfaces as `component-not-found`. A residual `likely-dead-code` verdict appends a pointer to `sfi.find_dead_code`, which additionally greps production source for static-field and type-name usages this walk cannot see. Carries a `soundness` envelope DERIVED from the walk: `complete: false` with a `dynamic-apex` blind spot when any class ON A REACH PATH uses dynamic Apex (a reflective CALLER is what makes the verdict wrong, and the caller is not the root), and an `unwalked-edge-type` blind spot if the walk ever covers less than the full usage set.',
+        description: 'Given an ApexClass / ApexTrigger (`classApiName` / `componentId` / `apiName` \u2014 a bare name or an `ApexClass:` / `ApexTrigger:` id, interchangeable, resolved + echoed as `appliedScope`), walks upstream USAGE-edge BFS (capped at depth 3) and classifies the reachable upstream set against the entry-point taxonomy: `ApexTrigger` (any), `ApexClass` with `properties.isRestResource === true` (REST), `properties.hasAuraEnabledMethod === true` (Aura), `properties.hasInvocableMethod === true` (Flow / Process Builder), any of `properties.isQueueable` / `properties.isBatchable` / `properties.isSchedulable` (async dispatch), the TARGET ITSELF carrying `properties.isTest === true` (`test-class` \u2014 the test runner is its entry point, so a test class is never dead code), or a `references` in-edge from a VisualforcePage / VisualforceComponent / Aura bundle (`ui-controller` \u2014 the `controller=` binding). Three further kinds cover components registered OUTSIDE Apex, where zero in-edges is expected rather than damning: `framework-subclass` (the class extends a base class in another namespace, so that package or the platform instantiates it), `namespaced-interface` (it implements an interface qualified by another namespace, e.g. an AuthProvider\'s `Auth.RegistrationHandler` \u2014 the platform names the implementing class by type), and `callable-dispatch` (it declares the `Callable` dynamic-invocation interface). None of the three is PROVEN: each says the class was BUILT for external invocation, not that any wiring is live, and the wiring lives somewhere no edge can reach it. So their hits are floored at `heuristic` confidence, and when they are the ONLY entry points found the disclosure says the class is "not dead" rather than "proven reachable". The walk follows EVERY edge type except `parentOf` (structural containment) and `grantedBy` (a permission grant \u2014 access is not usage), so a class reached only by `dispatchesAsync` or a static-type `references` is no longer reported dead; `walkedEdgeTypes` echoes the traversed set on every response and each hit carries the WEAKEST per-edge `confidence` along its path plus the `viaEdgeTypes` it travelled. Verdict cascade: `entry-point-reachable` (at least one entry point reaches the target), else `test-only-reachable` (at least one test class reaches it), else `likely-dead-code` (neither). Honesty axis (verbatim): dynamic dispatch (Type.forName) and reflective invocation are invisible \u2014 a class genuinely invoked at runtime via reflection will surface as `likely-dead-code`. Trigger framework base classes (TriggerHandler, fflib) may be partially invisible. Invalid prefix surfaces as `invalid-query`; unknown target surfaces as `component-not-found`. A residual `likely-dead-code` verdict appends a pointer to `sfi.find_dead_code`, which additionally greps production source for static-field and type-name usages this walk cannot see. Carries a `soundness` envelope DERIVED from the walk: `complete: false` with a `dynamic-apex` blind spot when any class ON A REACH PATH uses dynamic Apex (a reflective CALLER is what makes the verdict wrong, and the caller is not the root), and an `unwalked-edge-type` blind spot if the walk ever covers less than the full usage set.',
         inputSchema: METHOD_REACHABILITY_INPUT_SCHEMA
       },
       {
@@ -57591,7 +57687,7 @@ var init_roster = __esm({
       },
       {
         name: "sfi.find_dead_code",
-        description: "Cross-cutting dead-code surface \u2014 composes `method_reachability` verdict, entry-point taxonomy (REST / Aura / Invocable / Queueable / Batchable / Schedulable / triggers), and zero-usage detection into a single cascade verdict per candidate: `definitely_dead` (zero incoming USAGE edges and not own entry point), `likely_dead` (test-class-only reach), `uncertain` (entry-point reach or own entry point). A Flow is its OWN entry point unless its status is Obsolete/InvalidDraft (R2-12): an Active, Draft, or unknown-status Flow is `uncertain` (never definitely_dead/likely_dead), because Flow edges are all OUTGOING so a live flow has ~0 incoming edges by nature \u2014 flagging it dead would delete running automation; only Obsolete/InvalidDraft flows fall through to definitely_dead. : subflow invocation (flow-calls-flow) IS now modeled as an incoming `references` edge, so an Obsolete/InvalidDraft flow still invoked as a subflow by another flow reads `uncertain` (it has a live dependent) instead of definitely_dead \u2014 delete the referencing flow first. `parentOf` (structural) and `grantedBy` (Profile / PermissionSet access grants) edges are excluded \u2014 access is not usage, so a class nobody calls or a field nothing references is dead even when profiles grant access to it. Scope to ONE component with `componentId` (`ApexClass:`/`ApexTrigger:`/`Flow:`/`CustomField:` id) \u2014 or a bare class name via `classApiName`/`apiName` \u2014 to get just that node's verdict (`uncertain` included) + `appliedScope`; an unresolved id is `component-not-found`, a non-dead-code prefix is `invalid-query`, never a silent org-wide top-N. Default `types` covers ApexClass / ApexTrigger / Flow / CustomField. `includeUncertain` (default false) suppresses the noisy uncertain bucket. Test classes (properties.isTest === true) are NEVER flagged as dead \u2014 they ARE entry points for the test-runner. Returns `byVerdict` and `byType` tallies across the FULL classified set \u2014 INCLUDING the rows `includeUncertain: false` withholds from `candidates` \u2014 while `totalCount` counts only what is LISTED; the always-present `suppressed` block reports `includeUncertain`, how many `uncertain` rows were withheld (`uncertainWithheld`, a CHECKED 0 when none were), and states that relationship in words, so a short list is never mistakable for a clean scan. Truncated slice flips `truncated: true` and a truncated page returns a `nextCursor` to resume. Honesty axis (verbatim): dynamic dispatch, reflective invocation, framework wiring (TriggerHandler / fflib), and managed-package callers are invisible to the graph edges this tool walks. Carries a `soundness` envelope: `complete: false` with a `dynamic-apex` blind spot when a candidate class uses dynamic Apex \u2014 a class reached only reflectively will read as dead \u2014 so a `dead` verdict on a flagged class needs a human check before deletion. When any CALLER family (LWC, Aura, Flows, FlexiPages, Visualforce, \u2026) has incomplete coverage \u2014 errored retrieve, scoped refresh, or an in-progress staged build \u2014 the response adds a `coverageCaveat` naming the families: an un-retrieved caller would fake death. DYNAMIC REGISTRATION is separated from death: a class that extends a base class in ANOTHER namespace (managed-package and platform frameworks instantiate their own subclasses), that declares the `Callable` interface, or that implements `Queueable` / `Database.Batchable` / `Schedulable` is registered OUTSIDE the metadata a vault holds \u2014 in a string literal, a Custom Metadata record, package code, anonymous Apex, or a `CronTrigger` record written by Setup > Schedule Apex. `CronTrigger` is DATA, not metadata: it is never retrieved, mints no node and no edge, and NO refresh can close that gap. So such a class has ZERO incoming edges by construction, and an absent dispatch site is the EXPECTED reading for a live scheduled job rather than evidence against it. All of them are reported `uncertain`, never `definitely_dead` and never `likely_dead`. They are not proven live either, so confirm the registration \u2014 Setup > Scheduled Jobs / Apex Jobs for an async class \u2014 before deleting.",
+        description: "Cross-cutting dead-code surface \u2014 composes `method_reachability` verdict, entry-point taxonomy (REST / Aura / Invocable / Queueable / Batchable / Schedulable / triggers), and zero-usage detection into a single cascade verdict per candidate: `definitely_dead` (zero incoming USAGE edges and not own entry point), `likely_dead` (test-class-only reach), `uncertain` (entry-point reach or own entry point). A Flow is its OWN entry point unless its status is Obsolete/InvalidDraft (R2-12): an Active, Draft, or unknown-status Flow is `uncertain` (never definitely_dead/likely_dead), because Flow edges are all OUTGOING so a live flow has ~0 incoming edges by nature \u2014 flagging it dead would delete running automation; only Obsolete/InvalidDraft flows fall through to definitely_dead. : subflow invocation (flow-calls-flow) IS now modeled as an incoming `references` edge, so an Obsolete/InvalidDraft flow still invoked as a subflow by another flow reads `uncertain` (it has a live dependent) instead of definitely_dead \u2014 delete the referencing flow first. `parentOf` (structural) and `grantedBy` (Profile / PermissionSet access grants) edges are excluded \u2014 access is not usage, so a class nobody calls or a field nothing references is dead even when profiles grant access to it. Scope to ONE component with `componentId` (`ApexClass:`/`ApexTrigger:`/`Flow:`/`CustomField:` id) \u2014 or a bare class name via `classApiName`/`apiName` \u2014 to get just that node's verdict (`uncertain` included) + `appliedScope`; an unresolved id is `component-not-found`, a non-dead-code prefix is `invalid-query`, never a silent org-wide top-N. Default `types` covers ApexClass / ApexTrigger / Flow / CustomField. `includeUncertain` (default false) suppresses the noisy uncertain bucket. Test classes (properties.isTest === true) are NEVER flagged as dead \u2014 they ARE entry points for the test-runner. Returns `byVerdict` and `byType` tallies across the FULL classified set \u2014 INCLUDING the rows `includeUncertain: false` withholds from `candidates` \u2014 while `totalCount` counts only what is LISTED; the always-present `suppressed` block reports `includeUncertain`, how many `uncertain` rows were withheld (`uncertainWithheld`, a CHECKED 0 when none were), and states that relationship in words, so a short list is never mistakable for a clean scan. Truncated slice flips `truncated: true` and a truncated page returns a `nextCursor` to resume. Honesty axis (verbatim): dynamic dispatch, reflective invocation, framework wiring (TriggerHandler / fflib), and managed-package callers are invisible to the graph edges this tool walks. Carries a `soundness` envelope: `complete: false` with a `dynamic-apex` blind spot when a candidate class uses dynamic Apex \u2014 a class reached only reflectively will read as dead \u2014 so a `dead` verdict on a flagged class needs a human check before deletion. When any CALLER family (LWC, Aura, Flows, FlexiPages, Visualforce, \u2026) has incomplete coverage \u2014 errored retrieve, scoped refresh, or an in-progress staged build \u2014 the response adds a `coverageCaveat` naming the families: an un-retrieved caller would fake death. DYNAMIC REGISTRATION is separated from death: a class that extends a base class in ANOTHER namespace (managed-package and platform frameworks instantiate their own subclasses), that implements an interface qualified by another namespace (e.g. an AuthProvider's `Auth.RegistrationHandler`), that declares the `Callable` interface, or that implements `Queueable` / `Database.Batchable` / `Schedulable` is registered OUTSIDE the metadata a vault holds \u2014 in a string literal, a Custom Metadata record, package code, anonymous Apex, or a `CronTrigger` record written by Setup > Schedule Apex. `CronTrigger` is DATA, not metadata: it is never retrieved, mints no node and no edge, and NO refresh can close that gap. So such a class has ZERO incoming edges by construction, and an absent dispatch site is the EXPECTED reading for a live scheduled job rather than evidence against it. All of them are reported `uncertain`, never `definitely_dead` and never `likely_dead`. They are not proven live either, so confirm the registration \u2014 Setup > Scheduled Jobs / Apex Jobs for an async class \u2014 before deleting.",
         inputSchema: FIND_DEAD_CODE_INPUT_SCHEMA
       },
       {
@@ -59162,7 +59258,7 @@ var init_order_of_execution = __esm({
 
 // ../mcp/dist/src/tools/what-happens-on-save.js
 import { z as z8 } from "zod";
-var DISCLOSURE2, ALLOWED_EVENTS, WHAT_HAPPENS_ON_SAVE_ACCEPTED_KEYS, strictKeyErrorMap2, whatHappensOnSaveInputSchema, ENTITLEMENT_PROCESS_NOTE_CAP, PHASE_FILTER_CONCEPT_REASONING_OFF_NOTE, POST_ENFORCEMENT_DISCLOSURE_HEADROOM_BYTES, CONCEPT_REASONING_MIN_HEADROOM_BYTES, CONCEPT_REASONING_NO_HEADROOM_NOTE, computeFilteredPhaseOmission, workflowMatchesEvent2, flowMatchesEvent2, triggerMatchesEvent2, surfaceFirstCondition2, buildActions2, buildStep2, fetchParentedFirers2, fetchTriggersOnFirers2, buildAsyncSteps2, ASSIGNMENT_TYPES2, APPROVAL_TYPES2, VALIDATION_TYPES2, FLOW_TYPES2, TRIGGER_TYPES2, WORKFLOW_TYPES2, whatHappensOnSaveHandler;
+var DISCLOSURE2, ALLOWED_EVENTS, WHAT_HAPPENS_ON_SAVE_ACCEPTED_KEYS, strictKeyErrorMap2, whatHappensOnSaveInputSchema, ENTITLEMENT_PROCESS_NOTE_CAP, PHASE_FILTER_CONCEPT_REASONING_OFF_NOTE, POST_ENFORCEMENT_DISCLOSURE_HEADROOM_BYTES, CONCEPT_REASONING_MIN_HEADROOM_BYTES, CONCEPT_REASONING_NO_HEADROOM_NOTE, workflowMatchesEvent2, flowMatchesEvent2, triggerMatchesEvent2, surfaceFirstCondition2, buildActions2, buildStep2, fetchParentedFirers2, fetchTriggersOnFirers2, buildAsyncSteps2, ASSIGNMENT_TYPES2, APPROVAL_TYPES2, VALIDATION_TYPES2, FLOW_TYPES2, TRIGGER_TYPES2, WORKFLOW_TYPES2, whatHappensOnSaveHandler;
 var init_what_happens_on_save = __esm({
   "../mcp/dist/src/tools/what-happens-on-save.js"() {
     "use strict";
@@ -59246,12 +59342,6 @@ var init_what_happens_on_save = __esm({
     POST_ENFORCEMENT_DISCLOSURE_HEADROOM_BYTES = 2e3;
     CONCEPT_REASONING_MIN_HEADROOM_BYTES = 2500;
     CONCEPT_REASONING_NO_HEADROOM_NOTE = (headroom) => `Concept reasoning was NOT attached to this response: the order-of-execution steps are fitted FIRST and left ${headroom} byte(s) of the response budget, below what a reasoning block needs. The steps are the answer, so they keep the budget. No concept layer was checked here \u2014 that is "not checked", not "nothing found". Re-query one \`phase\` at a time for a narrower response with room for it.`;
-    computeFilteredPhaseOmission = (phaseCounts, phase, presentCount) => {
-      const declared = phaseCounts[phase];
-      if (presentCount >= declared)
-        return null;
-      return { phase, declared, present: presentCount };
-    };
     workflowMatchesEvent2 = (triggerType, event) => {
       if (typeof triggerType !== "string")
         return false;
@@ -59832,8 +59922,8 @@ var init_what_happens_on_save = __esm({
           data.disclosure = `${data.disclosure} ${crossPhaseShortfallNote(phasesOmitted)}`;
         }
       } else {
-        const omission = computeFilteredPhaseOmission(phaseCounts, input2.phase, data.soe.length);
-        if (omission !== null) {
+        const [omission] = computePhasesOmitted(phaseCounts, data.soe, input2.phase);
+        if (omission !== void 0) {
           data.phasesOmitted = [omission];
           data.truncated = true;
           data.disclosure = `${data.disclosure} ${filteredPhaseShortfallNote(omission)}`;
@@ -71243,10 +71333,14 @@ var init_coverage_report = __esm({
     partitionCoverage = (entries, unparsed) => {
       const isRetrievedNotParsed = (entry) => unparsed.has(entry.type) && entry.requested && entry.retrieved === 0 && entry.retrieveConfirmed === true && !entry.errored && !entry.neverModeled && entry.pending !== true;
       return {
-        covered: entries.filter((entry) => entry.requested && (entry.retrieved > 0 || entry.retrieveConfirmed === true) && !entry.errored && !entry.neverModeled && entry.pending !== true && !isRetrievedNotParsed(entry)),
-        partial: entries.filter((entry) => entry.requested && (entry.retrieved === 0 && entry.retrieveConfirmed !== true || entry.errored) && !entry.neverModeled && entry.pending !== true),
+        covered: entries.filter((entry) => entry.requested && (entry.retrieved > 0 || entry.retrieveConfirmed === true) && !entry.errored && !entry.neverModeled && entry.pending !== true && entry.capped !== true && !isRetrievedNotParsed(entry)),
+        partial: entries.filter((entry) => entry.requested && (entry.retrieved === 0 && entry.retrieveConfirmed !== true || entry.errored) && !entry.neverModeled && entry.pending !== true && entry.capped !== true),
         notModeled: entries.filter((entry) => entry.neverModeled),
         pending: entries.filter((entry) => entry.pending === true && !entry.neverModeled),
+        // FIX-2: `pending` wins when a row somehow carries both (mirrors the
+        // existing pending-over-retrieveConfirmed precedent) — "not yet attempted
+        // at all" is the stronger, more conservative claim.
+        capped: entries.filter((entry) => entry.capped === true && entry.pending !== true && !entry.neverModeled),
         retrievedNotParsed: entries.filter(isRetrievedNotParsed)
       };
     };
@@ -79131,11 +79225,11 @@ ${body}
       const comment = renderEvidenceComment("destructive", componentIds, evidence);
       const destructive = buildDestructiveChanges(componentIds, comment);
       const packageXml = buildEmptyPackageXml(apiVersion, comment);
-      const headline = options?.headline ?? `Proposes deletion of ${destructive.grouping.memberCount} component(s) via destructiveChanges.xml (verdict: ${evidence.verdict}).`;
+      const headline2 = options?.headline ?? `Proposes deletion of ${destructive.grouping.memberCount} component(s) via destructiveChanges.xml (verdict: ${evidence.verdict}).`;
       return {
         schemaVersion: PROPOSAL_SCHEMA_VERSION,
         kind: "destructive",
-        headline,
+        headline: headline2,
         files: [
           { path: "destructiveChanges.xml", contents: destructive.xml },
           { path: "package.xml", contents: packageXml }
@@ -79158,11 +79252,11 @@ ${body}
 `, `${XML_PROLOG}
 ${comment}
 `);
-      const headline = options?.headline ?? `Proposes a package.xml deploy of ${manifest.summary.memberCount} component(s) (verdict: ${evidence.verdict}).`;
+      const headline2 = options?.headline ?? `Proposes a package.xml deploy of ${manifest.summary.memberCount} component(s) (verdict: ${evidence.verdict}).`;
       return {
         schemaVersion: PROPOSAL_SCHEMA_VERSION,
         kind: "deploy",
-        headline,
+        headline: headline2,
         files: [{ path: "package.xml", contents: packageXml }],
         summary: {
           kind: "deploy",
@@ -83175,7 +83269,7 @@ var init_search_apex_source = __esm({
 
 // ../mcp/dist/src/tools/find-component-usages.js
 import { z as z74 } from "zod";
-var NON_USAGE_EDGE_TYPES2, GREP_RELIANT_PREFIXES, GRAPH_REFERRER_SAMPLE, GREP_LIMIT_DEFAULT, FRONTEND_SUFFIXES, FRONTEND_DIR_RE, TYPE_EMPTY_NOTES, findComponentUsagesInputSchema, typeOf, apiNameOf, findComponentUsagesHandler;
+var NON_USAGE_EDGE_TYPES2, GREP_RELIANT_PREFIXES, GRAPH_REFERRER_SAMPLE, GREP_LIMIT_DEFAULT, FRONTEND_SUFFIXES, FRONTEND_DIR_RE, TYPE_EMPTY_NOTES, findComponentUsagesInputSchema, typeOf, apiNameOf, isSelfMatch, findComponentUsagesHandler;
 var init_find_component_usages = __esm({
   "../mcp/dist/src/tools/find-component-usages.js"() {
     "use strict";
@@ -83217,6 +83311,14 @@ var init_find_component_usages = __esm({
       const i = id.indexOf(":");
       return i > 0 ? id.slice(i + 1) : id;
     };
+    isSelfMatch = (matchPath, ownSourcePath) => {
+      if (matchPath === ownSourcePath)
+        return true;
+      if (!FRONTEND_DIR_RE.test(ownSourcePath))
+        return false;
+      const ownDir = ownSourcePath.slice(0, ownSourcePath.lastIndexOf("/") + 1);
+      return ownDir.length > 0 && matchPath.startsWith(ownDir);
+    };
     findComponentUsagesHandler = async (ctx, input2) => {
       const componentId = input2.componentId;
       if (!componentId.includes(":")) {
@@ -83292,6 +83394,12 @@ var init_find_component_usages = __esm({
           }
         }
       }
+      let selfMatchesExcluded = 0;
+      if (node !== null) {
+        const before = grepMatches.length;
+        grepMatches = grepMatches.filter((m) => !isSelfMatch(m.path, node.sourcePath));
+        selfMatchesExcluded = before - grepMatches.length;
+      }
       const hasStaticEvidence = graphReferrerCount > 0 || grepMatches.length > 0;
       const surfaceGrants = targetType === "CustomPermission" || usageEdges.length === 0 && grantEdges.length > 0;
       let grantedBySection;
@@ -83314,6 +83422,9 @@ var init_find_component_usages = __esm({
         `\`graphReferrerCount\` and each group's \`count\` are EDGE counts, not component counts: one referrer contributes one edge per relationship it has to the target (a Flow that reads, writes AND triggers on an object counts 3). ${graphReferrerCount} edge(s) here come from ${distinctReferrerCount} distinct component(s) \u2014 quote \`distinctReferrerCount\` / \`distinctReferrers\` to a human, and note the 25-row \`sample\` cap is on ROWS, so a group with multi-edge referrers shows fewer than 25 distinct components.`,
         "The grep supplement is a literal text match on the api name across Apex AND frontend bundle source \u2014 LWC, Aura, Visualforce ($Label / $Resource / @salesforce module references) \u2014 (`text-match` tier): it can OVER-match (a substring / a different component sharing the name) and UNDER-match (dynamically built references). Treat it as leads, not proof."
       ];
+      if (selfMatchesExcluded > 0) {
+        boundaries.push(`${selfMatchesExcluded} grep match(es) were this component's OWN definition (its declaring file${FRONTEND_DIR_RE.test(node?.sourcePath ?? "") ? " / bundle directory" : ""}) and were EXCLUDED before \`grepMatchCount\` \u2014 a component's own declaration matching its own name is not evidence anything ELSE uses it. ${grepMatches.length === 0 ? "After exclusion, grep found NO other reference." : `After exclusion, ${grepMatches.length} genuine external match(es) remain.`}`);
+      }
       const coverageCaveat = !hasStaticEvidence ? buildEmptyTraversalCoverageCaveat(ctx, GRAPH_TRAVERSAL_REQUIRED_COVERAGE) : void 0;
       if (!hasStaticEvidence) {
         boundaries.push("No static evidence of usage found in this vault \u2014 this is NOT proof that nothing uses it. Dynamic SOQL / reflective access, references from un-modeled families (reports, dashboards, list-view filters, custom-metadata-driven config), and managed packages are invisible to static analysis.");
@@ -83343,7 +83454,8 @@ var init_find_component_usages = __esm({
             query: grepRan ? targetApiName : null,
             matchCount: grepMatches.length,
             matches: grepMatches,
-            truncated: grepTruncated
+            truncated: grepTruncated,
+            selfMatchesExcluded
           },
           summary: {
             graphReferrerCount,
@@ -83487,6 +83599,7 @@ var init_find_dead_code = __esm({
                type = 'ApexClass' AND (
                  COALESCE(json_extract_string(properties_json, '$.superclass') LIKE '%.%', FALSE)
                  OR COALESCE(json_extract_string(properties_json, '$.implements') LIKE '%"${CALLABLE_INTERFACE}"%', FALSE)
+                 OR COALESCE(json_extract_string(properties_json, '$.implements') LIKE '%.%', FALSE)
 ${ASYNC_DISPATCH_PROPERTY_KEYS.map((k) => `                 OR COALESCE(json_extract_string(properties_json, '$.${k}') = 'true', FALSE)`).join("\n")}
                ),
                FALSE)`;
@@ -83517,14 +83630,16 @@ ${ASYNC_DISPATCH_PROPERTY_KEYS.map((k) => `                 OR COALESCE(json_ext
                      OR COALESCE(json_extract_string(properties_json, '$.hasInvocableMethod') = 'true', FALSE)
                    )),
                FALSE) AS is_own_entry_point,
-             -- UNPROVEN dynamic registration. Same two predicates as
-             -- isFrameworkSubclass / isCallableDispatch in apex-reachability.ts,
-             -- expressed in SQL because this tool's cascade is a single CTE (a
-             -- measured ~7x speedup that is not worth losing). A behavioural
-             -- drift test runs both over the same fixture and asserts they agree.
-             -- A dotted superclass means the base class lives in ANOTHER
-             -- namespace, so its owner instantiates the subclass and no local
-             -- callsApex edge can exist.
+             -- UNPROVEN dynamic registration. Same predicates as
+             -- isFrameworkSubclass / isNamespacedInterfaceImplementation /
+             -- isCallableDispatch in apex-reachability.ts, expressed in SQL
+             -- because this tool's cascade is a single CTE (a measured ~7x
+             -- speedup that is not worth losing). A behavioural drift test
+             -- runs both over the same fixture and asserts they agree.
+             -- A dotted superclass OR a dotted implemented-interface name
+             -- means the base type lives in ANOTHER namespace, so its owner
+             -- instantiates/dispatches the class and no local callsApex edge
+             -- can exist.
 ${UNPROVEN_REGISTRATION_SQL} AS is_unproven_registration,
              -- Async-dispatch entry point: Queueable / Batchable / Schedulable.
              -- Dispatched by user Apex (enqueueJob / executeBatch / schedule), so
@@ -83652,7 +83767,7 @@ ${NON_USAGE_EDGE_EXCLUSION_SQL}
     };
     escapeForRegex2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     sourceFileApiName = (vaultRelativePath) => {
-      const base = vaultRelativePath.split("/").pop() ?? vaultRelativePath;
+      const base = splitPathSegments(vaultRelativePath).at(-1) ?? vaultRelativePath;
       return base.replace(/\.(cls|trigger)$/i, "");
     };
     fetchTestClassApiNames = async (store) => {
@@ -83742,7 +83857,7 @@ ${NON_USAGE_EDGE_EXCLUSION_SQL}
           reasoning = ownEntryPoint ? "component is its own entry point (REST/Aura/Invocable or trigger); platform invokes it" : "reached by an entry-point class (REST resource / AuraEnabled / InvocableMethod / async-dispatch)";
         } else if (row.is_unproven_registration) {
           verdict = "uncertain";
-          reasoning = "class is BUILT for dynamic registration \u2014 it extends a base class from another namespace (a managed package or platform framework instantiates its own subclasses) or declares the Callable dynamic-invocation interface. The registration itself lives in a string literal, a Custom Metadata record, or managed-package code and mints no edge, so zero incoming edges is EXPECTED here and is not evidence of death. Not proven live either \u2014 confirm the registration in the org before deleting.";
+          reasoning = "class is BUILT for dynamic registration \u2014 it extends a base class from another namespace (a managed package or platform framework instantiates its own subclasses), implements an interface qualified by another namespace (e.g. an AuthProvider's Auth.RegistrationHandler), or declares the Callable dynamic-invocation interface. The registration itself lives in a string literal, a Custom Metadata record, or managed-package code and mints no edge, so zero incoming edges is EXPECTED here and is not evidence of death. Not proven live either \u2014 confirm the registration in the org before deleting.";
         } else if (incomingCount === 0) {
           verdict = "definitely_dead";
           reasoning = "no incoming non-parentOf edges; no callers, no triggers, no listeners visible to the graph";
@@ -84567,6 +84682,7 @@ var init_find_hardcoded_values_anywhere = __esm({
   "../mcp/dist/src/tools/find-hardcoded-values-anywhere.js"() {
     "use strict";
     init_src();
+    init_src4();
     init_src3();
     init_input_aliases();
     init_page_cursor();
@@ -84576,7 +84692,7 @@ var init_find_hardcoded_values_anywhere = __esm({
     MAX_LIMIT12 = 500;
     DEFAULT_LIMIT12 = 100;
     FIND_HARDCODED_ANYWHERE_TOOL = "sfi.find_hardcoded_values_anywhere";
-    SALESFORCE_ID_REGEX = /\b0[0-9a-zA-Z]{14}([0-9a-zA-Z]{3})?\b/g;
+    SALESFORCE_ID_REGEX = /\b[0-9a-zA-Z]{15}([0-9a-zA-Z]{3})?\b/g;
     EMAIL_REGEX = /\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\b/g;
     DATE_REGEX = /\b(\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2}(\.\d{3})?(Z|[+-]\d{2}:\d{2})?)?|\d{1,2}\/\d{1,2}\/\d{4}|\d{1,2}\.\d{1,2}\.\d{4}|\d{4}\/\d{2}\/\d{2})\b/g;
     NUMERIC_REGEX = /\b\d+(\.\d+)?\b/g;
@@ -84634,7 +84750,7 @@ var init_find_hardcoded_values_anywhere = __esm({
       return hits;
     };
     NUMERIC_FP_DISCLOSURE = "the numeric category has very high false-positive rate \u2014 loop counters, array indices, and arithmetic constants all match. The category is suppressed from default searches; opt in explicitly only when looking for specific hardcoded numbers.";
-    ID_FP_DISCLOSURE = "the ID-shape search matches Salesforce-id-shaped strings filtered to a known-key-prefix allowlist (~40 prefixes). Arbitrary 15-character alphanumeric strings outside the allowlist are not returned. Strings shaped like an ID that aren't actually IDs (e.g., session keys, hashes) may still match if they happen to start with a known key prefix.";
+    ID_FP_DISCLOSURE = `the ID-shape search matches 15- or 18-character alphanumeric strings filtered to a known-key-prefix allowlist (${KNOWN_KEY_PREFIXES.size} prefixes), the same allowlist the Apex-side hardcoded-id recognizer applies. Arbitrary alphanumeric strings outside the allowlist are not returned. Strings shaped like an ID that aren't actually IDs (e.g., session keys, hashes) may still match if they happen to start with a known key prefix. An id whose object's key prefix is not in that list is NOT reported \u2014 the list covers the standard objects and the custom-object range, not every prefix Salesforce issues.`;
     TEST_CLASS_REFUSAL_DISCLOSURE = "matches in `@isTest`-annotated classes may be intentional test fixtures rather than production hardcoded values; verify the context before treating as a bug.";
     APEX_SOURCE_EMAIL_SCAN_DISCLOSURE = "For the email category, Apex source files were also scanned directly (CR-07 fallback) to catch addresses in classes updated after the last vault refresh. Source-scan matches are comment-stripped but not string-boundary-isolated \u2014 email-shaped tokens in @param JavaDoc or string-concatenation expressions may surface as false positives. Confidence: heuristic.";
     findHardcodedValuesAnywhereInputBaseSchema = z79.object({
@@ -84716,6 +84832,11 @@ var init_find_hardcoded_values_anywhere = __esm({
       const regex = new RegExp(regexForCategory(category).source, "g");
       let m;
       while ((m = regex.exec(text)) !== null) {
+        if (category === "id" && !isKnownSalesforceIdLiteral(m[0])) {
+          if (m.index === regex.lastIndex)
+            regex.lastIndex += 1;
+          continue;
+        }
         hits.push({
           value: m[0],
           index: m.index,
@@ -92068,10 +92189,14 @@ ${rendered.value.body}
       const colonIdx = parentId.indexOf(":");
       return colonIdx >= 0 ? parentId.substring(colonIdx + 1) : null;
     };
-    toRelativePath = (vaultRoot, fullPath) => {
-      const prefix = vaultRoot.endsWith("/") ? vaultRoot : `${vaultRoot}/`;
-      return fullPath.startsWith(prefix) ? fullPath.substring(prefix.length) : fullPath;
-    };
+    toRelativePath = (vaultRoot, fullPath) => (
+      // `fullPath` is `join()`-built, so on Windows it is backslash-separated while
+      // the hand-rolled prefix ended in `/` — the strip never fired and the wire
+      // field carried an ABSOLUTE native path where the contract above promises a
+      // vault-relative one. `toRelativePosix` also renders the separator, so this
+      // field and `component-doc-fallback`'s no longer disagree on Windows.
+      toRelativePosix(vaultRoot, fullPath)
+    );
     splitFrontmatter2 = (raw) => {
       if (!raw.startsWith("---\n"))
         return null;
@@ -111166,7 +111291,7 @@ var init_unused_components = __esm({
 
 // ../mcp/dist/src/tools/unused-fields-deep.js
 import { z as z152 } from "zod";
-var UNUSED_FIELDS_DEEP_TOOL, PROPOSAL_REPORT_EXCLUSION_EVIDENCE_CAP, UNUSED_FIELDS_DEEP_REQUIRED_COVERAGE, completenessForUnusedFieldsDeep, UNUSED_FIELDS_DEEP_MAX_LIMIT, UNUSED_FIELDS_DEEP_DEFAULT_LIMIT, UNUSED_FIELDS_DEEP_BYTE_BUDGET, PAGE_CAP5, pageSize5, LIVE_CROSS_CHECK_CAP, FRONTEND_REFERENCE_TYPES, INVISIBILITY_WARNINGS, BOUNDARIES13, unusedFieldsDeepInputSchema, propertyString4, propertyStringArray2, workflowConditionsText, layoutSectionFields, relatedListFields, buildCorpora, buildLoweredCorpora, checkNoIncomingEdgesFromEdges, checkNoFormulaTextReferences, checkNoLayoutReferences, checkNoSoqlStringReferences, checkNoUnresolvedApexReferences, checkNoLwcAuraVfReferencesFromEdges, checkNoConditionalContextReferences, checkNoIntegrationExposureFromEdges, parseParentApiName2, fieldTypeOf2, isCustomField4, namespacePrefixOf4, computeConfidence, PII_DELETION_ESCALATION, recommendedActionFor, compareById5, UNUSED_FIELDS_DEEP_CSV_HEADER, csvRowForUnusedField, resolveParentObjectFilter, CLEANUP_SYNTHESIS_DISCLOSURE, CLEANUP_SEVERITY_RANK, toCleanupFinding, sortCleanupFindings, PROPOSAL_MAX_COMPONENTS, buildUnusedFieldsProposal, unusedFieldsDeepHandler;
+var UNUSED_FIELDS_DEEP_TOOL, PROPOSAL_REPORT_EXCLUSION_EVIDENCE_CAP, UNUSED_FIELDS_DEEP_REQUIRED_COVERAGE, completenessForUnusedFieldsDeep, UNUSED_FIELDS_DEEP_MAX_LIMIT, UNUSED_FIELDS_DEEP_DEFAULT_LIMIT, UNUSED_FIELDS_DEEP_BYTE_BUDGET, PAGE_CAP5, pageSize5, LIVE_CROSS_CHECK_CAP, FRONTEND_REFERENCE_TYPES, INVISIBILITY_WARNINGS, BOUNDARIES13, unusedFieldsDeepInputSchema, propertyString4, propertyStringArray2, workflowConditionsText, layoutSectionFields, relatedListFields, buildCorpora, buildLoweredCorpora, checkNoIncomingEdgesFromEdges, checkNoFormulaTextReferences, checkNoLayoutReferences, checkNoSoqlStringReferences, checkNoUnresolvedApexReferences, checkNoLwcAuraVfReferencesFromEdges, checkNoConditionalContextReferences, checkNoIntegrationExposureFromEdges, parseParentApiName2, fieldTypeOf2, isCustomField4, namespacePrefixOf4, computeConfidence, PII_DELETION_ESCALATION, recommendedActionFor, compareById5, UNUSED_FIELDS_DEEP_CSV_HEADER, csvRowForUnusedField, CLEANUP_SYNTHESIS_DISCLOSURE, CLEANUP_SEVERITY_RANK, toCleanupFinding, sortCleanupFindings, PROPOSAL_MAX_COMPONENTS, buildUnusedFieldsProposal, unusedFieldsDeepHandler;
 var init_unused_fields_deep = __esm({
   "../mcp/dist/src/tools/unused-fields-deep.js"() {
     "use strict";
@@ -111175,8 +111300,8 @@ var init_unused_fields_deep = __esm({
     init_src4();
     init_src8();
     init_src3();
-    init_coerce_id();
     init_coverage_trust();
+    init_input_aliases();
     init_live_plane();
     init_live_population_check();
     init_page_cursor();
@@ -111235,8 +111360,11 @@ var init_unused_fields_deep = __esm({
       /**
        * Optional filter: restrict the scan to fields on a single object.
        * Accepts either the canonical CustomObject id (`CustomObject:Account`) or
-       * a bare object api name (`Account`). When supplied the scan returns only
-       * fields whose parent object matches; without it the scan is org-wide.
+       * a bare object api name (`Account`), matched case-insensitively against
+       * the vault. When supplied the scan returns only fields whose parent
+       * object matches (echoed back as `appliedScope`); without it the scan is
+       * org-wide. An object name that matches nothing in the vault is refused
+       * with `invalid-query` rather than silently returning an empty result.
        * `objectId` is the primary parameter; `objectApiName` and the legacy
        * `parentObjectFilter` (bare-name) are accepted as synonyms.
        */
@@ -111616,18 +111744,6 @@ var init_unused_fields_deep = __esm({
       entry.checks.noConditionalContextReferences,
       entry.checks.noIntegrationExposure
     ];
-    resolveParentObjectFilter = (input2) => {
-      const PREFIX3 = "CustomObject:";
-      if (input2.objectId !== void 0) {
-        const coerced = coercePrefix(input2.objectId, [PREFIX3]);
-        if (coerced.startsWith(PREFIX3))
-          return coerced.slice(PREFIX3.length);
-        return input2.objectId;
-      }
-      if (input2.objectApiName !== void 0)
-        return input2.objectApiName;
-      return input2.parentObjectFilter;
-    };
     CLEANUP_SYNTHESIS_DISCLOSURE = "Synthesis reports rank offline vault evidence only unless a live tool was composed. Re-run /sfi-refresh and check sfi.coverage_report before acting on absence-based findings.";
     CLEANUP_SEVERITY_RANK = {
       critical: 4,
@@ -111693,7 +111809,12 @@ var init_unused_fields_deep = __esm({
       const limit = input2.limit ?? UNUSED_FIELDS_DEEP_DEFAULT_LIMIT;
       const excludeManaged = input2.excludeManagedPackage ?? true;
       const excludeStandard = input2.excludeStandardFields ?? true;
-      const parentObjectFilter = resolveParentObjectFilter(input2);
+      const legacyParentObjectFilter = input2.objectId === void 0 && input2.objectApiName === void 0 ? input2.parentObjectFilter : void 0;
+      const scopeResult = await resolveExistingObjectScope(ctx.graph, { ...input2, objectApiName: input2.objectApiName ?? legacyParentObjectFilter }, { unhandledPrefix: "refuse" });
+      if (!scopeResult.ok)
+        return err(scopeResult.error);
+      const scope = scopeResult.value;
+      const parentObjectFilter = scope?.object;
       const corporaResult = await buildCorpora(ctx);
       if (!corporaResult.ok) {
         return err({
@@ -111884,6 +112005,11 @@ var init_unused_fields_deep = __esm({
         refreshedAt: ctx.manifest.refreshedAt
       };
       const dataWithoutCsv = {
+        // appliedScope FIRST + only when scoped, matching the sibling optionally-
+        // object-scoped tools (flow_bulkification_audit): a bare call omits the
+        // whole block (the pre-scope shape); a scoped one can never be misread as
+        // org-wide.
+        ...scope !== null ? { appliedScope: { componentId: scope.componentId, object: scope.object } } : {},
         fields: input2.format === "csv" ? [] : liveFields,
         totalCount: sorted.length,
         byParentObject,
@@ -111905,6 +112031,7 @@ var init_unused_fields_deep = __esm({
         const buildCleanup = (n2) => {
           const slice = liveFields.slice(0, n2);
           return {
+            ...scope !== null ? { appliedScope: { componentId: scope.componentId, object: scope.object } } : {},
             fields: slice,
             findings: sortCleanupFindings(slice.map(toCleanupFinding)),
             totalCount: sorted.length,
@@ -118919,7 +119046,7 @@ var init_group_membership = __esm({
 
 // ../mcp/dist/src/tools/who-can-access-object.js
 import { z as z170 } from "zod";
-var CUSTOM_OBJECT_PREFIX11, GROUP_MEMBER_PREFIX, DEFAULT_LIMIT26, MAX_LIMIT26, GRANTER_KIND_SAMPLE_LIMIT, PUBLIC_OWD_READ, whoCanAccessObjectInputBaseSchema, whoCanAccessObjectInputSchema, BLIND_SPOTS, flag3, stringProp6, sharingRuleObjectApiName2, ruleAccessToOp, whoCanAccessObjectHandler;
+var CUSTOM_OBJECT_PREFIX11, GROUP_MEMBER_PREFIX, DEFAULT_LIMIT26, MAX_LIMIT26, GRANTER_KIND_SAMPLE_LIMIT, PUBLIC_OWD_READ, whoCanAccessObjectInputBaseSchema, whoCanAccessObjectInputSchema, BLIND_SPOTS, flag3, stringProp6, utf8Bytes3, sharingRuleObjectApiName2, ruleAccessToOp, whoCanAccessObjectHandler;
 var init_who_can_access_object = __esm({
   "../mcp/dist/src/tools/who-can-access-object.js"() {
     "use strict";
@@ -118929,6 +119056,7 @@ var init_who_can_access_object = __esm({
     init_facts_block();
     init_group_membership();
     init_input_aliases();
+    init_response_budget();
     init_role_hierarchy();
     init_scan_cap();
     init_vault_assignment_disclosure();
@@ -118963,6 +119091,7 @@ var init_who_can_access_object = __esm({
     ]);
     flag3 = (p, k) => p[k] === true;
     stringProp6 = (p, k) => typeof p[k] === "string" ? p[k] : "";
+    utf8Bytes3 = (value) => Buffer.byteLength(JSON.stringify(value) ?? "null", "utf8");
     sharingRuleObjectApiName2 = (rule) => {
       const parentId = rule.parentId;
       if (typeof parentId === "string" && parentId.startsWith("CustomObject:")) {
@@ -119118,6 +119247,9 @@ var init_who_can_access_object = __esm({
             via,
             access: ruleAccessToOp(accessLevel),
             scope: "shared-records",
+            // Disambiguates `granterId|via` when a second rule of the SAME type
+            // shares with the SAME principal — see AccessGranter.sourceRuleId.
+            sourceRuleId: rule.id,
             detail: ruleType === "criteria" ? `criteria sharing rule ${rule.id} (${accessLevel}) shares records matching \`${predicate || "(predicate not extracted)"}\`` : ruleType === "guest" ? `guest sharing rule ${rule.id} (${accessLevel}) shares records matching \`${predicate || "(predicate not extracted)"}\` with the${siteName ? ` '${siteName}'` : ""} Experience Cloud site guest user (record-level + requester context required)` : ruleType === "territory" || ruleType === "territoryGroup" ? `${ruleType} sharing rule ${rule.id} (${accessLevel}) shares records matching \`${predicate || "(predicate not extracted)"}\` by territory assignment (record-level + territory context required)` : `owner sharing rule ${rule.id} (${accessLevel}) shares this user/group's owned records`
           });
           if (edge.toId.startsWith(GROUP_MEMBER_PREFIX)) {
@@ -119139,6 +119271,7 @@ var init_who_can_access_object = __esm({
                 via,
                 access: ruleAccessToOp(accessLevel),
                 scope: "shared-records",
+                sourceRuleId: rule.id,
                 detail: `${ruleType || "owner"} sharing rule ${rule.id} (${accessLevel}) shares with group ${edge.toId}, which contains this ${member.memberType} member${subDetail}${unresolved}`
               });
             }
@@ -119166,6 +119299,7 @@ var init_who_can_access_object = __esm({
                 via,
                 access: ruleAccessToOp(accessLevel),
                 scope: "shared-records",
+                sourceRuleId: rule.id,
                 detail: `${ruleType || "owner"} sharing rule ${rule.id} (${accessLevel}) shares with ${edge.toId} and its subordinate roles, which include this descendant role${internalNote}`
               });
             }
@@ -119202,35 +119336,16 @@ var init_who_can_access_object = __esm({
             interleaved.push(row);
         }
       }
-      const page = interleaved.slice(offset, offset + limit);
-      const hasMore = offset + page.length < total;
-      const truncated = hasMore || offset > 0;
-      const pageRowsByKind = /* @__PURE__ */ new Map();
-      for (const g of page) {
-        pageRowsByKind.set(g.granterType, (pageRowsByKind.get(g.granterType) ?? 0) + 1);
-      }
-      const byGranterType = kindOrder.map((granterType) => {
-        const rows = byKind.get(granterType) ?? [];
-        const distinctIds = [...new Set(rows.map((g) => g.granterId))].sort();
-        return {
-          granterType,
-          rows: rows.length,
-          distinctGranters: distinctIds.length,
-          rowsOnThisPage: pageRowsByKind.get(granterType) ?? 0,
-          sample: distinctIds.slice(0, GRANTER_KIND_SAMPLE_LIMIT)
-        };
-      });
       const externalOwdNote = externalOwd !== null ? ` External OWD (externalSharingModel): '${externalOwd}' \u2014 controls access for Experience Cloud / community users.` : "";
       const owdNote = owdGrantsAllInternalUsers ? `OWD '${owd}' is PUBLIC \u2014 every internal user can ${owd === "Read" ? "read" : "read and edit"} EVERY record of this object, beyond the principals listed.${externalOwdNote}` : `OWD '${owd}' is private/controlled \u2014 record access flows only from the listed grants/rules plus ownership.${externalOwdNote}`;
       const multiRowNote = total > distinctGranters ? ` ${total} granter rows come from ${distinctGranters} distinct Profile/PermissionSet/role/group(s) \u2014 each independent capability (read/create/edit/delete + View/Modify-All) is its own row, so a principal can appear in several. Count ACTORS by \`summary.distinctGranters\`, not row count.` : "";
-      const kindNote = byGranterType.length > 0 ? ` Rows are INTERLEAVED across granter kinds (round-robin), so this page samples every kind rather than one alphabetical block: ${byGranterType.map((k) => `${k.granterType} ${k.rowsOnThisPage.toString()} of ${k.rows.toString()} row(s) / ${k.distinctGranters.toString()} principal(s)`).join("; ")}. \`summary.byGranterType\` carries the complete per-kind counts and a named sample of each kind.` : "";
-      const pageNote = truncated ? ` Showing granters ${offset}\u2013${offset + page.length} of ${total}; summary holds the complete counts. Page with offset/limit.` : "";
       const scanTruncated = truncatedTypes.length > 0;
       const scanNote = scanTruncated ? ` ${scanTruncationNote(truncatedTypes, scanLimit)}` : "";
-      const containerIds = [
-        ...new Set(page.map((g) => g.granterId).filter((id) => id.startsWith("Profile:") || id.startsWith("PermissionSet:")))
+      const fullPage = interleaved.slice(offset, offset + limit);
+      const fullContainerIds = [
+        ...new Set(fullPage.map((g) => g.granterId).filter((id) => id.startsWith("Profile:") || id.startsWith("PermissionSet:")))
       ];
-      const dataShape = await readActiveHoldersFor(ctx, containerIds);
+      const fullDataShape = await readActiveHoldersFor(ctx, fullContainerIds);
       const blindSpots = [...BLIND_SPOTS];
       if (restrictionRules.length > 0) {
         blindSpots.push(`Active restriction rule(s) on this object (${restrictionRules.map((r) => r.id).join(", ")}) FILTER records for users matching each rule's user criteria \u2014 any granter row here, including View/Modify All Data, can be narrowed at runtime. Use why_cant_user_see_record for a per-user verdict.`);
@@ -119251,8 +119366,30 @@ var init_who_can_access_object = __esm({
         blindSpots.push(USER_ASSIGNMENT_NOT_IN_VAULT);
         blindSpots.push(SHARING_USER_ENUMERATION_NOT_AVAILABLE);
       }
-      return ok({
-        data: {
+      const buildData = (pageLimit) => {
+        const page = interleaved.slice(offset, offset + pageLimit);
+        const hasMore = offset + page.length < total;
+        const truncated = hasMore || offset > 0;
+        const pageRowsByKind = /* @__PURE__ */ new Map();
+        for (const g of page) {
+          pageRowsByKind.set(g.granterType, (pageRowsByKind.get(g.granterType) ?? 0) + 1);
+        }
+        const byGranterType = kindOrder.map((granterType) => {
+          const rows = byKind.get(granterType) ?? [];
+          const distinctIds = [...new Set(rows.map((g) => g.granterId))].sort();
+          return {
+            granterType,
+            rows: rows.length,
+            distinctGranters: distinctIds.length,
+            rowsOnThisPage: pageRowsByKind.get(granterType) ?? 0,
+            sample: distinctIds.slice(0, GRANTER_KIND_SAMPLE_LIMIT)
+          };
+        });
+        const kindNote = byGranterType.length > 0 ? ` Rows are INTERLEAVED across granter kinds (round-robin), so this page samples every kind rather than one alphabetical block: ${byGranterType.map((k) => `${k.granterType} ${k.rowsOnThisPage.toString()} of ${k.rows.toString()} row(s) / ${k.distinctGranters.toString()} principal(s)`).join("; ")}. \`summary.byGranterType\` carries the complete per-kind counts and a named sample of each kind.` : "";
+        const pageNote = truncated ? ` Showing granters ${offset}\u2013${offset + page.length} of ${total}; summary holds the complete counts. Page with offset/limit.` : "";
+        const pageContainerIds = new Set(page.map((g) => g.granterId).filter((id) => id.startsWith("Profile:") || id.startsWith("PermissionSet:")));
+        const dataShape = fullDataShape === void 0 ? void 0 : { ...fullDataShape, holders: fullDataShape.holders.filter((h) => pageContainerIds.has(h.id)) };
+        return {
           componentId,
           objectLabel: objectNode.label ?? objectNode.apiName,
           owd,
@@ -119266,7 +119403,7 @@ var init_who_can_access_object = __esm({
             sharedRecordsAccess: total - allRecordsAccess,
             byGranterType
           },
-          limit,
+          limit: pageLimit,
           offset,
           hasMore,
           truncated,
@@ -119275,7 +119412,28 @@ var init_who_can_access_object = __esm({
           ...dataShape !== void 0 ? { dataShape } : {},
           blindSpots,
           boundaryNote: `${owdNote} Declared static view (object permissions + sharing-rule targets + system god-mode); record-level paths are in blindSpots.${multiRowNote}${kindNote}${pageNote}${scanNote}`
-        },
+        };
+      };
+      const budget = toolLocalPayloadBudgetBytes();
+      let data = buildData(limit);
+      if (utf8Bytes3(data) > budget && data.granters.length > 1) {
+        let lo = 1;
+        let hi = data.granters.length - 1;
+        let best = buildData(1);
+        while (lo <= hi) {
+          const mid = Math.floor((lo + hi) / 2);
+          const candidate = buildData(mid);
+          if (utf8Bytes3(candidate) <= budget) {
+            best = candidate;
+            lo = mid + 1;
+          } else {
+            hi = mid - 1;
+          }
+        }
+        data = best;
+      }
+      return ok({
+        data,
         vaultState: {
           sourceTreeHash: ctx.manifest.sourceTreeHash,
           refreshedAt: ctx.manifest.refreshedAt
@@ -121072,11 +121230,12 @@ var init_why_field_changed = __esm({
 
 // ../mcp/dist/src/tools/tool-dispatch.js
 import { homedir as homedir4 } from "node:os";
-var dispatchTool, toDisclosedVaultPath, stampVaultDisclosure, runTool, SLIM_STRING_THRESHOLD_BYTES2, SLIM_STRING_KEEP_CHARS2, TRUNCATE_KEEP_MIN, utf8Bytes3, HONESTY_LIST_KEYS, HONESTY_CONTAINER_KEYS, collectTrimCandidates, truncateDataArrays, slimDataStrings, jsonResult, NARROWING_KNOB_RE, narrowingKnobs;
+var dispatchTool, toDisclosedVaultPath, stampVaultDisclosure, runTool, SLIM_STRING_THRESHOLD_BYTES2, SLIM_STRING_KEEP_CHARS2, TRUNCATE_KEEP_MIN, utf8Bytes4, HONESTY_LIST_KEYS, HONESTY_CONTAINER_KEYS, collectTrimCandidates, truncateDataArrays, slimDataStrings, jsonResult, NARROWING_KNOB_RE, narrowingKnobs;
 var init_tool_dispatch = __esm({
   "../mcp/dist/src/tools/tool-dispatch.js"() {
     "use strict";
     init_dist();
+    init_src();
     init_audit();
     init_live_capability();
     init_action_chain();
@@ -121690,8 +121849,15 @@ var init_tool_dispatch = __esm({
         case "sfi.field_provenance":
           return runTool(ctx, args, fieldProvenanceInputSchema, fieldProvenanceHandler);
         // RM-wire — deterministic reasoning-engine surface (offline, cited).
+        // INTERPRET-OVERSIZE-KNOBLESS-REMEDY: `concepts` / `ruleIds` are this
+        // tool's ONLY narrowing params (no limit/offset/hops — its schema does
+        // not match the shared knob regex), so an oversize error must name THEM
+        // explicitly or the remedy prescribes parameters the tool does not have.
         case "sfi.interpret":
-          return runTool(ctx, args, interpretInputSchema, interpretHandler);
+          return runTool(ctx, args, interpretInputSchema, interpretHandler, {
+            extraKnobs: ["ruleIds", "concepts"],
+            exampleCall: "sfi.interpret({ componentId, ruleIds: ['SOME_RULE_ID'] })"
+          });
         // v2.2 R2 — universal find-anywhere + discovery surface.
         case "sfi.find_field_anywhere":
           return runTool(ctx, args, findFieldAnywhereInputSchema, findFieldAnywhereHandler);
@@ -121751,10 +121917,14 @@ var init_tool_dispatch = __esm({
           });
       }
     };
-    toDisclosedVaultPath = (absPath) => {
-      const home = homedir4();
-      return home.length > 0 && (absPath === home || absPath.startsWith(`${home}/`)) ? `~${absPath.slice(home.length)}` : absPath;
-    };
+    toDisclosedVaultPath = (absPath) => (
+      // `collapseHome` replaces a hand-rolled `startsWith(`${home}/`)`, which never
+      // matched on Windows (`C:\\Users\\alice` + `/`), so the redaction silently
+      // did nothing and every response carried the operator's account name. It also
+      // fixes a case-sensitivity miss (`c:\\users` vs `C:\\Users`) for free, and
+      // maps "the vault IS home" to a bare `~` rather than the absolute path.
+      collapseHome(absPath, homedir4())
+    );
     stampVaultDisclosure = (resp, ctx) => {
       const manifest = ctx.manifest;
       return {
@@ -121767,7 +121937,7 @@ var init_tool_dispatch = __esm({
         }
       };
     };
-    runTool = async (ctx, args, schema, handler) => {
+    runTool = async (ctx, args, schema, handler, oversizeExtras) => {
       const parsed = schema.safeParse(args);
       if (!parsed.success) {
         const message = parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
@@ -121775,12 +121945,16 @@ var init_tool_dispatch = __esm({
           error: { kind: "invalid-query", message }
         });
       }
+      const knobs = [
+        .../* @__PURE__ */ new Set([...oversizeExtras?.extraKnobs ?? [], ...narrowingKnobs(schema)])
+      ];
       try {
         const result = await handler(ctx, parsed.data);
         return jsonResult(result.ok ? stampVaultDisclosure(result.value, ctx) : { error: result.error }, {
           args: parsed.data,
-          knobs: narrowingKnobs(schema),
-          vaultRoot: ctx.vaultRoot
+          knobs,
+          vaultRoot: ctx.vaultRoot,
+          ...oversizeExtras?.exampleCall !== void 0 ? { exampleCall: oversizeExtras.exampleCall } : {}
         });
       } catch (error) {
         console.error("sf-intelligence: runTool internal error in handler:", error);
@@ -121789,13 +121963,16 @@ var init_tool_dispatch = __esm({
             kind: "internal",
             message: "An internal error occurred while handling this tool. The server logged the details."
           }
-        }, { knobs: narrowingKnobs(schema) });
+        }, {
+          knobs,
+          ...oversizeExtras?.exampleCall !== void 0 ? { exampleCall: oversizeExtras.exampleCall } : {}
+        });
       }
     };
     SLIM_STRING_THRESHOLD_BYTES2 = 1536;
     SLIM_STRING_KEEP_CHARS2 = 1024;
     TRUNCATE_KEEP_MIN = 10;
-    utf8Bytes3 = (value) => Buffer.byteLength(JSON.stringify(value), "utf8");
+    utf8Bytes4 = (value) => Buffer.byteLength(JSON.stringify(value), "utf8");
     HONESTY_LIST_KEYS = /* @__PURE__ */ new Set([
       "blindSpots",
       "boundaries",
@@ -121844,7 +122021,7 @@ var init_tool_dispatch = __esm({
         return { dropped: 0, truncatedPaths: [], keptByPath: {}, originalByPath: {} };
       }
       const record = data;
-      const candidates = [...collectTrimCandidates(record)].sort((a, b) => utf8Bytes3(b.owner[b.key]) - utf8Bytes3(a.owner[a.key]));
+      const candidates = [...collectTrimCandidates(record)].sort((a, b) => utf8Bytes4(b.owner[b.key]) - utf8Bytes4(a.owner[a.key]));
       let dropped = 0;
       const truncatedPaths = [];
       const keptByPath = {};
@@ -121853,7 +122030,7 @@ var init_tool_dispatch = __esm({
         let list = candidate.owner[candidate.key];
         const originalLength = list.length;
         const droppedBefore = dropped;
-        while (list.length > TRUNCATE_KEEP_MIN && utf8Bytes3(body) > cap3) {
+        while (list.length > TRUNCATE_KEEP_MIN && utf8Bytes4(body) > cap3) {
           const keep = Math.max(TRUNCATE_KEEP_MIN, Math.floor(list.length / 2));
           dropped += list.length - keep;
           list = list.slice(0, keep);
@@ -121864,7 +122041,7 @@ var init_tool_dispatch = __esm({
           keptByPath[candidate.path] = list.length;
           originalByPath[candidate.path] = originalLength;
         }
-        if (utf8Bytes3(body) <= cap3)
+        if (utf8Bytes4(body) <= cap3)
           break;
       }
       return { dropped, truncatedPaths, keptByPath, originalByPath };
@@ -121914,9 +122091,10 @@ var init_tool_dispatch = __esm({
       const oversizeResult = (estimatedPayloadBytes, originalErrorKind) => {
         const boundedErrorKind = originalErrorKind?.slice(0, 64);
         const knobs = (narrowing?.knobs ?? []).slice(0, 8).map((knob) => knob.slice(0, 64));
+        const exampleCall = narrowing?.exampleCall?.slice(0, 200);
         const error = {
           kind: "oversize",
-          message: `${boundedErrorKind === void 0 ? "This tool's response" : `The '${boundedErrorKind}' error response`} (~${Math.round(estimatedPayloadBytes / 1e3)} KB) exceeds the response budget (~${Math.round(cap3 / 1e3)} KB, SFI_MAX_RESPONSE_BYTES). Re-query with a narrower scope${knobs.length > 0 ? ` \u2014 this tool supports: ${knobs.join(", ")}` : " (filter, pagination, fewer hops)"}.`
+          message: `${boundedErrorKind === void 0 ? "This tool's response" : `The '${boundedErrorKind}' error response`} (~${Math.round(estimatedPayloadBytes / 1e3)} KB) exceeds the response budget (~${Math.round(cap3 / 1e3)} KB, SFI_MAX_RESPONSE_BYTES). Re-query with a narrower scope${knobs.length > 0 ? ` \u2014 this tool supports: ${knobs.join(", ")}` : " (filter, pagination, fewer hops)"}${exampleCall !== void 0 ? `, e.g. ${exampleCall}` : ""}.`
         };
         return result({ error, estimatedPayloadBytes });
       };
@@ -121939,7 +122117,7 @@ var init_tool_dispatch = __esm({
         }
       }
       const withContentPolicy = (value) => isErrorEnvelope || !("data" in value) ? value : { ...value, contentPolicy: ORG_METADATA_CONTENT_POLICY };
-      const baseBytes = utf8Bytes3(withContentPolicy(body));
+      const baseBytes = utf8Bytes4(withContentPolicy(body));
       const toEnvelope = (value) => ({
         ...withContentPolicy(value),
         estimatedPayloadBytes: baseBytes
@@ -121970,10 +122148,10 @@ var init_tool_dispatch = __esm({
         originalByPath
       }) : "none";
       let stringsSlimmed = 0;
-      if (utf8Bytes3(clone) > reductionCap) {
+      if (utf8Bytes4(clone) > reductionCap) {
         stringsSlimmed = slimDataStrings(clone);
       }
-      if (utf8Bytes3(clone) <= reductionCap) {
+      if (utf8Bytes4(clone) <= reductionCap) {
         const args = narrowing?.args ?? {};
         const offset = args["offset"];
         const offsetShaped = "offset" in args || typeof offset === "number";
@@ -122091,8 +122269,8 @@ var init_server = __esm({
     init_tools();
     SERVER_NAME = "sf-intelligence";
     resolveServerVersion = () => {
-      if ("0.3.1") {
-        return "0.3.1";
+      if ("0.3.2") {
+        return "0.3.2";
       }
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
@@ -122220,6 +122398,132 @@ How to use it well:
   }
 });
 
+// ../mcp/dist/src/setup-server.js
+import { Server as Server2 } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema as CallToolRequestSchema2, ListToolsRequestSchema as ListToolsRequestSchema2 } from "@modelcontextprotocol/sdk/types.js";
+var isWindows2, quotePath, setupSteps, headline, setupInstructions, SETUP_TOOL, setupStatusPayload, createSetupServer;
+var init_setup_server = __esm({
+  "../mcp/dist/src/setup-server.js"() {
+    "use strict";
+    isWindows2 = () => process.platform === "win32";
+    quotePath = (p) => p.includes(" ") ? `"${p}"` : p;
+    setupSteps = (state) => {
+      const vaultFlag = `--vault ${quotePath(state.expectedVaultRoot)}`;
+      const org = state.authedOrgs[0] ?? "<your-org-alias>";
+      const needsInit = state.reason === "no-vault";
+      const steps = [];
+      if (needsInit) {
+        steps.push("Change into the Salesforce DX repo you want to model (the directory holding `sfdx-project.json`).", `Run \`npx -y sf-intelligence init --target-org ${org}\` to create the vault and bind it to one org.`);
+      }
+      steps.push(`Run \`npx -y sf-intelligence refresh --target-org ${org}\` to retrieve metadata and build the vault. First run takes a few minutes on a real org.`);
+      steps.push("Restart this MCP client so the server reconnects against the built vault.");
+      if (state.bindSource.includes("org-kb")) {
+        steps.push(`If the vault already exists somewhere else, the server is looking in the wrong place: it resolved \`./org-kb\` against its launch directory (${quotePath(state.cwd)}), which your MCP client chose \u2014 not you. Pin it instead by adding \`${vaultFlag}\` to the server's args, or setting the \`SFI_VAULT\` environment variable in the server's config.`);
+      }
+      return steps;
+    };
+    headline = (state) => {
+      switch (state.reason) {
+        case "no-vault":
+          return "sf-intelligence is running but has no knowledge base yet \u2014 the user has not built a vault for this project.";
+        case "vault-missing":
+          return "sf-intelligence found a vault config but no built vault \u2014 `refresh` has not completed for this project.";
+        case "manifest-load-failed":
+          return "sf-intelligence found a vault whose manifest could not be read \u2014 it is likely from an interrupted refresh.";
+        case "graph-open-failed":
+          return "sf-intelligence found a vault whose dependency graph could not be opened \u2014 it is likely from an interrupted refresh.";
+        default:
+          return "sf-intelligence could not open a knowledge base for this project.";
+      }
+    };
+    setupInstructions = (state) => [
+      headline(state),
+      "",
+      "IMPORTANT: in this state the server can answer NOTHING about the user's Salesforce org \u2014 no objects, fields, permissions, Apex or Flows. Do not guess, and do not answer org questions from general Salesforce knowledge; say the knowledge base is not built yet.",
+      "",
+      "Call `sfi.setup_status` for the exact next command, then offer to run it for the user. Once the vault is built, this server restarts with the full tool set."
+    ].join("\n");
+    SETUP_TOOL = {
+      name: "sfi.setup_status",
+      description: "Report why sf-intelligence has no knowledge base for this project yet, and the exact ordered commands to build one. Read-only; runs nothing. Call this before telling the user anything about their Salesforce org \u2014 in this state the server has no org data at all.",
+      inputSchema: {
+        type: "object",
+        properties: {},
+        required: [],
+        additionalProperties: false
+      },
+      annotations: {
+        title: "Setup status",
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false
+      }
+    };
+    setupStatusPayload = (state) => ({
+      data: {
+        status: "setup-required",
+        reason: state.reason,
+        detail: state.detail,
+        summary: headline(state),
+        /**
+         * Honest statement of capability. The router/answer surfaces are absent in
+         * this mode, so say so rather than letting a host infer that an empty tool
+         * list means "nothing to report".
+         */
+        canAnswerOrgQuestions: false,
+        lookedForVaultAt: state.expectedVaultRoot,
+        vaultBoundVia: state.bindSource,
+        serverLaunchDirectory: state.cwd,
+        authenticatedOrgs: state.authedOrgs,
+        nextSteps: setupSteps(state),
+        shell: isWindows2() ? "windows" : "posix",
+        /**
+         * The env-var form differs per shell and a wrong one is a dead end for a
+         * non-developer. Give the exact line for the shell they are in.
+         */
+        pinVaultExample: isWindows2() ? `$env:SFI_VAULT = '${state.expectedVaultRoot}'` : `export SFI_VAULT='${state.expectedVaultRoot}'`,
+        docs: "https://sfi.auditforce.cloud"
+      },
+      provenance: "setup_mode",
+      disclosures: [
+        "sf-intelligence is running in setup mode: no vault is bound, so no org metadata is available."
+      ]
+    });
+    createSetupServer = (state) => {
+      const server = new Server2({ name: "sf-intelligence", version: state.version }, {
+        capabilities: { tools: {} },
+        instructions: setupInstructions(state)
+      });
+      server.setRequestHandler(ListToolsRequestSchema2, async () => ({
+        tools: [SETUP_TOOL]
+      }));
+      server.setRequestHandler(CallToolRequestSchema2, async (request) => {
+        if (request.params.name !== SETUP_TOOL.name) {
+          const body2 = {
+            error: {
+              kind: "setup-required",
+              message: `sf-intelligence has no knowledge base for this project yet, so \`${request.params.name}\` cannot answer. Call \`${SETUP_TOOL.name}\` for the exact setup commands.`
+            },
+            provenance: "setup_mode"
+          };
+          return {
+            content: [{ type: "text", text: JSON.stringify(body2) }],
+            structuredContent: body2,
+            isError: true
+          };
+        }
+        const body = setupStatusPayload(state);
+        return {
+          content: [{ type: "text", text: JSON.stringify(body) }],
+          structuredContent: body
+        };
+      });
+      return server;
+    };
+  }
+});
+
 // ../mcp/dist/src/serve-http.js
 import { timingSafeEqual, createHash as createHash9, randomBytes } from "node:crypto";
 import { readFileSync as readFileSync5, statSync as statSync4 } from "node:fs";
@@ -122454,6 +122758,7 @@ var init_src9 = __esm({
     init_live_session();
     init_intent_router();
     init_server();
+    init_setup_server();
     init_serve_http();
     init_tools();
     init_security_posture_metric();
@@ -122967,7 +123272,7 @@ var init_package_version = __esm({
     "use strict";
     readCliPackageVersion = () => {
       if (true)
-        return "0.3.1";
+        return "0.3.2";
       for (const rel of ["../package.json", "../../package.json"]) {
         try {
           const raw = readFileSync6(fileURLToPath4(new URL(rel, import.meta.url)), "utf8");
@@ -122984,11 +123289,12 @@ var init_package_version = __esm({
 
 // dist/src/refresh-pipeline.js
 import { mkdir as mkdir13, readdir as readdir7, stat as stat7, writeFile as writeFile11 } from "node:fs/promises";
-import { basename as basename15, dirname as dirname26, join as join39, sep as sep3 } from "node:path";
+import { basename as basename15, dirname as dirname26, join as join39 } from "node:path";
 var EXTRACT_CACHE_VERSION, SUPPORTED_TYPES, CO_EMITTED_TYPES, coEmits, EXTRACTORS, dispatchFile, BUNDLE_PARENT_DIRS, walkDir, relativeSegments, DX_WRAPPER_SEGMENTS, KNOWN_SIDECAR_SUFFIXES, isKnownSidecar, skipAttributionKey, componentTypeFromSourcePath, REPORT_DASHBOARD_TYPES, FOLDED_REPORT_DASHBOARD_NAME_CAP, FOLDED_NAME_CAP, DEFAULT_REPORT_DASHBOARD_NODE_CAP, reportDashboardNodeCap, PERSISTED_REPORT_PROPERTY_KEYS, PERSISTED_DASHBOARD_PROPERTY_KEYS, PERSISTED_ANALYTICS_EDGE_PROPERTY_KEYS, FILTER_ITEM_KEYS, GROUPING_ITEM_KEYS, BUCKET_ITEM_KEYS, CROSS_FILTER_ITEM_KEYS, CHART_KEYS, projectItems, projectObject, sanitizeAnalyticsProperties, capFoldedNames, applyReportDashboardPersistence, profileIdKeys, buildProfileIdIndex, RESOLVED_PROFILE_REFERENCE_KIND, resolveRestrictionRuleProfileEdges, walkAndExtract, composeDocument, parentApiNameFor, writeNodeDocument, writeIndex, RENDER_PAGE_SIZE, renderVault, parseTypeFilter;
 var init_refresh_pipeline = __esm({
   "dist/src/refresh-pipeline.js"() {
     "use strict";
+    init_src();
     init_src6();
     init_src2();
     init_src8();
@@ -123421,8 +123727,10 @@ var init_refresh_pipeline = __esm({
       }
     };
     relativeSegments = (rootDir, absPath) => {
-      const rel = absPath.startsWith(`${rootDir}${sep3}`) ? absPath.slice(rootDir.length + 1) : absPath;
-      return rel.split(sep3);
+      const rootSegments = splitPathSegments(rootDir);
+      const absSegments = splitPathSegments(absPath);
+      const isUnderRoot = rootSegments.length > 0 && rootSegments.length <= absSegments.length && rootSegments.every((seg, i) => absSegments[i] === seg);
+      return isUnderRoot ? absSegments.slice(rootSegments.length) : absSegments;
     };
     DX_WRAPPER_SEGMENTS = /* @__PURE__ */ new Set(["main", "default"]);
     KNOWN_SIDECAR_SUFFIXES = [
@@ -124111,11 +124419,12 @@ var init_setup_audit_trail = __esm({
 
 // dist/src/source-reconcile.js
 import { cp, readdir as readdir8, rm as rm3, stat as stat8 } from "node:fs/promises";
-import { basename as basename16, join as join41, relative as relative3, sep as sep4 } from "node:path";
+import { basename as basename16, join as join41, relative as relative2, sep as sep3 } from "node:path";
 var BUNDLE_PARENT_DIRS2, KNOWN_SIDECAR_SUFFIXES2, isKnownSidecar2, primaryRelPathForSidecar, walkSourceEntries, DISPATCH_PROBE_ROOT, dispatchTailLength, strippedDxWrapper, comparisonKey, authoritativeIndex, RECONCILE_MAX_DELETE_FRACTION, RECONCILE_GUARD_MIN_CONSIDERED, layoutMismatchRefusal, reconcileSourceDeletions, syncAuthoritativeRetrieveIntoSource;
 var init_source_reconcile = __esm({
   "dist/src/source-reconcile.js"() {
     "use strict";
+    init_src();
     init_refresh_pipeline();
     BUNDLE_PARENT_DIRS2 = /* @__PURE__ */ new Set(["lwc", "aura"]);
     KNOWN_SIDECAR_SUFFIXES2 = [
@@ -124156,7 +124465,7 @@ var init_source_reconcile = __esm({
               if (type !== null) {
                 found.push({
                   absPath: abs,
-                  relPath: relative3(sourceRoot, abs),
+                  relPath: relative2(sourceRoot, abs),
                   type,
                   isDirectory: true
                 });
@@ -124165,7 +124474,7 @@ var init_source_reconcile = __esm({
               await walkDir2(abs);
             }
           } else if (entry.isFile()) {
-            const relPath = relative3(sourceRoot, abs);
+            const relPath = relative2(sourceRoot, abs);
             const fileName = entry.name;
             let type = componentTypeFromSourcePath(sourceRoot, abs, false);
             if (type === null && isKnownSidecar2(fileName)) {
@@ -124187,7 +124496,7 @@ var init_source_reconcile = __esm({
       };
       await walkDir2(sourceRoot);
     };
-    DISPATCH_PROBE_ROOT = join41(sep4, "__sfi-reconcile-dispatch-probe__");
+    DISPATCH_PROBE_ROOT = join41(sep3, "__sfi-reconcile-dispatch-probe__");
     dispatchTailLength = (segments, isDirectory) => {
       for (let length = 1; length <= segments.length; length += 1) {
         const tail = segments.slice(segments.length - length);
@@ -124205,10 +124514,10 @@ var init_source_reconcile = __esm({
       return segments;
     };
     comparisonKey = (relPath, isDirectory) => {
-      const segments = relPath.split(sep4);
+      const segments = splitPathSegments(relPath);
       const fileName = segments[segments.length - 1] ?? relPath;
       const primaryRel = primaryRelPathForSidecar(relPath, fileName);
-      const probeSegments = primaryRel === null ? segments : primaryRel.split(sep4);
+      const probeSegments = primaryRel === null ? segments : splitPathSegments(primaryRel);
       const length = dispatchTailLength(probeSegments, isDirectory);
       const tail = length === null ? strippedDxWrapper(segments) : segments.slice(segments.length - length);
       return tail.join("/");
@@ -124262,7 +124571,7 @@ var init_source_reconcile = __esm({
           candidateBundleDirs.add(entry.absPath);
         candidates.push(entry);
       }
-      const doomed = candidates.filter((entry) => entry.isDirectory || ![...candidateBundleDirs].some((dir) => entry.absPath.startsWith(`${dir}${sep4}`)));
+      const doomed = candidates.filter((entry) => entry.isDirectory || ![...candidateBundleDirs].some((dir) => entry.absPath.startsWith(`${dir}${sep3}`)));
       const refusalReason = layoutMismatchRefusal(doomed.length, considered.length, authoritative);
       if (refusalReason !== null) {
         return {
@@ -124681,7 +124990,7 @@ Pick a writable path with \`--out <file>\`.
 // dist/src/commands/vault-anonymize.js
 import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
 import { mkdir as mkdir16, readdir as readdir9, readFile as readFile112, writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname28, join as join43, relative as relative4, resolve as resolve7, sep as sep5 } from "node:path";
+import { dirname as dirname28, join as join43, relative as relative3, resolve as resolve7, sep as sep4 } from "node:path";
 var PHONE_RE, extendedScrubText, buildIdentityReplacements, applyReplacements, META_IDENTITY_KEY, collectVaultIdentities, validateOutDir, isLikelyBinaryFile, walkFiles, copyTextTree, transformMetaJsonIdentityFields, META_COPY_ALLOWLIST, loadLocalForbiddenNamePatterns, residualLeakScan, PSEUDONYMIZE_NOT_IMPLEMENTED_MESSAGE, buildAnonymizedReadme, anonymizeVault, registerVaultAnonymizeSubcommand;
 var init_vault_anonymize = __esm({
   "dist/src/commands/vault-anonymize.js"() {
@@ -124748,8 +125057,8 @@ var init_vault_anonymize = __esm({
       return ok([...identities]);
     };
     validateOutDir = (vaultRoot, outDir) => {
-      const src = resolve7(vaultRoot) + sep5;
-      const out = resolve7(outDir) + sep5;
+      const src = resolve7(vaultRoot) + sep4;
+      const out = resolve7(outDir) + sep4;
       if (out === src || out.startsWith(src)) {
         return err(`--out (${resolve7(outDir)}) must be OUTSIDE the source vault (${resolve7(vaultRoot)}).`);
       }
@@ -124779,7 +125088,7 @@ var init_vault_anonymize = __esm({
     copyTextTree = async (srcDir, destDir, relLabel, transform, stats) => {
       const files = await walkFiles(srcDir);
       for (const file of files) {
-        const rel = relative4(srcDir, file);
+        const rel = relative3(srcDir, file);
         const reportedPath = join43(relLabel, rel);
         if (isLikelyBinaryFile(file)) {
           stats.filesSkipped.push({
@@ -124860,7 +125169,7 @@ var init_vault_anonymize = __esm({
           continue;
         }
         filesScanned += 1;
-        const rel = relative4(outDir, file);
+        const rel = relative3(outDir, file);
         for (const identity of identities) {
           if (identity.length > 0 && text.includes(identity)) {
             findings.push({ file: rel, pattern: "identity-literal" });
@@ -126091,27 +126400,29 @@ SAFE but may now carry entries for components that no longer exist.
       const pending2 = new Set(marker.pendingTypes);
       return entries.map((entry) => pending2.has(entry.type) ? { ...entry, requested: true, pending: true } : entry);
     };
-    decorateReportsCapCoverage = (entries, stats) => {
-      if (stats === void 0)
+    decorateReportsCapCoverage = (entries, stats, previousReportsCap) => {
+      const effective = stats ?? previousReportsCap;
+      if (effective === void 0)
         return entries;
       const landed = /* @__PURE__ */ new Map([
-        ["Report", stats.reports],
-        ["Dashboard", stats.dashboards]
+        ["Report", effective.reports],
+        ["Dashboard", effective.dashboards]
       ]);
       const proven = (c) => c.retrieved > 0 && c.total <= c.retrieved;
       const decorated = (c) => ({
         requested: true,
         // This is the ONLY place a fold-erased row gets a truthful `retrieved`:
-        // the files the retrieve actually landed on disk. Overwriting the
-        // structurally-zero node count is the point (FOLD_ERASED_COVERAGE_TYPES).
+        // the files the retrieve actually landed on disk (or, via the fallback,
+        // the last time a retrieve actually landed them). Overwriting the
+        // structurally-unreliable node count is the point (FOLD_ERASED_COVERAGE_TYPES).
         retrieved: c.retrieved,
-        ...proven(c) ? { retrieveConfirmed: true } : { pending: true }
+        ...proven(c) ? { retrieveConfirmed: true } : c.retrieved > 0 ? { capped: true } : { pending: true }
       });
       const out = entries.map((entry) => {
         const c = landed.get(entry.type);
         if (c === void 0 || entry.neverModeled)
           return entry;
-        const { pending: _wasPending, retrieveConfirmed: _wasConfirmed, ...rest } = entry;
+        const { pending: _wasPending, capped: _wasCapped, retrieveConfirmed: _wasConfirmed, ...rest } = entry;
         return { ...rest, ...decorated(c) };
       });
       for (const [type, c] of landed) {
@@ -126135,8 +126446,8 @@ SAFE but may now carry entries for components that no longer exist.
       return entries.map((entry) => {
         if (!capped.has(entry.type) || entry.neverModeled)
           return entry;
-        const { retrieveConfirmed: _dropped, ...rest } = entry;
-        return { ...rest, requested: true, pending: true };
+        const { retrieveConfirmed: _dropped, pending: _wasPending, ...rest } = entry;
+        return { ...rest, requested: true, capped: true };
       });
     };
     decorateReportPullCoverage = (entries, disclosure) => {
@@ -126345,7 +126656,16 @@ SAFE but may now carry entries for components that no longer exist.
       }
       const coverageComputedAt = (/* @__PURE__ */ new Date()).toISOString();
       const pullRan = confirmedTypes !== null;
-      const coverage = stampFamilyEpochs(decorateProfileGrantCoverage(decoratePendingCoverage(decorateReportPullCoverage(decorateReportNodeCapCoverage(decorateReportsCapCoverage(buildCoverageEntries2(counts, walked.skippedDirectories, requestedTypes, paths.source, walked.failures, confirmedTypes), args.reportsCapStats), args.reportNodeStats), args.reportPull), opts.stagedMarker), profileGrantDisclosure), previousManifest?.coverage, coverageComputedAt, pullRan);
+      const coverage = stampFamilyEpochs(decorateProfileGrantCoverage(decoratePendingCoverage(decorateReportPullCoverage(decorateReportNodeCapCoverage(decorateReportsCapCoverage(
+        buildCoverageEntries2(counts, walked.skippedDirectories, requestedTypes, paths.source, walked.failures, confirmedTypes),
+        args.reportsCapStats,
+        // FIX-2 (coverage-spine): when THIS run has no fresh reportsCap
+        // evidence of its own (a `--no-pull` rebuild, a scoped refresh),
+        // fall back to the last manifest's — real, not fabricated —
+        // capped-retrieve evidence instead of regressing the row to the
+        // FOLD_ERASED "pending" default.
+        previousManifest?.reportsCap
+      ), args.reportNodeStats), args.reportPull), opts.stagedMarker), profileGrantDisclosure), previousManifest?.coverage, coverageComputedAt, pullRan);
       let phantomSummary;
       if (!midBuild && opts.stagedMarker === void 0) {
         try {
@@ -126505,6 +126825,10 @@ SAFE but may now carry entries for components that no longer exist.
 `);
         }
       }
+      const componentTotal = Object.values(counts.components).reduce((sum, n) => sum + (n ?? 0), 0);
+      if (componentTotal === 0) {
+        process.stderr.write("sfi refresh: WARNING \u2014 the build modelled 0 components, so this vault cannot answer any question about the org.\n  Most often the metadata is in `force-app/` but the vault reads `org-kb/source/`, or a `--types` filter excluded everything.\n  Run `sfi doctor` for the specific check that failed.\n");
+      }
       return {
         // A profile-grant integrity disclosure forces `partial`: the vault built,
         // but its permission graph is untrustworthy — never report clean success.
@@ -126516,7 +126840,18 @@ SAFE but may now carry entries for components that no longer exist.
         // as a profile-grant disclosure: the vault built, but some components were
         // assembled from two different retrievals of the same metadata, so their
         // permissions/properties are unresolved until the stale tree is removed.
-        status: walked.failures.length === 0 && args.retrieveFailures.length === 0 && profileGrantDisclosure === null && (walked.duplicateSourcePaths?.conflicting ?? 0) === 0 && args.reportPull === void 0 ? "success" : "partial",
+        // A build that modelled ZERO components is never a success. It used to be:
+        // with no per-file failures the status read `success`, the CLI printed
+        // "Refresh success", `sfi status` reported the vault "locally consistent"
+        // and `sfi quickstart` marked every step done — while the vault answered
+        // every question with nothing. Only `sfi doctor` told the truth. The
+        // realistic way in is a DX repo whose metadata sits in `force-app/` rather
+        // than `org-kb/source/`, which is most of them.
+        //
+        // `partial` rather than `failed`: the pipeline genuinely ran, and the
+        // remedy is the user's (point it at real source, or widen `--types`). The
+        // disclosure below names it so the reason is not left to inference.
+        status: componentTotal === 0 || walked.failures.length > 0 || args.retrieveFailures.length > 0 || profileGrantDisclosure !== null || (walked.duplicateSourcePaths?.conflicting ?? 0) > 0 || args.reportPull !== void 0 ? "partial" : "success",
         counts,
         skippedDirectories: walked.skippedDirectories,
         ...walked.duplicateSourcePaths !== void 0 ? { duplicateSourcePaths: walked.duplicateSourcePaths } : {},
@@ -128369,7 +128704,7 @@ var init_watch = __esm({
       return Math.max(ms, MIN_INTERVAL_MS);
     };
     registerWatchCommand = (program) => {
-      const watch = program.command("watch").description("Org-drift watcher: a small detached daemon running one read-only stale-sweep tick per interval (default 15m, floor 5m, \xB110% jitter, separate daily tick budget) so meta/staleness.json stays current. Single-instance per vault (stale pidfiles recovered). Subcommands: status, stop.").option("--interval <duration>", "Tick interval, e.g. 15m or 1h (floor 5m)", "15m").option("--auto-refresh <mode>", "When a tick detects drift, run `sfi refresh --incremental` automatically \u2014 at most once per hour; lock-safe (epoch side-build); a failure logs and the watcher continues. Mode: 'incremental'.").option("--foreground", "Run the loop in THIS process (used by the detached child)").option("--drain-demand-queue", "After a tick, drain queued automation-critical phantom hits (`meta/demand-queue.jsonl`, recorded by sfi.get_component) via the demand-retrieve gate \u2014 at most once per hour; a failure logs and the watcher continues.").action(async (flags) => {
+      const watch = program.command("watch").description("Org-drift watcher: a small detached daemon running one read-only stale-sweep tick per interval (default 15m, floor 5m, \xB110% jitter, separate daily tick budget) so meta/staleness.json stays current. Single-instance per vault (stale pidfiles recovered). Subcommands: status, stop.").option("--interval <duration>", "Tick interval, e.g. 15m or 1h (floor 5m)", "15m").option("--auto-refresh <mode>", "When a tick detects drift, run `sfi refresh --incremental --incremental-graph` automatically \u2014 this CONTACTS THE ORG (`sf project retrieve`), at most once per hour; lock-safe (epoch side-build); a failure logs and the watcher continues. Mode: 'incremental'.").option("--foreground", "Run the loop in THIS process (used by the detached child)").option("--drain-demand-queue", "After a tick, drain queued automation-critical phantom hits (`meta/demand-queue.jsonl`, recorded by sfi.get_component) via the demand-retrieve gate \u2014 at most once per hour; a failure logs and the watcher continues.").action(async (flags) => {
         const cwd = process.cwd();
         const intervalMs = parseInterval(flags.interval);
         if (!existsSync11(join50(cwd, "org-kb", "meta"))) {
@@ -129062,7 +129397,11 @@ var handleInit = async (cwd, flags) => {
   }
   const targetOrg = await resolveTargetOrg(flags, interactive);
   if (targetOrg === null) {
-    process.stderr.write("sfi init: no --target-org given and no default Salesforce org found. Pass --target-org <alias>.\n");
+    const detected = interactive ? null : await getDefaultOrgAlias();
+    const hint = detected !== null ? ` Your default org is \`${detected}\` \u2014 if that is the one you want, run:
+  sfi init --target-org ${detected}
+` : " Run `sf org list` to see your authenticated orgs.\n";
+    process.stderr.write("sfi init: --target-org is required when stdin is not a terminal. A vault is bound to ONE org and every later answer attaches to that binding, so the product will not pick one for you." + hint);
     return 1;
   }
   return runAndReport({ cwd, targetOrg, vaultRoot, force });
@@ -129072,7 +129411,7 @@ var resolveTargetOrg = async (flags, interactive) => {
     return flags.targetOrg;
   const detected = await getDefaultOrgAlias();
   if (!interactive)
-    return detected;
+    return null;
   return input({
     message: "Target org alias:",
     ...detected !== null ? { default: detected } : {}
@@ -129145,12 +129484,24 @@ var prepareMcp = async (opts) => {
     const orgs = await (opts.listOrgs ?? defaultListOrgs)();
     const where = opts.vaultRoot !== void 0 ? ` at ${vaultRoot}` : "";
     const base = `No vault${where}. Run \`sfi init\` followed by \`sfi refresh\`, or point \`sfi mcp --vault <path>\` at an existing org-kb.`;
-    const hint = orgs.length > 0 ? ` You are authenticated to ${orgs.length} org(s): ${orgs.slice(0, 8).join(", ")}${orgs.length > 8 ? ", \u2026" : ""}. Run \`sfi init\` to pick the one you want and build its knowledge base \u2014 live answers attach to a vault's org, so the product never guesses which of your orgs to query.` : "";
-    return err({ kind: "no-vault", message: base + hint });
+    const names = opts.discloseOrgNames === true ? `: ${orgs.slice(0, 8).join(", ")}${orgs.length > 8 ? ", \u2026" : ""}` : "";
+    const hint = orgs.length > 0 ? ` You are authenticated to ${orgs.length} org(s)${names}. Run \`sfi init\` to pick the one you want and build its knowledge base \u2014 live answers attach to a vault's org, so the product never guesses which of your orgs to query.` : "";
+    return err({
+      kind: "no-vault",
+      message: base + hint,
+      vaultRoot,
+      authedOrgs: orgs
+    });
   }
   const ctxResult = await buildContext(vaultRoot);
   if (!ctxResult.ok) {
-    return err({ kind: "buildContext-failed", message: ctxResult.error.message });
+    const boundOrg = await readBoundOrg(paths.config).catch(() => null);
+    return err({
+      kind: "buildContext-failed",
+      message: ctxResult.error.message,
+      vaultRoot,
+      authedOrgs: boundOrg !== null ? [boundOrg] : []
+    });
   }
   const targetOrg = await readBoundOrg(paths.config);
   return ok({
@@ -129180,12 +129531,25 @@ var registerMcpCommand = (program) => {
     const { vaultRoot: boundVault, bindSource } = resolveVaultBinding(cmdOpts.vault, process.env["SFI_VAULT"]);
     const prepared = await prepareMcp({
       cwd: process.cwd(),
+      // A TTY means a human is watching this scroll past in their own
+      // terminal; anything else means a host is capturing it to a log file.
+      discloseOrgNames: process.stderr.isTTY === true,
       ...boundVault !== void 0 ? { vaultRoot: boundVault } : {}
     });
     if (!prepared.ok) {
       process.stderr.write(`sfi mcp: ${prepared.error.message}
 `);
-      process.exit(1);
+      const setup = createSetupServer({
+        reason: prepared.error.kind === "no-vault" ? "no-vault" : "vault-missing",
+        detail: prepared.error.message,
+        cwd: process.cwd(),
+        expectedVaultRoot: prepared.error.vaultRoot,
+        bindSource,
+        authedOrgs: prepared.error.authedOrgs,
+        version: readCliPackageVersion()
+      });
+      await startServer(setup);
+      return;
     }
     const { ctx, server, vaultRoot, targetOrg } = prepared.value;
     process.env["SFI_PLUGIN_VERSION"] = readCliPackageVersion();
@@ -129219,7 +129583,7 @@ var makeShutdownOnce = (ctx) => {
 
 // dist/src/commands/demo.js
 init_refresh();
-var buildVersion = () => true ? "0.3.1" : "dev";
+var buildVersion = () => true ? "0.3.2" : "dev";
 var SHUTDOWN_SIGNALS2 = ["SIGINT", "SIGTERM"];
 var resolveDemoSource = () => {
   let dir = dirname30(fileURLToPath5(import.meta.url));
@@ -129355,6 +129719,15 @@ var runStatus = async (opts) => {
   }
   const currentSourceHash = hashResult.value;
   if (currentSourceHash === manifest.sourceTreeHash) {
+    const componentTotal = Object.values(manifest.components).reduce((sum, n) => sum + (n ?? 0), 0);
+    if (componentTotal === 0) {
+      return {
+        kind: "fresh",
+        message: "Vault built but modelled 0 components \u2014 it cannot answer any question about the org. The metadata is usually in `force-app/` while the vault reads `org-kb/source/`, or a `--types` filter excluded everything. Run `sfi doctor` for the specific check.",
+        manifest,
+        currentSourceHash
+      };
+    }
     return {
       kind: "fresh",
       message: "Vault is locally consistent (source hash matches last refresh). Live org drift is not checked \u2014 run `sfi live_stale_check` when you need live confirmation.",
@@ -129805,10 +130178,10 @@ var parseGapsSince = (raw, now = /* @__PURE__ */ new Date()) => {
   if (raw === void 0 || raw.trim() === "")
     return null;
   const trimmed = raw.trim();
-  const relative5 = /^(\d+)\s*(d|h|w|m)$/i.exec(trimmed);
-  if (relative5) {
-    const n = Number(relative5[1]);
-    const unit = (relative5[2] ?? "d").toLowerCase();
+  const relative4 = /^(\d+)\s*(d|h|w|m)$/i.exec(trimmed);
+  if (relative4) {
+    const n = Number(relative4[1]);
+    const unit = (relative4[2] ?? "d").toLowerCase();
     const ms = unit === "h" ? n * 36e5 : unit === "m" ? n * 6e4 : unit === "w" ? n * 7 * 864e5 : n * 864e5;
     return new Date(now.getTime() - ms);
   }
@@ -130097,7 +130470,7 @@ var statusToChangeKind = (status) => {
   return "modified";
 };
 var deriveComponentFromPath = (relPath) => {
-  const segments = relPath.split("/").filter((s) => s !== "");
+  const segments = splitPathSegments(relPath);
   if (segments.length === 0)
     return null;
   for (const bundleDir of BUNDLE_PARENT_DIRS) {
@@ -130674,7 +131047,7 @@ init_vault_git();
 init_watch();
 var readVersion = () => {
   if (true)
-    return "0.3.1";
+    return "0.3.2";
   const pkgUrl = new URL("../../package.json", import.meta.url);
   const raw = readFileSync10(fileURLToPath6(pkgUrl), "utf8");
   const parsed = JSON.parse(raw);