Spot Salesforce renewals at risk from support problems

**Objective:** For every Salesforce account with a contract ending in the next {renewal-window-days} days (default 90), owned by {account-owner} (default: any owner), report its Zendesk support health so the account team knows which renewals are at risk.

**Step 1: Find upcoming renewals in Salesforce**

Call `salesforce-get-contract` with `end-date.from` set to today and `end-date.to` set to today plus {renewal-window-days} days (default 90). If {account-owner} is given, also set `owner.contains` to it. Keep `account-id`, `account-name`, `contract-number`, `end-date` and `owner`. If nothing comes back, say there are no renewals in the window and stop.

For each distinct `account-id`, call `salesforce-get-account` with `account-id` to get `name`, `website`, `annual-revenue` and `rating`, and call `salesforce-get-opportunity` with `account-id` and `closed` set to false to get any open renewal or expansion opportunity (`name`, `stage`, `amount`, `close-date`).

**Step 2: Match each account in Zendesk**

**How to match a Salesforce account to a Zendesk organization (use this order, stop at the first hit):**

1. Call `zendesk-get-organization` with `external-id` set to the Salesforce `account-id`.
2. If nothing comes back, call `zendesk-get-organization` with `name` set to the Salesforce account `name` exactly.
3. If still nothing, take the domain from the account's `website` (strip `http://`, `https://`, `www.` and any path) and call `zendesk-get-organization` with `domain-names.contains` set to it.
4. If more than one organization matches at any step, list them and treat the account as ambiguous rather than guessing.
5. If none match, report the account as "No Zendesk organization found" and continue with the next account.

Once matched, use the Zendesk organization's own `name` (not the Salesforce account name) as `organization-name` on `zendesk-get-ticket`, since the two systems can spell the company differently.

**Step 3: Pull support signals from Zendesk**

For each matched organization:

* Zendesk unsolved tickets are those with status `new`, `open`, `pending` or `hold`. The `status` filter on `zendesk-get-ticket` takes one value, so call it once per status and combine the results. Count unsolved tickets and how many of them are `urgent` or `high` priority.
* Call `zendesk-get-ticket` with `organization-name` and `created.from` set to 90 days ago to count tickets raised in the last 90 days.
* For the tickets from the last 90 days, call `zendesk-get-satisfaction-rating` with `ticket-id` for each ticket (at most 25 tickets per account) and count `good` and `bad` scores.

**Step 4: Report**

One table, sorted by contract `end-date` ascending:

| Account | Contract end | Open opportunity (stage, amount) | Unsolved tickets | Urgent/high | Tickets last 90 days | CSAT good/bad | Health |

Health is **At risk** when there is any unsolved urgent ticket, or more bad than good ratings, or 5 or more unsolved tickets; **Watch** when there are 1 to 4 unsolved tickets or any bad rating; otherwise **Healthy**. Under the table, give one line per At risk account naming the ticket subjects driving the rating. List unmatched accounts separately.

**Rules & Guidelines:**

* Salesforce tools start with "salesforce-" and come from the Salesforce MCP server. Zendesk tools start with "zendesk-" and come from the Zendesk MCP server. Both servers must be connected.
* This prompt is read-only. Do NOT call any write tool on either server, including `salesforce-add-task`, `salesforce-update-task`, `salesforce-add-case`, `salesforce-update-case`, `salesforce-update-account`, `salesforce-update-opportunity`, `zendesk-add-ticket`, `zendesk-update-ticket`, `zendesk-add-ticket-comment`, `zendesk-update-organization` or `zendesk-update-user`.
* Do not infer health from Salesforce cases; support history for this job lives in Zendesk.

**Validation:**

* If an account has no Zendesk organization, show it as "No Zendesk organization found", not as Healthy.
* If a satisfaction rating has score `offered` or `unoffered`, it is not a rating; do not count it as good or bad.
* Dates in Salesforce are ISO dates; pass Zendesk date filters in the same ISO format.