Review mitigation for the 1c5s/xkr7 batch (nxf 6j6v.1c5s, xkr7)

[cabcookie]

Stacked on #55 (→ #54); this PR is the one to merge — it contains all three.

Mitigates the independent review of #55 (.nxf/review/2026-10-11T18-13-12Z.md).

Table contract and index revision: unchanged from #55. No new GSI and no new key attribute; the index revision stays 3. The watermark row gets one new non-key attribute, refold_until, which a clear sets. Embedders of nxs-fold-ddb see API changes: Table::get_many is a new required trait method (app-foundations' test Part table has to implement it on the next bump), Folder::clear(table, until) takes a new argument, and RecordsError::Refolding, Watermark::refold_until and the Vec that board::reindex now returns are new. Every item op now costs one more GetItem, because the row is weighed before the op writes.

Mitigation

Finding	Disposition	Notes
Hosted read cost unbounded (Integrity #1 · High, Code #1, Test #7)	Fixed	An unranked list keeps and cuts on the row before any join: ListReads::select, read::list_select, ListBoard::cut, and list_board_page uses the total counted before the cut. Only the page reads joins. Point reads go through the new Table::get_many: BatchGetItem, 100 keys a request, UnprocessedKeys retried with backoff. Guard tests: an_unranked_list_costs_its_page_not_the_stream (300 closed items add no requests) and a_ranked_list_with_next_and_a_graph_costs_what_its_scope_holds. A ranked list still reads its types' whole scope, per spec §12; this is documented in E4 §5.1 and spec §6. The hard per-call budget is not built: filed as 6j6v.wq9e.
Refold window serves partial data (Integrity #2 · Medium)	Fixed	Folder::clear(table, until) first rewrites the watermark as a sentinel with no revisions. Readers answer NotCurrent, then Refolding until folded_through >= until. Replay-safe, because nothing is written to end the window. Snapshot import writes the sentinel first. Test: a_refolding_stream_is_refused_from_its_clear_until_the_refold_reaches_the_head. Changelog wording fixed.
with_ranking skips the revision check; hollow rev-2 test (Integrity #3, Code #4, Test #1)	Fixed	check_current now runs at the start of with_ranking. The rev-2 test asserts the refusal, and also that the stripped entries read as an empty graph under a false rev-3 watermark while the store has edges.
refresh_item drops TooLarge (Integrity #4 · Medium)	Fixed	Folder::fold weighs each item row it writes: the stored row, plus this op's writes, plus its index attributes. Too large means Folded::Refused before anything is written. refresh_item's Outcome is reported by board::after and reindex. Test: an_item_with_no_room_for_its_index_attributes_is_refused_rather_than_left_off_an_index.
typed_partition escaping untested (Test #2)	Fixed	a_typed_partition_escapes_the_type_so_no_stream_and_type_share_one: no cross-stream collision, and a type of # characters is refused once escaped.
typed_items doc overstates the guard (Code #2, Integrity #8, Test #3)	Fixed (doc) + test	The doc now says what is actually checked: the copy's own cells, which covers a run that died between the row write and the attribute write. Index lag is documented as by design. Test: an_item_whose_typed_attribute_lags_its_row_is_not_listed_under_its_old_type.
Stale prose (Code #3)	Fixed	Spec :162, "third" index, Cargo.toml description.
Redundant graph_for (Code #5)	Fixed	Replaced by a debug_assert, since next_active already validated coverage.
Board-wide counters (Test #4)	Fixed	The counters now count removed edges and deleted ends at an active ticket.
Weak list counters (Test #5)	Fixed	Added counters: closed and archived neighbours, inbound contributes_to into a listed item, archived items of a graph list type (now asserted out of scope), and cut boards. Three unranked queries added.
typed: re-create, type set to None (Test #6)	Fixed	Covered in the robustness typed test, with the store as the oracle.
present_edges trusts the copy (Integrity #5)	Fixed	Entries that do not name the item as an end are dropped.
is_current downgrade (Integrity #6)	Documented	"No mixed fold versions" added to the fold doc, E4 §5.1 and the changelog. Not enforced in code: is_current stays a bool, and an older build cannot know a newer revision's meaning.
DynamoDB Local coverage (Integrity #7)	Fixed	Two tests: the_ranked_list_and_the_ranking_graph_read_back_as_from_memory, and a_hub_whose_adjacency_spans_query_pages_reads_every_edge (450 entries of about 2.9 KB, more than 1 MB). The recorder also checks the BatchGetItem count.
Info #6/#8–#11	No action	Context only.

Follow-ups filed (P3): 6j6v.wq9e (per-call request budget), 6j6v.jtfy (snapshot::import should report TooLarge rows and items left off an index), 6j6v.4r15 (batch active_board's point reads).

Tests run locally

nxs-fold-ddb lib, chat_and_memory, derived_differential, fold_differential, list_differential, records_differential, robustness: all pass. Facade derived_ranking, list_query, next_query: all pass. cargo check -p nxs-fold-ddb --features dynamodb --tests, cargo xtask docs check, cargo xtask changelog check origin/main, cargo fmt --all. The DynamoDB Local tests run in CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_016q5uMUkZJQW4fckJoA3FME