[cabcookie]

Stacked on #61 (vbp6, datetime). Merge #61 first; until then this diff includes its commit.

What

A plugin can declare a list field: [fields.email] type = "text" list = true. Each entry is a value of the field's type (text, date, datetime, enum, validated as a single value is) with an optional free-text label (work, private, …).

surface	add	remove	read
CLI	nxf entry add <id> <field> <value> [--label L]	nxf entry remove <id> <field> <value>	nxf entry list <id> <field>
MCP	flow_entry_add	flow_entry_remove	flow_entry_list
Engine	field_entry_add	field_entry_remove	field_entries

update --set <field>= (empty) clears a list; a non-empty --set (or create --set) on a list field is refused with a pointer to the entry verbs. Records carry entries under custom as [{"value": …, "label": …}] (label only when set, empty list omitted). nxf schema --json / flow_schema add "list": true beside kind.

Merge semantics (OR-set, add wins)

• Identity = the value within (item, field). Concurrent adds of one value → one entry.
• Label = label of the add with the highest (lamport, site, op id); relabel = re-add with the new label (no --label → unlabelled).
• Remove/clear tombstone the adds the writer observed, whatever their label; an unobserved concurrent add (re-add, relabel, new value) survives.
• Order = earliest present add of each value; a relabel keeps the place, remove + re-add goes last.

Core / hosted impact

• Ops: target_kind = field, op_type = add (value + U+001F + label) / remove (observed tags, ≤1024 per op). Older binaries store-don't-fold them.
• One new view field_entries(item_id, field, tag, value, label, lamport, site, removed), PK (item_id, field, tag); a remove only sets removed = 1 on the add's row, so any order converges on both appliers. Projection shared by replica and server (model::present_entries).
• Task reducer fold revision 2 → 3: replicas and hosted streams refold once. fold-ddb index revision unchanged (INDEX_REVISION stays 3), no GSI / table-contract change; the hosted records readers now also refuse a stream whose watermark names another task revision (RecordsError::NotCurrent { domain, found }, domain new) until it is refolded — no extra refold beyond the one the task bump already causes; hosted records read one more Query per item (field_entries#<item>#): active board 5n + 1 + p.
• Bounds (fold semantics): entry value+label ≤ 16 KiB, ids ≤ 128 bytes.

Refused at load

list = true with longtext, with merge, or with required = true; a ranking key of = { field = <list> }.

Facade: breaking

plugin::FieldDecl and read::SchemaField gain list and become #[non_exhaustive]; ActiveTicket/ListItem gain custom_lists (already non-exhaustive); new Engine::field_entry_add/remove/field_entries, read::field_entries, read::field_entries_to_value, write::entry_add/remove; FieldEntry re-exported. After review mitigation: Engine::field_entry_add/write::entry_add return the stored FieldEntry, Engine::field_entry_remove/write::entry_remove return the matched value (String), new write::entry_add_receipt/entry_remove_receipt; a list field name over 64 characters is refused at plugin load. app-foundations follows with 41j0.bm81.

Tests

• core: tests/field_entries.rs (two replicas: concurrent same-value add, remove vs re-add/relabel → add wins, concurrent removes, concurrent relabels, clear vs add, remove-before-add, malformed ops, 32 shuffled orders); full core suite green.
• facade: plugin load validation, ranking refusal, Engine seam, actor contract; full facade suite green.
• fold-ddb: shared generator writes entries → fold/records/list differentials compare served vs local (rows, records, JSON); cost tests updated; all green, including dynamodb_local against DynamoDB Local 3.3.1 (7/7).
• plugin-probe: file-fixture gains mirrors list; facade surfaces, sync round trip, and the real nxf command tree in-process; green.
• MCP handler test in-process; tests/mcp.rs surface/annotation tests; CLI verb_seam, schema, golden (entries.trycmd); cargo xtask docs check/coverage, changelog check ok.

Spec: docs/specs/plugin-custom-fields.md §5.2 (+ TB-CF-4, E1 §3.2, E4 cost). Guide EN/DE "List fields".

🤖 Generated with Claude Code

https://claude.ai/code/session_016q5uMUkZJQW4fckJoA3FME

[cabcookie]

Mitigation of the review (report 2026-10-12T12-02-18Z), commit 197a136

Finding (source · severity)	Disposition	Notes
Stale DynamoDB-local cost test (CQ #1 / TQ #1 · High)	Fixed	dynamodb_local.rs expects 4 * n Queries, renamed to …five_requests_per_ticket…; stale "three Queries" in lib.rs and E4 §5 cost text corrected. Ran against DynamoDB Local 3.3.1: 7/7 green
Hosted readers ignore the task revision (CQ #2 / Int #3 · Medium/Low)	Fixed	check_current compares the index AND task-reducer revisions; NotCurrent { domain, found } names which. INDEX_REVISION unchanged (3), so no extra refold. Test: a_stream_folded_by_task_revision_2_is_refused_then_refolded_and_reads_its_list_entries (active board + list)
Receipts echo raw input (CQ #3 · Medium)	Fixed	write::entry_add returns the stored FieldEntry, entry_remove the matched value; write::entry_add_receipt/entry_remove_receipt are the one spelling used by CLI and MCP (a datetime shows UTC)
Separator spelled four ways (CQ #4 · Low)	Fixed	One constant, model::ENTRY_SEP, in model, reducer, store, write
on scope asymmetry (CQ #5 · Low)	Fixed (decided)	Add keeps on; remove ignores it, so every entry on show can be removed (same reasoning as removing a dropped enum member). Documented in spec §5.2, the guide, and the doc comments; tested
Datetime trimming (CQ #6 · Low)	Fixed	validate::datetime trims, so --set and entries match; tests cover leap second (:60 → :59) and a space separator with zone (accepted, stored with T)
1 MB claim false (CQ #7 · Low)	Fixed	records.rs doc rewritten: the range grows with history, pagination is followed, compaction filed
Task revision 2→3 untested (TQ #2 · Medium)	Fixed	Local: a_store_folded_at_task_revision_2_folds_its_entry_ops_on_open; hosted: see above
Golden sandbox guard (TQ #3 · Medium)	Fixed	golden.rs fails if any .trycmd lacks <name>.in/ + <name>.out/, checked before trycmd runs; guide/agent-manifest got sandboxes. Confirmed it fails when a sandbox is removed
Typed entry validation untested (TQ #4 · Medium)	Fixed	facade tests/write.rs: enum non-member, bad dates, datetime stored/reported in UTC, remove across offsets, 16 KiB boundary (at limit / +1), on scope, dropped member removable
Successful nxf entry list output (TQ #5 · Medium)	Fixed	New plugin-probe bin probe-nxf (real command tree + fixture) runs as a subprocess with $HOME pinned in a temp workspace; exact human and --json stdout plus receipts asserted
Identical test bodies (TQ #6 · Low)	Fixed	The relabel test now races a relabel against a remove of an entry ahead of another, and checks the entry loses its place
Shuffle checks only values (TQ #7 · Low)	Fixed	Expected labels pinned and worked out by hand in the comment
Engine-seam failure paths (TQ #8 · Low)	Fixed	engine_field_entry_writes_return_the_stored_form_and_refuse_at_the_seam
MCP refusals (TQ #9 · Low)	Fixed	flow_entry_tools_refuse_with_the_error_kind_the_envelope_carries (kinds + receipts)
Datetime edge cases (TQ #10 · Low)	Fixed	See CQ #6
U+001F in op id poisons the field (Int #1 · Medium)	Fixed	parse_entry_add refuses such op ids; live_entry_tags skips them; two hostile-peer tests
Tombstone growth / phantom tombstones (Int #2 · Medium)	Documented + filed	Spec §5.2 "Tombstones grow and are not collected"; compaction / separate-prefix follow-up 6j6v.2sbr (P3)
Sort key may exceed 1 KiB (Int #4 · Low)	Fixed	An entry op's field must match the chunk-field grammar (≤64 plain ASCII) in the reducer, so both appliers agree; list field names over 64 characters are refused at plugin load
Peer-written non-normalized datetime (Int #5 · Low)	Fixed	entry_remove also removes the text as given; tested

Facade changes beyond the PR's original note: Engine::field_entry_add → Result<FieldEntry>, Engine::field_entry_remove → Result<String> (same for write::entry_add/remove), new write::entry_add_receipt / entry_remove_receipt. In fold-ddb (unpublished), RecordsError::NotCurrent gains domain. The changelog fragments are updated.

Gates run locally: core field_entries (17), crdt_properties, lib · facade lib (155), write (70), engine (29), read, actor_contract · fold-ddb full crate (all differentials + robustness) · dynamodb_local against DynamoDB Local (7/7) · cli golden, verb_seam, schema · plugin-probe list_field_consumer (6), ky26_file_consumer · nxs lib custom_field_tests (6), --test mcp flow (41) · cargo fmt --all · cargo xtask docs check · cargo xtask changelog check origin/main. Clippy is left to CI.