Summary

• Cedar's list-type custom fields (e.g. won_reason, pain_points_list, competitors_mentioned) are comma-joined internally, but Salesforce multipicklist fields require one semicolon-delimited string on the wire. getLabelFromAopEnumOptions() only ever recognized an already-semicolon-joined value, so a genuine Cedar multi-select value never converted correctly and failed Salesforce's own picklist validation , with the whole-string-match-before-split guard added so a compound option label (one that legitimately contains a comma) is never corrupted, even when its own comma-fragments happen to also be separately-defined option values.
• Because updateOpportunityFields() validated every field in a push up front and aborted the whole batch on the first invalid field, one bad multi-select field silently killed unrelated, valid fields in the same push , including closed_won_reason_details/closed_lost_reason_details, the customer-visible symptom this was root-caused from (a Warp rep's deal close-detail fields populating "sometimes" and not others). Per-field validation failures are now isolated: a bad field is dropped and logged, valid fields still reach Salesforce, and the result carries an optional failedFields array , plumbed through driver.ts, the sync workflow, and both tRPC mutations that push CRM field batches (upsertWorkingMemory, updateConversation) so a partial drop is surfaced to the caller instead of silently reporting bare success.

Test plan

• pnpm --filter @zero/server run types , clean.
• pnpm --filter @zero/server exec vitest run on all 7 touched/new test files , 69/69 passing:
  • salesforce-multipicklist.test.ts , comma→semicolon conversion, compound-label-not-corrupted, ;-input regression, isMultiPicklist:false no-op.
  • salesforce-partial-field-validation.test.ts (new) , mixed valid/invalid batch still writes the valid fields; all-invalid batch makes no Salesforce call; dropped fields logged and returned in failedFields.
  • update-external-crm-workflow.test.ts (extended) , updatedFields excludes a driver-dropped field instead of reporting the full attempted set.
  • crm-upsert-working-memory-partial-failure.test.ts / crm-update-conversation-partial-failure.test.ts (new) , both tRPC mutations throw naming the dropped field(s) on a partial CRM-sync failure, via a shared throwIfPartialCrmFailure() helper.
  • salesforce-object-binding.test.ts / salesforce-reference-resolution.test.ts , re-run for regression coverage on the shared updateOpportunityFields/validateAllowedValue path.
• Went through 3 rounds of fresh, impartial /thermo-review (each a context-free subagent, not the implementer) , 0 blocking issues survived to the final round. Fixed along the way: the failedFields plumbing gap on updateConversation, the compound-option-label corruption edge case, three line-width nits, and a stale doc comment.
• pnpm deps:check , 0 violations across 2011 modules.
• Full autofix:local was run once; its only failure (apps/mail/tests/modules/chat-store/chatHistoryList.test.ts) is a pre-existing, unrelated real-clock "Today"/"Yesterday" bucketing flake , confirmed via git diff --stat origin/staging -- apps/mail/ showing zero mail-app changes in this branch.

Verify in prod

• Axiom dataset: cedar-prod , a comma-joined multi-select value that fails the "every token is a known option" check:

  ['cedar-prod'] | where _time > ago(1h) and message contains "Comma-joined multipicklist value did not split into known options"
  | project _time, fieldName, value, parts
  

• Axiom dataset: cedar-prod , a field dropped from a Salesforce push by local validation:

  ['cedar-prod'] | where _time > ago(1h) and message == "[updateOpportunityFields] Dropped field , failed local validation"
  | project _time, user_id, opportunity_id, field, value, allowed_values
  

• Axiom dataset: cedar-prod , the workflow-level view of the sam