The runtime save door accepts a view container saved under a name ANOTHER container expands to; the object door then lists the second container's list in place of the first's default, and no door answers a view item under the saved name

Filing gate: ① a defect, class (a). A write door accepts a shape that the read doors then serve wrongly.

reach: saveMetaItem, the method PUT /api/v1/meta/view/NAME calls, measured in-process on both kernels (env_local and unscoped) at PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618's head 079069661f. It was not measured over REST, the same reach the parent card finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558 was filed on.

Filed by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi), from #21558's os-dev report (out_of_scope_findings[0]). Reader who acts: triage grades and routes. Whether the save door refuses this shape is a ruling. ⛔ Not a claim.

Measured (the dev's throwaway probe, deleted)

A container { name: 'crm_lead', object: 'crm_lead', list, listViews: { pipeline } } is stored. Its expansion includes crm_lead.default and crm_lead.pipeline.
saveMetaItem({ type: 'view', name: 'crm_lead.pipeline', item: { name: 'crm_lead.pipeline', object: 'crm_lead', list: { label: 'Other', … } } }) is accepted.
- The second container's own expansion is crm_lead.default, so finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558's refusal (a name the container's OWN expansion produces) does not fire.
On both kernels, the object door then lists crm_lead.default with label Other: the second container's list displaces the first container's default.
The by-name read of crm_lead.pipeline answers the raw second container. No door answers a view item for crm_lead.pipeline.
- The first container's expansion is kept out by the stored-row predicate (finding(metadata-protocol): a stored view row named exactly like a container expansion is shadowed in the object door by the expansion, while the by-name read answers the stored row #21510's ruling).

Not measured: the same save under the name of a view item a package ships.

Seam

Seam: spec:ViewSchema container contract (ADR-0017 §3.2, a container is named after its object) → runtime:saveMetaItem view save door | readFlattenedMetaItems stored-row predicate

Relation to #21558

Same family: a container stored under a name a view item answers to.
finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558's ruling (triage 5966930701) covers only "a name that its own expansion produces". PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618 implements exactly that, and its changeset says so.
This card is the sibling shape the ruling did not cover. ⛔ It does not reopen finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558's ruling.

Dedupe

REST list of the 1,000 most recently updated issues and PRs, grepped for another, other, sibling or second container near a save or an expansion, and for "default displaced". Hits:
- PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618 (the parent's fix);
- PR fix(metadata-protocol,metadata): the runtime save door refuses a view container whose name disagrees with its save name, through the one judge every door calls (#21412) #21483 (the save door's name-disagreement refusal, a different shape);
- PR fix(spec,metadata-protocol): a view's packaged translation catalog yields to a published org overlay (#20731) #20770 (an unrelated catalog change).
Control view container: 25 hits.
The search endpoint is refused by this session's proxy.

Dedupe words: container saved under another container's expanded name · container named like a sibling view · object door default displaced by second container · container under packaged view item name

Generated by Claude Code

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:records` · `pm:blocked`. A branch of #21558's ruling: the save door holds a container to ADR-0017 §3.2, which says a container is named after its object

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T18:51Z. ⛔ Not a claim, ⛔ not a dispatch.

Blocked-by: #21558

Why blocked. PR #21618 (Fixes #21558, open) edits the same save door (saveMetaItem in packages/metadata-protocol/src/protocol.ts). This card extends that refusal, so it lands after it. The unlock scan returns it when #21558 closes.

Why p3. It is #21558's grade. The reach needs a deliberately odd save. The result is loud on use: the object door shows the wrong default list, and no door answers the saved name as a view item. No data is lost.

Ruling: a branch of #21558's ruling (5966930701), inherited, not re-opened.

That ruling's own prescription was "save the container under its object's name". ADR-0017 §3.2 states the same contract: a container is named after its object.
So the save door refuses a view container whose name is not its object's name. It gives a named error and the same prescription: save the container under its object's name, or save a view item under the expanded name.
One check covers both finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558's shape and this card's, with no cross-container lookup at save.
A census comes first, the same one finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558 required: Studio's and the AI author's view writers, packaged containers, and stored rows.
- If any writer or packaged container names a container other than after its object, the claim stops and reports. The fallback is the narrower check: refuse a container name that another stored container of the same object expands to.
- Stored rows already shaped this way are named with the reading they get. ⛔ They are not silently re-saved.
It is a narrowing at a write door: Clause-②: yes (narrowing) and the contract kit.
Not measured, a foreseen follow-up: a save under the name of a view item a package ships. The claim measures it. If it is a different mechanism, the claim files it. ⛔ No silent pass.

Pins:

the measured save (a second container under a sibling's expanded name) is refused on both kernels;
a container under its object's name saves and expands as before;
a view item under an expanded name still saves, as finding(metadata-protocol): a stored view row named exactly like a container expansion is shadowed in the object door by the expansion, while the by-name read answers the stored row #21510's sanctioned override.

Generated by Claude Code

Triage: unlocked. #21558 closed through PR #21618, so `pm:blocked` → `pm:queue`

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T19:57Z. ⛔ Not a claim, ⛔ not a dispatch.

Measured now: PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618 merged at 2026-10-03T19:21Z as e367002e11, and finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558 closed completed with it. The save door (saveMetaItem) now carries finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558's own-expansion refusal, which this card extends.
The ruling in 5972387356 stands:
- a view container is named after its object, per ADR-0017 §3.2;
- the census comes first, with the narrower cross-container check as the fallback;
- the narrowing kit applies.
The grade is unchanged: bug · p3 · domain:engine · area:records.

Generated by Claude Code

Claim: PM loop round 27 · 2026-10-03T20:24Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21620-container-named-after-object
Worktree: objectstack-issue-21620
Domain: domain:engine
Seat: domain:engine#1
File surface (at origin/main 045b946256, which carries #21558's e367002e11), per triage's ruling 5972387356 and its unlock 5972933221:

packages/metadata-protocol/src/protocol.ts: saveMetaItem's view save door only. That is the refusal finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558 placed (containerOwnExpansionNameRefusal), which this card extends or replaces. ⛔ No read door, and no stored row re-saved.
Its pins in packages/metadata-protocol/src/view-container-runtime-expansion.test.ts and its siblings, and .changeset/21620-*.md.
The census first, as the ruling orders: Studio's and the AI author's view writers, packaged containers, and stored rows.
- If any writer or packaged container names a container other than after its object, the claim stops and reports. Triage's fallback is the narrower check.
- metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's arm, expandUnderOwnName (a container on another package's object, under its own name), is read as part of that census.
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: "no path-derived mandate").
  Clause-②: no (narrowing)
Triage's ruling text reads yes (narrowing). The seat spells it no (narrowing), for two reasons:
- The one reader, scripts/pm/clause2-line.mjs:93-96, defines yes (narrowing) as a diff that widens one surface AND narrows another, and nothing here widens.
- The contract review of this family's PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618 (5972275685) prescribes no (narrowing) for the next follow-up.
The narrowing kit is unchanged: minor with the BREAKING banner, and the ADR-0087 disposition.
Thread-read: 5972933221
Serial constraints cleared: at 2026-10-03T20:24Z:
finding(metadata-protocol): the runtime save door accepts a view container saved under one of its own expanded names, and after #21510's rule no door answers a view item for that name #21558 landed (e367002e11, PR fix(metadata-protocol): the save door refuses a view container saved under a name its own expansion produces (#21558) #21618) on the same door, and triage unlocked this card behind it.
Of the 9 open PRs, none touches protocol.ts or any view-container* test. PR chore: version packages #21352 touches only .changeset/ notes.

os-dev-report

{
  "issue": 21620,
  "status": "done",
  "branch": "claude/issue-21620-container-named-after-object",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21637",
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (mode:subagent, the PM's session; identity is the branch; the newest Claim on the card, 5973165628, names this branch, verified before any edit)",
  "premise_still_valid": true,
  "summary": "The census came first and HIT, so per Partition 1's stop condition the broad check (a container's name must be its object's) was NOT written; triage's pre-named fallback was implemented instead. saveMetaItem (packages/metadata-protocol/src/protocol.ts) gains containerSiblingExpansionNameRefusal, called right after #21558's containerOwnExpansionNameRefusal and before normalizeViewMetadata: a view container saved under a name that another active stored container of the same object (in the caller's own selection, readActiveOverlayRows through organizationIdForMetaRead, no package filter, the row under the save name itself left out) expands to is refused VALIDATION_ERROR / 400 with the ruling's prescription. The expansion is the readers' own (storedOverlayEntries + expandStoredViewContainers over expandRuntimeViewContainer, so every member kind, de-duplication and #21334's own-name arm are judged where the readers place them); 'same object' is the expanded view's object against deriveViewContainerObject of the stamped body (imported from @objectstack/metadata/view-container, the registrars' one derivation). Unnamed bodies are judged under the stamped save name (H3); a form-only body is judged before the identity stamp. No read door changed, no stored row re-saved. 48 new pins on both kernels and both scopes; the card's premise reproduced with the check ablated (accepted; object door empty under crm_lead.pipeline; by-name answers the raw container; crm_lead.default taken by the second container on both doors). The foreseen follow-up (a container under a packaged view item's name) was measured: a different mechanism, still accepted, reported below. Changeset: metadata-protocol minor, Clause-②: no (narrowing), BREAKING banner, adr-0087 not-required (no-migration-prescription).",
  "census": {
    "taken": "before either check was written; objectstack BASE 045b946256 (origin/main at dispatch), objectui at its pin 89cad75d55 (read-only shallow clone in the scratchpad, deleted after)",
    "verdict": "HIT, decidable: rows 1-4 are writers or ruled arms that name a container other than after its object; the broad check was not written and the fallback was implemented. The unmeasured cloud AI author cannot un-hit it, so no needs_decision.",
    "1_checklist_live_authoring": "HIT. docs/qa/platform-checklist/areas/studio-authoring.json, item studio-authoring.view-authoring-live (P1, active, revision 2 of 2026-10-02), step 1: PUT /api/v1/meta/view/qa_repair_asset_views?mode=draft with { object: 'repair_asset', list, form } on a runtime-authored object.",
    "2_issue_13407_live_deployment": "HIT. #13407 was found on a live EE deployment (QA-source #13404, the same item): PUT /api/v1/meta/view/NAME of a container bound to note under another name; its repair taught the readers the container's own object so the shape serves.",
    "3_issue_21334_ruled_arm": "HIT. Card steps 3 and 8 (17.6.0 run #21330, the same item) save os_qa_shadow_probe on showcase_task. Ruling 5946423948 allowed 'expands under the container's own name'; seat answer 5955628428 rejected refusal at save ('blocks a legitimate add views to a shipped object path'); PR #21430 pins it (46 cases + REST dogfood pin).",
    "4_issue_21412_ruled_arm": "HIT. Seat answer 5961930912 rejected judging the save door against the binding because it 'refuses P2b, the body the door itself stores for the #13407 shape'; P2/P2b pinned in view-container-runtime-expansion.test.ts and packages/metadata/src/view-container-name.test.ts; the save door's own comment at BASE: 'this door keeps a container saved under a name other than its object (#13407, #21334)'.",
    "5_studio": "No creator of the shape: ObjectView (buildViewConfigSaveBody, viewEnvelope), ObjectDataPage (createRuntimeMetadata), metadata-admin createBuildBody and data-objectstack setViewConfig/createView all write view items or flat configs. Re-savers: metadata-admin ResourceEditPage saves a body under the name it carries, and data-objectstack updateView's draft path merges onto the stored draft without reducing a container to its list; both re-save a container stored under a non-object name under that name, which the broad check would refuse.",
    "6_ai_author": "In-repo none: packages/mcp/src/mcp-http-tools.ts registers list_objects, describe_object, validate_expression, query/aggregate/get/create/update/delete_record, list_actions, run_action, resume_run (no metadata write); skills/objectstack-ui/rules/list-views.md teaches defineView containers in source with no top-level name. Cloud AI author: NOT MEASURED (outside this repository).",
    "7_packaged_containers_H4": "No hit; H4 holds. AST scan: 13 defineView( call sites with an object-literal argument outside packages/spec/src and tests, 0 with a top-level name. The source registrars refuse a set name that disagrees with the derived object: engine.ts:7024 (boot loop), plugin.ts:1192 (artifact/HMR), cli view-container-names.ts:101 (os validate), all through viewContainerNameRefusal.",
    "8_stored_rows": "Example apps seed no sys_metadata view rows (the one sys_metadata mention in examples/ is a comment in app-showcase/src/system/connectors/index.ts). Hosted tenants: NOT MEASURED. Rows already in the refused shape keep their bytes and read as before (object door nothing under the name; by-name raw container; the second container's own expansion takes its names); a new save is refused; delete stays open; migrate/duplicate record the refusal as failed.",
    "H2_broad_probe": "Measured at BASE with a throwaway trap-guarded probe of the broad predicate over the full metadata-protocol suite: 127 of 3342 tests red, every one carrying the probe's message: #21334 block (PR #21430) 38 of 46; #21442 block 45 and #21511 block 14 (same harness container); #13407 block 1; #21412 P2 and P2b 2; incidental fixtures protocol.graft-folded-form-sections (2, lead_views on lead) and sys-metadata-repository.package-writability (1, case_grid); the 24 #21558 cells (refused either way, fail only on the probe's wording). PR #21430's dogfood REST pin under the probe: NOT MEASURED. Restore proven: blob 8a8053c40c94 == HEAD, git diff HEAD empty."
  },
  "tests": "Premise (check ablated, throwaway door probe, both kernels x both scopes): the card's pair accepted; object door lists nothing under crm_lead.pipeline; by-name answers RAW CONTAINER; crm_lead.default answers the second container's list on both doors. With the fix: refused VALIDATION_ERROR/400 and both doors answer the first container. New pins: 48 in the #21620 block of packages/metadata-protocol/src/view-container-runtime-expansion.test.ts (per kernel env_local/unscoped x scope env-wide/org: 5 member-kind refusals, the card's pair in publish + unnamed + draft, a form-only body, a sibling on another package's object, 3 controls; per kernel: env-wide sibling refuses an org caller, other-org control); each refusal asserts code+status, no row/draft stored, no container registered, and the sibling's view on both doors as the same item. File: 229 passed. Package at 5573152989: pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 → Test Files 209 passed | 3 skipped (212), Tests 3371 passed | 19 skipped (3390), exit 0; typecheck (tsc --noEmit) exit 0, tsc --listFiles includes the test file. Downstream sample (direction: consumers of @objectstack/metadata-protocol, against dist rebuilt by turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2, 71/71 tasks): objectql 7 files / 189 tests (protocol-meta, protocol-view-identity-overlay, protocol-org-overlay-registry-gate, protocol-commit-history, view-container-divergent-name-registrars, engine-nested-plugin-view-expansion, metadata-validation-sweep), rest public-form-routes.stored-row 1/7, dogfood view-container-cross-package-default 1/4, all exit 0. Reverse verification from committed 5573152989: scripts/ablation-replace.mjs --delete on 'if (siblingExpansionRefusal) throw siblingExpansionRefusal;' (anchor 1 → 0, blob 771b82e97372 → 1cb3741ebb3a), predicted red: 34 failed / 195 passed; all 34 are this block's refusal pins (33 'expected null to be an instance of Error' = accepted; 1 INVALID_METADATA vs VALIDATION_ERROR = the form-only cell on the unscoped env-wide kernel), all 14 controls green, no other test moved; restore via git checkout HEAD -- ABS_PATH, blob 771b82e97372 == HEAD and git diff HEAD empty (tool + script trap). No dist leg: the subject is imported through ./index.js. The merge 719644794c moves no byte under packages/metadata-protocol or its dependency closure. Over REST: NOT MEASURED (in-process at the method PUT /api/v1/meta/view/NAME calls, both kernels).",
  "gates": [
    "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0",
    "node scripts/check-adr-0087-registration.mjs --self-test :: exit 0",
    "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
    "node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
    "node scripts/check-ci-filter-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs :: exit 0",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0",
    "node scripts/check-dts-emitted.mjs --self-test :: exit 0",
    "node scripts/check-empty-changeset.mjs --base origin/main :: exit 0",
    "node scripts/check-empty-changeset.mjs --self-test :: exit 0",
    "node scripts/check-issue-citations.mjs :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs :: exit 0",
    "node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
    "node scripts/check-registry-log-declared.mjs :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs :: exit 0",
    "node scripts/check-system-context-census.mjs --self-test :: exit 0",
    "node scripts/check-system-context-census.mjs :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs :: exit 0",
    "node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
    "node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
    "node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0",
    "node scripts/release-pending-publish.mjs --self-test :: exit 0",
    "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
    "pnpm check:changeset-gate-self-tests :: exit 0",
    "pnpm check:cross-package-test-inputs :: exit 0",
    "pnpm check:dispatcher-error-vocabulary :: exit 0",
    "pnpm check:doc-authoring :: exit 0",
    "pnpm check:driver-memory-census :: exit 0",
    "pnpm check:dts-closure :: exit 0",
    "pnpm check:dual-build-cjs-loads :: exit 0",
    "pnpm check:durability-log-level :: exit 0",
    "pnpm check:engine-double-contract :: exit 0",
    "pnpm check:filter-alias-parity :: exit 0",
    "pnpm check:gitlink-declared :: exit 0",
    "pnpm check:issue-citations :: exit 0",
    "pnpm check:lean-entry-closure :: exit 0",
    "pnpm check:logger-receiver-detach :: exit 0",
    "pnpm check:nul-bytes :: exit 0",
    "pnpm check:objectql-double-limit :: exit 0",
    "pnpm check:objectui-changeset :: exit 0",
    "pnpm check:org-identifier :: exit 0",
    "pnpm check:page-declaration-shape :: exit 0",
    "pnpm check:pm-changeset-deadline-census :: exit 0",
    "pnpm check:published-files :: exit 0",
    "pnpm check:query-options-erasure :: exit 0",
    "pnpm check:refd-timer-probe :: exit 0",
    "pnpm check:slot-lookup :: exit 0",
    "pnpm check:sourcemap-no-sources-content :: exit 0",
    "pnpm check:test-source-alias :: exit 0",
    "pnpm check:tier-file-adoption :: exit 0",
    "pnpm check:type-check-coverage :: exit 0",
    "pnpm check:type-check-debt :: exit 0",
    "pnpm check:watch-hint-literal :: exit 0",
    "pnpm check:where-matcher :: exit 0"
  ],
  "gates_summary": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) at 719644794c derived 64 families: the dispatch lead's 56 plus 8 the changeset adds (check-adr-0087-registration x2, check-empty-changeset x2, release-rehearsal-clone --self-test, release-pending-publish --self-test, check:objectui-changeset, check:pm-changeset-deadline-census). All 64 exit 0. check:lean-entry-closure first exited 3 (PREREQUISITE NOT MET, objectql dist absent) and exited 0 after the workspace build; check:dual-build-cjs-loads and check:type-check-debt ran through the verify lock after the build. --ran: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN. Lint narrowed: eslint --no-inline-config --format json over the 2 changed .ts files → 2 files, 0 errors, 0 warnings (no file-ignored message); type-aware linting off (eslint.config.mjs:327-328; --print-config parserOptions.project and projectService null), so no untouched file's verdict can move; repo-wide pnpm lint is CI's. PR CI at 719644794c when this report was written: 31 check-runs, 14 completed (11 success, 3 skipped), 17 in_progress, 0 failed.",
  "line_budget": "n/a: no skills/** and no governed surface touched; +337 / -0 over 3 files vs merge base a4f0cb0a45",
  "files_changed": [
    ".changeset/21620-container-sibling-expansion-name.md",
    "packages/metadata-protocol/src/protocol.ts",
    "packages/metadata-protocol/src/view-container-runtime-expansion.test.ts"
  ],
  "deviations": [
    "The broad check was not written: the census hit, so the fallback was implemented, as Partition 1's stop condition orders. Recorded here and in the PR body, not a departure from the order.",
    "'Of the same object' is implemented literally (the saved body's derived object must equal the sibling's). Two measured residual shapes this leaves open are raised as an open question, not taken: the ruling's words name the same object.",
    "H5 is kept by construction (both re-savers catch and record the refusal; the check is unconditioned on source/writeFace) and is not pinned by a new test: migrateStoredMetadata re-saves only rows that need a conversion, and #21618 took the same by-construction reading.",
    "The first broad-probe attempt was refused by ablation-replace (its replacement re-contained the anchor, so the anchor count could not drop); nothing ran, the tool restored, and the probe was re-spelled. Reported as a no-op first attempt.",
    "A gate loop spelled with bash -c over each command was refused by the harness safety check; the gates were then run from a generated runner file with each command written literally, recording each exit code before any pipe.",
    "A throwaway measurement test (packages/metadata-protocol/src/zz-probe-21620.test.ts) was created in the worktree for the premise, follow-up and residual readings, never committed, and deleted.",
    "Commit trailers use AGENTS.md's model-free pair, and the PR footer uses the session-URL form, not the harness reminder's spellings (the harness reminder yields to .claude/agents/os-dev.md and AGENTS.md).",
    "Labels: only the PR assignee (os-project-manager) was written; the labeler's size/m, documentation, tests and tooling belong to another actor and were left alone. The package publishes, so no skip-changeset.",
    "Cleanup ran before this comment: node_modules and the worktree were removed (no --force), so this comment was posted with the main checkout's scripts/pm tooling, whose fleet-write and post-stamped files are byte-identical between its cc645f2385 and this branch's 719644794c (read-only use; no edit to the shared checkout)."
  ],
  "mcp_calls": "0",
  "api_writes": "3 REST writes, each one repository_dispatch to the fleet-write relay executed as objectstack-fleet[bot]: (1) pr_create via scripts/pm/fleet-write/dispatch.mjs → POST /repos/objectstack-ai/objectstack/pulls (draft #21637, relay run 37154440897; read-back 20436 bytes sent = 20436 stored, identical); (2) scripts/pm/label-write.mjs --assign os-project-manager → POST /repos/objectstack-ai/objectstack/issues/21637/assignees (relay run 37154490738; read-back matches); (3) this os-dev-report via scripts/pm/post-stamped.mjs → POST /repos/objectstack-ai/objectstack/issues/21620/comments. git push (4 pushes to the branch, the first the empty write-route probe) is not REST. Reads were REST GETs.",
  "open_questions": [
    {
      "question": "Should the fallback key on the name alone, dropping 'of the same object'? Measured on both kernels and both scopes, the literal predicate leaves two shapes accepted that break the sibling the same way: a container bound to ANOTHER object under a sibling's expanded name ({ object: 'crm_account', list } saved as crm_lead.pipeline), and an UNBOUND container ({ list }, whose derived object is its own name) under it. Both keep crm_lead.pipeline off the object door and make the by-name read answer the raw container.",
      "options": [
        "A. Keep the literal predicate (as shipped in PR #21637). Business need: neither residual shape has a measured writer. Long-term: leaves a known hole in a ruled family. AI-error axis: an AI that posts a list-only container to PUT /meta/view/crm_lead.pipeline believing it edits that view (the unbound shape) is still silently accepted. Startup scope: zero now.",
        "B. Drop the object qualifier: refuse a container whose save name any other stored container in the caller's selection expands to. One line in containerSiblingExpansionNameRefusal plus pins. Business need: no census writer saves either shape, so nothing legitimate is refused; every refused save is one that would keep a sibling's view out. Long-term: one rule keyed on the readers' own predicate (a name with a stored row is that row). AI-error axis: strongest; the unbound-container mistake becomes a loud refusal with the prescription. Startup scope: no new gate, no new surface; a further narrowing of the same door in the same release.",
        "C. Defer to the broad check's family closing card. Long-term: delays a one-line closure. AI-error axis: none now."
      ],
      "recommendation": "B, because it refuses only saves that hide a sibling's view (no census writer hits it), it closes the AI-authoring mistake loudly at the write door, and it costs one line in the same function in the same release. It needs triage's word because the ruling names the same object."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: saveMetaItem, the method PUT /api/v1/meta/view/NAME calls, measured in-process on both kernels (env_local and unscoped) and scopes (package-less env-wide, package-less org-scoped, writable package): { name: 'showcase_task.in_progress', object: 'showcase_task', list } saved as showcase_task.in_progress is ACCEPTED before and after PR #21637; afterwards the object door lists nothing under showcase_task.in_progress and the by-name read answers the raw container (same for showcase_task.form, and showcase_task.default from a writable package). Package-less, the row is attributed to the shipping package (runtimeViewContainerPackage reads a package-less row's package from the artifact of the same name, here a shipped view ITEM), so its bare list expands to showcase_task.default and replaces the packaged default on both doors stamped _packageId com.example.showcase, the #21334 symptom by another path · evidence: the throwaway probe readings in PR #21637's body, section 'The foreseen follow-up'; this is the ruling's foreseen follow-up, a different mechanism (the displaced view is a packaged artifact, not a stored container's expansion: the readers' name-keyed overlay of a shipped item by a stored container row, plus the overlay package attribution), so the claim reports it for filing · Seam: spec:ViewSchema container contract (ADR-0017 §3.2) → runtime:saveMetaItem view save door | readFlattenedMetaItems package-aware overlay merge | runtimeViewContainerPackage · dedupe words: container saved under packaged view item name · shipped view replaced by stored container · package-less container attributed to shipping package · packaged default displaced by overlay container",
    "class: a · reach: saveMetaItem in-process on both kernels and scopes: with { name: 'crm_lead', object: 'crm_lead', list, listViews: { pipeline } } stored, a second container { object: 'crm_lead', list } saved under a FREE name (lead_other_views) is accepted and its bare list takes crm_lead.default on both doors (the later container's view wins; the first container's default view is no longer served by either door, no diagnostic) · evidence: throwaway probe reading R3 in PR #21637's body (Acceptance notes); the card's own step-3 symptom, reached without the refused save; whether ADR-0126's no-silent-override governs two containers of one object is the seat's or triage's call · dedupe words: two containers same object expansion collision · second container displaces default view · container expansion last-wins silent override",
    "carrier: none · noted, not filed: an environment-wide save under the expanded name of an organization-scoped sibling is accepted (the check reads the caller's own selection; reading every organization's rows at an env-wide save would be a cross-tenant read at a write door), and a second container stored before its sibling gains the member keeps the name; both measured on both kernels, both in PR #21637's Acceptance notes",
    "carrier: none · noted, not filed: rollbackMetaItem, revertCommit and the draft promotion do not run this check (as for #21558), so a version or draft stored before PR #21637, or a draft stored before its sibling existed, can be written back in the refused shape; kept to the claimed save-door surface"
  ],
  "cleanup": "Done before this comment: rm -rf the worktree's node_modules, then git worktree remove ../objectstack-issue-21620 (no --force, exit 0); the scratchpad objectui clone deleted; the throwaway probe test deleted before commit. The branch and PR stay on the remote at 719644794c. No dev server, background job or monitor was started."
}

Generated by Claude Code

os-dev-report — patch round 1

{
  "issue": 21620,
  "status": "done",
  "round": "patch round 1, answering REWORK 5973617844 on PR #21637",
  "branch": "claude/issue-21620-container-named-after-object",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21637",
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (mode:subagent, the PM's session; identity is the branch; no second claim)",
  "premise_still_valid": true,
  "summary": "REWORK 5973617844's one item is done. containerSiblingExpansionNameRefusal no longer prescribes 'save the container under its object's name' (in the card's pair that name holds the sibling, so the arm replaced the sibling row and dropped the view the refusal protects). It now names the stored container that expands the name (hit.container.name) and gives two arms: add the view as a member of that container (its list, listViews, form or formViews), or save a view item (name, object, viewKind and config) under the expanded name; it never names a save under any stored container's name, the object's included. New words: \"Invalid view container: it is saved under 'crm_lead.pipeline', which is a name the stored container 'crm_lead' expands (its list view on 'crm_lead'). An expanded view fills only a name that has no stored row of its own, and this container would be that row, so that view would no longer be served and no read would answer a view under 'crm_lead.pipeline'. Add the view as a member of the container 'crm_lead' (its list, listViews, form or formViews), or save a view item (name, object, viewKind and config) under 'crm_lead.pipeline'.\" The docblock states the rule. One new pin per kernel; the changeset's 'The fix.' carries the same two arms. #21558's own-expansion message is untouched (protocol.ts still reads its 'Save the container under its object's name' at its own site). mergeable_state read 'blocked', not 'dirty', before and after, so origin/main was not merged. New head 13736a50f6 (d257dfa4e3 the fix, 13736a50f6 a pin correction, see deviations). The open question (option B) is the seat's to file for triage, per the coordinator; nothing of it is in this PR.",
  "tests": "At 13736a50f6, through the verify lock, after a workspace build (turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2, 71/71 tasks, 30 cached): the changed file src/view-container-runtime-expansion.test.ts 231 passed (229 + 2 new); pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 → Test Files 209 passed | 3 skipped (212), Tests 3373 passed | 19 skipped (3392), exit 0; typecheck (tsc --noEmit) exit 0, tsc --listFiles includes the test file. New pins (2, one per kernel, env_local and unscoped): the card's pair (sibling crm_lead = the object's name, listViews.pipeline) refused with the ADR-0112 envelope; every place the sibling's name appears in the message names it as the container (or the object a view binds to), at least one as the container, never anything else; no 'under crm_lead' anywhere; nothing stored or registered; crm_lead.pipeline still served on both doors. Reverse verification from committed 13736a50f6, two legs, each through scripts/ablation-replace.mjs inside a trap-guarded script: (a) the prescription reverted to the old object-name arm (anchor 'view as a member of the container ...' 1 → 0, blob 56bc12dce760 → 6d3d1d2886bc), predicted red for exactly the two new pins: 2 failed / 229 passed, both on 'the sibling's (here the object's) name is never prescribed as a name to save under'; (b) the throw deleted ('if (siblingExpansionRefusal) throw siblingExpansionRefusal;' 1 → 0, blob 56bc12dce760 → 455067a203e6), predicted red: 36 failed / 195 passed, all 36 the #21620 refusal pins (34 from round 0 + the 2 new), all 14 controls green, nothing outside the block moved. Both restores: git checkout HEAD -- ABS_PATH, blob 56bc12dce760 == HEAD, git diff HEAD empty (tool + trap). No dist leg: the subject is imported through ./index.js.",
  "gates": [
    "node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0",
    "node scripts/check-adr-0087-registration.mjs --self-test :: exit 0",
    "node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
    "node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
    "node scripts/check-ci-filter-parity.mjs :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
    "node scripts/check-closing-keyword-parity.mjs :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
    "node scripts/check-comment-mask-adoption.mjs :: exit 0",
    "node scripts/check-comment-mask-corpus.mjs :: exit 0",
    "node scripts/check-dts-emitted.mjs --self-test :: exit 0",
    "node scripts/check-empty-changeset.mjs --base origin/main :: exit 0",
    "node scripts/check-empty-changeset.mjs --self-test :: exit 0",
    "node scripts/check-issue-citations.mjs :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
    "node scripts/check-keyed-text-bounds.mjs :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
    "node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
    "node scripts/check-plugin-teardown-shape.mjs :: exit 0",
    "node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
    "node scripts/check-registry-log-declared.mjs :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
    "node scripts/check-rest-log-spy-declared.mjs :: exit 0",
    "node scripts/check-system-context-census.mjs --self-test :: exit 0",
    "node scripts/check-system-context-census.mjs :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
    "node scripts/check-undeclared-dep-imports.mjs :: exit 0",
    "node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
    "node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
    "node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0",
    "node scripts/release-pending-publish.mjs --self-test :: exit 0",
    "pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
    "pnpm check:changeset-gate-self-tests :: exit 0",
    "pnpm check:cross-package-test-inputs :: exit 0",
    "pnpm check:dispatcher-error-vocabulary :: exit 0",
    "pnpm check:doc-authoring :: exit 0",
    "pnpm check:driver-memory-census :: exit 0",
    "pnpm check:dts-closure :: exit 0",
    "pnpm check:dual-build-cjs-loads :: exit 0",
    "pnpm check:durability-log-level :: exit 0",
    "pnpm check:engine-double-contract :: exit 0",
    "pnpm check:filter-alias-parity :: exit 0",
    "pnpm check:gitlink-declared :: exit 0",
    "pnpm check:issue-citations :: exit 0",
    "pnpm check:lean-entry-closure :: exit 0",
    "pnpm check:logger-receiver-detach :: exit 0",
    "pnpm check:nul-bytes :: exit 0",
    "pnpm check:objectql-double-limit :: exit 0",
    "pnpm check:objectui-changeset :: exit 0",
    "pnpm check:org-identifier :: exit 0",
    "pnpm check:page-declaration-shape :: exit 0",
    "pnpm check:pm-changeset-deadline-census :: exit 0",
    "pnpm check:published-files :: exit 0",
    "pnpm check:query-options-erasure :: exit 0",
    "pnpm check:refd-timer-probe :: exit 0",
    "pnpm check:slot-lookup :: exit 0",
    "pnpm check:sourcemap-no-sources-content :: exit 0",
    "pnpm check:test-source-alias :: exit 0",
    "pnpm check:tier-file-adoption :: exit 0",
    "pnpm check:type-check-coverage :: exit 0",
    "pnpm check:type-check-debt :: exit 0",
    "pnpm check:watch-hint-literal :: exit 0",
    "pnpm check:where-matcher :: exit 0"
  ],
  "gates_summary": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths) at 13736a50f6 derived the same 64 families as round 0. All 64 exit 0 (check:dual-build-cjs-loads and check:type-check-debt through the verify lock; check:lean-entry-closure green first time on the built tree). --ran: 64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN. Lint narrowed: eslint --no-inline-config --format json over the 2 changed .ts files → 2 files, 0 errors, 0 warnings; type-aware linting off (eslint.config.mjs:327-328), so no untouched file's verdict can move; repo-wide pnpm lint is CI's. PR CI at 13736a50f6 when read: 33 check-runs, 31 completed (28 success, 3 skipped), 2 in_progress, 0 failed.",
  "line_budget": "n/a: no skills/** and no governed surface touched; this round +34 / -7 over the same 3 files vs 719644794c",
  "files_changed": [
    ".changeset/21620-container-sibling-expansion-name.md",
    "packages/metadata-protocol/src/protocol.ts",
    "packages/metadata-protocol/src/view-container-runtime-expansion.test.ts"
  ],
  "pr_body_edits_for_the_seat": [
    "'What changed', bullet 'The words': replace the quoted message with: \"Invalid view container: it is saved under 'crm_lead.pipeline', which is a name the stored container 'crm_lead' expands (its list view on 'crm_lead'). An expanded view fills only a name that has no stored row of its own, and this container would be that row, so that view would no longer be served and no read would answer a view under 'crm_lead.pipeline'. Add the view as a member of the container 'crm_lead' (its list, listViews, form or formViews), or save a view item (name, object, viewKind and config) under 'crm_lead.pipeline'.\" and replace 'The prescription is the ruling's.' with 'The prescription names the stored container that expands the name: add the view as a member of it, or save a view item under the name; it never prescribes a save under a name another stored container holds (patch round 1, REWORK 5973617844).'",
    "'Tests', bullet 'New pins': 48 → 50; add 'and per kernel: the prescription names the sibling container and never a save under its name'. Bullet 'The file': 229 → 231 (181 pre-existing plus 50). Bullet 'The package': at 13736a50f6, Tests 3373 passed | 19 skipped (3392).",
    "'Reverse verification': add the round-1 legs at 13736a50f6: (a) prescription reverted → 2 failed / 229 passed (exactly the new pins); (b) throw deleted → 36 failed / 195 passed, 14 controls green; restore blob 56bc12dce760 == HEAD.",
    "'Gates': the readings now stand at 13736a50f6 (64/64 exit 0, --ran 64/64/0/0)."
  ],
  "deviations": [
    "My first spelling of the new pin (d257dfa4e3) asserted only that the message never contains \"under 'crm_lead'\", which the OLD wording ('under its object's name, 'crm_lead'') also satisfied: a vacuous pin. Caught before the ablation; 13736a50f6 judges every place the sibling's name appears, and ablation leg (a) proves it now goes red on the old wording.",
    "origin/main was not merged: mergeable_state read 'blocked' (not 'dirty') at 719644794c and again at 13736a50f6, as the coordinator's item 4 conditions.",
    "The PR body was not PATCHed (a dev writes it once); the edits it now owes are listed in pr_body_edits_for_the_seat.",
    "The worktree was recreated from the remote branch (local branch = remote = 719644794c) and removed again after the round; this comment was posted with the main checkout's scripts/pm tooling, byte-identical between cc645f2385 and 13736a50f6 (read-only use).",
    "Commit trailers use AGENTS.md's model-free pair, not the harness reminder's spelling."
  ],
  "mcp_calls": "0",
  "api_writes": "1 REST write this round: this os-dev-report via scripts/pm/post-stamped.mjs → the fleet-write relay → POST /repos/objectstack-ai/objectstack/issues/21620/comments. git push (2 pushes this round: d257dfa4e3, 13736a50f6) is not REST. Reads were REST GETs.",
  "open_questions": [],
  "out_of_scope_findings": [
    "unchanged from round 0's report (comment 5973588845): the packaged-view-item-name finding (class a) and the free-name sibling displacement (class a), plus two noted items; the option-B question is the seat's to file for triage"
  ],
  "cleanup": "Done before this comment: rm -rf the worktree's node_modules, then git worktree remove ../objectstack-issue-21620 (no --force, exit 0). The branch and PR stay on the remote at 13736a50f6. No dev server, background job or monitor was started."
}

Generated by Claude Code

Landed: PR #21637 → 7b07749f05 on main (merged 2026-10-03T22:37Z through the merge queue, entered 2026-10-03T22:01Z), verified at 2026-10-03T22:38Z. domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi.

The squash is on origin/main as a single-parent commit. Its file list is the reviewed one: 3 files, +364/-0 across both rounds.
containerSiblingExpansionNameRefusal is on main in packages/metadata-protocol/src/protocol.ts. It carries patch round 1's prescription ("add the view as a member of the container …"), which the squash message quotes too.
Fixes #21620 closed this card as completed. pm:dispatched is removed in this act. No other card was closed by the body.
What landed: triage's pre-named fallback, not the broad check, because the census hit (the PR body names each hit).
Follow-ups filed:
- The runtime save door accepts a view container saved under the name of a view item a package ships; package-less, the row is attributed to the shipping package and its bare list replaces that package's default view on both doors #21638: a container under a packaged view item's name, the ruling's foreseen follow-up;
- Two stored view containers of one object still displace each other's views: a container bound elsewhere or unbound under a sibling's expanded name, and a second container's bare list taking the first's <object>.default, are accepted with no diagnostic #21639: the residual shapes and last-wins between two containers of one object, carrying the dev's option B for triage's ruling.

Generated by Claude Code

fix(metadata-protocol): the save door refuses a view container saved …

fix(metadata-protocol): one collision predicate at the save door — a …

Navigation Menu

Repository navigation

The runtime save door accepts a view container saved under a name ANOTHER container expands to; the object door then lists the second container's list in place of the first's default, and no door answers a view item under the saved name #21620

Measured (the dev's throwaway probe, deleted)

Seam

Relation to #21558

Dedupe

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:records` · `pm:blocked`. A branch of #21558's ruling: the save door holds a container to ADR-0017 §3.2, which says a container is named after its object

Triage: unlocked. #21558 closed through PR #21618, so `pm:blocked` → `pm:queue`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The runtime save door accepts a view container saved under a name ANOTHER container expands to; the object door then lists the second container's list in place of the first's default, and no door answers a view item under the saved name #21620

Description

Measured (the dev's throwaway probe, deleted)

Seam

Relation to #21558

Dedupe

Activity

objectstack-fleet commented on Oct 3, 2026

Triage: first grade — bug · priority:p3 · domain:engine · area:records · pm:blocked. A branch of #21558's ruling: the save door holds a container to ADR-0017 §3.2, which says a container is named after its object

objectstack-fleet commented on Oct 3, 2026

Triage: unlocked. #21558 closed through PR #21618, so pm:blocked → pm:queue

objectstack-fleet commented on Oct 3, 2026

objectstack-fleet commented on Oct 3, 2026

objectstack-fleet commented on Oct 3, 2026

objectstack-fleet commented on Oct 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:records` · `pm:blocked`. A branch of #21558's ruling: the save door holds a container to ADR-0017 §3.2, which says a container is named after its object

Triage: unlocked. #21558 closed through PR #21618, so `pm:blocked` → `pm:queue`