fix(metadata-protocol): the sibling-expansion refusal prescribes the sibling container, never a save under its name

The refusal told the author to save the container under its object's name.
In the card's own pair that name holds the sibling container, so following
the arm literally replaced the sibling's row and dropped the view the
refusal keeps serving. It now names the stored container that expands the
name and prescribes adding the view as a member of it, or saving a view
item under the expanded name. One pin per kernel; the changeset's fix
carries the same two arms.

Claude-Session: https://claude.ai/code/session_017ErfyP2Rx7XWHJA27QjyUi
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21620-container-sibling-expansion-name.md

@@ -16,4 +16,4 @@ Clause-②: no (narrowing)
 
 **What still saves.** A container under its object's name, which expands as before, and its own re-save. A container under any other name of its own that no other stored container of its object expands to: this door keeps a container saved under a name other than its object, and this change leaves that alone. A view item (a body carrying `viewKind`) under an expanded name, the sanctioned override for that name. The read doors are unchanged. A row stored in this shape before this change keeps its bytes and is served as before; `migrate meta --stored` and package duplication, which re-save stored rows through this door, report such a row as failed with this refusal instead of re-saving it.
 
-**The fix.** Save the container under its object's name (`crm_lead`), or save a view item (`name`, `object`, `viewKind`, `config`) under the expanded name (`crm_lead.pipeline`).
+**The fix.** Add the view as a member of the stored container that already expands the name (in the example, the container `crm_lead`, whose `listViews.pipeline` is that view), or save a view item (`name`, `object`, `viewKind`, `config`) under the expanded name (`crm_lead.pipeline`).

packages/metadata-protocol/src/protocol.ts

@@ -18018,9 +18018,14 @@ export class ObjectStackProtocolImplementation implements
      * as the row's failure instead of re-saving it.
      *
      * `VALIDATION_ERROR` / 400, the envelope of the two name checks it sits
-     * beside. The prescription is the ruling's: save the container under its
-     * object's name, or save a view item under the expanded name. Runtime
-     * words carry no tracker number.
+     * beside. The prescription names the stored container that expands the
+     * name, and gives two arms: add the view as a member of THAT container, or
+     * save a view item under the expanded name. ⛔ It never prescribes a save
+     * under a name another stored container holds — not even the object's own
+     * name, which in the card's pair IS the sibling: an author (or an AI)
+     * following such an arm literally would replace the sibling's row and drop
+     * the very view this refusal keeps serving. Runtime words carry no tracker
+     * number.
      */
     private async containerSiblingExpansionNameRefusal(
         type: string,
@@ -18052,9 +18057,9 @@ export class ObjectStackProtocolImplementation implements
             `Invalid view container: it is saved under '${saveName}', which is a name the stored container `
             + `'${hit.container.name}' expands (its ${String(hit.item.viewKind)} view on '${object}'). An expanded `
             + `view fills only a name that has no stored row of its own, and this container would be that row, so `
-            + `that view would no longer be served and no read would answer a view under '${saveName}'. Save the `
-            + `container under its object's name, '${object}', or save a view item (name, object, viewKind and `
-            + `config) under '${saveName}'.`,
+            + `that view would no longer be served and no read would answer a view under '${saveName}'. Add the `
+            + `view as a member of the container '${hit.container.name}' (its list, listViews, form or formViews), `
+            + `or save a view item (name, object, viewKind and config) under '${saveName}'.`,
         ) as Error & { code: 'VALIDATION_ERROR'; status: 400 };
         err.code = 'VALIDATION_ERROR';
         err.status = 400;

packages/metadata-protocol/src/view-container-runtime-expansion.test.ts

@@ -1474,6 +1474,21 @@ describe('#21334 a container on another package\'s object never takes that packa
                     });
                 }
 
+                it('the prescription names the sibling container that expands the name and never prescribes a save under it — in the card\'s pair the object\'s own name IS that sibling', async () => {
+                    const { protocol, rows, registry } = showcaseHarness(environmentId);
+                    await saved(saveIn(protocol, LEAD, { name: LEAD, object: LEAD, listViews: { pipeline: leadList('Lead Pipeline') } }));
+                    const PIPELINE = `${LEAD}.pipeline`;
+                    const error = await refusalOf(saveIn(protocol, PIPELINE, second(PIPELINE)));
+                    // The envelope, and the sibling named as the container that expands the name.
+                    expectRefused(error, PIPELINE, LEAD);
+                    // A save under the sibling's name would replace its row and drop `pipeline`,
+                    // the view this refusal keeps serving: no arm may name that save.
+                    expect(error.message, 'no save is prescribed under the sibling\'s (here the object\'s) name')
+                        .not.toContain(`under '${LEAD}'`);
+                    expectNothingWritten(rows, registry, [LEAD], PIPELINE);
+                    await expectServed(protocol, PIPELINE, undefined, 'Lead Pipeline');
+                });
+
                 it('an environment-wide sibling is in an organization caller\'s selection: that caller\'s save under its expanded name is refused', async () => {
                     const { protocol, rows, registry } = showcaseHarness(environmentId);
                     await saved(saveIn(protocol, LEAD, { name: LEAD, object: LEAD, listViews: { pipeline: leadList('Lead Pipeline') } }));