[paynejd]

Part of OpenConceptLab/ocl_online#554.

What changes: creating a collection (POST …/collections/) or a collection version (POST …/<collection>/versions/) no longer stores an expansion_uri sent with the request.

• A new collection or version has no expansions yet, so the server sets the value itself: to the auto-expansion it creates, or to nothing.
• Before this change, both create paths stored whatever was sent. Only updates checked that the value names one of the version's own expansions.
• Updates are unchanged. PUT/PATCH on a version accepts an expansion_url that names one of its own expansions and refuses anything else with 400.
• expansion_url was already dropped on create; expansion_uri now behaves the same way. No OCL client sends either on create.

Tests:

• Two new tests, CollectionListViewTest.test_post_201_ignores_expansion_uri and CollectionVersionListViewTest.test_post_201_ignores_expansion_uri, send an absolute URL and another collection's expansion, with auto-expansion on and off. All four cases failed before the change.
• A third, CollectionVersionRetrieveUpdateDestroyViewTest.test_put_expansion_url, keeps the update check covered: it refuses a foreign value and accepts the version's own. Nothing tested that check before.
• Full suite, run locally with PYTHONHASHSEED=2, as in CI: 2,454 tests pass. The local test image predates the fakeredis dependency, so its two modules (250 tests) ran separately with it installed, and pass. CI runs everything together.
• pylint -j0 core/: 10.00. Its only messages come from the same missing fakeredis import, in files this PR doesn't touch.
• CI: Pylint and Tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QvHhCgtEqAD6xKyJAbToDH

[paynejd]

Codex review, pass 1 (codex-cli 0.163.0, commit b6d0d83): clean, no findings. The full pass is on the private ticket. Simplification and adversarial passes follow.

[paynejd]

Simplification pass (Claude subagent, commit b6d0d83): clean, nothing to cut. An adversarial pass follows.

[paynejd]

Adversarial pass (Claude subagent, commit b6d0d83): the fix held. No route still stores a caller-supplied value that names another host or another collection's expansion, and no legitimate client flow breaks.

It recorded two Low issues outside this change, both limited to the owner's own collections on the same host, and one Info note. They're on the private ticket; none is fixed here.

[paynejd]

Review loop finished (head b6d0d83): Codex pass 1, the simplification pass and the adversarial pass are all done, with nothing to fix in this PR. CI passes. Ready to merge.