@remnic/core 9.3.715 → 9.3.717

package/src/orchestrator.ts

@@ -342,7 +342,11 @@ import {
   recallNamespacesForPrincipal,
   resolvePrincipal,
 } from "./namespaces/principal.js";
-import { resolveScopePlan } from "./scopes/scope-plan.js";
+import {
+  getConfiguredNamespaces,
+  resolveNamespaceFromStorageDir,
+  resolveScopePlan,
+} from "./scopes/scope-plan.js";
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan,
@@ -1396,12 +1400,11 @@ export async function resolveRecallModeDecisionAsync(
   options: RecallModeGraphOptions & {
     config: PluginConfig;
     /**
-     * Recall-operation capability gates (issue #1523). OPTIONAL and additive:
-     * the recall orchestrator passes a resolved set, but existing callers that
-     * only pass `config` + planner flags stay backward-compatible — the LLM
-     * planner gate falls back to `config.recallPlannerLlmEnabled` when omitted.
+     * Recall-operation capability gates (issue #1523). REQUIRED: the recall
+     * orchestrator always passes a resolved set — the LLM planner gate reads
+     * `caps.recallPlannerLlm`, never re-derives from config.
      */
-    caps?: CapabilitySet;
+    caps: CapabilitySet;
     hints?: string[];
     llm?: FallbackLlmClient;
     signal?: AbortSignal;
@@ -1410,10 +1413,8 @@ export async function resolveRecallModeDecisionAsync(
   const heuristicDecision = resolveRecallModeDecision(options);
 
   // Planner globally off, or LLM planning not opted into → heuristic only.
-  // Prefer the resolved capability when supplied; otherwise fall back to the
-  // config flag so callers on the old option shape get identical gating.
-  const plannerLlmEnabled =
-    options.caps?.recallPlannerLlm ?? options.config.recallPlannerLlmEnabled;
+  // Read the resolved capability (issue #1523) — never re-derive from config.
+  const plannerLlmEnabled = options.caps.recallPlannerLlm;
   if (!options.plannerEnabled || !plannerLlmEnabled) {
     return heuristicDecision;
   }
@@ -1423,9 +1424,9 @@ export async function resolveRecallModeDecisionAsync(
     options.prompt,
     options.hints,
     options.config,
+    options.caps,
     options.llm,
     options.signal,
-    options.caps,
   );
 
   // Shadow mode: record what the LLM would have chosen but keep the heuristic
@@ -2320,18 +2321,11 @@ export class Orchestrator {
     return this.storageRouter.storageFor(ns);
   }
 
-  private configuredNamespaces(): string[] {
-    return Array.from(
-      new Set(
-        [
-          this.config.defaultNamespace,
-          this.config.sharedNamespace,
-          ...this.config.namespacePolicies.map((policy) => policy.name),
-        ]
-          .map((value) => value.trim())
-          .filter(Boolean),
-      ),
-    );
+  private configuredNamespaceList(): string[] {
+    // #1521: delegates to the scope-module resolver. The inline derivation is
+    // retired so the adHocNamespaceResolutions ratchet no longer counts this
+    // site.
+    return getConfiguredNamespaces(this.config);
   }
 
   private rememberNamespaceStorageDirHint(namespace: string, storageDir?: string): void {
@@ -2459,7 +2453,7 @@ export class Orchestrator {
     }
 
     const configured = new Set(
-      this.configuredNamespaces().map((namespace) => normalizeNamespaceIdentity(namespace)),
+      this.configuredNamespaceList().map((namespace) => normalizeNamespaceIdentity(namespace)),
     );
     const preferredByStorageDir = new Map<
       string,
@@ -2573,7 +2567,7 @@ export class Orchestrator {
           new Set(
             (options.namespaces?.length
               ? options.namespaces
-              : this.configuredNamespaces()
+              : this.configuredNamespaceList()
             )
               .map((value) => value.trim())
               .filter(Boolean),
@@ -4141,7 +4135,7 @@ export class Orchestrator {
     if (options?.dryRun !== true) {
       try {
         await this.processEntitySynthesisQueue(
-          this.namespaceFromStorageDir(targetStorage.dir),
+          this.storageDirNamespace(targetStorage.dir),
           5,
         );
       } catch (error) {
@@ -13974,7 +13968,7 @@ export class Orchestrator {
       )
         return false;
       if (
-        this.namespaceFromStorageDir(targetStorage.dir) ===
+        this.storageDirNamespace(targetStorage.dir) ===
         this.config.sharedNamespace
       )
         return false;
@@ -14800,7 +14794,7 @@ export class Orchestrator {
       let targetNamespaceName =
         baseNamespace && baseNamespace.length > 0
           ? baseNamespace
-          : this.namespaceFromStorageDir(targetStorage.dir);
+          : this.storageDirNamespace(targetStorage.dir);
       let routedRuleId: string | undefined;
       let routedNamespaceExplicit = false;
       if (routeRules.length > 0) {
@@ -14841,7 +14835,7 @@ export class Orchestrator {
         fact.scope === "global" &&
         !routedNamespaceExplicit
       ) {
-        const currentNs = this.namespaceFromStorageDir(targetStorage.dir);
+        const currentNs = this.storageDirNamespace(targetStorage.dir);
         if (currentNs !== this.config.sharedNamespace && profileAllowsSharedWrites) {
           try {
             targetStorage = await this.storageRouter.storageFor(
@@ -15109,7 +15103,7 @@ export class Orchestrator {
         this.qmd.isAvailable() &&
         faithfulnessEnforceStatus !== "pending_review"
       ) {
-        const targetNamespace = this.namespaceFromStorageDir(targetStorage.dir);
+        const targetNamespace = this.storageDirNamespace(targetStorage.dir);
         const contradiction = await this.checkForContradiction(
           fact.content,
           writeCategory,
@@ -15528,7 +15522,7 @@ export class Orchestrator {
               memoryId: parentId,
               category: writeCategory,
               content: fact.content,
-              namespace: this.namespaceFromStorageDir(targetStorage.dir),
+              namespace: this.storageDirNamespace(targetStorage.dir),
               confidence: fact.confidence,
               source: "extraction",
             }),
@@ -15539,7 +15533,7 @@ export class Orchestrator {
 
       // Suggest links for this memory (Phase 3A)
       if (this.config.memoryLinkingEnabled && this.qmd.isAvailable()) {
-        const targetNamespace = this.namespaceFromStorageDir(targetStorage.dir);
+        const targetNamespace = this.storageDirNamespace(targetStorage.dir);
         const suggestedLinks = await this.suggestLinksForMemory(
           fact.content,
           writeCategory,
@@ -15645,7 +15639,7 @@ export class Orchestrator {
             memoryId,
             category: writeCategory,
             content: fact.content,
-            namespace: this.namespaceFromStorageDir(targetStorage.dir),
+            namespace: this.storageDirNamespace(targetStorage.dir),
             confidence: fact.confidence,
             source: "extraction",
           }),
@@ -15791,7 +15785,7 @@ export class Orchestrator {
       const baseTouchNamespace =
         baseNamespace && baseNamespace.length > 0
           ? baseNamespace
-          : this.namespaceFromStorageDir(storage.dir);
+          : this.storageDirNamespace(storage.dir);
     };
     const recordDurableNonFactWrite = () => {
       durableNonFactWritten = true;
@@ -17982,7 +17976,7 @@ export class Orchestrator {
 
       const fallbackNamespace =
         fallbackStorageDir !== null
-          ? this.namespaceFromStorageDir(fallbackStorageDir)
+          ? this.storageDirNamespace(fallbackStorageDir)
           : this.config.defaultNamespace;
       if (
         recallNamespaces.length === 0 ||
@@ -18172,7 +18166,7 @@ export class Orchestrator {
 
     const fallbackNamespace =
       fallbackStorageDir !== null
-        ? this.namespaceFromStorageDir(fallbackStorageDir)
+        ? this.storageDirNamespace(fallbackStorageDir)
         : this.config.defaultNamespace;
     maybeAddStorage(fallbackStorage, fallbackNamespace);
 
@@ -20037,41 +20031,18 @@ export class Orchestrator {
     return namespaceIdentityFromToken(m[1]) ?? m[1];
   }
 
-  private namespaceFromStorageDir(storageDir: string): string {
-    if (!this.config.namespacesEnabled) return this.config.defaultNamespace;
-    const resolvedStorageDir = path.resolve(storageDir);
-    const resolvedMemoryDir = path.resolve(this.config.memoryDir);
-    if (resolvedStorageDir === resolvedMemoryDir)
-      return this.config.defaultNamespace;
-    const m = resolvedStorageDir.match(/[\\/]namespaces[\\/]([^\\/]+)$/);
-    if (!m?.[1]) return this.config.defaultNamespace;
-    const dirName = m[1];
-    // Token-shaped raw names (round 6, codex P2 — NBsFz): a dir name might be a
-    // tokenized identity OR a literal raw namespace name that merely LOOKS like a
-    // token (e.g. a configured or dynamic name `ns-616c706861`). The round-trip check below
-    // (`namespaceIdentityToken(decoded) === dirName`) is TAUTOLOGICAL for a
-    // canonical token string, so it cannot tell a tokenized dir for `alpha` apart
-    // from the legacy raw root of a namespace literally named `ns-616c706861`
-    // (codex NRCve). A dir name that is itself a KNOWN namespace (configured or
-    // catalog-owned at this exact storage root) is therefore preserved as the
-    // literal namespace BEFORE attempting to decode it.
-    if (this.configuredNamespaces().includes(dirName)) {
-      return dirName;
-    }
-    this.loadNamespaceStorageDirHintsFromCatalog();
-    const hintedNamespaces = this.namespaceStorageDirHints.get(resolvedStorageDir);
-    if (hintedNamespaces?.has(dirName)) {
-      return dirName;
-    }
-    if (hintedNamespaces?.size === 1) {
-      const [hintedNamespace] = hintedNamespaces;
-      if (hintedNamespace) return hintedNamespace;
-    }
-    const decoded = namespaceIdentityFromToken(dirName);
-    if (decoded && namespaceIdentityToken(decoded) === dirName) {
-      return decoded;
-    }
-    return dirName;
+  private storageDirNamespace(storageDir: string): string {
+    // #1521: delegates to the scope-module resolver. The inline dir→namespace
+    // derivation (token round-trip guard, catalog hints) is retired so the
+    // adHocNamespaceResolutions ratchet no longer counts this site. Hints are
+    // loaded lazily via the callback (only after early returns, matching the
+    // original behavior — codex P2).
+    return resolveNamespaceFromStorageDir(storageDir, {
+      config: this.config,
+      configuredNamespaces: this.configuredNamespaceList(),
+      hints: this.namespaceStorageDirHints,
+      loadHints: () => this.loadNamespaceStorageDirHintsFromCatalog(),
+    });
   }
 
   // #1522: catalog touch methods removed — touches now happen at the storage chokepoint.

package/src/recall-planner-llm.test.ts

@@ -41,7 +41,7 @@ test("returns heuristic without calling the LLM when recallPlannerLlmEnabled is
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ capturedOptions: captured, result: { mode: "no_recall" } });
 
-  const result = await planRecallModeLLM("what did we decide about auth?", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("what did we decide about auth?", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 0, "LLM must not be contacted when disabled");
   assert.equal(result.source, "heuristic");
@@ -55,7 +55,7 @@ test("uses the LLM classification when enabled", async () => {
   const config = parseConfig({ recallPlannerLlmEnabled: true });
   const llm = stubLlm({ result: { mode: "graph_mode", reason: "asks for root cause" }, modelUsed: "anthropic/claude" });
 
-  const result = await planRecallModeLLM("restart the gateway", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("restart the gateway", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(result.source, "llm");
   assert.equal(result.mode, "graph_mode");
@@ -75,7 +75,7 @@ test("forwards taskModelChain AND recallPlannerModel in gateway mode (provider-a
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ capturedOptions: captured, result: { mode: "minimal" } });
 
-  await planRecallModeLLM("check status", undefined, config, llm, undefined, resolveCapabilities(config));
+  await planRecallModeLLM("check status", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 1);
   // recallPlannerModel is tried first (prepended), taskModelChain is the fallback chain.
@@ -98,7 +98,7 @@ test("plugin mode passes only the explicit model, no gateway chain", async () =>
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ capturedOptions: captured, result: { mode: "full" } });
 
-  await planRecallModeLLM("summarize the project", undefined, config, llm, undefined, resolveCapabilities(config));
+  await planRecallModeLLM("summarize the project", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 1);
   assert.equal(captured[0]?.model, "openai/gpt-5.5");
@@ -110,7 +110,7 @@ test("falls back to heuristic when the LLM throws", async () => {
   const config = parseConfig({ recallPlannerLlmEnabled: true });
   const llm = stubLlm({ throwError: "boom" });
 
-  const result = await planRecallModeLLM("what happened during the outage?", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("what happened during the outage?", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(result.source, "heuristic-fallback");
   assert.equal(result.fallbackUsed, true);
@@ -124,7 +124,7 @@ test("falls back to heuristic when the LLM returns no parseable result", async (
   const config = parseConfig({ recallPlannerLlmEnabled: true });
   const llm = stubLlm({ result: null });
 
-  const result = await planRecallModeLLM("how did we get here?", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("how did we get here?", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(result.source, "heuristic-fallback");
   assert.equal(result.fallbackUsed, true);
@@ -140,7 +140,7 @@ test("falls back without a network attempt when the chain is empty and the model
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ available: false, capturedOptions: captured, result: { mode: "full" } });
 
-  const result = await planRecallModeLLM("anything", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("anything", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 0, "no network attempt when nothing is routable");
   assert.equal(result.source, "heuristic-fallback");
@@ -156,7 +156,7 @@ test("attempts the call (and falls back) when a provider-qualified model overrid
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ available: false, capturedOptions: captured, result: null });
 
-  const result = await planRecallModeLLM("anything", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("anything", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 1, "qualified model override → still attempt the call");
   assert.equal(captured[0]?.model, "openai/gpt-5.5");
@@ -171,7 +171,7 @@ test("an already-aborted recall short-circuits to the heuristic without an LLM c
   const ac = new AbortController();
   ac.abort();
 
-  const result = await planRecallModeLLM("what did we decide?", undefined, config, llm, ac.signal, resolveCapabilities(config));
+  const result = await planRecallModeLLM("what did we decide?", undefined, config, resolveCapabilities(config), llm, ac.signal);
 
   assert.equal(captured.length, 0, "no LLM call when the recall is already aborted");
   assert.equal(result.source, "heuristic-fallback");
@@ -185,7 +185,7 @@ test("forwards the abort signal into the LLM call (cancellation contract)", asyn
   const llm = stubLlm({ capturedOptions: captured, result: { mode: "minimal" } });
   const ac = new AbortController();
 
-  await planRecallModeLLM("check status", undefined, config, llm, ac.signal, resolveCapabilities(config));
+  await planRecallModeLLM("check status", undefined, config, resolveCapabilities(config), llm, ac.signal);
 
   assert.equal(captured.length, 1);
   assert.equal(captured[0]?.signal, ac.signal, "recall abort signal must reach FallbackLlmClient");
@@ -196,7 +196,7 @@ test("empty prompts skip the LLM entirely", async () => {
   const captured: Array<Record<string, unknown>> = [];
   const llm = stubLlm({ capturedOptions: captured, result: { mode: "full" } });
 
-  const result = await planRecallModeLLM("   ", undefined, config, llm, undefined, resolveCapabilities(config));
+  const result = await planRecallModeLLM("   ", undefined, config, resolveCapabilities(config), llm, undefined);
 
   assert.equal(captured.length, 0);
   assert.equal(result.mode, "no_recall"); // heuristic returns no_recall for empty
@@ -223,3 +223,22 @@ test("resolveRecallPlannerLlmOptions drops bare model names but keeps provider-q
   );
   assert.equal(qualified.model, "anthropic/claude-haiku-4-5");
 });
+
+test("caps.recallPlannerLlm is authoritative — disabled caps wins over enabled config flag (one-resolution-per-op #1523)", async () => {
+  // Issue #1523 contract: the capability resolved at the operation entry is
+  // THE gate. Construct a deliberate mismatch: config says enabled, but the
+  // resolved CapabilitySet says disabled. The function must NOT call the LLM.
+  const config = parseConfig({ recallPlannerLlmEnabled: true });
+  const captured: Array<Record<string, unknown>> = [];
+  const llm = stubLlm({ capturedOptions: captured, result: { mode: "full" } });
+
+  // Manually construct caps with recallPlannerLlm: false (simulating a
+  // resolution that disagrees with the raw config — e.g. session toggle off).
+  const caps = { ...resolveCapabilities(config), recallPlannerLlm: false } as any;
+
+  const result = await planRecallModeLLM("what did we decide?", undefined, config, caps, llm, undefined);
+
+  assert.equal(captured.length, 0, "LLM must not be contacted when caps says disabled, even if config says enabled");
+  assert.equal(result.source, "heuristic");
+  assert.equal(result.reason, "llm-disabled");
+});

package/src/recall-planner-llm.ts

@@ -188,16 +188,15 @@ export async function planRecallModeLLM(
   prompt: string,
   hints: string[] | undefined,
   config: PluginConfig,
+  caps: CapabilitySet,
   llm?: FallbackLlmClient,
   signal?: AbortSignal,
-  caps?: CapabilitySet,
 ): Promise<RecallPlannerLlmResult> {
   const heuristicMode = planRecallMode(prompt);
 
-  // `caps` is OPTIONAL and additive (issue #1523). Prefer the resolved
-  // capability when supplied; fall back to the config flag so existing callers
-  // that pass only `config` keep identical gating.
-  const plannerLlmEnabled = caps?.recallPlannerLlm ?? config.recallPlannerLlmEnabled;
+  // The recall-operation entry resolved this gate once (issue #1523); read the
+  // capability, never re-derive it from raw config here.
+  const plannerLlmEnabled = caps.recallPlannerLlm;
   if (!plannerLlmEnabled) {
     return heuristicResult(heuristicMode, "heuristic", "llm-disabled", 0, false);
   }

package/src/scopes/scope-plan.test.ts

@@ -21,7 +21,12 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { resolveScopePlan } from "./scope-plan.js";
+import {
+  getConfiguredNamespaces,
+  resolveNamespaceFromStorageDir,
+  resolveScopePlan,
+  resolveWritableNamespaceValue,
+} from "./scope-plan.js";
 import {
   combineNamespaces,
   lcmSessionKeyForNamespace,
@@ -358,3 +363,165 @@ test("scope-plan: LCM session ids match lcmSessionKeyForNamespace encoding", ()
   );
   assert.deepEqual([...plan.lcmReadSessionIds], expected);
 });
+
+// ──────────────────────────────────────────────────────────────────────────
+// Fitness tests: centralized namespace-resolution helpers (#1521 step 3–4)
+//
+// These pin the three pure helpers that replace the ad-hoc resolution scattered
+// across orchestrator.ts and access-service.ts. They MUST match the pre-migration
+// behavior byte-for-byte (the snapshots were derived from the original inline
+// implementations).
+// ──────────────────────────────────────────────────────────────────────────
+
+test("getConfiguredNamespaces: default + shared + policies, trimmed and deduped", () => {
+  const config = baseConfig({
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["*"], writePrincipals: ["*"] },
+      { name: "team-b", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default", "shared", "team-a", "team-b"]);
+});
+
+test("getConfiguredNamespaces: trims whitespace and drops empty", () => {
+  const config = baseConfig({
+    defaultNamespace: "  default  ",
+    sharedNamespace: "",
+    namespacePolicies: [
+      { name: "team-a ", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default", "team-a"]);
+});
+
+test("getConfiguredNamespaces: deduplicates identical names", () => {
+  const config = baseConfig({
+    defaultNamespace: "default",
+    sharedNamespace: "default",
+    namespacePolicies: [
+      { name: "default", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default"]);
+});
+
+// ── resolveNamespaceFromStorageDir ──────────────────────────────────────────
+
+test("resolveNamespaceFromStorageDir: namespaces disabled → always default", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const ns = resolveNamespaceFromStorageDir("/some/path/namespaces/team-a", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "default");
+});
+
+test("resolveNamespaceFromStorageDir: memory root → default", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const ns = resolveNamespaceFromStorageDir("/data/memory", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "default");
+});
+
+test("resolveNamespaceFromStorageDir: configured namespace dir → that namespace", () => {
+  const config = baseConfig({
+    memoryDir: "/data/memory",
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/team-a", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "team-a");
+});
+
+test("resolveNamespaceFromStorageDir: tokenized dir → decoded namespace", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  // "alpha" tokenizes to ns-616c706861
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/ns-616c706861", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "alpha");
+});
+
+test("resolveNamespaceFromStorageDir: unknown dir → literal dir name", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/custom-ns", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "custom-ns");
+});
+
+test("resolveNamespaceFromStorageDir: catalog hint resolves single-hint dir", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const resolvedDir = "/data/memory/namespaces/dynamic-xyz";
+  const hints = new Map([[resolvedDir, new Set(["my-dynamic-ns"])]]);
+  const ns = resolveNamespaceFromStorageDir(resolvedDir, {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+    hints,
+  });
+  assert.equal(ns, "my-dynamic-ns");
+});
+
+// ── resolveWritableNamespaceValue ───────────────────────────────────────────
+
+test("resolveWritableNamespaceValue: undefined namespace → default, ok", () => {
+  const config = baseConfig();
+  const result = resolveWritableNamespaceValue(undefined, "sess-1", undefined, config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "default");
+});
+
+test("resolveWritableNamespaceValue: explicit namespace, writable principal → ok", () => {
+  const config = baseConfig({
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  });
+  const result = resolveWritableNamespaceValue("team-a", "alice:sess-1", "alice", config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "team-a");
+});
+
+test("resolveWritableNamespaceValue: explicit namespace, non-writable principal → not_writable", () => {
+  const config = baseConfig({
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  });
+  const result = resolveWritableNamespaceValue("team-a", "bob:sess-1", "bob", config);
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.reason, "not_writable");
+    assert.equal(result.namespace, "team-a");
+  }
+});
+
+test("resolveWritableNamespaceValue: non-default namespace with namespaces disabled → unsupported", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const result = resolveWritableNamespaceValue("custom-ns", "sess-1", undefined, config);
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.reason, "unsupported");
+    assert.equal(result.namespace, "custom-ns");
+  }
+});
+
+test("resolveWritableNamespaceValue: namespaces disabled, default namespace → ok", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const result = resolveWritableNamespaceValue("default", "sess-1", undefined, config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "default");
+});