@remnic/core 9.3.716 → 9.3.718

package/src/orchestrator.ts

@@ -24,6 +24,10 @@ import { SmartBuffer } from "./buffer.js";
 import { chunkContent, type ChunkingConfig } from "./chunking.js";
 import { semanticChunkContent, type SemanticChunkResult } from "./semantic-chunking.js";
 import { ExtractionEngine } from "./extraction.js";
+import { detectPassiveCorrections } from "./correction/passive-correction-detector.js";
+import { capturePassiveCorrections, type PassiveCaptureConfig } from "./correction/passive-capture.js";
+import { createCorrectionService } from "./correction/correction-access-wiring.js";
+import type { CorrectionService } from "./correction/correction-service.js";
 import { isAboveImportanceThreshold, scoreImportance } from "./importance.js";
 import {
   judgeFactDurability,
@@ -338,11 +342,16 @@ import {
 } from "./namespaces/identity.js";
 import {
   canReadNamespace,
+  canWriteNamespace,
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal,
   resolvePrincipal,
 } from "./namespaces/principal.js";
-import { resolveScopePlan } from "./scopes/scope-plan.js";
+import {
+  getConfiguredNamespaces,
+  resolveNamespaceFromStorageDir,
+  resolveScopePlan,
+} from "./scopes/scope-plan.js";
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan,
@@ -1976,6 +1985,16 @@ export class Orchestrator {
     { count: number; lastAccessed: string }
   > = new Map();
 
+  // Passive correction capture (issue #1581) — dedup state + lazy service.
+  private passiveCorrectionDedup: Set<string> = new Set();
+  private _passiveCorrectionService: CorrectionService | null = null;
+  private passiveCorrectionTelemetry: {
+    detected: number;
+    queued: number;
+    autoApplied: number;
+    suppressedReasonCounts: Record<string, number>;
+  } = { detected: 0, queued: 0, autoApplied: 0, suppressedReasonCounts: {} };
+
   // Background serial queue for extractions (agent_end optimization)
   // Queue stores promises that resolve when extraction should run
   private extractionQueue: Array<() => Promise<void>> = [];
@@ -2317,18 +2336,11 @@ export class Orchestrator {
     return this.storageRouter.storageFor(ns);
   }
 
-  private configuredNamespaces(): string[] {
-    return Array.from(
-      new Set(
-        [
-          this.config.defaultNamespace,
-          this.config.sharedNamespace,
-          ...this.config.namespacePolicies.map((policy) => policy.name),
-        ]
-          .map((value) => value.trim())
-          .filter(Boolean),
-      ),
-    );
+  private configuredNamespaceList(): string[] {
+    // #1521: delegates to the scope-module resolver. The inline derivation is
+    // retired so the adHocNamespaceResolutions ratchet no longer counts this
+    // site.
+    return getConfiguredNamespaces(this.config);
   }
 
   private rememberNamespaceStorageDirHint(namespace: string, storageDir?: string): void {
@@ -2456,7 +2468,7 @@ export class Orchestrator {
     }
 
     const configured = new Set(
-      this.configuredNamespaces().map((namespace) => normalizeNamespaceIdentity(namespace)),
+      this.configuredNamespaceList().map((namespace) => normalizeNamespaceIdentity(namespace)),
     );
     const preferredByStorageDir = new Map<
       string,
@@ -2570,7 +2582,7 @@ export class Orchestrator {
           new Set(
             (options.namespaces?.length
               ? options.namespaces
-              : this.configuredNamespaces()
+              : this.configuredNamespaceList()
             )
               .map((value) => value.trim())
               .filter(Boolean),
@@ -4138,7 +4150,7 @@ export class Orchestrator {
     if (options?.dryRun !== true) {
       try {
         await this.processEntitySynthesisQueue(
-          this.namespaceFromStorageDir(targetStorage.dir),
+          this.storageDirNamespace(targetStorage.dir),
           5,
         );
       } catch (error) {
@@ -13015,6 +13027,139 @@ export class Orchestrator {
     }
   }
 
+  /**
+   * Passive correction capture (issue #1581) — detects corrections expressed
+   * passively in conversation turns and routes them to the Correction Contract
+   * (#1580). Called from `runExtraction` after persistence completes.
+   *
+   * Thin wiring: delegates ALL correction logic to the detector + capture
+   * modules + the CorrectionService. This method only checks gates, calls the
+   * detector, and routes results. Fail-open: capture errors never block the
+   * extraction return path.
+   */
+  private async maybeCapturePassiveCorrections(
+    turns: readonly BufferTurn[],
+    opts: {
+      sessionKey: string;
+      principal?: string;
+      namespace: string;
+      bufferKey: string;
+      isLiveSession: boolean;
+    },
+  ): Promise<void> {
+    const mode = this.config.correctionCaptureMode;
+    if (mode === "off") return;
+    if (!this.config.correctionEnabled) return;
+
+    try {
+      const corrections = detectPassiveCorrections(
+        turns.map((t) => ({ role: t.role, content: t.content })),
+      );
+      if (corrections.length === 0) return;
+
+      // Replay/import: force queue-only mode even if config says auto.
+      const effectiveMode = opts.isLiveSession ? mode : "queue";
+      const captureConfig: PassiveCaptureConfig = {
+        mode: effectiveMode,
+        confidenceFloor: this.config.correctionCaptureConfidenceFloor,
+        autoApplyMaxAffected: this.config.correctionCaptureAutoApplyMaxAffected,
+      };
+
+      const service = this.passiveCorrectionService();
+      const result = await capturePassiveCorrections(
+        corrections,
+        {
+          correctionEnabled: this.config.correctionEnabled,
+          isLiveSession: opts.isLiveSession,
+          bufferKey: opts.bufferKey,
+          sessionKey: opts.sessionKey,
+          principal: opts.principal,
+          namespace: opts.namespace,
+        },
+        captureConfig,
+        {
+          planCorrection: (req) => service.plan(req),
+          applyCorrection: (planId, applyOpts) => service.apply(planId, applyOpts),
+          storageDir: async (ns) => (await this.getStorage(ns)).dir,
+          // Resolve `[m:xxxx]` handles to concrete memory ids via the single
+          // shared helper (#1582). Returns null on miss/ambiguity so the
+          // capture loop drops the handle and the planner falls back to text
+          // search (review: "memory handles not resolved").
+          resolveHandle: (ref, sessionKey) => {
+            try {
+              return this.resolveMemoryIdOrHandle(ref, sessionKey);
+            } catch {
+              return null;
+            }
+          },
+        },
+        this.passiveCorrectionDedup,
+      );
+
+      // Accumulate telemetry
+      this.passiveCorrectionTelemetry.detected += result.telemetry.detected;
+      this.passiveCorrectionTelemetry.queued += result.telemetry.queued;
+      this.passiveCorrectionTelemetry.autoApplied += result.telemetry.autoApplied;
+      for (const [reason, count] of Object.entries(result.telemetry.suppressedReasons)) {
+        this.passiveCorrectionTelemetry.suppressedReasonCounts[reason] =
+          (this.passiveCorrectionTelemetry.suppressedReasonCounts[reason] ?? 0) + count;
+      }
+    } catch (err) {
+      // Fail-open: passive capture never blocks extraction.
+      log.debug(
+        `passive-correction: capture failed (non-fatal): ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+  }
+
+  /** Lazily construct the CorrectionService for passive capture. Stateless
+   *  across requests (per #1580 design); cached for the orchestrator's life. */
+  private passiveCorrectionService(): CorrectionService {
+    if (this._passiveCorrectionService) return this._passiveCorrectionService;
+    this._passiveCorrectionService = createCorrectionService({
+      orchestrator: this,
+      // Session-scoped write ACL (review: "passive capture bypasses write
+      // ACL"). A correction detected in session S plans only against S readable
+      // namespaces and applies only to writable ones (rule 42) — passive
+      // capture never becomes a cross-tenant mutation vector. Mirrors the
+      // access-service createCorrectionService wiring rather than bypassing it.
+      resolveAuthorizedNamespace: async (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.config);
+        const ns = req.namespace ?? defaultNamespaceForPrincipal(principal, this.config);
+        if (!canWriteNamespace(principal, ns, this.config)) {
+          throw new Error(
+            `passive correction: namespace "${ns}" is not writable for principal ${principal ?? "(none)"}`,
+          );
+        }
+        return ns;
+      },
+      resolveReadableNamespaces: (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.config);
+        return recallNamespacesForPrincipal(principal, this.config);
+      },
+      canWriteNamespace: async (req) => {
+        const principal = req.principal || resolvePrincipal(req.sessionKey, this.config);
+        return canWriteNamespace(principal, req.namespace, this.config);
+      },
+      llmComplete: async ({ system, user }) => {
+        const llmResult = await this.localLlm.chatCompletion(
+          [
+            { role: "system", content: system },
+            { role: "user", content: user },
+          ],
+          { operation: "correction-classify", priority: "background" },
+        );
+        if (!llmResult) {
+          throw new Error(
+            "passive correction classify+draft: local LLM unavailable (disabled or in cooldown)",
+          );
+        }
+        return llmResult.content;
+      },
+    });
+    return this._passiveCorrectionService;
+  }
+
   private async runExtraction(
     turns: BufferTurn[],
     options: {
@@ -13100,13 +13245,13 @@ export class Orchestrator {
     );
     if (targetTurns.length === 0) {
       log.debug("skipping extraction: no non-context turns after normalization");
+      // Context-only turns may still contain corrections (review: "context-only
+      // turns skip capture"). Scan normalizedTurns before clearing the buffer.
+      if (normalizedTurns.length > 0) {
+        await this.maybeCapturePassiveCorrections(normalizedTurns as BufferTurn[], { sessionKey, principal: resolvePrincipal(sessionKey, this.config), namespace: this.resolveSelfNamespace(sessionKey), bufferKey, isLiveSession: clearBufferAfterExtraction });
+      }
       await clearBuffer();
-      return {
-        status: "skipped",
-        reason: "empty_normalized_turns",
-        persistedCount: 0,
-        durableOutputCount: 0,
-      };
+      return { status: "skipped", reason: "empty_normalized_turns", persistedCount: 0, durableOutputCount: 0 };
     }
     const sourceValidAt = latestSourceValidAtFromTurns(targetTurns);
     throwIfDeadlineExceeded("before_extract");
@@ -13126,6 +13271,30 @@ export class Orchestrator {
         `skipping extraction: below threshold (totalChars=${totalChars}, userTurns=${userTurns.length})`,
       );
       await clearBuffer();
+      // Passive correction capture runs even when extraction is skipped for
+      // being below the char/user-turn threshold (review: "skipped extraction
+      // skips capture"). A short correction like "stop using Vim" is under
+      // extractionMinChars but is exactly the high-value case this feature
+      // exists for. The write namespace resolves through the SAME scope-profile
+      // plan as the full extraction path so corrections target the active
+      // profile's write layer, not just resolveSelfNamespace (review:
+      // "below-threshold wrong namespace"). The ACL in passiveCorrectionService
+      // authorizes the actual plan/apply.
+      {
+        const capturePrincipal =
+          typeof options.principalOverride === "string" && options.principalOverride.length > 0
+            ? options.principalOverride
+            : resolvePrincipal(sessionKey, this.config);
+        const captureWO = typeof options.writeNamespaceOverride === "string" && options.writeNamespaceOverride.length > 0
+          ? options.writeNamespaceOverride : undefined;
+        const captureCodingCtx = sessionKey ? this.getCodingContextForSession(sessionKey) : null;
+        const captureCodingOv = resolveCodingNamespaceOverlay(captureCodingCtx, this.config.codingMode, this.config.defaultNamespace);
+        const captureScopePlan = resolveScopeProfilePlan({ config: this.config, principal: capturePrincipal, codingContext: captureCodingCtx, codingOverlay: captureCodingOv });
+        const captureNamespace = captureWO ?? captureScopePlan?.writeNamespace ?? this.resolveSelfNamespace(sessionKey);
+        await this.maybeCapturePassiveCorrections(normalizedTurns as BufferTurn[], {
+          sessionKey, principal: capturePrincipal, namespace: captureNamespace, bufferKey, isLiveSession: clearBufferAfterExtraction,
+        });
+      }
       return {
         status: "skipped",
         reason: "below_threshold",
@@ -13325,13 +13494,12 @@ export class Orchestrator {
         meta.lastExtractionAt = new Date().toISOString();
         await storage.saveMeta(meta);
       }
+      // Correction-only turns that meet char/user-turn thresholds but yield
+      // zero facts still need passive capture (review: "empty extraction skips
+      // capture"). selfNamespace/principal already resolved above.
+      await this.maybeCapturePassiveCorrections(normalizedTurns as BufferTurn[], { sessionKey, principal, namespace: selfNamespace, bufferKey, isLiveSession: clearBufferAfterExtraction });
       await clearBuffer();
-      return {
-        status: "skipped",
-        reason: "empty_extraction_result",
-        persistedCount: 0,
-        durableOutputCount: 0,
-      };
+      return { status: "skipped", reason: "empty_extraction_result", persistedCount: 0, durableOutputCount: 0 };
     }
 
     let threadIdForExtraction: string | null = null;
@@ -13448,6 +13616,19 @@ export class Orchestrator {
 
     await clearBuffer({ ignoreAbort: true });
 
+    // Passive correction capture (issue #1581) — detect corrections expressed
+    // passively in the extracted turns and route to the Correction Contract.
+    // Runs AFTER persistence + buffer clear so a capture failure never blocks
+    // the extraction return. `clearBufferAfterExtraction` gates live-session
+    // auto-apply (replay/import → queue-only).
+    await this.maybeCapturePassiveCorrections(normalizedTurns as BufferTurn[], {
+      sessionKey,
+      principal,
+      namespace: selfNamespace,
+      bufferKey,
+      isLiveSession: clearBufferAfterExtraction,
+    });
+
     // Build memory box from this extraction (v8.0 Phase 2A)
     // Topics are derived from the current extraction's facts and entities only —
     // not from readAllMemories() — so box topics accurately reflect the current
@@ -13971,7 +14152,7 @@ export class Orchestrator {
       )
         return false;
       if (
-        this.namespaceFromStorageDir(targetStorage.dir) ===
+        this.storageDirNamespace(targetStorage.dir) ===
         this.config.sharedNamespace
       )
         return false;
@@ -14797,7 +14978,7 @@ export class Orchestrator {
       let targetNamespaceName =
         baseNamespace && baseNamespace.length > 0
           ? baseNamespace
-          : this.namespaceFromStorageDir(targetStorage.dir);
+          : this.storageDirNamespace(targetStorage.dir);
       let routedRuleId: string | undefined;
       let routedNamespaceExplicit = false;
       if (routeRules.length > 0) {
@@ -14838,7 +15019,7 @@ export class Orchestrator {
         fact.scope === "global" &&
         !routedNamespaceExplicit
       ) {
-        const currentNs = this.namespaceFromStorageDir(targetStorage.dir);
+        const currentNs = this.storageDirNamespace(targetStorage.dir);
         if (currentNs !== this.config.sharedNamespace && profileAllowsSharedWrites) {
           try {
             targetStorage = await this.storageRouter.storageFor(
@@ -15106,7 +15287,7 @@ export class Orchestrator {
         this.qmd.isAvailable() &&
         faithfulnessEnforceStatus !== "pending_review"
       ) {
-        const targetNamespace = this.namespaceFromStorageDir(targetStorage.dir);
+        const targetNamespace = this.storageDirNamespace(targetStorage.dir);
         const contradiction = await this.checkForContradiction(
           fact.content,
           writeCategory,
@@ -15525,7 +15706,7 @@ export class Orchestrator {
               memoryId: parentId,
               category: writeCategory,
               content: fact.content,
-              namespace: this.namespaceFromStorageDir(targetStorage.dir),
+              namespace: this.storageDirNamespace(targetStorage.dir),
               confidence: fact.confidence,
               source: "extraction",
             }),
@@ -15536,7 +15717,7 @@ export class Orchestrator {
 
       // Suggest links for this memory (Phase 3A)
       if (this.config.memoryLinkingEnabled && this.qmd.isAvailable()) {
-        const targetNamespace = this.namespaceFromStorageDir(targetStorage.dir);
+        const targetNamespace = this.storageDirNamespace(targetStorage.dir);
         const suggestedLinks = await this.suggestLinksForMemory(
           fact.content,
           writeCategory,
@@ -15642,7 +15823,7 @@ export class Orchestrator {
             memoryId,
             category: writeCategory,
             content: fact.content,
-            namespace: this.namespaceFromStorageDir(targetStorage.dir),
+            namespace: this.storageDirNamespace(targetStorage.dir),
             confidence: fact.confidence,
             source: "extraction",
           }),
@@ -15788,7 +15969,7 @@ export class Orchestrator {
       const baseTouchNamespace =
         baseNamespace && baseNamespace.length > 0
           ? baseNamespace
-          : this.namespaceFromStorageDir(storage.dir);
+          : this.storageDirNamespace(storage.dir);
     };
     const recordDurableNonFactWrite = () => {
       durableNonFactWritten = true;
@@ -17979,7 +18160,7 @@ export class Orchestrator {
 
       const fallbackNamespace =
         fallbackStorageDir !== null
-          ? this.namespaceFromStorageDir(fallbackStorageDir)
+          ? this.storageDirNamespace(fallbackStorageDir)
           : this.config.defaultNamespace;
       if (
         recallNamespaces.length === 0 ||
@@ -18169,7 +18350,7 @@ export class Orchestrator {
 
     const fallbackNamespace =
       fallbackStorageDir !== null
-        ? this.namespaceFromStorageDir(fallbackStorageDir)
+        ? this.storageDirNamespace(fallbackStorageDir)
         : this.config.defaultNamespace;
     maybeAddStorage(fallbackStorage, fallbackNamespace);
 
@@ -20034,41 +20215,18 @@ export class Orchestrator {
     return namespaceIdentityFromToken(m[1]) ?? m[1];
   }
 
-  private namespaceFromStorageDir(storageDir: string): string {
-    if (!this.config.namespacesEnabled) return this.config.defaultNamespace;
-    const resolvedStorageDir = path.resolve(storageDir);
-    const resolvedMemoryDir = path.resolve(this.config.memoryDir);
-    if (resolvedStorageDir === resolvedMemoryDir)
-      return this.config.defaultNamespace;
-    const m = resolvedStorageDir.match(/[\\/]namespaces[\\/]([^\\/]+)$/);
-    if (!m?.[1]) return this.config.defaultNamespace;
-    const dirName = m[1];
-    // Token-shaped raw names (round 6, codex P2 — NBsFz): a dir name might be a
-    // tokenized identity OR a literal raw namespace name that merely LOOKS like a
-    // token (e.g. a configured or dynamic name `ns-616c706861`). The round-trip check below
-    // (`namespaceIdentityToken(decoded) === dirName`) is TAUTOLOGICAL for a
-    // canonical token string, so it cannot tell a tokenized dir for `alpha` apart
-    // from the legacy raw root of a namespace literally named `ns-616c706861`
-    // (codex NRCve). A dir name that is itself a KNOWN namespace (configured or
-    // catalog-owned at this exact storage root) is therefore preserved as the
-    // literal namespace BEFORE attempting to decode it.
-    if (this.configuredNamespaces().includes(dirName)) {
-      return dirName;
-    }
-    this.loadNamespaceStorageDirHintsFromCatalog();
-    const hintedNamespaces = this.namespaceStorageDirHints.get(resolvedStorageDir);
-    if (hintedNamespaces?.has(dirName)) {
-      return dirName;
-    }
-    if (hintedNamespaces?.size === 1) {
-      const [hintedNamespace] = hintedNamespaces;
-      if (hintedNamespace) return hintedNamespace;
-    }
-    const decoded = namespaceIdentityFromToken(dirName);
-    if (decoded && namespaceIdentityToken(decoded) === dirName) {
-      return decoded;
-    }
-    return dirName;
+  private storageDirNamespace(storageDir: string): string {
+    // #1521: delegates to the scope-module resolver. The inline dir→namespace
+    // derivation (token round-trip guard, catalog hints) is retired so the
+    // adHocNamespaceResolutions ratchet no longer counts this site. Hints are
+    // loaded lazily via the callback (only after early returns, matching the
+    // original behavior — codex P2).
+    return resolveNamespaceFromStorageDir(storageDir, {
+      config: this.config,
+      configuredNamespaces: this.configuredNamespaceList(),
+      hints: this.namespaceStorageDirHints,
+      loadHints: () => this.loadNamespaceStorageDirHintsFromCatalog(),
+    });
   }
 
   // #1522: catalog touch methods removed — touches now happen at the storage chokepoint.

package/src/scopes/scope-plan.test.ts

@@ -21,7 +21,12 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { resolveScopePlan } from "./scope-plan.js";
+import {
+  getConfiguredNamespaces,
+  resolveNamespaceFromStorageDir,
+  resolveScopePlan,
+  resolveWritableNamespaceValue,
+} from "./scope-plan.js";
 import {
   combineNamespaces,
   lcmSessionKeyForNamespace,
@@ -358,3 +363,165 @@ test("scope-plan: LCM session ids match lcmSessionKeyForNamespace encoding", ()
   );
   assert.deepEqual([...plan.lcmReadSessionIds], expected);
 });
+
+// ──────────────────────────────────────────────────────────────────────────
+// Fitness tests: centralized namespace-resolution helpers (#1521 step 3–4)
+//
+// These pin the three pure helpers that replace the ad-hoc resolution scattered
+// across orchestrator.ts and access-service.ts. They MUST match the pre-migration
+// behavior byte-for-byte (the snapshots were derived from the original inline
+// implementations).
+// ──────────────────────────────────────────────────────────────────────────
+
+test("getConfiguredNamespaces: default + shared + policies, trimmed and deduped", () => {
+  const config = baseConfig({
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["*"], writePrincipals: ["*"] },
+      { name: "team-b", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default", "shared", "team-a", "team-b"]);
+});
+
+test("getConfiguredNamespaces: trims whitespace and drops empty", () => {
+  const config = baseConfig({
+    defaultNamespace: "  default  ",
+    sharedNamespace: "",
+    namespacePolicies: [
+      { name: "team-a ", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default", "team-a"]);
+});
+
+test("getConfiguredNamespaces: deduplicates identical names", () => {
+  const config = baseConfig({
+    defaultNamespace: "default",
+    sharedNamespace: "default",
+    namespacePolicies: [
+      { name: "default", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = getConfiguredNamespaces(config);
+  assert.deepEqual(ns, ["default"]);
+});
+
+// ── resolveNamespaceFromStorageDir ──────────────────────────────────────────
+
+test("resolveNamespaceFromStorageDir: namespaces disabled → always default", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const ns = resolveNamespaceFromStorageDir("/some/path/namespaces/team-a", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "default");
+});
+
+test("resolveNamespaceFromStorageDir: memory root → default", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const ns = resolveNamespaceFromStorageDir("/data/memory", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "default");
+});
+
+test("resolveNamespaceFromStorageDir: configured namespace dir → that namespace", () => {
+  const config = baseConfig({
+    memoryDir: "/data/memory",
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["*"], writePrincipals: ["*"] },
+    ],
+  });
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/team-a", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "team-a");
+});
+
+test("resolveNamespaceFromStorageDir: tokenized dir → decoded namespace", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  // "alpha" tokenizes to ns-616c706861
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/ns-616c706861", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "alpha");
+});
+
+test("resolveNamespaceFromStorageDir: unknown dir → literal dir name", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const ns = resolveNamespaceFromStorageDir("/data/memory/namespaces/custom-ns", {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+  });
+  assert.equal(ns, "custom-ns");
+});
+
+test("resolveNamespaceFromStorageDir: catalog hint resolves single-hint dir", () => {
+  const config = baseConfig({ memoryDir: "/data/memory" });
+  const resolvedDir = "/data/memory/namespaces/dynamic-xyz";
+  const hints = new Map([[resolvedDir, new Set(["my-dynamic-ns"])]]);
+  const ns = resolveNamespaceFromStorageDir(resolvedDir, {
+    config,
+    configuredNamespaces: getConfiguredNamespaces(config),
+    hints,
+  });
+  assert.equal(ns, "my-dynamic-ns");
+});
+
+// ── resolveWritableNamespaceValue ───────────────────────────────────────────
+
+test("resolveWritableNamespaceValue: undefined namespace → default, ok", () => {
+  const config = baseConfig();
+  const result = resolveWritableNamespaceValue(undefined, "sess-1", undefined, config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "default");
+});
+
+test("resolveWritableNamespaceValue: explicit namespace, writable principal → ok", () => {
+  const config = baseConfig({
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  });
+  const result = resolveWritableNamespaceValue("team-a", "alice:sess-1", "alice", config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "team-a");
+});
+
+test("resolveWritableNamespaceValue: explicit namespace, non-writable principal → not_writable", () => {
+  const config = baseConfig({
+    namespacePolicies: [
+      { name: "team-a", readPrincipals: ["alice"], writePrincipals: ["alice"] },
+    ],
+  });
+  const result = resolveWritableNamespaceValue("team-a", "bob:sess-1", "bob", config);
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.reason, "not_writable");
+    assert.equal(result.namespace, "team-a");
+  }
+});
+
+test("resolveWritableNamespaceValue: non-default namespace with namespaces disabled → unsupported", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const result = resolveWritableNamespaceValue("custom-ns", "sess-1", undefined, config);
+  assert.equal(result.ok, false);
+  if (!result.ok) {
+    assert.equal(result.reason, "unsupported");
+    assert.equal(result.namespace, "custom-ns");
+  }
+});
+
+test("resolveWritableNamespaceValue: namespaces disabled, default namespace → ok", () => {
+  const config = baseConfig({ namespacesEnabled: false });
+  const result = resolveWritableNamespaceValue("default", "sess-1", undefined, config);
+  assert.equal(result.ok, true);
+  if (result.ok) assert.equal(result.namespace, "default");
+});