fix: harden invalidation registry governance

tests/unit/query-invalidation-registry.test.ts

@@ -106,6 +106,31 @@ describe("query invalidation registry", () => {
     ]);
   });
 
+  it("snapshots a caller-owned namespace identity before indexing it", () => {
+    const mutableNamespace = {
+      namespaceId: "orders",
+      namespaceVersion: 1,
+    };
+    const index = indexInvalidationRegistry({
+      topics: [topic],
+      namespaces: [mutableNamespace],
+      edges: [{ topicId: topic, namespace: mutableNamespace }],
+    });
+
+    mutableNamespace.namespaceId = "mutated-orders";
+    mutableNamespace.namespaceVersion = 2;
+
+    const indexedNamespace = index.namespacesForTopic.get(topic)?.[0];
+    expect(indexedNamespace).toEqual({
+      namespaceId: "orders",
+      namespaceVersion: 1,
+    });
+    expect(Object.isFrozen(indexedNamespace)).toBe(true);
+    expect(
+      indexedNamespace && createQueryInvalidationPrefix(indexedNamespace),
+    ).toEqual(["query", 2, "orders", 1]);
+  });
+
   it("rejects duplicate namespace identities even when they are separate objects", () => {
     const duplicate = defineQueryNamespaceIdentity("orders", 1);