fix: label cross-namespace trace_flow members with their real namespace

Flow memberships were stamped with the start namespace, so members
reached through a cross_ref edge carried an unusable label and clients
could not resolve foreign node ids. The tracer now batch-loads member
nodes when the reader supports it and stamps each membership with the
node's stored namespace; the MCP response exposes it only in
cross-namespace mode, keeping single-namespace payloads unchanged. The
persisted-flow rebuild path is unaffected because FlowRebuildStore has
no batch node read.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tae2089

internal/adapters/inbound/mcp/handler_analysis.go

@@ -39,9 +39,11 @@ type impactRadiusResponse struct {
 
 // traceFlowMember captures one ordered member inside a traced flow.
 // @intent serialize flow member references without exposing the full node record.
+// @domainRule Namespace is set only in cross-namespace mode so single-namespace responses stay unchanged.
 type traceFlowMember struct {
-	NodeID  uint `json:"node_id"`
-	Ordinal int  `json:"ordinal"`
+	NodeID    uint   `json:"node_id"`
+	Ordinal   int    `json:"ordinal"`
+	Namespace string `json:"namespace,omitempty"`
 }
 
 // traceFlowMetadata records bounded trace settings and fallback-edge summary data.
@@ -232,6 +234,9 @@ func (h *handlers) traceFlow(ctx context.Context, request mcp.CallToolRequest) (
 		members := make([]traceFlowMember, len(flow.Members))
 		for i, m := range flow.Members {
 			members[i] = traceFlowMember{NodeID: m.NodeID, Ordinal: m.Ordinal}
+			if crossNamespace {
+				members[i].Namespace = m.Namespace
+			}
 		}
 
 		result, err := marshalJSON(traceFlowResponse{

internal/adapters/inbound/mcp/handler_crossns_test.go

@@ -144,18 +144,25 @@ func TestTraceFlow_CrossNamespace(t *testing.T) {
 	})
 	var payload struct {
 		Members []struct {
-			NodeID uint `json:"node_id"`
+			NodeID    uint   `json:"node_id"`
+			Namespace string `json:"namespace"`
 		} `json:"members"`
 	}
 	if err := json.Unmarshal([]byte(resultTextOf(t, result)), &payload); err != nil {
 		t.Fatalf("unmarshal: %v", err)
 	}
-	got := map[uint]bool{}
+	got := map[uint]string{}
 	for _, m := range payload.Members {
-		got[m.NodeID] = true
+		got[m.NodeID] = m.Namespace
 	}
-	if !got[authValidate] || !got[authAudit] {
-		t.Fatalf("flow members = %+v, want continuation into auth-svc nodes %d and %d", payload.Members, authValidate, authAudit)
+	if _, ok := got[authValidate]; !ok {
+		t.Fatalf("flow members = %+v, want continuation into auth-svc node %d", payload.Members, authValidate)
+	}
+	if _, ok := got[authAudit]; !ok {
+		t.Fatalf("flow members = %+v, want continuation into auth-svc node %d", payload.Members, authAudit)
+	}
+	if got[authValidate] != "auth-svc" || got[authAudit] != "auth-svc" {
+		t.Fatalf("cross members namespaces = %v, want auth-svc labels so clients can resolve foreign node ids", got)
 	}
 }
 

internal/app/analyze/flow/flow.go

@@ -22,6 +22,41 @@ type Tracer struct {
 	store EdgeReader
 }
 
+// nodeBatchReader is the optional capability used to resolve members' true namespaces.
+// @intent let cross-namespace readers label foreign members without widening the EdgeReader contract.
+type nodeBatchReader interface {
+	GetNodesByIDs(ctx context.Context, ids []uint) ([]graph.Node, error)
+}
+
+// stampMemberNamespaces replaces the context-namespace default with each member node's stored namespace.
+// @intent make cross-namespace flow members resolvable by callers; single-namespace traces are unchanged
+// because every member already lives in the context namespace.
+// @domainRule stores without batch node reads keep the context-namespace stamp (persisted-flow rebuild path).
+func (t *Tracer) stampMemberNamespaces(ctx context.Context, members []graph.FlowMembership) error {
+	reader, ok := t.store.(nodeBatchReader)
+	if !ok || len(members) == 0 {
+		return nil
+	}
+	ids := make([]uint, len(members))
+	for i, m := range members {
+		ids[i] = m.NodeID
+	}
+	nodes, err := reader.GetNodesByIDs(ctx, ids)
+	if err != nil {
+		return err
+	}
+	namespaceByID := make(map[uint]string, len(nodes))
+	for _, n := range nodes {
+		namespaceByID[n.ID] = n.Namespace
+	}
+	for i := range members {
+		if ns, found := namespaceByID[members[i].NodeID]; found {
+			members[i].Namespace = ns
+		}
+	}
+	return nil
+}
+
 // TraceOptions bounds how far a single flow trace is allowed to expand.
 // @intent let callers cap traversal cost when tracing large call graphs
 type TraceOptions struct {
@@ -136,6 +171,10 @@ func (t *Tracer) TraceFlowBounded(ctx context.Context, startNodeID uint, opts Tr
 		frontier = nextFrontier
 	}
 
+	if err := t.stampMemberNamespaces(ctx, members); err != nil {
+		return nil, err
+	}
+
 	node, _ := t.store.GetNodeByID(ctx, startNodeID)
 	name := fmt.Sprintf("flow_from_%d", startNodeID)
 	if node != nil {