docs(decisions): TS/RS namespace isolation direction (LAB-640)

CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to the CacheKit Protocol Specification.
 
 ## [Unreleased]
 
+### Decision — TS/RS namespace isolation is a Python-SDK + `nsapi:` feature (LAB-640)
+
+- New decision record
+  [decisions/namespace-isolation.md](decisions/namespace-isolation.md): records
+  the stage-1 direction for epic LAB-680. Server-side namespace isolation
+  (`allowed_namespaces` ACL, per-namespace quotas, the `ns:`/`nsapi:`
+  write-space split) is driven only by the key prefix, and **only cachekit-py
+  emits `ns:`** — so TS/RS SDK namespaces and interop-mode namespaces are
+  **client-side conventions**, scoped server-side to `default`/`open`. Chooses
+  **option 2** (document the asymmetry; no key-format change) over option 1
+  (TS/RS adopt `ns:` — rejected: key-stability break, billed-miss migration,
+  and it still leaves interop in `default`) and option 3 (per-key
+  default-namespace server override — deferred, reopenable). Interop keys stay
+  in `default` by the existing spec pin (tenant isolation comes from
+  authentication, not key parsing). Documentation-only: no spec key-format
+  change, no server change.
+  **Proposed (accepted on merge)** — the epic owner's merge is the ratification.
+
 ### Wire format — compressed-byte reproducibility scoped per-vector (LAB-1751)
 
 - LZ4 compressed bytes are **not canonical** across conforming block encoders.