Permission-set expansion resolved the lexicon's DNS authority using a fixed `parts[..2]`, which only works for three-segment NSIDs. For a four-segment NSID such as community.lexicon.bookmarks.authManageBookmarks this dropped a segment and queried _lexicon.lexicon.community instead of _lexicon.bookmarks.lexicon.community, failing with "DNS resolution failed: ... no record found". The authority is every NSID segment except the last (the name), reversed. Use parts[..parts.len() - 1] to match the spec and the existing extract_namespace_authority helper, and update the DNS authority test with three/four-segment and bookmarks regression cases.