feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

docs/concepts/field-addressing.md

@@ -114,6 +114,43 @@ Reach for the explicit spelling when it reads more clearly next to a
 `system.` field in the same query — for example, sorting by your own `score`
 while filtering on `system.confidence`.
 
+## No special names — the write side
+
+The same law governs writes:
+
+> **Data is either in main space, where developers can use anything, or it
+> is in `system.*`.**
+
+There are **no reserved metadata names**. A field called `confidence`,
+`type`, `id`, `data`, `content`, or anything else inside your `metadata` bag
+is an ordinary user field: it is stored verbatim, indexed, filterable,
+sortable, aggregatable, and it survives restarts, index rebuilds, and
+time-travel (`asOf`) reads exactly as written — even when an engine scalar
+shares its spelling. The engine's values are written only through their
+dedicated params (`confidence`, `weight`, `subtype`, `visibility`, …) and
+read at `system.<field>`; your bag can never touch them and they can never
+shadow your bag.
+
+```typescript
+const id = await brain.add({
+  data: 'Ada Lovelace',
+  type: NounType.Person,
+  confidence: 0.9,                       // the ENGINE scalar
+  metadata: { confidence: 'self-rated' } // YOUR field, same spelling — both live
+})
+
+await brain.find({ where: { confidence: 'self-rated' } })      // finds it (yours)
+await brain.find({ where: { 'system.confidence': 0.9 } })      // finds it (engine's)
+```
+
+The one spelling a write refuses is a metadata key that literally starts
+with `system.` — the explicit address namespace cannot be forged as a user
+field name. That refusal is typed and names the fix.
+
+Value **shape** rules still apply uniformly to every name (they are not name
+carve-outs): arrays longer than 10 elements are not turned into posting-list
+scalars, and very long values are indexed by hash.
+
 ## Refusal semantics
 
 A name that resolves to neither your metadata nor a system scalar is a typed
@@ -190,7 +227,6 @@ against the new rule.
 
 ## Where to go next
 
-- [Consistency Model](./consistency-model.md) — the separate (and
-  longer-standing) contract for *reserved* fields: which names may never
-  appear inside a `metadata` bag at write time, distinct from this page's
+- [Consistency Model](./consistency-model.md) — visibility tiers, revision
+  counters, and the rest of the read/write contract this page's
   read-time addressing rule.