feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

src/db/db.ts

@@ -59,10 +59,6 @@ import type {
 import type { StorageAdapter } from '../coreTypes.js'
 import { exportGraph } from './portableGraph.js'
 import type { ExportSelector, ExportOptions, PortableGraph } from './portableGraph.js'
-import {
-  splitNounMetadataRecord,
-  splitVerbMetadataRecord
-} from '../types/reservedFields.js'
 import { v4 as uuidv4 } from '../universal/uuid.js'
 import { coerceNewEntityId, resolveEntityId, ORIGINAL_ID_KEY } from '../utils/idNormalization.js'
 import { EntityNotFoundError } from '../errors/notFound.js'
@@ -705,23 +701,15 @@ export class Db<T = any> {
     for (const op of ops) {
       switch (op.op) {
         case 'add': {
-          // Reserved-field normalization — mirror of the brain.transact()
-          // write path: user-settable fields lift to their dedicated field
-          // (top-level wins), system-managed fields drop, and the entity's
-          // metadata bag carries ONLY custom fields. Speculative views skip
-          // the one-shot warnings — committing the same ops through
-          // `brain.transact()` warns on the real write path.
-          const { reserved, custom } = splitNounMetadataRecord(
-            op.metadata as Record<string, unknown> | undefined
-          )
-          const confidence =
-            op.confidence ?? (typeof reserved.confidence === 'number' ? reserved.confidence : undefined)
-          const weight =
-            op.weight ?? (typeof reserved.weight === 'number' ? reserved.weight : undefined)
-          const subtype =
-            op.subtype ?? (typeof reserved.subtype === 'string' ? reserved.subtype : undefined)
-          const service =
-            op.service ?? (typeof reserved.service === 'string' ? reserved.service : undefined)
+          // Field-addressing law: the metadata bag is the user's, VERBATIM —
+          // no reserved-name lift, no drops. Engine scalars come ONLY from
+          // their dedicated op fields; a bag field named `confidence` is an
+          // ordinary user field, exactly as on the committed write path.
+          const custom = { ...(op.metadata as Record<string, unknown> | undefined) }
+          const confidence = op.confidence
+          const weight = op.weight
+          const subtype = op.subtype
+          const service = op.service
 
           // Id normalization (8.0) — mirror of the committed transact() add
           // path: a natural key coerces to a STABLE UUID (v5), preserving the
@@ -759,16 +747,12 @@ export class Db<T = any> {
               `with(): entity ${updateId} not found at generation ${this.gen}`
             )
           }
-          // Same reserved-field normalization as the committed update path.
-          const { reserved, custom } = splitNounMetadataRecord(
-            op.metadata as Record<string, unknown> | undefined
-          )
-          const confidence =
-            op.confidence ?? (typeof reserved.confidence === 'number' ? reserved.confidence : undefined)
-          const weight =
-            op.weight ?? (typeof reserved.weight === 'number' ? reserved.weight : undefined)
-          const subtype =
-            op.subtype ?? (typeof reserved.subtype === 'string' ? reserved.subtype : undefined)
+          // Field-addressing law — mirror of the add case: the patch bag is
+          // the user's verbatim; engine scalars only from dedicated op fields.
+          const custom = { ...(op.metadata as Record<string, unknown> | undefined) }
+          const confidence = op.confidence
+          const weight = op.weight
+          const subtype = op.subtype
           const mergedMetadata =
             op.merge !== false
               ? ({ ...(base.metadata as object), ...custom } as T)
@@ -830,19 +814,14 @@ export class Db<T = any> {
           }
           if (duplicate) break
 
-          // Reserved-field normalization — relationship mirror of the add
-          // op above (and of the committed relate() path).
-          const { reserved, custom } = splitVerbMetadataRecord(
-            op.metadata as Record<string, unknown> | undefined
-          )
-          const confidence =
-            op.confidence ?? (typeof reserved.confidence === 'number' ? reserved.confidence : undefined)
-          const weight =
-            op.weight ?? (typeof reserved.weight === 'number' ? reserved.weight : undefined)
-          const subtype =
-            op.subtype ?? (typeof reserved.subtype === 'string' ? reserved.subtype : undefined)
-          const service =
-            op.service ?? (typeof reserved.service === 'string' ? reserved.service : undefined)
+          // Field-addressing law — relationship mirror of the add case: the
+          // edge bag is the user's verbatim; engine scalars only from
+          // dedicated op fields.
+          const custom = { ...(op.metadata as Record<string, unknown> | undefined) }
+          const confidence = op.confidence
+          const weight = op.weight
+          const subtype = op.subtype
+          const service = op.service
 
           const id = uuidv4()
           overlay.verbs.set(id, {

src/db/fieldAddressing.ts

@@ -174,23 +174,26 @@ export function readEntityFieldAddress(
       : null
 
   if (address.scope === 'system') {
-    // Entity views carry system scalars top-level; raw storage shapes carry
-    // them inside the stored metadata record (where `type` is spelled `noun`).
-    // Read top-level first, then the record — never the user's namespace.
+    // System scalars live at the record's top level, NEVER in the user's
+    // bag — a user field named `confidence` must be unreachable from
+    // system.confidence (and vice versa). Entity views carry the scalars
+    // top-level directly; record-derived views spell the type `noun`.
     const top = rec[address.field]
     if (top !== undefined) return top
-    if (bag) {
-      if (address.field === 'type') return bag.type ?? bag.noun
-      return bag[address.field]
-    }
+    if (address.field === 'type') return rec.noun
     return undefined
   }
 
-  // User scope. The write-path remap guarantees the user can never OWN a
-  // field named like a system scalar (those lift top-level at write), so a
-  // bare system name reads as ABSENT — reading the stored record's reserved
-  // key here would re-create the shadow this module exists to kill. Same for
-  // plumbing and the legacy 'noun' spelling.
+  // User scope: the bag IS the user's namespace, authoritative — EVERY name
+  // reads from it, engine spellings included (`bag.confidence` is the user's
+  // confidence field under the field-addressing law).
+  if (bag) return bag[address.field]
+
+  // No bag at all: a LEGACY flat record (pre-nested-bag storage). Its keys
+  // matching system/plumbing names are the ENGINE's — the pre-law write door
+  // refused user colliders — so a bare system name reads as ABSENT rather
+  // than resurrecting the shadow this module exists to kill. Same for the
+  // legacy 'noun' spelling.
   if (
     SYSTEM_ENTITY_SCALARS.has(address.field) ||
     PLUMBING_FIELDS.has(address.field) ||
@@ -198,7 +201,6 @@ export function readEntityFieldAddress(
   ) {
     return undefined
   }
-  if (bag) return bag[address.field]
   return rec[address.field]
 }