feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

tests/integration/aggregate-reserved-fields.test.ts

@@ -42,8 +42,11 @@ describe('aggregation + query field-resolution law', () => {
   it('reserved-field groupBy decrements on delete (the drift bug)', async () => {
     brain.defineAggregate({
       name: 'by_subtype',
+      // system.subtype — subtype is an add() param (an engine scalar), never
+      // a user metadata field; bare 'subtype' now addresses the user's own
+      // metadata bag under the sealed field-addressing law.
       source: { type: NounType.Document },
-      groupBy: ['subtype'],
+      groupBy: ['system.subtype'],
       metrics: { count: { op: 'count' } }
     })
 
@@ -60,7 +63,7 @@ describe('aggregation + query field-resolution law', () => {
     }
     let groups = await brain.queryAggregate('by_subtype')
     expect(groups).toHaveLength(1)
-    expect(groups[0].groupKey).toEqual({ subtype: 'note' })
+    expect(groups[0].groupKey).toEqual({ 'system.subtype': 'note' })
     expect(groups[0].metrics.count).toBe(5)
 
     await brain.remove(ids[0])
@@ -76,7 +79,7 @@ describe('aggregation + query field-resolution law', () => {
     brain.defineAggregate({
       name: 'by_subtype',
       source: { type: NounType.Document },
-      groupBy: ['subtype'],
+      groupBy: ['system.subtype'],
       metrics: { count: { op: 'count' } }
     })
     const id = await brain.add({
@@ -88,7 +91,7 @@ describe('aggregation + query field-resolution law', () => {
 
     const groups = await brain.queryAggregate('by_subtype')
     const byKey = Object.fromEntries(
-      groups.map((g) => [String(g.groupKey.subtype), g.metrics.count])
+      groups.map((g) => [String(g.groupKey['system.subtype']), g.metrics.count])
     )
     expect(byKey['published']).toBe(1)
     // The old group must be gone or zero — never still counting the entity.
@@ -98,7 +101,7 @@ describe('aggregation + query field-resolution law', () => {
   it('source.where on a reserved field filters instead of matching nothing', async () => {
     brain.defineAggregate({
       name: 'notes_only',
-      source: { type: NounType.Document, where: { subtype: 'note' } },
+      source: { type: NounType.Document, where: { 'system.subtype': 'note' } },
       groupBy: ['team'],
       metrics: { count: { op: 'count' } }
     })