feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

tests/integration/lens-consistency.test.ts

@@ -2,8 +2,8 @@
  * @module tests/integration/lens-consistency
  * @description The three metadata "lenses" over one corpus must agree with
  * canonical ground truth id-for-id, warm AND after a cold reopen:
- *   - combined:      find({ type: T, where: { subtype: S } })
- *   - subtype-only:  find({ where: { subtype: S } })
+ *   - combined:      find({ type: T, where: { 'system.subtype': S } })
+ *   - subtype-only:  find({ where: { 'system.subtype': S } })
  *   - type-only:     find({ type: T })
  * Ported from the fresh-brain probe that closed the type+subtype lens-drop
  * investigation (a restored pre-8.2.2 torn capture had entities visible to the
@@ -63,8 +63,11 @@ async function assertAllLenses(brain: any): Promise<void> {
   const subtypes = [...new Set(CORPUS.map((c) => c.subtype))]
 
   for (const { type, subtype } of CORPUS) {
-    const combined = idSet(await brain.find({ type, where: { subtype }, limit: 1000 }))
-    const subtypeOnly = idSet(await brain.find({ where: { subtype }, limit: 1000 }))
+    // system.subtype — subtype is an add()/update() param (an engine scalar),
+    // never a user metadata field; bare 'subtype' now addresses the user's
+    // own metadata bag under the sealed field-addressing law.
+    const combined = idSet(await brain.find({ type, where: { 'system.subtype': subtype }, limit: 1000 }))
+    const subtypeOnly = idSet(await brain.find({ where: { 'system.subtype': subtype }, limit: 1000 }))
     const truthPair = await groundTruth(brain, { type, subtype })
     const truthSubtype = await groundTruth(brain, { subtype })
 
@@ -82,7 +85,7 @@ async function assertAllLenses(brain: any): Promise<void> {
   // Count cross-check against the corpus definition itself.
   for (const subtype of subtypes) {
     const expected = CORPUS.filter((c) => c.subtype === subtype).reduce((s, c) => s + c.count, 0)
-    const got = (await brain.find({ where: { subtype }, limit: 1000 })).length
+    const got = (await brain.find({ where: { 'system.subtype': subtype }, limit: 1000 })).length
     expect(got).toBe(expected)
   }
 }
@@ -123,16 +126,16 @@ describe('lens consistency — combined vs subtype-only vs canonical ground trut
 
   it('after an update() flips type AND subtype, every lens tracks the move exactly', async () => {
     // The historical cross-bucket-staleness path: change (concept, action) -> (task, review).
-    const victims = await brain.find({ type: 'concept', where: { subtype: 'action' }, limit: 1 })
+    const victims = await brain.find({ type: 'concept', where: { 'system.subtype': 'action' }, limit: 1 })
     expect(victims.length).toBe(1)
     const id = victims[0].id
     await brain.update({ id, type: 'task', subtype: 'review' })
 
-    const oldCombined = idSet(await brain.find({ type: 'concept', where: { subtype: 'action' }, limit: 1000 }))
+    const oldCombined = idSet(await brain.find({ type: 'concept', where: { 'system.subtype': 'action' }, limit: 1000 }))
     expect(oldCombined.has(id)).toBe(false) // unposted from the old buckets
-    const newCombined = idSet(await brain.find({ type: 'task', where: { subtype: 'review' }, limit: 1000 }))
+    const newCombined = idSet(await brain.find({ type: 'task', where: { 'system.subtype': 'review' }, limit: 1000 }))
     expect(newCombined.has(id)).toBe(true) // posted to the new buckets
-    const subtypeOnly = idSet(await brain.find({ where: { subtype: 'review' }, limit: 1000 }))
+    const subtypeOnly = idSet(await brain.find({ where: { 'system.subtype': 'review' }, limit: 1000 }))
     expect(subtypeOnly.has(id)).toBe(true)
   })
 })