feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

tests/unit/brainy/visibility.test.ts

@@ -198,60 +198,47 @@ describe('visibility (8.0 reserved field)', () => {
       expect(entity?.visibility).toBeUndefined()
     })
 
-    it('an untyped caller passing visibility inside metadata is normalized under reservedFieldPolicy:"remap" (lifted to top-level)', async () => {
-      // Simulate a JavaScript caller smuggling the reserved key past the compile-time guard.
-      // The legacy remap behavior is now opt-in (8.0 default is 'throw').
-      const remapBrain = new Brainy(createTestConfig({ reservedFieldPolicy: 'remap' }))
-      await remapBrain.init()
-      try {
-        const id = await remapBrain.add({
-          type: NounType.Concept,
-          data: 'y',
-          metadata: { visibility: 'internal', tag: 't' } as object
-        })
-        const entity = await remapBrain.get(id)
-        // Lifted to the top-level field…
-        expect(entity?.visibility).toBe('internal')
-        // …and stripped from the metadata bag.
-        expect((entity?.metadata as Record<string, unknown>)?.visibility).toBeUndefined()
-        expect((entity?.metadata as Record<string, unknown>)?.tag).toBe('t')
-        // It is excluded from the default count, exactly like a top-level internal write.
-        expect(await remapBrain.getNounCount()).toBe(0)
-      } finally {
-        await remapBrain.close()
-      }
+    it('metadata.visibility is the USER’s field (field-addressing law) — stored verbatim, never lifted to the engine tier', async () => {
+      const id = await brain.add({
+        type: NounType.Concept,
+        data: 'y',
+        metadata: { visibility: 'internal', tag: 't' } as object
+      })
+      const entity = await brain.get(id)
+      // The user's field lives in the bag, verbatim…
+      expect((entity?.metadata as Record<string, unknown>)?.visibility).toBe('internal')
+      expect((entity?.metadata as Record<string, unknown>)?.tag).toBe('t')
+      // …and the ENGINE tier is untouched: absent === public, so the entity
+      // stays visible on default reads (the engine tier is set only via the
+      // dedicated visibility param and reads at system.visibility).
+      expect(entity?.visibility).toBeUndefined()
+      const visible = await brain.find({ type: NounType.Concept, limit: 20 })
+      expect(visible.map((r) => r.id)).toContain(id)
     })
 
-    it('a "system" value smuggled through metadata is dropped under reservedFieldPolicy:"remap", not honored', async () => {
-      // 'system' is Brainy-only; an untyped caller must not be able to set it.
-      const remapBrain = new Brainy(createTestConfig({ reservedFieldPolicy: 'remap' }))
-      await remapBrain.init()
-      try {
-        const id = await remapBrain.add({
-          type: NounType.Concept,
-          data: 'z',
-          metadata: { visibility: 'system' } as object
-        })
-        const entity = await remapBrain.get(id)
-        // The smuggled 'system' was dropped → entity stays public (counted, visible).
-        expect(entity?.visibility).toBeUndefined()
-        expect(await remapBrain.getNounCount()).toBe(1)
-        const found = await remapBrain.find({ type: NounType.Concept, limit: 10 })
-        expect(found.map((r) => r.id)).toContain(id)
-      } finally {
-        await remapBrain.close()
-      }
+    it('a user field valued "system" cannot smuggle the Brainy-only tier — it is just user data', async () => {
+      const id = await brain.add({
+        type: NounType.Concept,
+        data: 'z',
+        metadata: { visibility: 'system' } as object
+      })
+      const entity = await brain.get(id)
+      // Engine tier unaffected → entity stays public (counted, visible);
+      // the string 'system' is ordinary user data in the bag.
+      expect(entity?.visibility).toBeUndefined()
+      expect((entity?.metadata as Record<string, unknown>)?.visibility).toBe('system')
+      const found = await brain.find({ type: NounType.Concept, limit: 10 })
+      expect(found.map((r) => r.id)).toContain(id)
     })
 
-    it('an untyped caller passing visibility inside metadata throws under the default policy', async () => {
-      // 8.0 default: no silent remap — a reserved key in the bag is a loud error.
+    it('a forged system.visibility key in metadata refuses loudly at the write door', async () => {
       await expect(
         brain.add({
           type: NounType.Concept,
           data: 'throws',
-          metadata: { visibility: 'internal', tag: 't' } as object
+          metadata: { 'system.visibility': 'internal' } as object
         })
-      ).rejects.toThrow(/visibility.*reserved field/)
+      ).rejects.toThrow(/system\./)
     })
   })
 })