feat(namespace): NO SPECIAL NAMES + storage fidelity — the ruled completion of the field-addressing law

The write side of the law, ruled 2026-08-03: data is either in main space
where developers can use anything, or it is in system.*.

- The reserved-name write door DIES: add/update/relate/updateRelation
  metadata bags accept EVERY name (confidence, type, id, data, level,
  content, ...) as ordinary user fields — indexed, filterable, sortable,
  aggregatable, identical to any other field. The remap/enforce/warn
  machinery, the reservedFieldPolicy config (now a typed init refusal),
  and the compile-time metadata key bans are all removed. The one write
  refusal left: keys spelled 'system.*' (namespace forgery), now enforced
  on all four write doors.
- STORED RECORDS GO NESTED (v2): engine fields top-level, the user bag
  nested verbatim under 'metadata', sealed by a format stamp — by-name
  storage discrimination is unsound once colliders are admitted. Legacy
  flat records stay readable forever through the shape-aware splitters
  (sound for them: the old door refused colliders). Time travel rides the
  same split (generation store snapshots whole records).
- Name-based index exclusions DIE: user frame indexes every name; the
  excludeFields/indexedFields knobs and their silent-[] holes are gone;
  bulk-payload protection is value-shape only, uniform across names.
- Consumer-sweep findings fixed in the same wave: per-type counts read
  the frozen 'system.type' column (addToIndex sort, affinity tracking,
  cold-count rehydration, VFS type bitmaps — legacy 'noun' fallback for
  pre-rebuild reads); resolveHiddenIds addresses 'system.visibility'
  (bare 'visibility' was a silent no-op under the law — VFS/system
  entities leaked into default reads).
- Fidelity fallout fixed in the owning layers: readEntityFieldAddress
  reads the bag first (colliders were absent-shadowed by its own guard)
  and never serves system addresses from the bag; blob history refs read
  the bag shape-aware; migration transforms now receive ONE normalized
  view (engine fields + nested bag) regardless of stored era, and stray
  flat-habit keys refuse with the fix in the message.
- THE REOPEN-COLLIDER CONFORMANCE CASE (required before any RC counts as
  gates-green): all ten collider names + plumbing names written as user
  fields, verified verbatim + queryable across live reads, flush+reopen,
  a forced epoch rebuild, and asOf time travel; relation mirror; forgery
  refusals; legacy flat-record compat. 8/8 green.

Gates: unit 1901/1901 (exit 0) · integration 758 (exit 0) · conformance
27/27 (exit 0) · consumer test sweep migrated (10 files).

tests/unit/db/whereMatcher.test.ts

@@ -32,7 +32,7 @@ function entity(overrides: Partial<Entity> = {}): Entity {
 }
 
 describe('db/whereMatcher — resolveEntityField', () => {
-  it('resolves standard top-level fields', () => {
+  it('system.<field> resolves the entity scalar; bare/metadata. reads the metadata bag only (sealed 2026-08-03)', () => {
     const e = entity({
       subtype: 'invoice',
       service: 'billing',
@@ -41,17 +41,32 @@ describe('db/whereMatcher — resolveEntityField', () => {
       _rev: 3,
       data: 'payload'
     })
-    expect(resolveEntityField(e, 'id')).toBe('e-1')
-    expect(resolveEntityField(e, 'type')).toBe(NounType.Document)
-    expect(resolveEntityField(e, 'noun')).toBe(NounType.Document) // alias
-    expect(resolveEntityField(e, 'subtype')).toBe('invoice')
-    expect(resolveEntityField(e, 'service')).toBe('billing')
-    expect(resolveEntityField(e, 'confidence')).toBe(0.9)
-    expect(resolveEntityField(e, 'weight')).toBe(0.5)
-    expect(resolveEntityField(e, '_rev')).toBe(3)
-    expect(resolveEntityField(e, 'createdAt')).toBe(1000)
-    expect(resolveEntityField(e, 'updatedAt')).toBe(2000)
-    expect(resolveEntityField(e, 'data')).toBe('payload')
+
+    // system.<field> is the ONLY spelling that reaches an entity scalar.
+    expect(resolveEntityField(e, 'system.id')).toBe('e-1')
+    expect(resolveEntityField(e, 'system.type')).toBe(NounType.Document)
+    expect(resolveEntityField(e, 'system.subtype')).toBe('invoice')
+    expect(resolveEntityField(e, 'system.service')).toBe('billing')
+    expect(resolveEntityField(e, 'system.confidence')).toBe(0.9)
+    expect(resolveEntityField(e, 'system.weight')).toBe(0.5)
+    expect(resolveEntityField(e, 'system.createdAt')).toBe(1000)
+    expect(resolveEntityField(e, 'system.updatedAt')).toBe(2000)
+
+    // Plumbing (_rev, data) is invisible even via system. — not in the
+    // ten-scalar map, so this internal resolver reads it as absent (the typed
+    // refusal for these lives one layer up, at the query-surface parser).
+    expect(resolveEntityField(e, 'system._rev')).toBeUndefined()
+    expect(resolveEntityField(e, 'system.data')).toBeUndefined()
+
+    // Bare names are ALWAYS the user's metadata field — even when they share
+    // a spelling with an engine scalar, or with the now-dead 'noun' alias.
+    // This entity's metadata bag is empty, so every bare name below reads
+    // absent rather than silently falling back to the entity scalar.
+    expect(resolveEntityField(e, 'id')).toBeUndefined()
+    expect(resolveEntityField(e, 'type')).toBeUndefined()
+    expect(resolveEntityField(e, 'noun')).toBeUndefined() // legacy alias is dead
+    expect(resolveEntityField(e, 'subtype')).toBeUndefined()
+    expect(resolveEntityField(e, 'createdAt')).toBeUndefined()
   })
 
   it('resolves custom fields from the metadata bag', () => {