feat(namespace): write-door forgery refusal (user metadata keys may never start 'system.') + refusal messages name both spellings in every branch (the non-colliding case marks system.<f> honestly as NOT valid) — cross-engine message pin alignment

tests/unit/db/fieldAddressing.test.ts

@@ -133,9 +133,13 @@ describe('field-addressing law — pure module pins', () => {
     expect(msg).toContain('metadata.createdAt')
   })
 
-  it('a non-colliding unknown bare name gets the single-candidate refusal', () => {
+  it('a non-colliding unknown bare name names both spellings — system.<f> explicitly as NOT valid', () => {
+    // Cross-engine pin (cor's suite greps for both spellings in every
+    // refusal): the metadata candidate is the fix; the system spelling is
+    // named but HONESTLY marked invalid, never offered as a candidate.
     const msg = buildUnresolvableMessage('scoore', 'entity')
-    expect(msg).not.toContain('system.scoore')
     expect(msg).toContain('metadata.scoore')
+    expect(msg).toContain('system.scoore')
+    expect(msg).toContain('NOT valid')
   })
 })