feat(namespace): egress guard + validation speak the law — whereMatcher's resolver reads system.* from the record and bare names from the metadata bag only (the bare-system switch is dead); validateFindParams refuses cursor/includeRelations/writeOnly typed (accepted-and-ignored dies as a class), validates order, and parses every orderBy address

src/db/fieldAddressing.ts

@@ -244,3 +244,42 @@ export class InvalidFieldAddressError extends Error {
     this.kind = kind
   }
 }
+
+/**
+ * @description Refusal for a syntactically valid address that resolves to
+ * NOTHING — a bare name no user field carries. Carries the did-you-mean
+ * (both candidate spellings when the name collides with a system scalar) so
+ * the fix ships inside the error. Thrown by the query layer with index
+ * knowledge, never by the pure parser.
+ */
+export class UnresolvableFieldError extends Error {
+  public readonly raw: string
+  public readonly kind: FieldAddressKind
+
+  constructor(raw: string, kind: FieldAddressKind) {
+    super(buildUnresolvableMessage(raw, kind))
+    this.name = 'UnresolvableFieldError'
+    this.raw = raw
+    this.kind = kind
+  }
+}
+
+/**
+ * @description Refusal for a find() option that is accepted by the type
+ * surface but NOT implemented — an accepted option must work or refuse;
+ * accepted-and-ignored died as a class (sealed 2026-08-03). Names the
+ * option and the honest state so nobody discovers a no-op by measurement.
+ */
+export class UnsupportedFindOptionError extends Error {
+  public readonly option: string
+
+  constructor(option: string) {
+    super(
+      `find() option '${option}' is not implemented — it used to be silently ` +
+        `ignored, which read as working. Remove it from the call (or track the ` +
+        `feature request); it will be honored or refused, never swallowed.`
+    )
+    this.name = 'UnsupportedFindOptionError'
+    this.option = option
+  }
+}