The review notes are all done, so the file that said to delete it goes

Six items, all fixed and all tested: the streamed commit bounded against
its reservation, the memory map checked against itself, the save guarantee
stated precisely, temporaries marked in the entry rather than by name, the
path limits measured and left alone, and the directory bounded to what the
parent field can name.

The list of design strengths at the end went with it. It was a reader
describing what the format gets right, which the README says in its own
words and at more length; keeping a second copy in a file headed 'delete
me' would only be a second copy to keep current. It is in the history if
anybody wants to read it back.

NOTES.md

@@ -1,30 +0,0 @@
-# Delete me after these things are fixed
-
-Temporary notes from the SBFS v2 and CosmOS review, in priority order.
-
-## Bound the number of directory entries
-
-The parent field is 16 bits and stores `descriptor index + 1`, with zero reserved for the
-root. Descriptor index 65535 therefore cannot be represented as a parent because adding
-one wraps to zero. SplitDisk currently accepts directory sizes large enough to exceed the
-representable parent domain.
-
-Define and validate a maximum directory-block/entry count such that every directory entry
-can be named as a parent. Apply the check while formatting and mounting/reading malformed
-images in both implementations.
-
-## Design strengths worth preserving
-
-- Parent-as-index-plus-one makes every version one entry a valid root child without
-  conversion.
-- Directories consume one descriptor and no data blocks, leaving the descriptor array as
-  the complete allocation map.
-- Files remain contiguous and the block allocator remains ignorant of hierarchy.
-- Path resolution below the service boundary gave existing applications directories
-  without changing their interfaces.
-- The current directory is a two-byte identity rather than a stored string, and the shell
-  restores it after applications run.
-- The independent host/native implementations and byte-identical disk agreement tests are
-  unusually strong validation of the written format.
-- `osFileStart`/`osFileWrite`/`osFileFetch`/`osFileDone` provide the bounded-memory output
-  abstraction needed by assemblers, compilers, linkers, and future sequential pipelines.