# K1581–K1585: read-only filesystem trait

The `FileSystem` trait exposes root inode, child lookup, metadata, and positional read operations. A `Mount` binds backend inode numbers to a nonzero volume and generation. Every operation validates the node token against the current mount generation; remounting invalidates older tokens.

Lookup accepts a bounded UTF-8 name without separators or NUL bytes. The mount validates backend metadata before publishing a node: inode identity must match, size must fit allocated 512-byte blocks, and the volume must be read-only. A directory cannot be read as a regular file.

Reads are limited to 32 bytes per call. The backend writes into a private scratch buffer; the caller's buffer changes only after the backend returns a valid byte count. Backend errors and oversized reads leave the output unchanged. Reads at or beyond end of file return zero bytes. This interface is a bounded synthetic development model; disk-backed backend integration and product release acceptance need separate evidence.