# K1606–K1610: read-only inode table integrity

The bounded inode table has exactly three records: root inode 1 and two regular files. Validation checks nonzero and unique inode numbers, root kind and empty extent, one link per record, zero reserved fields, disk-bounded nonempty file extents, file sizes no larger than allocated 512-byte blocks, and nonoverlapping file extents.

The table is published only after every record and the cross-record extent relationship pass. A malformed later record cannot leave an earlier inode visible through the validated table. Lookup by inode number is available only on the validated value.

This model checks synthetic records. Reading and authenticating real on-disk inode sectors and product release acceptance require separate evidence.