AI codebase review

fix: cap snapshot node count relative to file size

The 64x decompressed-body limit still let an 804 KB crafted snapshot
(repeating blocks of records) expand to 4.2 M nodes and ~500 MB of
heap, ~600x amplification; larger files exhaust memory. LoadFile now
allows at most one node per byte of file (1 Mi floor); real snapshots
use ~15 bytes per node. Limit errors on the node count are no longer
misreported as "no root node".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -296,7 +296,7 @@ Filenames and snapshot contents are untrusted.
 * Snapshot decoding validates magic, version, every length, every parent
   reference (a parent must precede its child, so cycles are impossible),
   depth (≤ 4096 levels, bounding recursion in exporters), per-node sizes
-  (≤ 1 EiB) and node count; caps the decompressed body at 64× the file size
+  (≤ 1 EiB) and node count (at most one node per byte of snapshot file, 1 Mi floor); caps the decompressed body at 64× the file size
   (decompression bombs fail fast); and verifies a SHA-256 trailer.
   Aggregates are recomputed with saturating arithmetic rather than trusted.
 * No shell is ever invoked. "Open/reveal" and trash use direct `exec` with