Runtime filesystem consistency checking

> Writing to unallocated data to which there is no linkage at commit seems suspect: how would the file system know that data is useful in anyway after a crash?

The data would not be useful after a crash; up to the point where the allocation is recorded on disk, there are no references to it, and it can simply revert to unallocated space, canceling the incomplete "transaction".