The Screen Is Not the Authority
A chat window teaches the wrong physics. Tokens appear, therefore they happened. A coding engine that believes that will lie after every crash. Firebrand inverts the order. A request is durable before the call leaves. A completed tool-call block is durable before anything runs. A result is durable before the model or the operator sees it. Deltas are written before they are drawn. The terminal may pretty-print Markdown after that write. Pretty-print is projection. It is not source.
The primitive under that rule is boring on purpose. A short write is not an error; the writer loops until the last byte lands. A replaced file is published through a temp on the same filesystem, a flush, a replace, and a parent flush so the rename survives power loss. A reader sees the old body or the new body, never a hybrid. A content-addressed artifact is read back and hashed after publication. A body that does not hash to its own name is unlinked and the step fails closed.
What a Failed Write Means
Disk full or I/O error during a record write aborts the stream and closes the step as a record-write failure. Because render follows write, the operator did not see the missing bytes. After a process crash, nothing shown is missing. After power loss, at most the last unflushed delta batch is gone, and that step loads as an interrupt with its partial kept out of the transcript.