Package persistence owns application-write accounting and atomic publication.
It leaves flushing to the kernel; successful publication is not a power-loss guarantee.
AtomicFile closes a private same-directory temporary file before rename.
A failed publication still accounts bytes successfully written to its temp file.
Writer counts the returned byte count even when the write also reports an error.
Wrap the file, not a buffer: buffered bytes have not yet reached the kernel.