Reads are sacred
Every file is written to a temp name, fsynced, then renamed into place. A reader sees the old file or the new one — never a mix, never a half-written one. Every document is re-parsed with a strict XML parser before the rename, so malformed output can't reach the tree.