A Save whose write fails changes nothing: not the name, not the dirty flag

A scratch took its new name before the host wrote it, so `Save /root/x.txt`
failing with EACCES renamed it anyway; a failed write to another name
marked a clean file dirty. A scratch is now named once its write is done
(promoteSaved), and a failed write puts the saved revision back.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

1 files changed, 4 insertions, 2 deletions

diff --git a/docs/fs.md b/docs/fs.md
index 6b393918..cfcb62a3 100644
--- a/docs/fs.md
+++ b/docs/fs.md
@@ -266,8 +266,10 @@ argument "Save"` (EINVAL), for a builtin that would have asked at a prompt
 lines before a failing one have taken effect and those after it never run,
 which is what acme's ctl loop does (editors/acme/xfid.c:600-790). An error
 that only happens as the editor performs what a line asked for -- a `Save`
-whose disk write fails -- is reported in the editor and /log, not in the
-write's answer. Like any write, a ctl write answers once the editor has
+whose disk write fails -- fails the write too, once the editor has tried
+(`Save /root/x.txt: access denied`, EIO), and changes nothing: a scratch
+keeps its name and stays a scratch, a clean file stays clean, a dirty one
+dirty. Like any write, a ctl write answers once the editor has
 performed what it asked for (a save written, a shell started). A click on
 the same word, or the word written to `exec`, still opens its prompt.