If a check fails, nothing is written and the agent gets a precise reason instead of a silent overwrite. The agent never holds your FTP password: it works with short-lived capabilities, and its writes are tied to its open session.
When there is something about those files that is new to the agent, the write tools pause once to show it: other live agents on the same files with their objective, recent changes, decisions, failed approaches, the planning items of those files and the rules, which always apply; sending the same call again writes. The pause shows only what is new, and says how many things already known it leaves out: what the same team member wrote in earlier sessions, or was already shown on that project in the last 30 days, never stops a write again, while another live session and a change made after the session began always do. Then the server checks the capability, refuses a .php or .json file that would not parse, locks that single file, re-reads the live file and compares it with the agent's baseline. After writing, it reads the file back to compare its SHA-256 (only the size above 8 MB) and records the change in the project's history.
Agents can run the same check earlier with preflight, which reports what the project knows about the files without granting or refusing anything; with compact it lists only what is new to the agent, and a very long answer comes back compact by itself and says so. The baseline rules that decide whether a write may replace a file are explained in How does SyncNow stop an agent from overwriting someone else's work?.