Durability

Atomic visibility and durability are different properties. A rename changes the name seen by concurrent readers. Persistence after a power cut depends on what reached stable storage.

The order matters

1. Write and flush the new data to the temporary file.
2. Sync the temporary file and close it.
3. Rename it over the destination.
4. Sync the containing directory when the filesystem supports it.

The directory has its own state. A file sync can finish before the directory entry created by the rename has reached disk. For important data, test recovery on the filesystem and storage stack you actually ship.

Which checkpoints need a sync?

A cache rebuilt on startup can tolerate losing the newest entry. For state that acknowledges work to another process, record the acknowledgement after the filesystem has committed the state you need to recover.