The flush path has a gap the WAL doesn’t: writing an SSTable is many bytes, and a crash partway through would leave a half-written file under its real name - which Open would then try to load as if it were complete. The fix is the standard atomic-publish trick: write the whole table to a temporary name, fsync it, then rename it to its final name. On a POSIX filesystem a rename is atomic, so the final filename only ever names a complete file.

A crash before the rename leaves at most a stray .tmp file, which Open simply ignores because it only looks for final names. (Fsyncing the directory after the rename makes the rename itself durable, closing the last window.) This is the same “make the change appear all-at-once” discipline as the WAL’s fsync, applied to whole files - and it is what lets the next lesson safely assume any partial SSTable it finds can be discarded.